Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
CF537GfmKa.exe

Overview

General Information

Sample name:CF537GfmKa.exe
renamed because original name is a hash value
Original sample name:5226ea8e0f516565ba825a1bbed10020982c16414750237068b602c5b4ac6abd.exe
Analysis ID:1589527
MD5:834c7fd865eee5f7e17a3a1fb62e7051
SHA1:0246696395c8514494435f645cdff034d70d0951
SHA256:5226ea8e0f516565ba825a1bbed10020982c16414750237068b602c5b4ac6abd
Tags:exefunklockerfunksecransomwareRustyStealeruser-TheRavenFile
Infos:

Detection

FunkLocker
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected FunkLocker Ransomware
AI detected suspicious sample
Bypasses PowerShell execution policy
Creates files in the recycle bin to hide itself
Disables Windows Defender (via service or powershell)
Loading BitLocker PowerShell Module
Modifies Windows Defender protection settings
Sigma detected: Disable of ETW Trace
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Powershell Defender Disable Scan Feature
Sigma detected: Suspicious Eventlog Clear or Configuration Change
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Drops PE files
Enables debug privileges
Enables security privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Installs a raw input device (often for capturing keystrokes)
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Sigma detected: Change PowerShell Policies to an Insecure Level

Classification

Process Tree

  • System is w10x64
  • CF537GfmKa.exe (PID: 6760 cmdline: "C:\Users\user\Desktop\CF537GfmKa.exe" MD5: 834C7FD865EEE5F7E17A3A1FB62E7051)
    • conhost.exe (PID: 6764 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • net.exe (PID: 5480 cmdline: "net" session MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)
      • net1.exe (PID: 6992 cmdline: C:\Windows\system32\net1 session MD5: 55693DF2BB3CBE2899DFDDF18B4EB8C9)
    • tasklist.exe (PID: 7072 cmdline: "tasklist" /fi "IMAGENAME eq vmware" MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)
    • powershell.exe (PID: 7152 cmdline: "powershell" -Command "Set-MpPreference -DisableRealtimeMonitoring $true" MD5: 04029E121A0CFA5991749937DD22A1D9)
      • WmiPrvSE.exe (PID: 7232 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)
    • powershell.exe (PID: 7124 cmdline: "powershell" -Command "wevtutil sl Security /e:false" MD5: 04029E121A0CFA5991749937DD22A1D9)
      • wevtutil.exe (PID: 6740 cmdline: "C:\Windows\system32\wevtutil.exe" sl Security /e:false MD5: 1AAE26BD68B911D0420626A27070EB8D)
    • powershell.exe (PID: 1700 cmdline: "powershell" -Command "wevtutil sl Application /e:false" MD5: 04029E121A0CFA5991749937DD22A1D9)
      • wevtutil.exe (PID: 1544 cmdline: "C:\Windows\system32\wevtutil.exe" sl Application /e:false MD5: 1AAE26BD68B911D0420626A27070EB8D)
    • powershell.exe (PID: 4008 cmdline: "powershell" -Command "Set-ExecutionPolicy Bypass -Scope Process -Force" MD5: 04029E121A0CFA5991749937DD22A1D9)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
Process Memory Space: CF537GfmKa.exe PID: 6760JoeSecurity_funklockerYara detected FunkLocker RansomwareJoe Security

    Sigma Signatures

    System Summary

    barindex
    Sigma detected: Disable of ETW Trace
    Source: Process startedAuthor: @neu5ron, Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "powershell" -Command "wevtutil sl Security /e:false", CommandLine: "powershell" -Command "wevtutil sl Security /e:false", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\CF537GfmKa.exe", ParentImage: C:\Users\user\Desktop\CF537GfmKa.exe, ParentProcessId: 6760, ParentProcessName: CF537GfmKa.exe, ProcessCommandLine: "powershell" -Command "wevtutil sl Security /e:false", ProcessId: 7124, ProcessName: powershell.exe
    Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
    Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "powershell" -Command "Set-MpPreference -DisableRealtimeMonitoring $true", CommandLine: "powershell" -Command "Set-MpPreference -DisableRealtimeMonitoring $true", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\CF537GfmKa.exe", ParentImage: C:\Users\user\Desktop\CF537GfmKa.exe, ParentProcessId: 6760, ParentProcessName: CF537GfmKa.exe, ProcessCommandLine: "powershell" -Command "Set-MpPreference -DisableRealtimeMonitoring $true", ProcessId: 7152, ProcessName: powershell.exe
    Sigma detected: Powershell Defender Disable Scan Feature
    Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "powershell" -Command "Set-MpPreference -DisableRealtimeMonitoring $true", CommandLine: "powershell" -Command "Set-MpPreference -DisableRealtimeMonitoring $true", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\CF537GfmKa.exe", ParentImage: C:\Users\user\Desktop\CF537GfmKa.exe, ParentProcessId: 6760, ParentProcessName: CF537GfmKa.exe, ProcessCommandLine: "powershell" -Command "Set-MpPreference -DisableRealtimeMonitoring $true", ProcessId: 7152, ProcessName: powershell.exe
    Sigma detected: Suspicious Eventlog Clear or Configuration Change
    Source: Process startedAuthor: Ecco, Daniil Yugoslavskiy, oscd.community, D3F7A5105: Data: Command: "C:\Windows\system32\wevtutil.exe" sl Security /e:false, CommandLine: "C:\Windows\system32\wevtutil.exe" sl Security /e:false, CommandLine|base64offset|contains: , Image: C:\Windows\System32\wevtutil.exe, NewProcessName: C:\Windows\System32\wevtutil.exe, OriginalFileName: C:\Windows\System32\wevtutil.exe, ParentCommandLine: "powershell" -Command "wevtutil sl Security /e:false", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 7124, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\system32\wevtutil.exe" sl Security /e:false, ProcessId: 6740, ProcessName: wevtutil.exe
    Sigma detected: Change PowerShell Policies to an Insecure Level
    Source: Process startedAuthor: frack113: Data: Command: "powershell" -Command "Set-ExecutionPolicy Bypass -Scope Process -Force", CommandLine: "powershell" -Command "Set-ExecutionPolicy Bypass -Scope Process -Force", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\CF537GfmKa.exe", ParentImage: C:\Users\user\Desktop\CF537GfmKa.exe, ParentProcessId: 6760, ParentProcessName: CF537GfmKa.exe, ProcessCommandLine: "powershell" -Command "Set-ExecutionPolicy Bypass -Scope Process -Force", ProcessId: 4008, ProcessName: powershell.exe
    Sigma detected: Non Interactive PowerShell Process Spawned
    Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "powershell" -Command "Set-MpPreference -DisableRealtimeMonitoring $true", CommandLine: "powershell" -Command "Set-MpPreference -DisableRealtimeMonitoring $true", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\CF537GfmKa.exe", ParentImage: C:\Users\user\Desktop\CF537GfmKa.exe, ParentProcessId: 6760, ParentProcessName: CF537GfmKa.exe, ProcessCommandLine: "powershell" -Command "Set-MpPreference -DisableRealtimeMonitoring $true", ProcessId: 7152, ProcessName: powershell.exe

    Suricata Signatures

    ⊘No Suricata rule has matched

    Joe Sandbox Signatures

    Click to jump to signature section

    Show All Signature Results

    AV Detection

    barindex
    Multi AV Scanner detection for dropped file
    Source: C:\Users\CK3Wg2mN4T.exeReversingLabs: Detection: 71%
    Multi AV Scanner detection for submitted file
    Source: CF537GfmKa.exeVirustotal: Detection: 66%Perma Link
    Source: CF537GfmKa.exeReversingLabs: Detection: 71%
    AI detected suspicious sample
    Source: Submited SampleIntegrated Neural Analysis Model: Matched 99.3% probability
    Source: unknownHTTPS traffic detected: 199.232.196.193:443 -> 192.168.2.4:49730 version: TLS 1.2
    Source: CF537GfmKa.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
    Source: Binary string: dev.pdbw source: CF537GfmKa.exe
    Source: Binary string: dev.pdb source: CF537GfmKa.exe
    Source: Binary string: d:\dbs\el\omr\target\x86\ship\click2run\x-none\Integrator.pdb source: CF537GfmKa.exe, 00000000.00000003.1881981187.0000014501FCA000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: d:\dbs\el\omr\target\x86\ship\click2run\x-none\Integrator.pdb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: CF537GfmKa.exe, 00000000.00000003.1881981187.0000014501FCA000.00000004.00000020.00020000.00000000.sdmp
    Source: C:\Users\user\Desktop\CF537GfmKa.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\Jump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\GatherLogs\Jump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Jump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Jump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Config\Jump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Jump to behavior
    Source: global trafficHTTP traffic detected: GET /HCYQoVR.jpeg HTTP/1.1accept: */*host: i.imgur.com
    Source: Joe Sandbox ViewIP Address: 199.232.196.193 199.232.196.193
    Source: Joe Sandbox ViewJA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: global trafficHTTP traffic detected: GET /HCYQoVR.jpeg HTTP/1.1accept: */*host: i.imgur.com
    Source: global trafficDNS traffic detected: DNS query: i.imgur.com
    Source: CF537GfmKa.exe, 00000000.00000003.1881981187.0000014501FCA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://127.0.0.1:13556/InsiderSlabBehaviorReportedBuildInsiderSlabBehaviorInsiderSlabBehaviorReporte
    Source: CF537GfmKa.exe, 00000000.00000003.1909014710.0000014501691000.00000004.00000020.00020000.00000000.sdmp, CF537GfmKa.exe, 00000000.00000003.1909014710.00000145016C5000.00000004.00000020.00020000.00000000.sdmp, CF537GfmKa.exe, 00000000.00000003.1905282842.00000145015FB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
    Source: CF537GfmKa.exe, 00000000.00000003.1905282842.00000145015FB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
    Source: CF537GfmKa.exe, 00000000.00000003.1905282842.00000145015FB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
    Source: CF537GfmKa.exe, 00000000.00000003.1905282842.00000145015FB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
    Source: CF537GfmKa.exe, 00000000.00000003.1909014710.0000014501691000.00000004.00000020.00020000.00000000.sdmp, CF537GfmKa.exe, 00000000.00000003.1909014710.00000145016C5000.00000004.00000020.00020000.00000000.sdmp, CF537GfmKa.exe, 00000000.00000003.1905282842.00000145015FB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
    Source: CF537GfmKa.exe, 00000000.00000003.1909014710.0000014501691000.00000004.00000020.00020000.00000000.sdmp, CF537GfmKa.exe, 00000000.00000003.1909014710.00000145016C5000.00000004.00000020.00020000.00000000.sdmp, CF537GfmKa.exe, 00000000.00000003.1905282842.00000145015FB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
    Source: CF537GfmKa.exe, 00000000.00000003.1909014710.00000145016C5000.00000004.00000020.00020000.00000000.sdmp, CF537GfmKa.exe, 00000000.00000003.1905282842.0000014501630000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
    Source: CF537GfmKa.exe, 00000000.00000003.1909014710.0000014501671000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
    Source: CF537GfmKa.exe, 00000000.00000003.1854907203.0000014501FCD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://g.live.com/0CR%1/30
    Source: CF537GfmKa.exeString found in binary or memory: http://ns.adobe.
    Source: powershell.exe, 00000008.00000002.1756212996.00000229433C1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1733064682.0000022934CC7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://nuget.org/NuGet.exe
    Source: CF537GfmKa.exe, 00000000.00000003.1854907203.0000014501FCD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://oe.msn.msnmail.hotmail.com/cgi-bin/hmdata
    Source: powershell.exe, 00000008.00000002.1733064682.0000022933578000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://pesterbdd.com/images/Pester.png
    Source: powershell.exe, 00000008.00000002.1733064682.0000022933C80000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1733064682.0000022933578000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
    Source: powershell.exe, 00000008.00000002.1733064682.0000022933351000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
    Source: powershell.exe, 00000008.00000002.1733064682.0000022933C80000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1733064682.0000022933578000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/wsdl/
    Source: powershell.exe, 00000008.00000002.1733064682.0000022933578000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
    Source: CF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/InlineSignup.aspx?iww=1&id=80502
    Source: CF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/Wizard/Password/Change?id=80601
    Source: CF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80600
    Source: CF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80601
    Source: CF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80603
    Source: CF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80604
    Source: CF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80605
    Source: CF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/msangcwam
    Source: powershell.exe, 00000008.00000002.1733064682.0000022933351000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/pscore68
    Source: powershell.exe, 00000008.00000002.1733064682.0000022933578000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/winsvr-2022-pshelp
    Source: powershell.exe, 00000008.00000002.1733064682.0000022934666000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/winsvr-2022-pshelpX
    Source: CF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://arc.msn.com/v4
    Source: CF537GfmKa.exe, 00000000.00000003.1903646139.0000014501B33000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://config.edge.skype.com/config/v1/EdgeUpdate/1.3.147.37?clientId=s:92C86F7C-DB2B-4F6A-95AD-98B
    Source: CF537GfmKa.exe, 00000000.00000003.1903646139.0000014501B33000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://config.edge.skype.com/config/v1/EdgeUpdate/1.3.177.11?clientId=s:92C86F7C-DB2B-4F6A-95AD-98B
    Source: powershell.exe, 00000008.00000002.1733064682.0000022934CC7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/
    Source: powershell.exe, 00000008.00000002.1733064682.0000022934CC7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/Icon
    Source: powershell.exe, 00000008.00000002.1733064682.0000022934CC7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/License
    Source: CF537GfmKa.exeString found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support
    Source: CF537GfmKa.exe, 00000000.00000003.1905282842.00000145016A5000.00000004.00000020.00020000.00000000.sdmp, CF537GfmKa.exe, 00000000.00000003.1909014710.0000014501671000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
    Source: CF537GfmKa.exe, 00000000.00000003.1905282842.00000145016FD000.00000004.00000020.00020000.00000000.sdmp, CF537GfmKa.exe, 00000000.00000003.1909014710.0000014501671000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
    Source: CF537GfmKa.exe, 00000000.00000003.1905282842.00000145016A5000.00000004.00000020.00020000.00000000.sdmp, CF537GfmKa.exe, 00000000.00000003.1909014710.0000014501671000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://g.live.com/odclientsettings/ProdV2
    Source: CF537GfmKa.exe, 00000000.00000003.1905282842.0000014501686000.00000004.00000020.00020000.00000000.sdmp, CF537GfmKa.exe, 00000000.00000003.1905282842.00000145016EA000.00000004.00000020.00020000.00000000.sdmp, CF537GfmKa.exe, 00000000.00000003.1905282842.00000145016CB000.00000004.00000020.00020000.00000000.sdmp, CF537GfmKa.exe, 00000000.00000003.1909014710.0000014501671000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
    Source: CF537GfmKa.exe, 00000000.00000003.1905282842.00000145016A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
    Source: CF537GfmKa.exeString found in binary or memory: https://getsession.org/
    Source: powershell.exe, 00000008.00000002.1733064682.0000022933578000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/Pester/Pester
    Source: powershell.exe, 00000008.00000002.1733064682.0000022934666000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://go.micro
    Source: CF537GfmKa.exeString found in binary or memory: https://i.imgur.com/HCYQoVR.jpeg
    Source: CF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ApproveSession.srf
    Source: CF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80502
    Source: CF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80600
    Source: CF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80601
    Source: CF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ListSessions.srf
    Source: CF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ManageApprover.srf
    Source: CF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ManageLoginKeys.srf
    Source: CF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/RST2.srf
    Source: CF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/didtou.srf
    Source: CF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/getrealminfo.srf
    Source: CF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/getuserrealm.srf
    Source: CF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/DeviceAssociate.srf
    Source: CF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/DeviceDisassociate.srf
    Source: CF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/DeviceQuery.srf
    Source: CF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/DeviceUpdate.srf
    Source: CF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/EnumerateDevices.srf
    Source: CF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/GetAppData.srf
    Source: CF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/GetUserKeyData.srf
    Source: CF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineClientAuth.srf
    Source: CF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80600
    Source: CF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80601
    Source: CF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80603
    Source: CF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80604
    Source: CF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srf
    Source: CF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80502
    Source: CF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80600
    Source: CF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80601
    Source: CF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80603
    Source: CF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80604
    Source: CF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80605
    Source: CF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80606
    Source: CF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80607
    Source: CF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80608
    Source: CF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cp
    Source: CF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80605
    Source: CF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/ResolveUser.srf
    Source: CF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/SHA1Auth.srf
    Source: CF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/deviceaddcredential.srf
    Source: CF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/devicechangecredential.srf
    Source: CF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/deviceremovecredential.srf
    Source: CF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/resetpw.srf
    Source: CF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/retention.srf
    Source: CF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/MSARST2.srf
    Source: CF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/common
    Source: CF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceAssociate.srf
    Source: CF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srf
    Source: CF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceQuery.srf
    Source: CF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceUpdate.srf
    Source: CF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/EnumerateDevices.srf
    Source: CF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/ResolveUser.srf
    Source: CF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/deviceaddmsacredential.srf
    Source: CF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/devicechangecredential.srf
    Source: CF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/deviceremovecredential.srf
    Source: CF537GfmKa.exe, 00000000.00000003.1854907203.0000014501FCD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://m-vnext.sqlazurelabs.com/
    Source: CF537GfmKa.exe, 00000000.00000003.1881981187.0000014501FCA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://nexus.officeapps.live.comhttps://nexusrules.officeapps.live.com
    Source: powershell.exe, 00000008.00000002.1756212996.00000229433C1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1733064682.0000022934CC7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://nuget.org/nuget.exe
    Source: CF537GfmKa.exe, 00000000.00000003.1905282842.00000145016A5000.00000004.00000020.00020000.00000000.sdmp, CF537GfmKa.exe, 00000000.00000003.1909014710.0000014501671000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
    Source: CF537GfmKa.exe, 00000000.00000003.1905282842.0000014501655000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:
    Source: CF537GfmKa.exe, 00000000.00000003.1881981187.0000014501FCA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://otelrules.azureedge.net/rules/.bundlesdxhelper.exeFailed
    Source: CF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://signup.live.com/signup.aspx
    Source: CF537GfmKa.exeString found in binary or memory: https://www.blockchain.com/)
    Source: CF537GfmKa.exeString found in binary or memory: https://www.coinbase.com/)
    Source: CF537GfmKa.exeString found in binary or memory: https://www.torproject.org/
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49730
    Source: unknownNetwork traffic detected: HTTP traffic on port 49730 -> 443
    Source: unknownHTTPS traffic detected: 199.232.196.193:443 -> 192.168.2.4:49730 version: TLS 1.2
    Source: CF537GfmKa.exe, 00000000.00000003.1881981187.0000014501FCA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: RegisterRawInputDevicesmemstr_920ebda5-c

    Spam, unwanted Advertisements and Ransom Demands

    barindex
    Yara detected FunkLocker Ransomware
    Source: Yara matchFile source: Process Memory Space: CF537GfmKa.exe PID: 6760, type: MEMORYSTR
    Source: C:\Windows\System32\wevtutil.exeProcess token adjusted: SecurityJump to behavior
    Source: CF537GfmKa.exe, 00000000.00000003.1881981187.00000145023BE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameIntegrator.exeB vs CF537GfmKa.exe
    Source: CF537GfmKa.exeBinary string: Failed to open \Device\Afd\Mio: X
    Source: CF537GfmKa.exeBinary string: 0\Device\Afd\Mio
    Source: CF537GfmKa.exe, 00000000.00000003.1854907203.0000014501FCD000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Microsoft.Vbe.Interop.VBProjectClass
    Source: CF537GfmKa.exe, 00000000.00000003.1854907203.0000014501FCD000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Microsoft.Vbe.Interop.VBProjectsClass
    Source: classification engineClassification label: mal100.rans.evad.winEXE@21/157@1/1
    Source: C:\Users\user\Desktop\CF537GfmKa.exeFile created: C:\Users\user\Desktop\README-IeCSISq4gi.mdJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6764:120:WilError_03
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vmdz15gz.uy3.ps1Jump to behavior
    Source: CF537GfmKa.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
    Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'VMWARE'
    Source: C:\Users\user\Desktop\CF537GfmKa.exeFile read: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\desktop.iniJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
    Source: CF537GfmKa.exe, 00000000.00000003.1881981187.0000014501FCA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
    Source: CF537GfmKa.exe, 00000000.00000003.1847274248.0000014501FF3000.00000004.00000020.00020000.00000000.sdmp, CF537GfmKa.exe, 00000000.00000003.1847274248.0000014501FC3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CREATE TABLE SchemaVersions(schema_id INTEGER PRIMARY KEY NOT NULL, SchemaVersion INTEGER NOT NULL, GitSHA1 TEXT NOT NULL , UNIQUE (SchemaVersion, GitSHA1));
    Source: CF537GfmKa.exe, 00000000.00000003.1881981187.0000014501FCA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
    Source: CF537GfmKa.exe, 00000000.00000003.1881981187.0000014501FCA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
    Source: CF537GfmKa.exe, 00000000.00000003.1881981187.0000014501FCA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
    Source: CF537GfmKa.exeVirustotal: Detection: 66%
    Source: CF537GfmKa.exeReversingLabs: Detection: 71%
    Source: CF537GfmKa.exeString found in binary or memory: /load_hpack; header malformed -- pseudo not at head of block
    Source: C:\Users\user\Desktop\CF537GfmKa.exeFile read: C:\Users\user\Desktop\CF537GfmKa.exeJump to behavior
    Source: unknownProcess created: C:\Users\user\Desktop\CF537GfmKa.exe "C:\Users\user\Desktop\CF537GfmKa.exe"
    Source: C:\Users\user\Desktop\CF537GfmKa.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Users\user\Desktop\CF537GfmKa.exeProcess created: C:\Windows\System32\net.exe "net" session
    Source: C:\Windows\System32\net.exeProcess created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 session
    Source: C:\Users\user\Desktop\CF537GfmKa.exeProcess created: C:\Windows\System32\tasklist.exe "tasklist" /fi "IMAGENAME eq vmware"
    Source: C:\Users\user\Desktop\CF537GfmKa.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
    Source: C:\Users\user\Desktop\CF537GfmKa.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "wevtutil sl Security /e:false"
    Source: C:\Users\user\Desktop\CF537GfmKa.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "wevtutil sl Application /e:false"
    Source: C:\Users\user\Desktop\CF537GfmKa.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "Set-ExecutionPolicy Bypass -Scope Process -Force"
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\wevtutil.exe "C:\Windows\system32\wevtutil.exe" sl Security /e:false
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\wevtutil.exe "C:\Windows\system32\wevtutil.exe" sl Application /e:false
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
    Source: C:\Users\user\Desktop\CF537GfmKa.exeProcess created: C:\Windows\System32\net.exe "net" sessionJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeProcess created: C:\Windows\System32\tasklist.exe "tasklist" /fi "IMAGENAME eq vmware"Jump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "Set-MpPreference -DisableRealtimeMonitoring $true"Jump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "wevtutil sl Security /e:false"Jump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "wevtutil sl Application /e:false"Jump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "Set-ExecutionPolicy Bypass -Scope Process -Force"Jump to behavior
    Source: C:\Windows\System32\net.exeProcess created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 sessionJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\wevtutil.exe "C:\Windows\system32\wevtutil.exe" sl Security /e:falseJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\wevtutil.exe "C:\Windows\system32\wevtutil.exe" sl Application /e:falseJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeSection loaded: apphelp.dllJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeSection loaded: secur32.dllJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeSection loaded: vcruntime140.dllJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeSection loaded: cryptbase.dllJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeSection loaded: sspicli.dllJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeSection loaded: mswsock.dllJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeSection loaded: dnsapi.dllJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeSection loaded: iphlpapi.dllJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeSection loaded: rasadhlp.dllJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeSection loaded: fwpuclnt.dllJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeSection loaded: schannel.dllJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeSection loaded: mskeyprotect.dllJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeSection loaded: ntasn1.dllJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeSection loaded: ncrypt.dllJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeSection loaded: ncryptsslp.dllJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeSection loaded: msasn1.dllJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeSection loaded: cryptsp.dllJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeSection loaded: rsaenh.dllJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeSection loaded: gpapi.dllJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeSection loaded: cryptnet.dllJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeSection loaded: uxtheme.dllJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeSection loaded: windows.storage.dllJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeSection loaded: wldp.dllJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeSection loaded: profapi.dllJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeSection loaded: ntmarta.dllJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeSection loaded: kernel.appcore.dllJump to behavior
    Source: C:\Windows\System32\net.exeSection loaded: mpr.dllJump to behavior
    Source: C:\Windows\System32\net.exeSection loaded: wkscli.dllJump to behavior
    Source: C:\Windows\System32\net.exeSection loaded: netutils.dllJump to behavior
    Source: C:\Windows\System32\net.exeSection loaded: samcli.dllJump to behavior
    Source: C:\Windows\System32\net.exeSection loaded: srvcli.dllJump to behavior
    Source: C:\Windows\System32\net.exeSection loaded: iphlpapi.dllJump to behavior
    Source: C:\Windows\System32\net1.exeSection loaded: samcli.dllJump to behavior
    Source: C:\Windows\System32\net1.exeSection loaded: netutils.dllJump to behavior
    Source: C:\Windows\System32\net1.exeSection loaded: dsrole.dllJump to behavior
    Source: C:\Windows\System32\net1.exeSection loaded: srvcli.dllJump to behavior
    Source: C:\Windows\System32\net1.exeSection loaded: wkscli.dllJump to behavior
    Source: C:\Windows\System32\net1.exeSection loaded: logoncli.dllJump to behavior
    Source: C:\Windows\System32\net1.exeSection loaded: cryptbase.dllJump to behavior
    Source: C:\Windows\System32\tasklist.exeSection loaded: version.dllJump to behavior
    Source: C:\Windows\System32\tasklist.exeSection loaded: mpr.dllJump to behavior
    Source: C:\Windows\System32\tasklist.exeSection loaded: framedynos.dllJump to behavior
    Source: C:\Windows\System32\tasklist.exeSection loaded: dbghelp.dllJump to behavior
    Source: C:\Windows\System32\tasklist.exeSection loaded: sspicli.dllJump to behavior
    Source: C:\Windows\System32\tasklist.exeSection loaded: srvcli.dllJump to behavior
    Source: C:\Windows\System32\tasklist.exeSection loaded: netutils.dllJump to behavior
    Source: C:\Windows\System32\tasklist.exeSection loaded: sspicli.dllJump to behavior
    Source: C:\Windows\System32\tasklist.exeSection loaded: kernel.appcore.dllJump to behavior
    Source: C:\Windows\System32\tasklist.exeSection loaded: wbemcomn.dllJump to behavior
    Source: C:\Windows\System32\tasklist.exeSection loaded: winsta.dllJump to behavior
    Source: C:\Windows\System32\tasklist.exeSection loaded: amsi.dllJump to behavior
    Source: C:\Windows\System32\tasklist.exeSection loaded: userenv.dllJump to behavior
    Source: C:\Windows\System32\tasklist.exeSection loaded: profapi.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kdscli.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntasn1.dllJump to behavior
    Source: C:\Windows\System32\wevtutil.exeSection loaded: kernel.appcore.dllJump to behavior
    Source: C:\Windows\System32\wevtutil.exeSection loaded: wevtapi.dllJump to behavior
    Source: C:\Windows\System32\wevtutil.exeSection loaded: kernel.appcore.dllJump to behavior
    Source: C:\Windows\System32\wevtutil.exeSection loaded: wevtapi.dllJump to behavior
    Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: fastprox.dllJump to behavior
    Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: ncobjapi.dllJump to behavior
    Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: wbemcomn.dllJump to behavior
    Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: wbemcomn.dllJump to behavior
    Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: kernel.appcore.dllJump to behavior
    Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: mpclient.dllJump to behavior
    Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: userenv.dllJump to behavior
    Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: version.dllJump to behavior
    Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: msasn1.dllJump to behavior
    Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: wmitomi.dllJump to behavior
    Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: mi.dllJump to behavior
    Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: miutils.dllJump to behavior
    Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: miutils.dllJump to behavior
    Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: gpapi.dllJump to behavior
    Source: C:\Windows\System32\tasklist.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32Jump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeProcess created: C:\Windows\System32\tasklist.exe "tasklist" /fi "IMAGENAME eq vmware"
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dllJump to behavior
    Source: CF537GfmKa.exeStatic PE information: Virtual size of .text is bigger than: 0x100000
    Source: CF537GfmKa.exeStatic PE information: Image base 0x140000000 > 0x60000000
    Source: CF537GfmKa.exeStatic file information: File size 5482496 > 1048576
    Source: CF537GfmKa.exeStatic PE information: Raw size of .text is bigger than: 0x100000 < 0x37c600
    Source: CF537GfmKa.exeStatic PE information: Raw size of .rdata is bigger than: 0x100000 < 0x18bc00
    Source: CF537GfmKa.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
    Source: CF537GfmKa.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
    Source: Binary string: dev.pdbw source: CF537GfmKa.exe
    Source: Binary string: dev.pdb source: CF537GfmKa.exe
    Source: Binary string: d:\dbs\el\omr\target\x86\ship\click2run\x-none\Integrator.pdb source: CF537GfmKa.exe, 00000000.00000003.1881981187.0000014501FCA000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: d:\dbs\el\omr\target\x86\ship\click2run\x-none\Integrator.pdb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: CF537GfmKa.exe, 00000000.00000003.1881981187.0000014501FCA000.00000004.00000020.00020000.00000000.sdmp
    Source: C:\Users\user\Desktop\CF537GfmKa.exeFile created: C:\Users\CK3Wg2mN4T.exeJump to dropped file

    Hooking and other Techniques for Hiding and Protection

    barindex
    Creates files in the recycle bin to hide itself
    Source: C:\Users\user\Desktop\CF537GfmKa.exeFile created: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\desktop.ini.funksecJump to behavior
    Loading BitLocker PowerShell Module
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdateJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRootJump to behavior
    Source: C:\Windows\System32\tasklist.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 7432Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2217Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2109Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2048Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 7051Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2526Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2668Thread sleep count: 7432 > 30Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7188Thread sleep time: -6456360425798339s >= -30000sJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2668Thread sleep count: 2217 > 30Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8Thread sleep count: 2109 > 30Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6188Thread sleep time: -922337203685477s >= -30000sJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6428Thread sleep count: 2048 > 30Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6428Thread sleep count: 86 > 30Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6164Thread sleep time: -922337203685477s >= -30000sJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3852Thread sleep count: 7051 > 30Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5180Thread sleep count: 2526 > 30Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7192Thread sleep time: -5534023222112862s >= -30000sJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\Jump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\GatherLogs\Jump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Jump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Jump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Config\Jump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Jump to behavior
    Source: CF537GfmKa.exe, 00000000.00000003.1847274248.0000014501FF3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: elwKk1x5+9NJD0oC1Sm0PchOiV+3spsDahFOwVMcIA7E=/
    Source: tasklist.exe, 00000004.00000003.1693814599.000001A494E1C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'VMWARE'
    Source: tasklist.exe, 00000004.00000003.1693814599.000001A494E08000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: WMI.ExecQuery(SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'VMWARE');
    Source: tasklist.exe, 00000004.00000003.1693814599.000001A494E08000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: IMAGENAME eq vmware
    Source: CF537GfmKa.exe, 00000000.00000003.1903646139.0000014501B33000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [10/03/23 08:56:22.600][MicrosoftEdgeUpdate:msedgeupdate][3356:4472][Send][url=https://msedge.api.cdp.microsoft.com/api/v1.1/contents/Browser/namespaces/Default/names/msedgeupdate-stable-win-x86/versions/latest?action=select][request={"targetingAttributes":{"AppAp":"","AppBrandCode":"INBX","AppCohort":"","AppCohortHint":"","AppCohortName":"","AppLang":"","AppMajorVersion":"1","AppRollout":0.96,"AppTargetVersionPrefix":"","AppVersion":"1.3.147.37","ExpETag":"\"VPQoP1F+fq15wRzh1kPL4PMpWh8ORMB5izvrOC/chjQ=\"","HW_AVX":true,"HW_DiskType":2,"HW_LogicalCpus":2,"HW_PhysicalRamGB":4,"HW_SSE":true,"HW_SSE2":true,"HW_SSE3":true,"HW_SSE41":true,"HW_SSE42":true,"HW_SSSE3":true,"InstallSource":"core","IsInternalUser":false,"IsMachine":true,"OemProductManufacturer":"VMware, Inc.","OemProductName":"VMware20,1","OsArch":"x64","OsPlatform":"win","OsVersion":"10.0.19045.2006","Priority":0,"Updater":"MicrosoftEdgeUpdate","UpdaterVersion":"1.3.147.37"}}][filename=]
    Source: CF537GfmKa.exeBinary or memory string: *Set-MpPreference -DisableRealtimeMonitoring $truewevtutil sl Security /e:falsewevtutil sl Application /e:falsevboxserviceqemuhypervvmwaretasklist/fiIMAGENAME eq LB8@
    Source: CF537GfmKa.exe, 00000000.00000003.1847274248.0000014501FF3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: eeKcxqaYUpQemuF/g4XeY+/GN/5r9nu6fcwnr/bvuY4c=/
    Source: CF537GfmKa.exeBinary or memory string: Set-MpPreference -DisableRealtimeMonitoring $truewevtutil sl Security /e:falsewevtutil sl Application /e:falsevboxserviceqemuhypervvmwaretasklist/fiIMAGENAME eq
    Source: CF537GfmKa.exe, 00000000.00000003.1903646139.0000014501B33000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [10/03/23 08:56:35.318][MicrosoftEdgeUpdate:msedgeupdate][4092:4100][Send][url=https://config.edge.skype.com/config/v1/EdgeUpdate/1.3.147.37?clientId=s:92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A&appBrandCode_stable=INBX&appChannel_stable=4&appConsentState_stable=0&appDayOfInstall_stable=0&appInstallTimeDiffSec_stable=0&appLastLaunchTime_stable=0&appUpdateCheckIsUpdateDisabled_stable=false&appVersion_stable=92.0.902.67&hwDiskType=2&hwHasSsse3=true&hwLogicalCpus=2&hwPhysmemory=4&isMsftDomainJoined=false&oemProductManufacturer=VMware,%20Inc.&oemProductName=VMware20,1&osArch=x64&osPlatform=win&osVersion=10.0.19045.2006&requestCheckPeriodSec=-1&requestDomainJoined=false&requestInstallSource=core&requestIsMachine=true&requestOmahaShellVersion=1.3.147.37&requestOmahaVersion=1.3.147.37][request=][filename=]
    Source: CF537GfmKa.exe, 00000000.00000003.1847274248.0000014501FF3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: enHfHDfN6bsbeT8o/5kyYSl66SsuWvyQeMuXDlHbQfqo=/
    Source: CF537GfmKa.exe, 00000000.00000003.1847274248.0000014501FF3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ePXA5AScIvMCImrQWnUlK4F/6o1LRBi5HHuZNpAnWxvI=/
    Source: CF537GfmKa.exe, 00000000.00000003.1903646139.0000014501B33000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [10/03/23 13:05:10.568][MicrosoftEdgeUpdate:msedgeupdate][4796:8636][Send][url=https://msedge.api.cdp.microsoft.com/api/v2/contents/Browser/namespaces/Default/names?action=batchupdates][request=[{"Product":"msedgewebview-stable-win-x64","targetingAttributes":{"AppAp":"","AppBrandCode":"","AppCohort":"","AppCohortHint":"","AppCohortName":"","AppLang":"","AppMajorVersion":"","AppRollout":0.63,"AppTargetVersionPrefix":"","AppVersion":"","ExpETag":"\"VPQoP1F+fq15wRzh1kPL4PMpWh8ORMB5izvrOC/chjQ=\"","HW_AVX":true,"HW_DiskType":2,"HW_LogicalCpus":2,"HW_PhysicalRamGB":4,"HW_SSE":true,"HW_SSE2":true,"HW_SSE3":true,"HW_SSE41":true,"HW_SSE42":true,"HW_SSSE3":true,"InstallSource":"otherinstallcmd","IsInternalUser":false,"IsMachine":true,"IsWIP":false,"OemProductManufacturer":"VMware, Inc.","OemProductName":"VMware20,1","OsArch":"x64","OsPlatform":"win","OsRegionDMA":false,"OsRegionName":"CH","OsRegionNation":"223","OsVersion":"10.0.19045.2006","Priority":10,"Updater":"MicrosoftEdgeUpdate","UpdaterVersion":"1.3.177.11","WIPBranch":""}}]][filename=]
    Source: tasklist.exe, 00000004.00000002.1694203560.000001A494E09000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'VMWARE'
    Source: tasklist.exe, 00000004.00000002.1694203560.000001A494E09000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: cQuery(SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'VMWARE');
    Source: tasklist.exe, 00000004.00000002.1694119831.000001A494DD0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: "tasklist" /fi "IMAGENAME eq vmware"
    Source: tasklist.exe, 00000004.00000003.1693814599.000001A494E08000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: , ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'VMWARE'0
    Source: CF537GfmKa.exe, 00000000.00000003.1927003032.000001457FBD7000.00000004.00000020.00020000.00000000.sdmp, CF537GfmKa.exe, 00000000.00000002.1927866977.000001457FBD7000.00000004.00000020.00020000.00000000.sdmp, CF537GfmKa.exe, 00000000.00000003.1926871152.000001457FBD7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
    Source: tasklist.exe, 00000004.00000003.1693814599.000001A494E08000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: tasklist/fiIMAGENAME eq vmware
    Source: CF537GfmKa.exe, 00000000.00000000.1690085887.00007FF7E163E000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: *Set-MpPreference -DisableRealtimeMonitoring $truewevtutil sl Security /e:falsewevtutil sl Application /e:falsevboxserviceqemuhypervvmwaretasklist/fiIMAGENAME eq LBd
    Source: tasklist.exe, 00000004.00000002.1694250091.000001A4950D0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: tasklist/fiIMAGENAME eq vmwareuser\G]
    Source: CF537GfmKa.exe, 00000000.00000003.1847274248.0000014501FF3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: lwKk1x5+9NJD0oC1Sm0PchOiV+3spsDahFOwVMcIA7E=!
    Source: CF537GfmKa.exe, 00000000.00000003.1903646139.0000014501B33000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [10/03/23 13:11:26.031][MicrosoftEdgeUpdate:msedgeupdate][6164:6168][Send][url=https://config.edge.skype.com/config/v1/EdgeUpdate/1.3.177.11?clientId=s:92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A&appBrandCode_edgeupdate=INBX&appBrandCode_webview=GGLS&appChannel_edgeupdate=6&appChannel_webview=5&appCohort_edgeupdate=rrf@0.24&appCohort_webview=rrf@0.75&appConsentState_edgeupdate=0&appConsentState_webview=0&appDayOfInstall_edgeupdate=0&appDayOfInstall_webview=6118&appInactivityBadgeApplied_edgeupdate=0&appInactivityBadgeApplied_webview=0&appInactivityBadgeCleared_edgeupdate=0&appInactivityBadgeCleared_webview=0&appInactivityBadgeDuration_edgeupdate=0&appInactivityBadgeDuration_webview=0&appInstallTimeDiffSec_edgeupdate=0&appInstallTimeDiffSec_webview=0&appIsPinnedSystem_edgeupdate=false&appIsPinnedSystem_webview=false&appLastLaunchCount_edgeupdate=0&appLastLaunchCount_webview=0&appLastLaunchTime_edgeupdate=0&appLastLaunchTimeJson_edgeupdate=0&appLastLaunchTimeDaysAgo_edgeupdate=0&appLastLaunchTime_webview=0&appLastLaunchTimeJson_webview=0&appLastLaunchTimeDaysAgo_webview=0&appUpdateCheckIsUpdateDisabled_edgeupdate=false&appUpdateCheckIsUpdateDisabled_webview=false&appUpdatesAllowedForMeteredNetworks_edgeupdate=false&appUpdatesAllowedForMeteredNetworks_webview=false&appVersion_edgeupdate=1.3.177.11&appVersion_webview=117.0.2045.47&hwDiskType=2&hwHasSsse3=true&hwLogicalCpus=2&hwPhysmemory=4&isCTADevice=false&isMsftDomainJoined=false&oemProductManufacturer=VMware,%20Inc.&oemProductName=VMware20,1&osArch=x64&osIsDefaultNetworkConnectionMetered=false&osIsInLockdownMode=false&osIsWIP=false&osPlatform=win&osProductType=48&osVersion=10.0.19045.2006&requestCheckPeriodSec=-1&requestDomainJoined=false&requestInstallSource=scheduler&requestIsMachine=true&requestOmahaShellVersion=1.3.147.37&requestOmahaVersion=1.3.177.11][request=][filename=]
    Source: CF537GfmKa.exe, 00000000.00000003.1847274248.0000014501FF3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: PXA5AScIvMCImrQWnUlK4F/6o1LRBi5HHuZNpAnWxvI=+
    Source: tasklist.exe, 00000004.00000002.1694250091.000001A4950D5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'VMWARE'Ab]
    Source: CF537GfmKa.exe, 00000000.00000003.1903646139.0000014501B33000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [10/03/23 13:06:04.175][MicrosoftEdgeUpdate:msedgeupdate][8536:732][Send][url=https://config.edge.skype.com/config/v1/EdgeUpdate/1.3.177.11?clientId=s:92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A&appChannel_webview=5&appConsentState_webview=0&appDayOfInstall_webview=-1&appInactivityBadgeApplied_webview=0&appInactivityBadgeCleared_webview=0&appInactivityBadgeDuration_webview=0&appInstallTimeDiffSec_webview=-86400&appIsPinnedSystem_webview=false&appLastLaunchCount_webview=0&appLastLaunchTime_webview=0&appLastLaunchTimeJson_webview=0&appLastLaunchTimeDaysAgo_webview=0&appVersion_webview=117.0.2045.47&appUpdateCheckIsUpdateDisabled_webview=false&appUpdatesAllowedForMeteredNetworks_webview=false&hwDiskType=2&hwHasSsse3=true&hwLogicalCpus=2&hwPhysmemory=4&isCTADevice=false&isMsftDomainJoined=false&oemProductManufacturer=VMware,%20Inc.&oemProductName=VMware20,1&osArch=x64&osIsDefaultNetworkConnectionMetered=false&osIsInLockdownMode=false&osIsWIP=false&osPlatform=win&osProductType=48&osVersion=10.0.19045.2006&requestCheckPeriodSec=-1&requestDomainJoined=false&requestInstallSource=otherinstallcmd&requestIsMachine=true&requestOmahaShellVersion=1.3.147.37&requestOmahaVersion=1.3.177.11][request=][filename=]
    Source: CF537GfmKa.exe, 00000000.00000003.1847274248.0000014501FF3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: nHfHDfN6bsbeT8o/5kyYSl66SsuWvyQeMuXDlHbQfqo=9
    Source: CF537GfmKa.exe, 00000000.00000003.1903646139.0000014501B33000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [10/03/23 13:05:09.866][MicrosoftEdgeUpdate:msedgeupdate][1336:8952][Send][url=https://config.edge.skype.com/config/v1/EdgeUpdate/1.3.177.11?clientId=s:92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A&appChannel_edgeupdate=6&appConsentState_edgeupdate=0&appDayOfInstall_edgeupdate=0&appInactivityBadgeApplied_edgeupdate=0&appInactivityBadgeCleared_edgeupdate=0&appInactivityBadgeDuration_edgeupdate=0&appInstallTimeDiffSec_edgeupdate=0&appIsPinnedSystem_edgeupdate=false&appLastLaunchCount_edgeupdate=0&appLastLaunchTime_edgeupdate=0&appLastLaunchTimeJson_edgeupdate=0&appLastLaunchTimeDaysAgo_edgeupdate=0&appVersion_edgeupdate=1.3.177.11&appUpdateCheckIsUpdateDisabled_edgeupdate=false&appUpdatesAllowedForMeteredNetworks_edgeupdate=false&hwDiskType=2&hwHasSsse3=true&hwLogicalCpus=2&hwPhysmemory=4&isCTADevice=false&isMsftDomainJoined=false&oemProductManufacturer=VMware,%20Inc.&oemProductName=VMware20,1&osArch=x64&osIsDefaultNetworkConnectionMetered=false&osIsInLockdownMode=false&osIsWIP=false&osPlatform=win&osProductType=48&osVersion=10.0.19045.2006&requestCheckPeriodSec=-1&requestDomainJoined=false&requestInstallSource=otherinstallcmd&requestIsMachine=true&requestOmahaShellVersion=1.3.147.37&requestOmahaVersion=1.3.177.11][request=][filename=]
    Source: CF537GfmKa.exe, 00000000.00000003.1847274248.0000014501FF3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: A8eXZTvg7YGvCcJUzyxbHGFSKXp/UmDdgVxDyBqqswI=e*1
    Source: CF537GfmKa.exe, 00000000.00000003.1903646139.0000014501B33000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [10/03/23 13:10:48.035][MicrosoftEdgeUpdate:msedgeupdate][4220:5516][Send][url=https://msedge.api.cdp.microsoft.com/api/v2/contents/Browser/namespaces/Default/names?action=batchupdates][request=[{"Product":"msedgeupdate-stable-win-x86","targetingAttributes":{"AppAp":"","AppBrandCode":"INBX","AppCohort":"","AppCohortHint":"","AppCohortName":"","AppLang":"","AppMajorVersion":"1","AppRollout":0.72,"AppTargetVersionPrefix":"","AppVersion":"1.3.177.11","ExpETag":"\"qWJSzWwPfdcLR+XGIv6xrZfiYOxhPU2s1NWmjWcaFPg=\"","HW_AVX":true,"HW_DiskType":2,"HW_LogicalCpus":2,"HW_PhysicalRamGB":4,"HW_SSE":true,"HW_SSE2":true,"HW_SSE3":true,"HW_SSE41":true,"HW_SSE42":true,"HW_SSSE3":true,"InstallSource":"scheduler","IsInternalUser":false,"IsMachine":true,"IsWIP":false,"OemProductManufacturer":"VMware, Inc.","OemProductName":"VMware20,1","OsArch":"x64","OsPlatform":"win","OsRegionDMA":false,"OsRegionName":"CH","OsRegionNation":"223","OsVersion":"10.0.19045.2006","Priority":0,"Updater":"MicrosoftEdgeUpdate","UpdaterVersion":"1.3.177.11","WIPBranch":""}},{"Product":"msedge-stable-win-x64","targetingAttributes":{"AppAp":"","AppBrandCode":"INBX","AppCohort":"","AppCohortHint":"","AppCohortName":"","AppLang":"","AppMajorVersion":"92","AppRollout":0.65,"AppTargetVersionPrefix":"","AppVersion":"92.0.902.67","ExpETag":"\"qWJSzWwPfdcLR+XGIv6xrZfiYOxhPU2s1NWmjWcaFPg=\"","HW_AVX":true,"HW_DiskType":2,"HW_LogicalCpus":2,"HW_PhysicalRamGB":4,"HW_SSE":true,"HW_SSE2":true,"HW_SSE3":true,"HW_SSE41":true,"HW_SSE42":true,"HW_SSSE3":true,"InstallSource":"scheduler","IsInternalUser":false,"IsMachine":true,"IsWIP":false,"OemProductManufacturer":"VMware, Inc.","OemProductName":"VMware20,1","OsArch":"x64","OsPlatform":"win","OsRegionDMA":false,"OsRegionName":"CH","OsRegionNation":"223","OsVersion":"10.0.19045.2006","Priority":0,"Updater":"MicrosoftEdgeUpdate","UpdaterVersion":"1.3.177.11","WIPBranch":""}},{"Product":"msedgewebview-stable-win-x64","targetingAttributes":{"AppAp":"","AppBrandCode":"GGLS","AppCohort":"","AppCohortHint":"","AppCohortName":"","AppLang":"","AppMajorVersion":"117","AppRollout":0.6,"AppTargetVersionPrefix":"","AppVersion":"117.0.2045.47","ExpETag":"\"qWJSzWwPfdcLR+XGIv6xrZfiYOxhPU2s1NWmjWcaFPg=\"","HW_AVX":true,"HW_DiskType":2,"HW_LogicalCpus":2,"HW_PhysicalRamGB":4,"HW_SSE":true,"HW_SSE2":true,"HW_SSE3":true,"HW_SSE41":true,"HW_SSE42":true,"HW_SSSE3":true,"InstallSource":"scheduler","IsInternalUser":false,"IsMachine":true,"IsWIP":false,"OemProductManufacturer":"VMware, Inc.","OemProductName":"VMware20,1","OsArch":"x64","OsPlatform":"win","OsRegionDMA":false,"OsRegionName":"CH","OsRegionNation":"223","OsVersion":"10.0.19045.2006","Priority":0,"Updater":"MicrosoftEdgeUpdate","UpdaterVersion":"1.3.177.11","WIPBranch":""}}]][filename=]
    Source: CF537GfmKa.exe, 00000000.00000003.1847274248.0000014501FF3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: eKcxqaYUpQemuF/g4XeY+/GN/5r9nu6fcwnr/bvuY4c=A
    Source: tasklist.exe, 00000004.00000002.1694119831.000001A494DD0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: C:\Users\user\Desktop\C:\Windows\system32\tasklist.exe"tasklist" /fi "IMAGENAME eq vmware"C:\Windows\system32\tasklist.exeWinsta0\Default
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior
    Source: C:\Windows\System32\tasklist.exeProcess token adjusted: DebugJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeMemory allocated: page read and write | page guardJump to behavior

    HIPS / PFW / Operating System Protection Evasion

    barindex
    Bypasses PowerShell execution policy
    Source: C:\Users\user\Desktop\CF537GfmKa.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "Set-ExecutionPolicy Bypass -Scope Process -Force"
    Disables Windows Defender (via service or powershell)
    Source: C:\Users\user\Desktop\CF537GfmKa.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
    Source: C:\Users\user\Desktop\CF537GfmKa.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "Set-MpPreference -DisableRealtimeMonitoring $true"Jump to behavior
    Modifies Windows Defender protection settings
    Source: C:\Users\user\Desktop\CF537GfmKa.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
    Source: C:\Users\user\Desktop\CF537GfmKa.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "Set-MpPreference -DisableRealtimeMonitoring $true"Jump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeProcess created: C:\Windows\System32\net.exe "net" sessionJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeProcess created: C:\Windows\System32\tasklist.exe "tasklist" /fi "IMAGENAME eq vmware"Jump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "Set-MpPreference -DisableRealtimeMonitoring $true"Jump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "wevtutil sl Security /e:false"Jump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "wevtutil sl Application /e:false"Jump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "Set-ExecutionPolicy Bypass -Scope Process -Force"Jump to behavior
    Source: C:\Windows\System32\net.exeProcess created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 sessionJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\wevtutil.exe "C:\Windows\system32\wevtutil.exe" sl Security /e:falseJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\wevtutil.exe "C:\Windows\system32\wevtutil.exe" sl Application /e:falseJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\$Recycle.Bin VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\desktop.ini VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\desktop.ini VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\desktop.ini VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\desktop.ini VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\desktop.ini VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\desktop.ini VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\desktop.ini VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\desktop.ini VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\desktop.ini VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\$WinREAgent VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\$WinREAgent\Scratch VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\Users VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM\Acrobat_23.006.20320 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-0C0A92D435E5} VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM\Acrobat_23.006.20320 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-0C0A92D435E5} VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM\Acrobat_23.006.20320 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-0C0A92D435E5} VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM\Acrobat_23.006.20320 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-0C0A92D435E5} VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM\Acrobat_23.006.20320 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-0C0A92D435E5} VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM\Acrobat_23.006.20320 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-0C0A92D435E5} VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM\Acrobat_23.006.20320 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-0C0A92D435E5} VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM\Acrobat_23.006.20320 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-0C0A92D435E5} VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM\Acrobat_23.006.20320 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-0C0A92D435E5} VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM\Acrobat_23.006.20320 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-0C0A92D435E5} VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM\Acrobat_23.006.20320 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-0C0A92D435E5} VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM\Acrobat_23.006.20320 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-0C0A92D435E5} VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM\Acrobat_23.006.20320 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-0C0A92D435E5} VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM\Acrobat_23.006.20320 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM\Acrobat_23.006.20320 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-0C0A92D435E5} VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM\Acrobat_23.006.20320 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-0C0A92D435E5} VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM\Acrobat_23.006.20320 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-0C0A92D435E5} VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM\Acrobat_23.006.20320 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-0C0A92D435E5} VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM\Acrobat_23.006.20320 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-0C0A92D435E5} VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM\Acrobat_23.006.20320 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-0C0A92D435E5} VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM\Acrobat_23.006.20320 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-0C0A92D435E5} VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM\Acrobat_23.006.20320 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-0C0A92D435E5} VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM\Acrobat_23.006.20320 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-0C0A92D435E5} VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM\Acrobat_23.006.20320 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-0C0A92D435E5} VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM\Acrobat_23.006.20320 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-0C0A92D435E5} VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM\Acrobat_23.006.20320 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-0C0A92D435E5} VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM\Acrobat_23.006.20320 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-0C0A92D435E5} VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM\Acrobat_23.006.20320 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-0C0A92D435E5} VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM\Acrobat_23.006.20320 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM\Acrobat_23.006.20320 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-0C0A92D435E5} VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\dbg VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\AppV VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\AppV\Setup VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\AppV\Setup\OfficeIntegrator.ps1 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\AppV\Setup\OfficeIntegrator.ps1 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\DeploymentConfig.1.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\DeploymentConfig.1.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\DeploymentConfig.1.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA} VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8} VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\DeploymentConfiguration.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\DeploymentConfiguration.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\DeploymentConfiguration.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\Manifest.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\Manifest.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\Manifest.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\UserDeploymentConfiguration.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\UserDeploymentConfiguration.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\UserDeploymentConfiguration.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\UserManifest.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\UserManifest.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\UserManifest.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\MachineData\Integration VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\MachineData\Integration\ShortcutBackups VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\ProductReleases VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\AAD0B0DB-711A-45EF-A013-BDD28531EC08\en-us.16 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\AAD0B0DB-711A-45EF-A013-BDD28531EC08\en-us.16\MasterDescriptor.en-us.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\AAD0B0DB-711A-45EF-A013-BDD28531EC08\en-us.16\MasterDescriptor.en-us.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\AAD0B0DB-711A-45EF-A013-BDD28531EC08\en-us.16\MasterDescriptor.en-us.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\AAD0B0DB-711A-45EF-A013-BDD28531EC08\en-us.16\s321033.hash VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\AAD0B0DB-711A-45EF-A013-BDD28531EC08\en-us.16\s321033.hash VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\AAD0B0DB-711A-45EF-A013-BDD28531EC08\en-us.16\stream.x86.en-us.dat.cat VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\AAD0B0DB-711A-45EF-A013-BDD28531EC08\en-us.16\stream.x86.en-us.dat.cat VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\AAD0B0DB-711A-45EF-A013-BDD28531EC08\en-us.16\stream.x86.en-us.db VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\AAD0B0DB-711A-45EF-A013-BDD28531EC08\en-us.16\stream.x86.en-us.db VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\AAD0B0DB-711A-45EF-A013-BDD28531EC08\en-us.16\stream.x86.en-us.hash VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\AAD0B0DB-711A-45EF-A013-BDD28531EC08\en-us.16\stream.x86.en-us.hash VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\AAD0B0DB-711A-45EF-A013-BDD28531EC08\en-us.16\stream.x86.en-us.man.dat VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\AAD0B0DB-711A-45EF-A013-BDD28531EC08\operations.db VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\AAD0B0DB-711A-45EF-A013-BDD28531EC08\operations.db VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\AAD0B0DB-711A-45EF-A013-BDD28531EC08\operations.db VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\AAD0B0DB-711A-45EF-A013-BDD28531EC08\VirtualRegistry.dat VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\AAD0B0DB-711A-45EF-A013-BDD28531EC08\VirtualRegistry.dat VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\AAD0B0DB-711A-45EF-A013-BDD28531EC08\VirtualRegistry.dat VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\AAD0B0DB-711A-45EF-A013-BDD28531EC08\x-none.16 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\AAD0B0DB-711A-45EF-A013-BDD28531EC08\x-none.16\i320.c2rx.hash VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\AAD0B0DB-711A-45EF-A013-BDD28531EC08\x-none.16\i320.c2rx.hash VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\AAD0B0DB-711A-45EF-A013-BDD28531EC08\x-none.16\MasterDescriptor.x-none.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\AAD0B0DB-711A-45EF-A013-BDD28531EC08\x-none.16\MasterDescriptor.x-none.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\AAD0B0DB-711A-45EF-A013-BDD28531EC08\x-none.16\MasterDescriptor.x-none.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\AAD0B0DB-711A-45EF-A013-BDD28531EC08\x-none.16\s320.hash VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\AAD0B0DB-711A-45EF-A013-BDD28531EC08\x-none.16\s320.hash VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\AAD0B0DB-711A-45EF-A013-BDD28531EC08\x-none.16\stream.x86.x-none.db VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\AAD0B0DB-711A-45EF-A013-BDD28531EC08\x-none.16\stream.x86.x-none.man.dat VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\AAD0B0DB-711A-45EF-A013-BDD28531EC08\x-none.16\stream.x86.x-none.man.dat VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA} VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\AirSpace.Etw.man VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\AirSpace.Etw.man VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Access.Access.x-none.msi.16.x-none.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Access.Access.x-none.msi.16.x-none.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.accessmui.msi.16.en-us.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.accessmui.msi.16.en-us.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.accessmui.msi.16.en-us.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.dcfmui.msi.16.en-us.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.dcfmui.msi.16.en-us.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.dcfmui.msi.16.en-us.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.excelmui.msi.16.en-us.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.excelmui.msi.16.en-us.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.excelmui.msi.16.en-us.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.lyncmui.msi.16.en-us.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.lyncmui.msi.16.en-us.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.lyncmui.msi.16.en-us.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.office64mui.msi.16.en-us.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.office64mui.msi.16.en-us.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.office64ww.msi.16.x-none.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.office64ww.msi.16.x-none.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.office64ww.msi.16.x-none.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.officemui.msi.16.en-us.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.officemui.msi.16.en-us.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.officemui.msi.16.en-us.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.onenotemui.msi.16.en-us.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.onenotemui.msi.16.en-us.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.onenotemui.msi.16.en-us.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.osmmui.msi.16.en-us.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.osmmui.msi.16.en-us.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.osmmui.msi.16.en-us.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.osmuxmui.msi.16.en-us.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.osmuxmui.msi.16.en-us.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.outlookmui.msi.16.en-us.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.outlookmui.msi.16.en-us.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.outlookmui.msi.16.en-us.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.powerpointmui.msi.16.en-us.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.powerpointmui.msi.16.en-us.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.powerpointmui.msi.16.en-us.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.PowerView.PowerView.x-none.msi.16.x-none.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.PowerView.PowerView.x-none.msi.16.x-none.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Proof.Culture.msi.16.en-us.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Proof.Culture.msi.16.es-es.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Proof.Culture.msi.16.es-es.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Proof.Culture.msi.16.es-es.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Proof.Culture.msi.16.fr-fr.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Proof.Culture.msi.16.fr-fr.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Proof.Culture.msi.16.fr-fr.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.publishermui.msi.16.en-us.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.publishermui.msi.16.en-us.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.publishermui.msi.16.en-us.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.shared.Office.x-none.msi.16.x-none.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.shared.Office.x-none.msi.16.x-none.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Word.Word.x-none.msi.16.x-none.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Word.Word.x-none.msi.16.x-none.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Word.Word.x-none.msi.16.x-none.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.wordmui.msi.16.en-us.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.wordmui.msi.16.en-us.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.wordmui.msi.16.en-us.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\Microsoft_Office_Office Feature Updates Logon.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\Microsoft_Office_Office Feature Updates Logon.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\Microsoft_Office_Office Feature Updates Logon.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\Microsoft_Office_Office Feature Updates.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\Microsoft_Office_Office Feature Updates.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\msoutilstat.etw.man VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\msoutilstat.etw.man VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\wordEtw.man VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\wordEtw.man VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Crypto\PCPKSP VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Crypto\SystemKeys VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Crypto\SystemKeys\4fbf593b24f129e7d8c9fc84ba6a1ac3_9e146be9-c76a-4720-bcdb-53011b87bd06 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Device VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0} VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\behavior.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\behavior.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\behavior.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\behavior.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\behavior.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Task VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-GB VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-GB\resource.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-GB\resource.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-GB\resource.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\folder.ico VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\folder.ico VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\netfol.ico VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\resource.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\ringtones.ico VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\ringtones.ico VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\settings.ico VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\sync.ico VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\tasks.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\wmp.ico VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\wmp.ico VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-GB VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-GB\resource.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-GB\resource.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-GB\resource.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\folder.ico VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\print_pref.ico VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\print_property.ico VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\scan_settings.ico VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\scan_settings.ico VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\tasks.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\CustomTraceProfiles VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\DownloadedScenarios VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.ASM-WindowsDefault.json VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.ASM-WindowsDefault.json.bk VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.ASM-WindowsDefault.json.bk VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\TELEMETRY.ASM-WINDOWSSQ.json VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.P-ARIA-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.P-ARIA-4bb4d6f7cafc4e9292f972dca2dcde42-bd019ee8-e59c-4b0f-a02c-84e72157a3ef-7485.json VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.P-ARIA-7005b72804a64fa4b2138faab88f877b-14cf798a-05a4-4b7b-9d02-4d99259ebd4a-7553.json VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.P-ARIA-7005b72804a64fa4b2138faab88f877b-14cf798a-05a4-4b7b-9d02-4d99259ebd4a-7553.json VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.P-ARIA-af397ef28e484961ba48646a5d38cf54-77418283-d6f6-4a90-b0c8-37e0f5e7b087-7425.json VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.P-ARIA-af397ef28e484961ba48646a5d38cf54-77418283-d6f6-4a90-b0c8-37e0f5e7b087-7425.json VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.P-ARIA-af397ef28e484961ba48646a5d38cf54-77418283-d6f6-4a90-b0c8-37e0f5e7b087-7425.json VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.P-ARIA-d5a8f02229be41efb047bd8f883ba799-59258264-451c-4459-8c09-75d7d721219a-7112.json VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.P-Eco3PTelDefault.json VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.allow.json VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.allow.json VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.app.json VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.app.json VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.app.json VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.app.json.bk VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.app.json.bk VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.cert.json VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.cert.json VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.cert.json VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.privacy.json VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.privacy.json VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.privacy.json VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.tracing.json VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.tracing.json VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.tracing.json VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.tracing.json.bk VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.tracing.json.bk VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\ETLLogs VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\ETLLogs\ScenarioShutdownLogger VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\ETLLogs\ShutdownLogger\Diagtrack-Listener.etl VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\ETLLogs\ShutdownLogger\Diagtrack-Listener.etl VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\ETLLogs\ShutdownLogger\Diagtrack-Listener.etl VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\EventStore.db VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\EventStore.db VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\EventStore.db VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\EventTranscript VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\osver.txt VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\osver.txt VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\parse.dat VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\parse.dat VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\parse.dat VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\ScenariosSqlStore\EventStore.db VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\ScenariosSqlStore\EventStore.db VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\TenantStorage\P-ARIA\EventStore.db VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\TenantStorage\P-ARIA\EventStore.db VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\TenantStorage\P-ARIA\EventStore.db VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\DiagnosticLogCSP\Channels VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\DiagnosticLogCSP\Collectors VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\DiagnosticLogCSP\Collectors\DiagnosticLogCSP_Collector_Autopilot_2023_10_3_9_57_25.etl VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\DiagnosticLogCSP\Collectors\DiagnosticLogCSP_Collector_Autopilot_2023_10_3_9_57_25.etl VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\DiagnosticLogCSP\Collectors\DiagnosticLogCSP_Collector_Autopilot_2023_10_3_9_57_25.etl VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\DiagnosticLogCSP\Collectors\DiagnosticLogCSP_Collector_Autopilot_2023_10_3_9_59_39.etl VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\DiagnosticLogCSP\Collectors\DiagnosticLogCSP_Collector_Autopilot_2023_10_3_9_59_39.etl VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\DiagnosticLogCSP\Collectors\DiagnosticLogCSP_Collector_Autopilot_2023_10_3_9_59_39.etl VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\DiagnosticLogCSP\Collectors\DiagnosticLogCSP_Collector_DeviceProvisioning_2023_10_3_8_56_48.etl VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\DiagnosticLogCSP\Collectors\DiagnosticLogCSP_Collector_DeviceProvisioning_2023_10_3_8_56_48.etl VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\DiagnosticLogCSP\Collectors\DiagnosticLogCSP_Collector_DeviceProvisioning_2023_10_4_9_46_43.etl VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\DiagnosticLogCSP\Collectors\DiagnosticLogCSP_Collector_DeviceProvisioning_2023_10_4_9_46_43.etl VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\DiagnosticLogCSP\Collectors\DiagnosticLogCSP_Collector_DeviceProvisioning_2023_10_4_9_46_43.etl VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\DRM VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\DRM\Server VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\EdgeUpdate VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\EdgeUpdate\Log VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\IdentityCRL\INT\wlidsvcconfig.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\IdentityCRL\INT\wlidsvcconfig.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\IdentityCRL\production\wlidsvcconfig.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\IdentityCRL\production\wlidsvcconfig.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\MF\Active.GRL VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\MF\Active.GRL VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\MF\Pending.GRL VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Network VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Network\Connections VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edbres00001.jrs VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edbres00002.jrs VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edbtmp.log VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Office VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Office\ClickToRunPackageLocker VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Office\ClickToRunPackageLocker VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Provisioning VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Provisioning\AssetCache VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Provisioning\AssetCache\CellularUx VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Search\Data VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Search\Data\Applications VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Search\Data\Applications\Windows VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Config VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\edb.jcp VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\edb.jcp VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\edb.jtx VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\edb00011.jtx VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\edbres00002.jrs VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\SystemIndex.1.Crwl VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\SystemIndex.1.Crwl VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeQueries volume information: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\SystemIndex.1.gthr VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\CF537GfmKa.exeCode function: 0_2_00007FF7E162B7B8 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,0_2_00007FF7E162B7B8
    Source: C:\Users\user\Desktop\CF537GfmKa.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

    Mitre Att&ck Matrix

    ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
    Gather Victim Identity InformationAcquire InfrastructureValid Accounts1
    Windows Management Instrumentation    		1
    DLL Side-Loading    		11
    Process Injection    		1
    Masquerading    		11
    Input Capture    		1
    System Time Discovery    		Remote Services11
    Input Capture    		1
    Encrypted Channel    		Exfiltration Over Other Network MediumAbuse Accessibility Features
    CredentialsDomainsDefault Accounts2
    Command and Scripting Interpreter    		Boot or Logon Initialization Scripts1
    DLL Side-Loading    		21
    Disable or Modify Tools    		LSASS Memory1
    Query Registry    		Remote Desktop ProtocolData from Removable Media1
    Ingress Tool Transfer    		Exfiltration Over BluetoothNetwork Denial of Service
    Email AddressesDNS ServerDomain Accounts1
    PowerShell    		Logon Script (Windows)Logon Script (Windows)21
    Virtualization/Sandbox Evasion    		Security Account Manager11
    Security Software Discovery    		SMB/Windows Admin SharesData from Network Shared Drive2
    Non-Application Layer Protocol    		Automated ExfiltrationData Encrypted for Impact
    Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook11
    Process Injection    		NTDS2
    Process Discovery    		Distributed Component Object ModelInput Capture3
    Application Layer Protocol    		Traffic DuplicationData Destruction
    Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
    Hidden Files and Directories    		LSA Secrets21
    Virtualization/Sandbox Evasion    		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
    Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
    DLL Side-Loading    		Cached Domain Credentials1
    Application Window Discovery    		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
    DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup ItemsCompile After DeliveryDCSync2
    File and Directory Discovery    		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
    Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/JobIndicator Removal from ToolsProc Filesystem14
    System Information Discovery    		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement

    Behavior Graph

    Hide Legend

    Legend:

    • Process
    • Signature
    • Created File
    • DNS/IP Info
    • Is Dropped
    • Is Windows Process
    • Number of created Registry Values
    • Number of created Files
    • Visual Basic
    • Delphi
    • Java
    • .Net C# or VB.NET
    • C, C++ or other language
    • Is malicious
    • Internet
    behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1589527 Sample: CF537GfmKa.exe Startdate: 12/01/2025 Architecture: WINDOWS Score: 100 36 ipv4.imgur.map.fastly.net 2->36 38 i.imgur.com 2->38 42 Multi AV Scanner detection for dropped file 2->42 44 Multi AV Scanner detection for submitted file 2->44 46 Yara detected FunkLocker Ransomware 2->46 48 5 other signatures 2->48 8 CF537GfmKa.exe 145 2->8         started        signatures3 process4 dnsIp5 40 ipv4.imgur.map.fastly.net 199.232.196.193, 443, 49730 FASTLYUS United States 8->40 30 C:\Users\CK3Wg2mN4T.exe, PE32+ 8->30 dropped 32 C:\$Recycle.Bin\...\desktop.ini.funksec, data 8->32 dropped 34 C2RManifest.Proof....6.en-us.xml.funksec, COM 8->34 dropped 50 Creates files in the recycle bin to hide itself 8->50 52 Bypasses PowerShell execution policy 8->52 54 Modifies Windows Defender protection settings 8->54 56 Disables Windows Defender (via service or powershell) 8->56 13 powershell.exe 23 8->13         started        16 powershell.exe 22 8->16         started        18 powershell.exe 7 8->18         started        20 4 other processes 8->20 file6 signatures7 process8 signatures9 58 Loading BitLocker PowerShell Module 13->58 22 WmiPrvSE.exe 13->22         started        24 wevtutil.exe 1 18->24         started        26 wevtutil.exe 1 20->26         started        28 net1.exe 1 20->28         started        process10

    Screenshots

    Thumbnails

    This section contains all screenshots as thumbnails, including those not shown in the slideshow.


    windows-stand

    Antivirus, Machine Learning and Genetic Malware Detection

    Initial Sample

    SourceDetectionScannerLabelLink
    CF537GfmKa.exe67%VirustotalBrowse
    CF537GfmKa.exe71%ReversingLabsWin64.Ransomware.FunkSec

    Dropped Files

    SourceDetectionScannerLabelLink
    C:\Users\CK3Wg2mN4T.exe71%ReversingLabsWin64.Ransomware.FunkSec

    Unpacked PE Files

    ⊘No Antivirus matches

    Domains

    ⊘No Antivirus matches

    URLs

    SourceDetectionScannerLabelLink
    http://oe.msn.msnmail.hotmail.com/cgi-bin/hmdata0%Avira URL Cloudsafe
    http://127.0.0.1:13556/InsiderSlabBehaviorReportedBuildInsiderSlabBehaviorInsiderSlabBehaviorReporte0%Avira URL Cloudsafe
    http://ns.adobe.0%Avira URL Cloudsafe
    https://getsession.org/0%Avira URL Cloudsafe

    Domains and IPs

    Contacted Domains

    NameIPActiveMaliciousAntivirus DetectionReputation
    ipv4.imgur.map.fastly.net
    		199.232.196.193
    		truefalse
      		high
      i.imgur.com
      		unknown
      		unknownfalse
        		high

        URLs from Memory and Binaries

        NameSourceMaliciousAntivirus DetectionReputation
        https://login.microsoftonline.com/ppsecure/deviceremovecredential.srfCF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpfalse
          		high
          http://g.live.com/0CR%1/30CF537GfmKa.exe, 00000000.00000003.1854907203.0000014501FCD000.00000004.00000020.00020000.00000000.sdmpfalse
            		high
            https://contoso.com/Licensepowershell.exe, 00000008.00000002.1733064682.0000022934CC7000.00000004.00000800.00020000.00000000.sdmpfalse
              		high
              https://login.microsoftonline.com/ppsecure/DeviceQuery.srfCF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpfalse
                		high
                https://docs.rs/getrandom#nodejs-es-module-supportCF537GfmKa.exefalse
                  		high
                  https://g.live.com/odclientsettings/ProdV2.C:CF537GfmKa.exe, 00000000.00000003.1905282842.0000014501686000.00000004.00000020.00020000.00000000.sdmp, CF537GfmKa.exe, 00000000.00000003.1905282842.00000145016EA000.00000004.00000020.00020000.00000000.sdmp, CF537GfmKa.exe, 00000000.00000003.1905282842.00000145016CB000.00000004.00000020.00020000.00000000.sdmp, CF537GfmKa.exe, 00000000.00000003.1909014710.0000014501671000.00000004.00000020.00020000.00000000.sdmpfalse
                    		high
                    https://www.torproject.org/CF537GfmKa.exefalse
                      		high
                      http://oe.msn.msnmail.hotmail.com/cgi-bin/hmdataCF537GfmKa.exe, 00000000.00000003.1854907203.0000014501FCD000.00000004.00000020.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      https://login.microsoftonline.com/ppsecure/ResolveUser.srfCF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpfalse
                        		high
                        https://login.microsoftonline.com/MSARST2.srfCF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpfalse
                          		high
                          https://g.live.com/odclientsettings/Prod.C:CF537GfmKa.exe, 00000000.00000003.1905282842.00000145016FD000.00000004.00000020.00020000.00000000.sdmp, CF537GfmKa.exe, 00000000.00000003.1909014710.0000014501671000.00000004.00000020.00020000.00000000.sdmpfalse
                            		high
                            https://g.live.com/odclientsettings/ProdV2CF537GfmKa.exe, 00000000.00000003.1905282842.00000145016A5000.00000004.00000020.00020000.00000000.sdmp, CF537GfmKa.exe, 00000000.00000003.1909014710.0000014501671000.00000004.00000020.00020000.00000000.sdmpfalse
                              		high
                              https://contoso.com/powershell.exe, 00000008.00000002.1733064682.0000022934CC7000.00000004.00000800.00020000.00000000.sdmpfalse
                                		high
                                https://nuget.org/nuget.exepowershell.exe, 00000008.00000002.1756212996.00000229433C1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1733064682.0000022934CC7000.00000004.00000800.00020000.00000000.sdmpfalse
                                  		high
                                  https://login.microsoftonline.com/ppsecure/devicechangecredential.srfCF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpfalse
                                    		high
                                    https://login.microsoftonline.com/ppsecure/EnumerateDevices.srfCF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpfalse
                                      		high
                                      https://account.live.com/InlineSignup.aspx?iww=1&id=80502CF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpfalse
                                        		high
                                        http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namepowershell.exe, 00000008.00000002.1733064682.0000022933351000.00000004.00000800.00020000.00000000.sdmpfalse
                                          		high
                                          https://signup.live.com/signup.aspxCF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpfalse
                                            		high
                                            https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6CF537GfmKa.exe, 00000000.00000003.1905282842.00000145016A5000.00000004.00000020.00020000.00000000.sdmp, CF537GfmKa.exe, 00000000.00000003.1909014710.0000014501671000.00000004.00000020.00020000.00000000.sdmpfalse
                                              		high
                                              https://getsession.org/CF537GfmKa.exefalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://nuget.org/NuGet.exepowershell.exe, 00000008.00000002.1756212996.00000229433C1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1733064682.0000022934CC7000.00000004.00000800.00020000.00000000.sdmpfalse
                                                		high
                                                https://aka.ms/winsvr-2022-pshelppowershell.exe, 00000008.00000002.1733064682.0000022933578000.00000004.00000800.00020000.00000000.sdmpfalse
                                                  		high
                                                  http://pesterbdd.com/images/Pester.pngpowershell.exe, 00000008.00000002.1733064682.0000022933578000.00000004.00000800.00020000.00000000.sdmpfalse
                                                    		high
                                                    http://schemas.xmlsoap.org/soap/encoding/powershell.exe, 00000008.00000002.1733064682.0000022933C80000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1733064682.0000022933578000.00000004.00000800.00020000.00000000.sdmpfalse
                                                      		high
                                                      http://www.apache.org/licenses/LICENSE-2.0.htmlpowershell.exe, 00000008.00000002.1733064682.0000022933578000.00000004.00000800.00020000.00000000.sdmpfalse
                                                        		high
                                                        https://go.micropowershell.exe, 00000008.00000002.1733064682.0000022934666000.00000004.00000800.00020000.00000000.sdmpfalse
                                                          		high
                                                          https://account.live.com/msangcwamCF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            		high
                                                            https://contoso.com/Iconpowershell.exe, 00000008.00000002.1733064682.0000022934CC7000.00000004.00000800.00020000.00000000.sdmpfalse
                                                              		high
                                                              https://aka.ms/winsvr-2022-pshelpXpowershell.exe, 00000008.00000002.1733064682.0000022934666000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                		high
                                                                https://login.microsoftonline.com/ppsecure/deviceaddmsacredential.srfCF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  https://i.imgur.com/HCYQoVR.jpegCF537GfmKa.exefalse
                                                                    		high
                                                                    https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srfCF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      https://github.com/Pester/Pesterpowershell.exe, 00000008.00000002.1733064682.0000022933578000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        https://login.microsoftonline.com/ppsecure/DeviceAssociate.srfCF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          https://account.live.com/Wizard/Password/Change?id=80601CF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            https://account.live.com/inlinesignup.aspx?iww=1&id=80601CF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              https://www.coinbase.com/)CF537GfmKa.exefalse
                                                                                		high
                                                                                https://account.live.com/inlinesignup.aspx?iww=1&id=80600CF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96CF537GfmKa.exe, 00000000.00000003.1905282842.00000145016A5000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    http://schemas.xmlsoap.org/wsdl/powershell.exe, 00000008.00000002.1733064682.0000022933C80000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1733064682.0000022933578000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      https://login.microsoftonline.com/ppsecure/DeviceUpdate.srfCF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        http://127.0.0.1:13556/InsiderSlabBehaviorReportedBuildInsiderSlabBehaviorInsiderSlabBehaviorReporteCF537GfmKa.exe, 00000000.00000003.1881981187.0000014501FCA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                        • Avira URL Cloud: safe
                                                                                        		unknown
                                                                                        https://aka.ms/pscore68powershell.exe, 00000008.00000002.1733064682.0000022933351000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                          		high
                                                                                          http://ns.adobe.CF537GfmKa.exefalse
                                                                                          • Avira URL Cloud: safe
                                                                                          		unknown
                                                                                          https://account.live.com/inlinesignup.aspx?iww=1&id=80605CF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                            		high
                                                                                            https://account.live.com/inlinesignup.aspx?iww=1&id=80603CF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                              		high
                                                                                              https://account.live.com/inlinesignup.aspx?iww=1&id=80604CF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                		high
                                                                                                https://www.blockchain.com/)CF537GfmKa.exefalse
                                                                                                  		high
                                                                                                  https://login.microsoftonline.com/commonCF537GfmKa.exe, 00000000.00000003.1902296321.0000014501DD0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                    		high

                                                                                                    World Map of Contacted IPs

                                                                                                    • No. of IPs < 25%
                                                                                                    • 25% < No. of IPs < 50%
                                                                                                    • 50% < No. of IPs < 75%
                                                                                                    • 75% < No. of IPs

                                                                                                    Public IPs

                                                                                                    IPDomainCountryFlagASNASN NameMalicious
                                                                                                    199.232.196.193
                                                                                                    		ipv4.imgur.map.fastly.netUnited States
                                                                                                    		54113FASTLYUSfalse

                                                                                                    General Information

                                                                                                    Joe Sandbox version:42.0.0 Malachite
                                                                                                    Analysis ID:1589527
                                                                                                    Start date and time:2025-01-12 18:46:08 +01:00
                                                                                                    Joe Sandbox product:CloudBasic
                                                                                                    Overall analysis duration:0h 7m 22s
                                                                                                    Hypervisor based Inspection enabled:false
                                                                                                    Report type:full
                                                                                                    Cookbook file name:default.jbs
                                                                                                    Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                    Number of analysed new started processes analysed:17
                                                                                                    Number of new started drivers analysed:0
                                                                                                    Number of existing processes analysed:0
                                                                                                    Number of existing drivers analysed:0
                                                                                                    Number of injected processes analysed:0
                                                                                                    Technologies:
                                                                                                    • HCA enabled
                                                                                                    • EGA enabled
                                                                                                    • AMSI enabled
                                                                                                    Analysis Mode:default
                                                                                                    Analysis stop reason:Timeout
                                                                                                    Sample name:CF537GfmKa.exe
                                                                                                    renamed because original name is a hash value
                                                                                                    Original Sample Name:5226ea8e0f516565ba825a1bbed10020982c16414750237068b602c5b4ac6abd.exe
                                                                                                    Detection:MAL
                                                                                                    Classification:mal100.rans.evad.winEXE@21/157@1/1
                                                                                                    EGA Information:Failed
                                                                                                    HCA Information:Failed
                                                                                                    Cookbook Comments:
                                                                                                    • Found application associated with file extension: .exe

                                                                                                    Warnings

                                                                                                    • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
                                                                                                    • Excluded IPs from analysis (whitelisted): 20.12.23.50, 13.107.246.45
                                                                                                    • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                                                                                                    • Execution Graph export aborted for target CF537GfmKa.exe, PID 6760 because there are no executed function
                                                                                                    • Execution Graph export aborted for target powershell.exe, PID 4008 because it is empty
                                                                                                    • Not all processes where analyzed, report is missing behavior information
                                                                                                    • Report size getting too big, too many NtCreateKey calls found.
                                                                                                    • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                    • Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

                                                                                                    Simulations

                                                                                                    Behavior and APIs

                                                                                                    TimeTypeDescription
                                                                                                    12:47:05API Interceptor34x Sleep call for process: powershell.exe modified

                                                                                                    Joe Sandbox View / Context

                                                                                                    IPs

                                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                    199.232.196.193siy9g3WGCc.exeGet hashmaliciousFunkLockerBrowse
                                                                                                      SjDqoVVmzX.exeGet hashmaliciousFunkLockerBrowse
                                                                                                        https://heuristic-knuth-588d37.netlify.app/?naps/Get hashmaliciousHTMLPhisherBrowse
                                                                                                          https://freesourcecodes70738.emlnk.com/lt.php?x=3DZy~GDLVnab5KCs-Nu4WOae1qEoiN9xvxk1XaPMVXahD5B9-Uy.xuW-242imNXGet hashmaliciousUnknownBrowse
                                                                                                            https://theleadking2435063.emlnk.com/lt.php?x=3DZy~GDHJaLL5a37-gxLhhGf13JRv_MkkPo2jHPMKXOh5XR.-Uy.xuO-2I2imNfGet hashmaliciousUnknownBrowse
                                                                                                              https://media.maxfs.de/Get hashmaliciousUnknownBrowse
                                                                                                                http://synthex.cheating.store/Get hashmaliciousUnknownBrowse
                                                                                                                  https://report-scam.malwarebouncer.com/XcUR2TnV2VTlXT0s0Z0NYa01KSGt3dUtWMWNiblBrc29mMlpZUU1WdThBSjdDdTlRQTVDV1ZZd0pDeWRmUU5rQ1QvVDNiSlBNYWd2bTd0eTRkZW5jT0hrYTBKWHFiVUc4TVZBOGpiNkh4VG9OTm9zNTVUWHNmNWVydHpqbzhIc1llSzdzTHZ0dENVNWRLZy9BbCsyVDRMSGRHOThUWnV5QUxPU0RZL1dPalNYTmUzMTVoRzl5bmk1ZVZRPT0tLUdVYnJkMC9GazI3MWlxYmotLUpFOURyOWkzK1l6Vy9BYTVOVDBVNkE9PQ==?cid=2346401253Get hashmaliciousKnowBe4Browse
                                                                                                                    https://pwv95gp5r-xn--r3h9jdud-xn----c1a2cj-xn----p1ai.translate.goog/sIQKSvTC/b8KvU/uoTt6?ZFhObGNpNXBiblp2YkhabGJXVnVkRUJ6YjNWMGFHVnliblJ5ZFhOMExtaHpZMjVwTG01bGRBPT06c1JsOUE+&_x_tr_sch=http&_x_tr_sl=hrLWHGLm&_x_tr_tl=bTtllyqlGet hashmaliciousHTMLPhisherBrowse
                                                                                                                      https://covid19.protected-forms.com/XQTNkY0hwMkttOEdiZmZ0V2RRTHpDdDNqUTROanhES0NBYmdFOG1KTGRSTUtrK3VMMzlEN1JKVVFXNUxaNGJOQmd1YzQ3ajJMeVdZUDU3TytRbGtIaFhWRkxnT0lkeTZhdy9xWEhjeFBoRXRTb2hxdjlVbi9iSk1qZytLQ0JxRjd4UmpOS3VUQ2lpOEZneTRoVmpzY2dyekR1WlhYOWVteVcrUXg0a2Y2aEU2ZEZwMVNId3R0U01RK3N3PT0tLVR0bDl1WEFUelg3K2VzTystLUxaMkFrZnU0UmJXRkR3aE5NRE9BOEE9PQ==?cid=2351432832Get hashmaliciousKnowBe4Browse

                                                                                                                        Domains

                                                                                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                        ipv4.imgur.map.fastly.netsiy9g3WGCc.exeGet hashmaliciousFunkLockerBrowse
                                                                                                                        • 199.232.196.193
                                                                                                                        SjDqoVVmzX.exeGet hashmaliciousFunkLockerBrowse
                                                                                                                        • 199.232.196.193
                                                                                                                        http://steam.usercommunityart.com/filedetails/sharedfiles/id=319248110/Get hashmaliciousUnknownBrowse
                                                                                                                        • 199.232.192.193
                                                                                                                        https://heuristic-knuth-588d37.netlify.app/?naps/Get hashmaliciousHTMLPhisherBrowse
                                                                                                                        • 199.232.196.193
                                                                                                                        https://freesourcecodes70738.emlnk.com/lt.php?x=3DZy~GDLVnab5KCs-Nu4WOae1qEoiN9xvxk1XaPMVXahD5B9-Uy.xuW-242imNXGet hashmaliciousUnknownBrowse
                                                                                                                        • 199.232.196.193
                                                                                                                        https://theleadking2435063.emlnk.com/lt.php?x=3DZy~GDHJaLL5a37-gxLhhGf13JRv_MkkPo2jHPMKXOh5XR.-Uy.xuO-2I2imNfGet hashmaliciousUnknownBrowse
                                                                                                                        • 199.232.192.193
                                                                                                                        https://media.maxfs.de/Get hashmaliciousUnknownBrowse
                                                                                                                        • 199.232.192.193
                                                                                                                        http://synthex.cheating.store/Get hashmaliciousUnknownBrowse
                                                                                                                        • 199.232.196.193
                                                                                                                        setup-avast-premium-x64.exeGet hashmaliciousUnknownBrowse
                                                                                                                        • 199.232.192.193
                                                                                                                        setup-avast-premium-x64.exeGet hashmaliciousUnknownBrowse
                                                                                                                        • 199.232.192.193

                                                                                                                        ASNs

                                                                                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                        FASTLYUSsiy9g3WGCc.exeGet hashmaliciousFunkLockerBrowse
                                                                                                                        • 199.232.196.193
                                                                                                                        SjDqoVVmzX.exeGet hashmaliciousFunkLockerBrowse
                                                                                                                        • 199.232.196.193
                                                                                                                        sZSXKXOnBw.exeGet hashmaliciousUnknownBrowse
                                                                                                                        • 185.199.111.133
                                                                                                                        sZSXKXOnBw.exeGet hashmaliciousUnknownBrowse
                                                                                                                        • 185.199.110.133
                                                                                                                        PDF-523.msiGet hashmaliciousAteraAgentBrowse
                                                                                                                        • 199.232.210.172
                                                                                                                        http://steam.usercommunityart.com/filedetails/sharedfiles/id=319248110/Get hashmaliciousUnknownBrowse
                                                                                                                        • 199.232.192.193
                                                                                                                        https://heuristic-knuth-588d37.netlify.app/?naps/Get hashmaliciousHTMLPhisherBrowse
                                                                                                                        • 199.232.192.193
                                                                                                                        https://terrific-metal-countess.glitch.me/Get hashmaliciousHTMLPhisherBrowse
                                                                                                                        • 151.101.129.44
                                                                                                                        http://procustodiavalueslive.github.io/mediantime1db1d62ef90e6fec5644546bc086f16336d68481479f56e29285a338fc23/Get hashmaliciousHTMLPhisher, Mamba2FABrowse
                                                                                                                        • 185.199.110.153
                                                                                                                        https://adopt0098.bitbucket.io/Get hashmaliciousHTMLPhisherBrowse
                                                                                                                        • 151.101.130.137

                                                                                                                        JA3 Fingerprints

                                                                                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                        3b5074b1b5d032e5620f69f9f700ff0esiy9g3WGCc.exeGet hashmaliciousFunkLockerBrowse
                                                                                                                        • 199.232.196.193
                                                                                                                        SjDqoVVmzX.exeGet hashmaliciousFunkLockerBrowse
                                                                                                                        • 199.232.196.193
                                                                                                                        rii2.mp3.htaGet hashmaliciousLummaCBrowse
                                                                                                                        • 199.232.196.193
                                                                                                                        sZSXKXOnBw.exeGet hashmaliciousUnknownBrowse
                                                                                                                        • 199.232.196.193
                                                                                                                        sZSXKXOnBw.exeGet hashmaliciousUnknownBrowse
                                                                                                                        • 199.232.196.193
                                                                                                                        v2.exeGet hashmaliciousAdes Stealer, BlackGuard, NitroStealer, VEGA StealerBrowse
                                                                                                                        • 199.232.196.193
                                                                                                                        c2.htaGet hashmaliciousUnknownBrowse
                                                                                                                        • 199.232.196.193
                                                                                                                        E6wUHnV51P.exeGet hashmaliciousDCRatBrowse
                                                                                                                        • 199.232.196.193
                                                                                                                        resembleC2.exeGet hashmaliciousBlank Grabber, Umbral StealerBrowse
                                                                                                                        • 199.232.196.193
                                                                                                                        c1.htaGet hashmaliciousUnknownBrowse
                                                                                                                        • 199.232.196.193

                                                                                                                        Dropped Files

                                                                                                                        ⊘No context

                                                                                                                        Created / dropped Files

                                                                                                                        C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\desktop.ini.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):249
                                                                                                                        Entropy (8bit):7.235890435988568
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:6:auDAOX74KRUDvJIFXnFIDs4KmihrTB/zE92SYz:XAOXknDh6nF+ziVB/zg2D
                                                                                                                        MD5:C9E5B2A6B3ABB7C862DD3FF16B5FE7FE
                                                                                                                        SHA1:8BF7A7B74EFA1F8BDE157F3D5B5B8BC3200F4438
                                                                                                                        SHA-256:C4C79CD5465DF2A533D8D4BAECBEE06315906CA47D2D3ED554A1C8DD5BB4DD1B
                                                                                                                        SHA-512:BF21AEC3AC3EC1126291565AE809C59B87A1DD2B0B8E5E7FACA6785921719369AD464F1F6AD2CD73D55932C426C50911106342216804D8FC0618AD39B12A17B5
                                                                                                                        Malicious:true
                                                                                                                        Preview:Lh...A&...rUQ.X..J..@.A.5......a,.....t.z...$!...[;..Rj.V.^1...M?<.h...n.K;i........f............~.......d..!O&R.Q.d{.l.........s..!){K..'.._.....Zk...M]a....xW..ZV.L.J.E......m...e33.a...p..H.k..EX..b.(6.+.K_!.+..m.....Q.. .#..G1+9c>B.

                                                                                                                        C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\desktop.ini.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):249
                                                                                                                        Entropy (8bit):7.129346962040855
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:6:pUowNkOSxkDDnkd9f7RXbeaFfDywWV7VAvnGB4kq:GoAFSxkDDkj7RLeofllvkq
                                                                                                                        MD5:43B2FFC3B238A3E08BA9D781B24D842F
                                                                                                                        SHA1:709C11AB3E4141B2534CC8C8D017E518705BB7D0
                                                                                                                        SHA-256:D7AA61C21AB03E1B84FAF83530C69317891A7EF47ECB955095CFA5E539CDBC41
                                                                                                                        SHA-512:6E2A791B62401BD915EBF20AC508F0A0A6DEE394109357721278A9F9EA2D4CB6CCD296D4B1E8EF5FB96A93001B342FB4A277F15FF1735F0F65B52A4A5EC86757
                                                                                                                        Malicious:false
                                                                                                                        Preview:....._......!.....m .L........!...]...|j-\.y.....E..&..u{....a..v.}g.#e\.u...y....-.1....k.(..@.Z.W*j..v%....f...O.)..li8.*{.O=2He......JH..r..aT..Hn....:..v.,.l.:..$....Q......._.P.'ap.mz.W._.7}TR.d.....F..Z.......m.5.3.l@PB3$....]2..1gZ\

                                                                                                                        C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\desktop.ini.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):249
                                                                                                                        Entropy (8bit):7.039128514463705
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:6:ABgLwSPkJ6HsLNyyxTHax+XRHKWv2ZvGei2eXx:AjSPkJ68NTT6x+XRqBvG+eh
                                                                                                                        MD5:C94FDEBC1DBA2DD72BFAC1329FC02237
                                                                                                                        SHA1:B10E2046EEEE98D8683D392A055439BDEB8C2276
                                                                                                                        SHA-256:EF43A03ECCBF54B396E33991926C52DCC997BF8C84BA52C3D7B9AC43112BCDFB
                                                                                                                        SHA-512:4BC67397E312B6030BA902E35502C2D4C77CA6F29E534FF0E99A75375EE9FA915E54A2070C82229A2BA244AB1B20E2E74089C7ECAAAEB01E3D20D27609AD6926
                                                                                                                        Malicious:false
                                                                                                                        Preview:KK...^....6."0S..6,F..s..q..@..3....vH....A."E..H.....F....x.W7v].......g..{.S.d.3..8...F....r...(E.oQ-.4.8.W....y7q;.......XD`...o...N4.'"m....a.......)#P..Go..i./...z]e..+......Y[G..X.".{'.....K.....\.6K....F4R,.w.....'....E0*.I.LF\

                                                                                                                        C:\ProgramData\Microsoft\ClickToRun\DeploymentConfig.1.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:SysEx File -
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1934
                                                                                                                        Entropy (8bit):7.643502831787657
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:48:x9MExp3YqLbpKiHSBq282QweKlMCS+LKTlB1djHxO4g:x9MsYqLbpKySBJQwmCSyCBTjHxO4g
                                                                                                                        MD5:FFAFC90E3425F453423643A74361CEEE
                                                                                                                        SHA1:545A7A1B17ABA87271F86D93CE978B31A24119BC
                                                                                                                        SHA-256:5E8471902493F750364F6A4F93EEDD8634900668458F418F8118E79BB2B09882
                                                                                                                        SHA-512:AD48881FD4DBABA5CE20A6021929754C2E12E9C22D4B68A7EF3D86FBF43FD557FC9826CFB3FAC2CDCD16A59B8D73B8B8E8833197252F1D69BCCDD53341B1BADC
                                                                                                                        Malicious:false
                                                                                                                        Preview:.;.@...1)'.4q.. /-..f.|>]...O~..d...Q..2.Lj.bc.J....y]R.~....W...P.'.#.S....{.Q.... .d|r@W...C.Vd.?d.F>.b..E.......^K.....T55...-..\$..L...*....i...r.=.u.*...z.`7....P...`...7I).....H.1S..dRdP.e_.........jM.&M...8US#....W...P.'.#.S....{.Q...r.#|a@E.N..C.Vz..?$..>.b..J..._...CK.....S5"..a..\~..L...*]....i...r.=.u.*G....z.`<....U...l...a..{.....W..g... ;).a{...F./.....8..?#..t.P..JS'....W...P.'.#.S....{.Q...m.;|~@G.v..C.Va.?l.G>.b..........sK......5i... ..\(..L...*U...iS.]rP=.u.*C....z.`........!.)Vsn.+....jM..;*..AC.o&7.C..zJ.+U6#a..U.E".....bS....W)..P.'.#.S....{.Q...?.w|t@&.V..C.V\..?O.G>.b..W...F....K.....51..b..\"..L...*s...i...r.=.u.*...z.`6......5..x..g...|;.m..p.8....'..H.....cXul#/m~./..)X...S#....W...P.'.#.S....{.Q...q.k||@G...C.V*..?j.R>.b......]...DK.....U5...{..\v..L..*^...i...r.=.u.*...z.`z......5.Il..R...;.v..p2q.l.M...o]F..$..`..........c.2...Sb...WQ..P.'.#.S....{.Q...v..|3@..@..C.V..?j.V>.b..L...w...

                                                                                                                        C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\DeploymentConfiguration.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):878
                                                                                                                        Entropy (8bit):7.743943407173421
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:12:ZAqMIlIdTJnF2PmPbWrUu5+NqtbSo9I5/BmoFIEp4HcvSm2tS5p6D+GxrW0mZrNn:ZAqXE9TQUu5Wok/Uc5ZvSxc5fZplJ8BG
                                                                                                                        MD5:9D876D8849F00D6D46C4B409C4DB2529
                                                                                                                        SHA1:505690E046F66F1328774459EDD6290D0F0CABC0
                                                                                                                        SHA-256:610FC4BD983FC4134C64A31BE78C9D1A207F532173E7B0598CC929E796D82420
                                                                                                                        SHA-512:7B51C685E80B0C8C7A17367550ADD2D8A72377CE2D9FCBB533CA56627FACF5D7C02AF500EB12939BCF3D619E916949D20FA622E41C1972BC61865802BEB3B3C4
                                                                                                                        Malicious:false
                                                                                                                        Preview:X.$B.7.-..O.?.G.Q.Z\.\....!..:Ye...a.S.).m...a.........wr....ld.b..!u>psU.....`..u.L.4.g.FQ...:.6.`ha...."....r..(:J.A..w.c [.#...`.RtG.y.#.....".O).a!...}...7..r..Z7h...[7...?....!.k.bM9..V.T.c>.....y.../.75..Y...f......ul....,%...).Rme^.,c.....a..{.Z.|.%.....@..,.dap....r.X.."..87F..H.Q. ...g.H.>.~}=x>........l..Y...en..d...d.z..Z&%...J....OS..].v..)..!...|tTS})...@T....v....Z.......kG....wI...%.Fl*G. .......`.2v.N.q.g.W.G..).<.o{G....|.K.$..&&):.Y.s.+Z..w.].i.S.L..........7..W..&"...y...v..p..{.5.L.Iy.c.$..hHQ..s...:..=k..y.v.Y.c..a.B..UHB.2a&.....wK....Sx...?.vp*Q.*u.........>J.E.6.f.\Y..U..w.sza.J..R..O..*..~J5.-Y.`.,l..a.....]}=d)........3..S...b}../..X..q..E}}.m.(...i.kl..n.CU.R@.....{j..r........s,jl.......2i....Vy...#.Uw,F..e..X..m.9t.i.=.|.GJ..Y..k..Be....~.D..,..{}.:...=.+i..k.L.#..-gB,......._.u*.....w..nK..

                                                                                                                        C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\Manifest.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):6924272
                                                                                                                        Entropy (8bit):7.973183214789623
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:49152:roKUMPFZxa9GmXx1zn1lYbKcWCayz0RfbUd9ydCzjAso1fUoN74X/3jIMfXIlHt3:U4qtrS/2cRfXpLzp0ofggFlmJ3nPJ
                                                                                                                        MD5:A5DB4B39FC1A21D830A17A98E6679C4C
                                                                                                                        SHA1:200DFE780D1F99215D4FC8FCBA22BB65AB348BCE
                                                                                                                        SHA-256:CEFBA9CF917894CC155E15C513FE04F6B32F8C87DE2B4BE35419E159B5CB3A58
                                                                                                                        SHA-512:34849935ED550287AE09156F381DCC4046DC4B36DF0B1F77C22695C46BF765622558805212577AA4362DF2D9A54214D6B11221268B0413613F3F95D33E393FB5
                                                                                                                        Malicious:false
                                                                                                                        Preview:h..M..m......}...!ar.b.. ..Y.....|7..GD.!.=..S..zF.L.B^.NT.K-.?..1.....GkF(:L.vlPnN...e{.+.....\.Z..?....`c"..YN|u.y./..+.4.....T.....s^.G.&.EL.{..mj.."Ge....s?..`..u.....E.`Hm.,...pF....I.............}][..(Tu5..@'.I4.....i.I6. ...g....ly_oiD.ygPi.....y./.......B..o..ba=..v]<y.u..:...|.u.O....S....:..Y.j....jOF<&.t_+..@.4)....l..j.......{.!...`..3.*. ..*4..J4s........".._....\v.P....R7.t.^i.h...;.....+*S %R./hS#...^.y./.......B..o..ba=..v]<y.u..:...|.u.O....S....Ot...4..../.WOe.=.C..V.*)....t..q.......Z[\k......S.;../.)...h[J....U..b.*.........gZ].w.Z0.<..3......8<.}g..-;.}^.._#y\:..j..A..k....8R...U.+7.+..g...v.}.R......Li.pJ.v.p....a7.sw.nfu....d.....,..\X.Q...VW8}......?.~.I..h...0..W.......F.|.<;..]i.;R.=..>7)..p.i..f.........;S.p{W:..a.Rug...V..d..k...s|!..d.]|.q.j...a.-......T.E".Kw.g.2....>.3hw..aV_..V..)..d..79....Y.q.J.6.z2.....D..~?Nt.[.,&-..57......?W-9.5.K.P..8.w.D'.....h.....ziY$9H.zg......e>.g...Y..Z..a....n..wF,H.k.

                                                                                                                        C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\UserDeploymentConfiguration.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):878
                                                                                                                        Entropy (8bit):7.759638271086075
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:KTbs2p999z40IiQ1WkOlNKJFB1643ixEV0j:KPRf9/VYFBEeG
                                                                                                                        MD5:D061F595D9052640D2FC1DD522E7E689
                                                                                                                        SHA1:05B31A21C017A0D4FA54028EFC54798415B2FFA1
                                                                                                                        SHA-256:BA58FAE011994DA38EC0A548908481A410F105A1B7231A3F5D0FBCA854292B4D
                                                                                                                        SHA-512:2259B81F5D2F93808DA850B7023A32FCE8C9E1468D83E7A6BB0E6B1C5757956B4F5449C26E40A3B604CD41128376D76199929AD78AA144F2D6DB4602673CCF72
                                                                                                                        Malicious:false
                                                                                                                        Preview:.....0.Vq..d..h.........?.Yi...a..M.&A.j.....o...P7.!.,(t.,....S..M..%...].!...N.nA..\.....8...h...4.,O...S.h..g....>.Gq....=.X...[......`.s.L......\.-/.............z.....B..=..K.~..uj[..K`....J&<R.....=.`^$..../.%M...>j............n....=.~"..G.-G..0.........c.N.:.(F.....8.9%E.....KfB...j.......@....'.E...%.....t.7+..n.....t8..m.....N]..B...}..:,t.....S.....0.^vc...g.x.J...j....f5;.0....T.....b...$.r>..@.oa..}...E.9..9N..9.#\.....6.>6P...0.$\W...w.".....G......R.S......f.$h..d..... ...@...J.S.4.......f/d..D..C.-M..tj..Kos...kJ...w.C.....z..f$|.,....\.....x....2.x4.S.f.E.q!....>...e.[.h..?]..MR...82C..hi8~p...l......S......0.S...`'.....v.b,..^.....6...{....O..~Q.:.<<.....x.!....V.y.>*.nV..m`.KG....>}.=.`)j.i..........d....%.|$....NE..v..!..+....f.W.;..be.....4.#9B..m^.\_..A.......Z....5.D.../....O.....].s.M..U.

                                                                                                                        C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\UserManifest.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):4352478
                                                                                                                        Entropy (8bit):7.982104931297916
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:49152:fzRJhX6hUxouf5ws/2fZEvw/pYfjWcKGV42a2yyiAgxIEvZBtS3v7c/oh:fxX1f57CZw8afjWcKGG2wzUI/oh
                                                                                                                        MD5:5F2FFBB8F5354A4C26F9A39D922833AF
                                                                                                                        SHA1:6267CD397201469FB7D6F3F24728E2F5D14FE9EB
                                                                                                                        SHA-256:6D6AE2E0039585798AFDD9FB4229DA1C0030EEDD0B9CE45816E7E78C5EF9FC7F
                                                                                                                        SHA-512:D873133B0C3DB4A32844F647C159DC69D58B9ECFADB5F5E46E183F5E7479533C2E4FBFB857B9096843E03080E040E7F2A5A71DF0350B08F30FD40608D7BF655E
                                                                                                                        Malicious:false
                                                                                                                        Preview:.(.{...z.L,.c...b.W.)...k.e.."vq....wg.,..+DZ..'....F..@bb.w.>..!..%U....]X..t......M:.......;.t..4.m.`..`.AC..S..{eH.z..o....=....i....L.7s.Q....W?.N.I$...U..G..^...I.&....8:,().....E&`S..N^.Q._._'Y..~.+.Qo..rB..:Hz....LMf"t..j5.x.8../..}...#J..zR.......d......-.&.T..5.u..o./Z...Yv.f].1..9+%..~....v.V..., o.L......].P=...U...Tq.U....66...kf{4y...-k8...~..m^pr.j...3cmwU.g............u?..)..Rt|.m.:..)..)Y......]..%N.5....x...I...i.3.YcU..#S.c......Ar.gK.(...6W..*..Q13.M...Sq.......}...N.c...T...X`O...N.gr...%t?}........#.H.AS/.o..j$....W*.y.....>..d....W=.^ ..n{.m.t..+..:....8...t..X.....g...W...8.w.Jo]..e..b..B..m.KjpJ....%71..b...<e....L.7s.Q....^4.L..c... ..Z.!N#..X.:W..."tf%...7..k&JLU` 6.).a ..( .....],..G...s7.?..J....;s|.;."..+..g.....x4..{.......P%...6...b.a..#. .h..(..H..K.@&:|.4..r{...|..%.c.J..V.7j.Z...._n.c.^=......z.#\...yGud...?na......@..7.j+...q.V!%4[#...S..(...p.F.l...?x...wc.$.y..>...g......y...e......L8......o.+..?.6.r.N(.....N.

                                                                                                                        C:\ProgramData\Microsoft\ClickToRun\ProductReleases\AAD0B0DB-711A-45EF-A013-BDD28531EC08\VirtualRegistry.dat.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):10672664
                                                                                                                        Entropy (8bit):7.820335242420768
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:98304:og9mg4oMcuOKy5Ope2DIcOVcOfX9uZM2cvK+XiO5a+:1otoMcvswcec4XQZM2cC+XiOj
                                                                                                                        MD5:BF3E1EC183B80DCFB50E720508EDB39C
                                                                                                                        SHA1:F10561E2434E239F86FA33F307BDA2DD6505DE94
                                                                                                                        SHA-256:FAC22AE320B2C7FC5268993667637ECDE9E5737D9B180223A626116DB16A27B2
                                                                                                                        SHA-512:80A75F03B8F760EAC684204D65E9E0829DE88304F49A0448273D879C42DEE71A1919E65656E15197551B946F2513D1EC10EE96242838832C19B452ADE7B3E708
                                                                                                                        Malicious:false
                                                                                                                        Preview:t.S.z].....0.~'?F......)x;.q/....&...#.wtY9...-..z,.iG.h..PQ<....iz'..g.v..f....jb.Ww..]u.T.-.1.r.......<.fB. .v...Y...D...Y..id'..#...D...bDt.r..'V,.p...~....#8{e...W.;.m.....T.uR<3.hI.)..U...J.u.k........?.x2.c>.A.n^..!.h..QQ<....iz'..g.v..f....jb-Ww..=..U.-.~. .......<.fB. .v...Y...D...Y..id'..#...D...bDt.r..'V,.p...~....#8{e...W.;.m..n!V....Q<.V......o....s.M.G8]....cj.a...<.B.7^..!.h..QQ<....iz'..g.v..f....jb-Ww..=..U.-.1.r.......<.fB. .v...Y...D...Y..id'..#...D...bDt.r..'V,.p...~....#8{e...W.;.m.:...i...Dq..8........+l.._....die..|6p8.z....z.^..!.h..QQ<....iz'..g.v..f....jb-Ww..=..U.-.1.r.......<.fB. .v...Y...D...Y..id'..#...D...bDt.r..'V,.p...~....#8{e...W.#b..R.b..s."X.P..8......Mha.Z.0... +`..0.b.....v..G.O.7.QQ<....iz'..g.v..f....jb-Ww..=..U.-.1.r.......<.fB. .v...Y...D...Y..id'..#...D...bDt.r..'V,.p...~....#8{e...W.;.m.....^n8...(D...U)V0ya$*...'..T.n.......%Pe.:'..^..!.h..QQ<....iz'..g.v..f....jb-Ww..=..U.-.1.r.......<.fB.

                                                                                                                        C:\ProgramData\Microsoft\ClickToRun\ProductReleases\AAD0B0DB-711A-45EF-A013-BDD28531EC08\en-us.16\MasterDescriptor.en-us.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):49408
                                                                                                                        Entropy (8bit):7.935589047605588
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:768:3dZCyh5l/xA2AE2kfkwggLjz/xJLdOWPwNGPkXu3WYyHfkep2fXDktx:2yhzuE0wggL7PwYPkIy8s2fDkL
                                                                                                                        MD5:672112E7820996002A1089F3FECA5FFE
                                                                                                                        SHA1:7D4E6AA4691891C10144CE8AC086A732FF08D043
                                                                                                                        SHA-256:FC95858E05570003102D389F2F809BE5F423E2D5BB628D1803C9AC5D4A58523E
                                                                                                                        SHA-512:0ED265E279491F621EA1C23F165D6F24D247F9BE01400DDD7EECFF2043EECBAF7069C9EAC8023C3D8B9085F5A027F5C2AAD9A5A6832E931EA5CF16F8E39726CC
                                                                                                                        Malicious:false
                                                                                                                        Preview:</;.|/.0....Ew..`.<f&.$..@....."....=+...>...3....r.M..#"w....Pot..........2.]!..=.SM3P....eO.3f........0W"TC...u....l..K{QL.....d+.ug;.$O>.Q..K.....)...........W..$."..[.J|.e.j{.*......d3H.{...H0.O.;..U...>....A1.g....G...M.w'.S.Gfs..........*..l..e..R1.....gP.i(..8...../.i.a...zL...#I..?.\...2&.3R..$\P....S....@`F.U.......V...7.....O.UI.p. .^.c.y..6p"H..Ji..}..T.D'..@2H....N..M.b...r..I...$..N.`.j..........=.A-..&.].b.....{1..Jd..}..O...2W=U..*.xN...bI..*.......#G.-.X.aBX..R..\....u[............... ...7..=. .*.m.2.p.k@.D..=8.]...2..Ce..Q......f[G..W.}%K..".....Ao&....e...U.<..t.:.A.?.....y}..z..}..?...#.1B..a.;.....M.D@c^....'k."...@0(..,.S...A.,s.B............e.g..Y.@z. .4&@..^..]....Qh.eW.Y.!(.(....d#|lHp.:..m.).4.bR./..Z.....$c.........,.9b..t..L>u...V ...4P..}..@...|z^...K.Z[...&..?5..J...%|.?W..k....G..\..Wsu[.D............e.{...Q.Fx.>...~..&.t4..O2....k^W\..1d)>.u.}O.............:.a..>h..S..Zg...A....W.P'..,..^tK...vF...d..}..O...m'5RZ...h..

                                                                                                                        C:\ProgramData\Microsoft\ClickToRun\ProductReleases\AAD0B0DB-711A-45EF-A013-BDD28531EC08\en-us.16\stream.x86.en-us.db.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):608801
                                                                                                                        Entropy (8bit):7.999665289832932
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:12288:42SAfRiWKO3QWTn5ZzigqdC16hHswku8O2kBpMJFw2:42dF3AYn5lWs6OkBWHV
                                                                                                                        MD5:FBB3FC871ACEC7141D5C1532106F6AED
                                                                                                                        SHA1:B9B351786B9D02CE039DD67F0A57240BF5FDD339
                                                                                                                        SHA-256:551F95F648DF50B705D5CC8A4DA32FEED74911256736B6D892DE800E0F9AE773
                                                                                                                        SHA-512:8465174CE786B57F136EFD40E71A94657CB2D0F0F562A5E8295022145F786D8BDD5F66BEA1912A525C250DC020041578737D8BD7EEA70FA02C023EF11A6D3D73
                                                                                                                        Malicious:false
                                                                                                                        Preview:..........8"l......f.......S.*....)...p.o.(N....k......$QF.o....}.g.I.....:........%..6..{...&\V.....^+.~X..,7.vi....q...x....V.|.>....F..g..K.[.mt.5.MZn#`)..f.;.D..L.&..5..R/I..1M..7..i....lP....R|N.......vlq5....,.i..Q]....6..[$oL!.b...<j|..... ...&7.... J[...?.....;Dj..../.F.....}a...'T..6h...X..s...l.`d...)v.G.X..!.....-..M...U.O{-r...x9...Ml..+.g.....Y.....j.q`.h...uT.EA.48f.....Iw.....{~..c..gr.....TT.,.k.$.nxI.`..=...+b...y...6....W.~s2V.#.,...&O..t..6....N7........|J...7..OL... ...u..!?..k..l...fFuD.D.._x..D...$.4..G.%.t$.\..r|....o..<..*g[mb?.9.[DKl...%.>......../...rp^....&G...}...?+p.3...N..m..W....9.M.<+..<..,R09.C!.Ti.,M.*....F".%gx#....u..<.+..$.O8........j...1Z..{..vn.....1..t...8wG..9..=.^.P..Q.....!|\.Z....=.....7.g..#J..'.....'>...[..An1F8.=...n....}..le...*...K;...J...&y..3W....)G......F...#...[$..0.B.(.....a.....a.&H^9'.]...Bu..q@...B...im......M..3=[...b..5...V.d..('`&.z.u.+....8c.6ZO..[..t=H"^..*t..vS.6.....&#..)...N1.

                                                                                                                        C:\ProgramData\Microsoft\ClickToRun\ProductReleases\AAD0B0DB-711A-45EF-A013-BDD28531EC08\en-us.16\stream.x86.en-us.man.dat.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1288045
                                                                                                                        Entropy (8bit):7.79269652709404
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:12288:anHmmZNZBy7qttAZ5uokryI6TFfK9fQrdDcijEcT/WWU/tWD9WZNw8mib/k0H4x6:UG8Ot5BVT3AxZNjcMzlf
                                                                                                                        MD5:07A433E36244B6F3B23C8AF131ECD499
                                                                                                                        SHA1:F75525619E04791D9707099856041D8FC98C39A8
                                                                                                                        SHA-256:023694D353FACC0B2ED1DD231020F2ED9A827EC81162E9C56A9797C8DAD327B9
                                                                                                                        SHA-512:D53C7FF0E845078A84211E5DBA8BC89CCF2E3C5D03C86A1EA629B462FF473708DF4F85BD3DD3BB3CF0A4C84DEA1EC3970982A61A4EA479BCA10D256192245717
                                                                                                                        Malicious:false
                                                                                                                        Preview:-9[szvVe..........i..\oA...I8...(..mJQ_..B.m*...]e..o.v....3]...2...U.....O.".[.._.Sq.1........N=k.}$8...ra..b.=x...3v....\..O....Q....9..F[j}a....WR8..>..d.._n....X.*wSjl..U.g...]9..VjT.W..)h5.....).A.....Z.....0%y..-n.vm...W.....$.....".. .".Y.._.Fv.C........(R...!GN...D...4.T.......E..!....=.g.e..+k.N.....$.QG.._..J..q......rYS...!....u.%.G.......}..=..v,........).Sh.*s...n.F....3....$..@.._."5.".Y.1./v.1.........N4k..H$-...rs..b.=b...nv....6..O.........9..F[l}a...QR?...c...J........N.*YS.l.-+&/...H.....4.3.l....^>y...i.ez5a.X).)V.v.+...n.v....3e.{..$F.&....kV.G.h.._.F .X.......!R...!AN......R.......!...@.......=.g..o..+..%....$mQT....J.._....X.*-S@l.{.#......C...l;..X...c.h.:/.T..I6..j..'.....X..n.vl...P.......@..e..5.".Y....)v.1.........Nbk...$....rS..b.=@...Bv...T..O....n.*..9..j[X}M....iR....\......_....X.<^S.l..k..5#o&..........f...k..D..L.E..<p..m..@m.:.M.n.v....3e.`..$U.6....kR.U.6.._.FB..........#R...!.N......S.

                                                                                                                        C:\ProgramData\Microsoft\ClickToRun\ProductReleases\AAD0B0DB-711A-45EF-A013-BDD28531EC08\operations.db.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:modified
                                                                                                                        Size (bytes):15471128
                                                                                                                        Entropy (8bit):7.985446267672888
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:393216:mqRMtgxs8tChUtrFaSdeQlHUIvv/LG+84Bm+OwJj/s8x/6d:dsmCIBaGEI8+3blk
                                                                                                                        MD5:D0B806408B9AE46884D54EA36A476F74
                                                                                                                        SHA1:B2741CF8843A8D8639463B23B41B4D6CA6B4DA63
                                                                                                                        SHA-256:E58F0E2550F4AD213003DE9BF1752BF97F9B3A566EB16954F594C94B54F933CA
                                                                                                                        SHA-512:137191F9B81F7AEE03FC6A4780106F006B2CB0B70026137560A753AEC7705208594926EAFC8F5AC34B1E030977ADCA3A749391A5520A626671B62153145044AF
                                                                                                                        Malicious:false
                                                                                                                        Preview:.;...@.-....v}*.5.gdn............:..4....x.4.u!..d~uB..Ju#xrC.%.y.W.....np.c.G..+......{<?.~..p.._..^m..?....A.}..".|f...t..........E.NF..D.mN..I'..|........]E...t..x......\..U6X.)@..4.!.D.,|p..qk..#....FL.}M....N2...h.B..?$l..qh..d..........o....=..)..p.._..^m..?....A.}..".|f...t..........E.NF..j..K..I&.G|.......:..K...y...t..+.r..&bs.q. K..z.Z..]......B.)qy..7.......p..9J..c.J...#.....oq...C.G..+.7......%<?...p.._..^m..?....A.}..".|f...t..........E.NF..j..K..I&.G|.......:..K...y...t...CC...%.yk...&..X...~...;..T>..R..a.}..1VY!..9J.>C.]...#..n.......&.&...B.S......Vc...n....:..Iz.............C...yZ.. ..Z..Z....|6.>'.5..k.V.c...'UM.M..c.....6..!Z..WA..8X.&..l]...p..Y..E.X.,.t7.....P...G.@:...7..ee..>.f.|..*..;4...c.....~.{......k.z..F....+{..;...q.....)..m..23U...;..O..6....Qi..'.J...._.t..9ADJ.T.......,.........9..k..c...=."4.~...?.q...x.k. ...4m..N...~Z>ce..#.8.m..o..;....j.Y..<.7......IUK..c....1p...=.zW.....5

                                                                                                                        C:\ProgramData\Microsoft\ClickToRun\ProductReleases\AAD0B0DB-711A-45EF-A013-BDD28531EC08\x-none.16\MasterDescriptor.x-none.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):49214
                                                                                                                        Entropy (8bit):7.936091761707732
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:1536:YBrlULbsyEByDY/UG2fiRi80Bw9RxPDA7oe4B:2ULbFEBcY4oPPDA7D4B
                                                                                                                        MD5:0783CCCA1A5F2D807777D2883C681B55
                                                                                                                        SHA1:D53CDEEAB197C920AE9E44C8BFFFAD0C9E576EC7
                                                                                                                        SHA-256:182FB70BAC07EE9F45A05B381E07ED7D2DBF52511F1E870496E748543D4C12EC
                                                                                                                        SHA-512:7F729555952D2DB61074A587D2C5EAC32902C9809DE3B7588DBC696B3C61E5AFE4D302703F53C86791DE27160024A00DE6D74E2FD069953A1298378FC0A00DF8
                                                                                                                        Malicious:false
                                                                                                                        Preview::GN.T..=....4O:8....+R....^_..a....9R.,).;.K....).Y.P.H...z3(.....z...kn.$..PG-...3.,bW.U........(H.V.%.+{....3.o+5...B......f1..K..Q..SD>.C>h...c.s......g.U:....S..w..k...>.W.. M..G.k{.8.U.^.._....p.......q.7..Xl.!/A..D../c>.E..l...go.%...`...d..8..r..1.....9N...+..`<....<.(Jo..H......R"g....S..=;[..l<@....w![...m.....H.@..8...... ....f.?../..6..T.N76!8dOK..kFt]r.....1(H.|>Z.wh...'`%....e...DU.4.e[!...=.})..X..PA....nZk....:.4z....>.>i!..O.....Q8v........5j<.G/.....j6......(..h..].Y../......y......g...[d.-..Z...E<..X...8C....5..C...fHp.]....Qz\1..R..@....*<.g..M.x....;.k9..Z../<...DZk..v.)..:{..}.m:?..^.......kC..U..L.@ps.+F<\...N..N....{.=B.......j..k...>....&..........z...s..._]C..&{.........5X.1..F..h.LdH...K...q....,q."....C...t..+.....pV....nZk.......c.....}..js..JN.....wv.....L.lY%.I*z...XN6W...p..v.......j..k...>.6..(m.4W.;(...=+i.....J|.0T..h.y.....Y.h...AQ..{f,p......Y.....:.]...l6...,.89[....t....KDF0...j..a1....<.(

                                                                                                                        C:\ProgramData\Microsoft\ClickToRun\ProductReleases\AAD0B0DB-711A-45EF-A013-BDD28531EC08\x-none.16\stream.x86.x-none.db.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):2377177
                                                                                                                        Entropy (8bit):7.99983579462046
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:49152:bM7uradCZsw+AIWTjeSr/smBvrW6gkipR17Id+uQ+DVa41huS8Ai:bM7u6CZ+VWTjeStPHUuQil1USO
                                                                                                                        MD5:C8B2460113A24C7E7BD30C4C28A2A86C
                                                                                                                        SHA1:615F9E22E5795A8D10231BD6F90AA3C6F297DD6D
                                                                                                                        SHA-256:1D1D9A6B0EDEC87659AC8A29DAAEDCBC6454D36AC9411342199F220761CEF132
                                                                                                                        SHA-512:32479FF39F0A7BC3CD4344AE0BC2D1EE3E533988BB59EE401E1E1FAF1834405FF5479F3327F86D7BA5EEE66197C81BE4AAE50835860097EF1D4504EEB846A631
                                                                                                                        Malicious:false
                                                                                                                        Preview:.@.....V<..8...w).?.9.. .:`.z...y=.....r.'..;.my9.,h..K.'.....l.0w.5_....}iqN....^.*%/.O..Z..oS..CoL)a..A{..[...PH..K..<K.CW.G.....}...|B...z.......o......$/'..C....\ .'..Y.....p.m....._...N.N..T..".n.2..n........N.........Q......XG...Z..EA..S........c...8MWj`...%......vz...3.xPg.E}R[.Rz;w.,.X.l..X....+.P.Jwj......pJ...t.oH.B..{.8e ...D.2Ba.../.'.B...1B...I..*.Z..X..S3(...aG...h.U..>$..@...%%.ES..I...c[G Z...z...._....[.&o K,.....Jm]..D..>w.k9...#..=hVg.C.[..y>.T....[..%$.MS./#.wo"er]9N4..{.]4...........4...W..d.|.Q..F.kC.C..].Z\.Wu.A...!...E.+s.~+.h....ht.T.<&<..oj..}Uy...{]............u..Q&=(..}#...^I..;:.}.x1..BY._]..'.X...t15.$G..H...i9..=$N.U.z...*vu..iY.._R.......ny....d...Y<..)-.}[[...az.ZnN......L{..V.kU..@..".......m#K..z...}.9.......u.e.~.I.....e...k.$......x....D.....h..;.$.@+2..D.e..md..\F.m.,.H.@. .?.U.m.....LJ.(...^V~..v....A.....C..0.].?%......q.D..7^.nX&....:.$....wY..F.Kq..Qw..=Yt[.;.jM...C.8.\..(..-$,.DM.....o

                                                                                                                        C:\ProgramData\Microsoft\ClickToRun\ProductReleases\AAD0B0DB-711A-45EF-A013-BDD28531EC08\x-none.16\stream.x86.x-none.man.dat.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):6080932
                                                                                                                        Entropy (8bit):7.761995658247673
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:98304:oNJPfFLdemjBrfJqeHQxi1g9zq2YyZPpwTX:cPfFLdeUBrflws1g9G2YyZPpkX
                                                                                                                        MD5:045435B4DC12EB9878BC4123A18139F7
                                                                                                                        SHA1:52AC9CBCA2F96FC7B69FA16D53CAE1E9F359AF42
                                                                                                                        SHA-256:8E9581F633C5B70C1589B9D73FBD543D0768456A47E211D62656BD8C1D32E859
                                                                                                                        SHA-512:84763EAA61B1F3A596E406ED2A8EA7895334ADA20D6BBBB62D517CFB909C37DC2ED1AA1E692462BB62F2DAE17D91656B04601C74D2DA4843DC688C5B5509BBB8
                                                                                                                        Malicious:false
                                                                                                                        Preview:.7_.wN4...b....:r9.Ar......U.7.ytT...;...T%...".j.."..m..WJs...0h$.&..GcY...QE.,.....'.....^V....u.M.D..`j....f.K.....V[.C..'.. ....n=.b.IYg.%.(. ...;<'^.`..i^h=..)...f.s....<.`.+.A.9...^2.U-....p....; .B...!...=2...b..8.. mv.;J^..._....~!..~..O..._...q.'..9..^V....u.M..M.,......%..O...8j~u...hw%T...r&|x..9<?.h.I.N...dYt-n.s..g....@....V.C.(..f..W.L...BK....5.fz...M...MEJ.O......kV......].?W.s...0..&NY+cN..b.h.,......<...nV.A.3.|..M.,D.....%......ej.n..h.% ....T=.b.IHg.%.(. ....<.^_`E.F^x=..8...f.s.....T*w.0........k..:...{[.2H....)~.,P..#6.>0.....=m3.gJC......z~?..~......D....'....^?....u.M.D5.Xj..Z.........Vj.u..@v%O...Z&ax../<..y.x.R...dNt?n.s..7.Q..@........u.3.+.....V..N..5SB..?9....Dk...{.P...7.....L..G...5.6W|s.0...&.Yic..b.h.,......F.~...:V..H...+.-M.,......%..r...{jzu...hs%I....&^x..;<....[.Y...dTtsn.s..s....@......t.....j_..C.2.i.f..2.).a.).9.....e.!......k&..+.":..m.$W{o...0..&~Y..~......p....'....^3....u.M.D..Xj....g.D..

                                                                                                                        C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Access.Access.x-none.msi.16.x-none.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):93204
                                                                                                                        Entropy (8bit):7.719525472790393
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:1536:qXMuWnK7pZw19zUCTO1L+/L8+qtU+/ru9G9SAxUI9Xeoi+wYQAnPRRO:q1WKdy19ICC+D8+qtU+/ru895SI9XTZK
                                                                                                                        MD5:7E40FA0B30CF844D5695881B232B7CE4
                                                                                                                        SHA1:95ECBC17BDC062173159EF61E05345E9EDB2C0E8
                                                                                                                        SHA-256:84E2BFE172A0A211BB78D281976996A16F6768B576FBB5F126FF8234794870F9
                                                                                                                        SHA-512:860950BC55E35433C42B27A9898EA700FB7B18C101B0ACCB5C771B9A5B190C0D33A7DCE2144D050245344A8923FE154E5AF7F7A02C3B044F1F6FD628B0EBD6F1
                                                                                                                        Malicious:false
                                                                                                                        Preview:.F.{<..\.Ou.8......b..`..@?...4..W.s.W..u.........z...W..h=.7KW.8...C|~.........,w. ......y.....1.CY..)4...c.p*..`+%.G..*].ID.x..p.......-2.....j{q.y..`.I..........Q=.......H....K!R...D..B...J|."......OC..zW..).j3.Q.6.W..!=.7.W.8N.HC#~...Z.....>w. ......y....E.s..Y..w4L..c.pO..`+%.G...*..TD.x....L.....-+.....-{)....`.I........./.@=..@.I...K.C(...(dp....Ec.;...]61E.#r.d.f..<.6...S...6.W{..=.7WW.8...C`~..........0w' ......y.....2.NY../4?..c.p...`.%.G...*_.&D.x....D.....-6.....`{?.L..`.I..n.......J..=....c...h.n.9Z$.M.`..... .......4..>#...T@...Y........6.W..==.7.W.8N.UC:~...].....Kwl ......y...A.i.fY..s4O..c.p...`M%.G...*...D.x...._.....-*.....l{4.Z..`.I..r.....<.Z=..\.O...h.G.?.rp.r...b4..u./.g@.eHM.X.....P..V...v....6.WV.d=.7CW.8\..CK~...+....Mw. .....y....A...cY..j4>..c.pI..`_%.G..*K.4D.x..B.......-{......{!.m..`.I..7......9.P=..X.U..+...^Fq.,.V.L...M.F.e.'.cJ.&./i.b...(..zY.c....6.W..2=.7dW.8;.+C]~..........,w. .......y.....c..Y...4/..c.p3.

                                                                                                                        C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):23356
                                                                                                                        Entropy (8bit):7.68854926169768
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:384:oePc2zCXm0bX0kxwgrMhmr9Bp6WwtNFzqbR52KvIHk10mZP9lJByA0lMn5+DcK9J:vErXfeHmrVDYFaRvIE9DByrq2TPZWkT9
                                                                                                                        MD5:F951EDB9C26DACE95959FA178CF1225F
                                                                                                                        SHA1:877C3D86D211DD4BD6DA0F61BFDBE55C64FBD60B
                                                                                                                        SHA-256:994C93F312C9BE59DD608262CD3AF5093CFB6EDD7BE3997B3FB90B5D18D4726C
                                                                                                                        SHA-512:BE42458BCFB84E09EE12DADE4CA5CC149BCA6D507451FB544DE42005D8DBC79451193D0D81702D3F15CE1769A1E03D00A4E06C13DBC8FE1677C73D82F906E80C
                                                                                                                        Malicious:false
                                                                                                                        Preview:e......j*.#.....v...#..t..q[../..."..h.*.@......e9.8..... .}.....W8o....#.............l...[.$.V/-...~:S.`MM..]+....wXs...`.\. .g..2......B7.f..&$.+...>../..x...*.7g..j.ip.g).xGs..fr..I.v..R...I.\..Dl..1c+..\8G|.....C.y_vP..'%.r.].Y..8.....|.......8.....m...[.+.F/x...-:..4M..W]|.....Xa...|...S.8..,.....I.f7.f..?$.+P...>{.k..x..p*.7....F.if..).x[..7.Y......W.H...5.9..}PVx...*~.U.8.X.........'Y.:.....U8<....?.............W...b.:.5/=...i:S.iMa..]8.@...QXN...#.M.X.$...i....e.A7.f..+$.+....>c.l..x..M*.7\..o.iv..).xeF/S$.../......E;.eb.Ih{(z.H....X...,..z;..4....'u. .....I86...............R...`...N.E.%/....Q:c.TMv.(]..w...oXx.....!.S.....O.....e.]7.f...$.+....>,....x...*.7@..d.ip.>).x...=...Va.X......H.A.!g..=.\3.0.)v...0N...rX...'z.$.....^8~...........:.r.......;.i../<...i:N.aME..]q.....PXR...o.M.[.6...t.....O.`7.f..$$.+....>..2..x...*.7a..q.iq.x).xY..^.?...,..J..L._..F .jb.5.."..=.@....W1.4...].'p.#.....T8=.....s.......\.....W...b...J/....z:U.wMP..]5.....MX

                                                                                                                        C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):238848
                                                                                                                        Entropy (8bit):7.695267939431234
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:6144:NY2/tAxISzCYEMvoNEqkfNj7hp3VlyA7j537vZVQ:22lKKMdrfNXV4A7jt7k
                                                                                                                        MD5:F5D287ADD9A9AB848A20F3C2AF2574EB
                                                                                                                        SHA1:21DD5508075F263ED5E9D09B56ED4BFCD0EA7664
                                                                                                                        SHA-256:810FD4BBD53BEE064532A3F65EF9FC813F3663DD1A52973525A7839100147903
                                                                                                                        SHA-512:8D40FC95D63E426708681A102BBFFB788913AC0E61F7526CDC9FFC73DFF2DD5185ED032DED554114AE47024F87B4050A10F7B1F1543C3B1F04EC9D6888BEA24C
                                                                                                                        Malicious:false
                                                                                                                        Preview:Hc..-.............;...C$....S.J..c..?V.J...7.....Q..`......mNg..O..........'.&....z.p)...g(-...P)..7.vMvLb.....X..N.i[.o.m...w..q.Mc....c...H.]:......S.....c..........#..`.X.y.........3..'......y......g.RwN....i7.Y).L..7...{.xz..$N<..O.@.....~.y.2..h.q)...g'-...Pw.X7.v.v.bE.Y..J.N.i[.s.....(..q.M>..Kc...H.]#.......S...._c............`.X.y...y..]......?A.d.j..C...eH.U.UQ....h.p..&:o..h..x+...zNg..O............ .....f.L)...g.-...P2..7.v@vVb..*....N;is.'.2...u..q.M...Cc...H.]>......S.....c.........y.`.X.y...x.e..V...@.....N...<`....,....,..6.,)@.}.~..xt..8N?..O..@.....x.~.Y......)..g:-...P..\7.vhv.bA.Z..9..Nvi=...)...9..q.M...Xc...H.])......S.....c.........<..`.X.y...S.b...IR.VK.<....4.V..\.V...k..^......:'...Xo.x....(N(..O..H......~.{.L....q)...g'-...Pu.-7.v.v.bE.[...H.N.i(.{.j...`..q.M/...Wc...H.]!......S...._c.........8..`.X.y...........E....r.. T}.,..6}..5.c....6...."E..x....VNO..O..........l.i.?...!..)..go-...Pb.+7.v`vab9.6...(..N

                                                                                                                        C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:OpenPGP Secret Key
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):129894
                                                                                                                        Entropy (8bit):7.685159568229896
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:3072:stvSRMOIJnJ5irkfIhqQi5gAwhbnihFyf928i/iUBLMePRWK:stvSOOIJJGbbAwhmSfU8iqU1rZWK
                                                                                                                        MD5:1E6448F833398E69D21D1816EEA37EE1
                                                                                                                        SHA1:54F7B3C4F2CE6FADBE6E7BCBC0B8ADF693218AC3
                                                                                                                        SHA-256:91B6928B7C90B6E5A147C497006FD1C50D99EA999E285A7F4BE1C8FAF93F6500
                                                                                                                        SHA-512:9FCE14582D2260313E4CB2FEABB6F6AA578914AC4E83B698B4B902899E14623A67D02F69087038CD05DC6F996D3DE1CDF7FA69A3D08A1FFFE115FF72B1094361
                                                                                                                        Malicious:false
                                                                                                                        Preview:.......!!e.....Q.._U.L.u".+.M_#....C.H.0...s.w.lhv....r......h..Q.d-...v.....6u.........2..^....L...[.......;.(,j"m....h.....r;.\.....`c~.s... u.w..Z@[3a..6"poD6.....z...w....<.aT....v^0..f...i.?"..T.)@2..W#.........l.....x...p..3..Q.dk...).....iu....<....2..Q................;.(>jGm....h....o;.\....N.Dcy.....,u.w...@33%.U6xp.D_....E...p....... ...7.X....X.V.a....Y).b.B..c|)...r...(....@p.......h..QPd5...j.....0u...2...72..u....W...X.......;.(cj.m.0..h.......;.\....F.Ccw.S...,u.w...@n3}..6.p~Dh..... ..#....+>.<.=.8.....H-O..{..e..^.$*........}.w...3...6...q..0..Qydk...0.....nu...I..|2..L.....d...........;.(Mj.m..~..h....$;.\....]..c=.Q...1u.w...@y3z..6!pYD=.....x...Z.....2.4&(...2D_.4`.&.Y"..9D. ..;n.+9..cUi@....g..mh...8...3..Q[d7...&.....6u...c..X2............O.......;.(;jOm..s..h...`;.\......c^.R.G.yu.w..<@<3Q.56~p_Dm.....S..o....7..p.y.`8.-.w4..v.E.&1A..;....m.l.&]-.M.k..a$..B...0...d..Q^df...&.....<u...y..X2..^.....L...k.......;.(gj.m

                                                                                                                        C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1512
                                                                                                                        Entropy (8bit):7.6018112550148365
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:p+ximJGEXK7Y4YTgCAd/LOorhatoYFVKgJVwl+QkQCmTovzcFZfH5HA+JOt5p0BB:wrYh7YVRAd/LZrSNPVuEwovYZfHRA+Oi
                                                                                                                        MD5:7CAE6D0B067176CD7D9E121FA5331A1C
                                                                                                                        SHA1:621237FB16E144B374519AB6632EB23E207E7FA2
                                                                                                                        SHA-256:481F463FB61550CEF34FD5B0D5FCA2EF6AAA2AFD956C93B1545A8D7627B338C5
                                                                                                                        SHA-512:0607E35D114D089E168AB3904D8125B53EDCFECC1B0533498D4919A2DC5A5812F836BC4F4573A558A0594641D3BBA9280ABB2527A607D531184BEC173A975F07
                                                                                                                        Malicious:false
                                                                                                                        Preview:..3.z.X.Zwr..3...?M...@b+.y]V..'...)s..F....&....*P-...>..U..i......u.10C..s...\..G.Q,.l.W{.....0...7.F.x....O...h.....U6.!':Q.f.....'0E........x;`.........9.p..U.g..|......U..0e.i.o(....._...c."U.K.l.X>.C..L..p.&.E....#n...Z..i_.T...3.d0...s..\W.W.C,.l.W{.....0....c...&....O..rh.....UD.R'eQ.f......'.E.......Yx|`D...S...J.A....U.g..}...V..U<.'6+MX4.8....{. Ea[_.p..|.2...T....6.....C....{......i-.....b.j0<..s..\-.<..,.l...{.......0...m.".....3O..~h....MUs.b'jQ.f......'.E........xc`.......'...F..U.g..v......U.)]6u]/......\..G.}....]..x.#.I.w.>..=..he,.H8t......i..Y...!.j0<..s..\..s.O,.l...{......0...s.l.y...JO..,h-...XUN.s'%Q.f.......'VEO......Ixo`....S...@.|.R..U.g. ......U.H..e6.{...Z..-.+.f...gs..q.(...t."..u.%...A{. ...]..i^.W...6..0...s...\3.D.O,.l...{.......0...'.......3O..Kht..jUb.v'lQ.f.......'jEq......."x;`]..........z..U.g.....*..U...!......;.'...1@...@...!...U-.g..?..\x..FXo)......i......f.:0E..s...\e.D.~,.l.n{.....0...<.A.s...NO...h

                                                                                                                        C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):2196
                                                                                                                        Entropy (8bit):7.646011000559292
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:48:/EVUcJyMFq1KrXrCLLFetUZyF2QisFKa48P:EBFqEr7YBetwyFlisFKyP
                                                                                                                        MD5:57B4D083D5FCB27E8BB2A0AAB00710AC
                                                                                                                        SHA1:A8C55C1F6882569264D1274426DFD468B5E64708
                                                                                                                        SHA-256:4E22A9E1327AEC60FB504B4594C54DE3E1357B0B272D08D76413294714787FC6
                                                                                                                        SHA-512:CD1A9112F7C04CC82C654CB20A32FE757D246C587F8D38FC4E7812B9DA699F26F2979BACD7AFDA7F49966F304EB1BCA9392784B27B064E267549E822A68BB3B2
                                                                                                                        Malicious:false
                                                                                                                        Preview:.D.aG.p...6&.b.l..V-..60.....H.7..+P.i.....-dA.\....B.......B}.....v..}..N@]........^(..;..Ne6.|2...(su...F......+R....=J....I-'@#.zR.=..N..P.=@.Wl.ZJQ...P..!. ...wWvs2.$+..J..._..hby}.yv.....`...;....9!lg..D.....eH{.I..Kz...doi......}....v.(..N.]....>...L(..%..Nj6.|g..{s7....].y..9R....=J....:-x@>.dRH=.....P.=L.Nl.Z.Q...P..e.m.L..W.sO.[+..K......h..&..e...N-...k.U...D.za...w......x}T.R....u.|.....^}....v..&..N9]....D....(.a.VN56.|....8sn..".g.@...R.....JZ....-w@y.dR^=.....P.=Q.Yl.ZIQ...P.. .".1.nW|s#..+..{...@..h...G.D9.<..."..ID....*[..Xn...gf..8..r.8...o..B....._}.....v.:..N>]....q...u(..V.LN*6.|8....st.......&...yR..#..JU...6-a@!.fRc=..A..P.=f..l.Z.Q...P..c..._.6W%sv.R+.....R..h *].I.t...*.H....3.T....\.2.....@.'[A.-A!.L"HI?.....y}...v..Z..N.]........B(..:.`N(6.|'...%s....[.S.D...R..D.rJ.....-h@l.+Rv=.....P.=`.Sl.Z]Q...P..=.;.;.fW(sd..+.h...[..h....\".....j@E......3..Q..l..T.X....\.v .`..do..Q......}...v..5..N.]....U...J(..&..N.6.|...rs\...._.q...JR..

                                                                                                                        C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):139890
                                                                                                                        Entropy (8bit):7.688498115079986
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:3072:J9ocd3tnzl4H/HISzpo57nVD9TarEMP+DtYI:JDd3lZI/HIIW119TarE9tYI
                                                                                                                        MD5:D079BA7D7C291F19842273D34A778924
                                                                                                                        SHA1:ABDCBFD4846D11081E186FED1E3CF97C82B62B17
                                                                                                                        SHA-256:307FC6AC09D10CC3027AFD32C5F9FFDE795D11BDD43A8357F88A431865DF6FAA
                                                                                                                        SHA-512:10F801890A005970918E1EEB1AC23EBAFCDC13BE2734D1AFF90050BFC7ADBB3486132DB63A335B9DADBB32FF08AF1F3BB69E908E774702157D1221A5DC7F4828
                                                                                                                        Malicious:false
                                                                                                                        Preview:H.L....z.....)....oE.......Je..;.......vp).gV&...O. '.<...{...b..p .i..a....6.Mi.zd..p..../C...MQS:f.X.T..m....@|......;.....C.....;.y<....?...P{.?e..'G..rMB......6r.qo...c..UNv..~.....^x........(=..(......U.........~ou..".3... .R.r..pu.6..8.....&._i.zz..p....zC].WM.Snf.X.T..`...s@n......;....C..H.u;.y.....?...P!.xe...'....(M:.e......r.qh.W.(...Y....o.q4...YQ...._P...T.R.h#...F?r....>......s.@...{...-..p .u..D......Qi.z@..p.....C...MRS7f.X.T..?..3@G......;.....C..z.u;.y.....?...Pl.5e..'[.._MS.R.....lr.q;....._ZS......SS.5........z...[O.3.{......K+K...{.A.,.2...#.Q....ph./..>.....I.*iez...p...~C+.SM.S.f.X.T..g..>@......;...C..q.|;.yQ....?...Pr.5e..'...nMR.M.....6r.qz.T./..E...t...AWA.F.+.....e..Al...v).......q.B.^p@f..u.w...r._.`..pw.Z..N....O.Xi.z...p....gCY.PM.Slf.X.T..`...n@......;....C..*.*;.y(....?..Pl.*e..'A..+M..M.....<r.q~.N.3.......21Q.#.J.5......U-5..D...c.r.r.....F.2...&.!...x......p1.~..a....x.Mi.z...p..#C...M.S|f.X.T......@

                                                                                                                        C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):150322
                                                                                                                        Entropy (8bit):7.656769346203915
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:1536:J1/IoByvDWHDyxsMv2lzJRrdrEtI6bfemH3IsY1MnBOIcISVZSULNGkKHBulLEx8:X/MCI2hrhH6bfTH4spHCrpGkVwdG
                                                                                                                        MD5:BBEABF38F7FBCDC934BE38EECA6B6DBA
                                                                                                                        SHA1:FE8C668A576C1C727B41B7D24E2970A4D2CF50FC
                                                                                                                        SHA-256:4F7B2AD547B0ECB2099F0B7E657FDF2DF5F5384763F754D5C584170F2942B5F8
                                                                                                                        SHA-512:8C882322BD3F18B8C063D7376A8920E460140030E8BAFE4CF452BE68BED0AADCF3247E52CC0A1D4520CFE7B6106884FB9BF71F75FECF18396C34FCFD4FC8E56B
                                                                                                                        Malicious:false
                                                                                                                        Preview:O....`n.y.(........r.B.e.OU.]c........v...V..{.H.Z..\.....a..9+......g.~...`.........d..2..G.4.x6..._.h.C..F...9........iG..+....?...2.m...2T.g.F\...m....w.O.k.._..0=....`.G.].D#`..el.U....$..O.%...-...$...<.H[v.b._...h50....a..b+......{g.~...`..).......z..2!.W.a.&6......1..C.K...\....2...G..6...?......j...>T.g.F....).W..w.O.k. ..0,....`.G...#...~z9...........G.o.z..i........."P.;.|.8.D..a..9+......g.~...`.........@..2..[...c6...R.r.C..........f..+G..D..?......d...>T.g.F....q....w.O.k.g..0a...`.G.....<..t......g....t4.....V..ZS.W..h..~....~....a..a+......fg.~...`..B........2<.&.e.P6....z.8..C.L........R..>G..}..?..._.....'T.g.F....1....w.O.k._..04....`.G@.a.^7B<.~..3.@{|.....{.d.....P..K.E.1.....W...B..a..0+......yg.~...`..^.......~..28.U.|."6...x.,..C.?...A.....G...kG.."....?...P.q.....T.g.F8...k....w.O.k.Z..08....`.G...H2f...Z.p...(J~.F...I...V.G...&<.9?i.....QaO.....a...+......g.~...`............2u.!.8.z6......$.C..2... .

                                                                                                                        C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):6172
                                                                                                                        Entropy (8bit):7.628859008952815
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:192:XUORStO6x0L42AbfLy5iyvFIVZfGyB2QeAn:EDNvLy5ikyrfGyBfxn
                                                                                                                        MD5:C3FBA5100571142F43AA8E779205D8E2
                                                                                                                        SHA1:050A139EA50FBB97C27E2A38A231648AF7A9EADC
                                                                                                                        SHA-256:F80C1FDE990505E7FF528A40D942417A42823B98E7617B96D8B52A6889BA3730
                                                                                                                        SHA-512:A54CCC1938C6C20287AD0F2C9E2D36BFCA8434BE4A621F2050EC83A13594AC346BC20D3CF9600F8FF84F517C704FE18ADC592B39F2936B406F65140FF9B2475F
                                                                                                                        Malicious:false
                                                                                                                        Preview:..My....CY..Q...i...X...vj.V&.Mb..P......U6....u$..4.e.g..J.B.....B......D.$..B...~..|f....F..R]./...tT...x,t..5.....6...,..5.....B9.]...~....o.A.PA....>. .......N.z.....Ut..m.-G.7. ...stq......UV..._S....7x.n{.(...C..J.,b..J.BC....BX.......}..B...~..}f....I...]./.=t.....x{t..'.....6...^..5....Bd.;...Z.....c....A..w.z.m.D.....N.z.....U3..4...8.......s.jI.-s'FHl=.}:...\R..<0.....U.Dg.,8.UJ.B1....B......=.D..B...~Q.,f..T.....{]./..dt.....xBt............i..5.....Br.2...Z....G.B..A....4.,.......N.z.....U!..#(.....M..1g.....%......jm.W.p/...e.y.h.[.....,).`J.B.....B......R.>..B...~U.?f.O.....]./..stU...x/t..~.........x..5.....B>.^...'.....a.K.EA..!.).!.......N.z.....U8.g......(......L....[Q....b.p..;..X=.~...\....,..TJ.BW....BX.....u....B...~..}f....I...]./..=t....x|t..U.....E...*..5....Bu.c.........M.I.XA.. .".*......N.z......Uj..ZF.6u...*..... ......a..%...z..)X....1..e..,4.]J.B.....B......t."..B...~Z.(f.U.-....]./..&t...xyt..$...

                                                                                                                        C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):165054
                                                                                                                        Entropy (8bit):7.694083105522314
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:3072:L8e3cKgVeWKJMBXcObYkym6/LcB8UkpToNA/WW4/iFTodsMooQ4as0:LDMKgVdKJoMObAX/LcBBkpTKA/WW4/id
                                                                                                                        MD5:B71F4E41E72F96AF297725A61C55D7D1
                                                                                                                        SHA1:7E9CE90C9151BDE47CE260902E9566499D237B5F
                                                                                                                        SHA-256:A7BDA58CB21E5E06562CCFD45BD199CBC40C74A9773B4F9EC6194B8F615039AC
                                                                                                                        SHA-512:978F9BE7D291874AF85D513FE583E8BECB5F1075A17B6ACD46D264252FFC3E6545BC88BA125475FE8FFB2643690E2B1E4E79E8BE70DBCE3CC026B740BC5EE9ED
                                                                                                                        Malicious:false
                                                                                                                        Preview:..C........$..z.a.../.*.G.......D. ..#..m7..o"e-..c..=.....D...."...b.L:.>...<.(.s.kx`.[.J@........k........)[b....RsL.zS..,.b.]_.3.........0.V......L}....d?...s.G.V.p.^.V..WQ3Z... ...rE.By.......j/.,.?..P..m..V..2...k...2..Y......"..b]Lc.a...,.:.r.ux`.T.Z@R....U...2.]......)>b....Ns>..S..,.b.]9..3.........0HV.......}2....?..s.G.G.w......[.+..M.QO.h.G_.I1.B...p.>:.A..c.=.o&..[.Q.@>8W@c.Y.A.....X..."...b.L..8...u.4.O.OxY.p.V@2.......q.......B)~b.....s..8S...,.b.]9..3.........0.V....P}d...u?..s.G....$.Q.7.n.fV.s.. ..?-.....C.jt$.....X'D..^.X.........%...3...Z....."..bYLe.f...C.O....x}.I.+@V...O..;.Y.....l)sb....s..-S...,.b.]0..3..[......0.V......J}>...i?..s.G.].x.......]....1=......WQB9.W.7!....H[.&..(.Nw.+...~)7..~.T.l...&.L...."...b(Ld.b...D.K.v.hxb.@..@R....<...4.@.....m)7b...>s?.}S..,.b.]..3..I...@.B04V......_}d...,?..s.G.W.t......U.......K.[B........<U..z.~L..'7.C:,....~U...1{b.T.?..?.x..."...b.L .s...J.o.;..x9....@_....;..K.)......)\b

                                                                                                                        C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.PowerView.PowerView.x-none.msi.16.x-none.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):15828
                                                                                                                        Entropy (8bit):7.683358640900379
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:384:+TX7Yht4MIcCaVtmLDT6dgCqTtFYmq22nxhT2UvdDGw:+3YhtNCitQSgVBFW2WvvdR
                                                                                                                        MD5:8C5301964B5401F5FC271D5C530C6BA1
                                                                                                                        SHA1:983686058593DB09F1BB7702039FEF5FB81A5E36
                                                                                                                        SHA-256:F486087836B28539354CE1C6ED7035E83ADAF6E08582CDD7FA570BB6E466C2C4
                                                                                                                        SHA-512:34FDB902F2343A9652B88F320B2AA731FD244E63F7B86D187816C2C3571D363FA1EF2F06DF67DB04847A2A5D32ABDC3304D81A69575032EE7874B8DC47FEDF29
                                                                                                                        Malicious:false
                                                                                                                        Preview:l..a.n....n.{..".S7..q ...i].K.:I,...........Oti..Y.m".Y5[.C.|.9@.-zk.H.$.....^.F...Tks.....w...S.u.F.$Ql=.xv."..F....*U!.w#....z...L..t@.......X.yT..i-....Oik.'...HQ3..... ..D.:4..N.j..... .)...m2...c..`%kZL4..cK<di...@..\5T...'.e@.-<kWH.$......^.F...Tus.....w...S.u.F.$.lc./v."..#....*I!.wP.....z......tG........>T..-.....i..N..7Q........g..l...y.@..ho..)h<s|9k.].B,93.*..+...*1.=..9.X...5.._.U.4@.-mkYH.$.....^.F...T1s...w...S.u.F.$5lY..v."5./...+*.!.w`...@..z......tT.....[.!T..|-....Nir.....oQ.......u..K.].D..0.....n..$.U"V.W..!.1o3...R..*..F:....S...52.R.t."@.-ek.H.$......^.F...T+s...w...S.u.F.$yl7.{v."R.U.!."*.!.w7.(..z...y..t........O.sT.\-.....i].+...{Q3......v..A.0!T.0m3...r)t~.+.[5...|....Z"..O!.9.....2!.....5Y...j.g@.-8kVH.$......^.F...Tus.....w...S.u.F.$.lb.2v."..&.|.y*N!.w$..f..z...R..t.......R.lT.W-...._i .I...QU....A...Tt...( .@..z.... .......I....].0e.....e.m.....5..T...0@.-xkGH.$.....^.F...T1s....w...S.u.F.$~l`.\v."..>.

                                                                                                                        C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Proof.Culture.msi.16.en-us.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:COM executable for DOS
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):39876
                                                                                                                        Entropy (8bit):7.7029371465228955
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:768:YSIj76Hqj7DRcrYN7gvTX0iE6IAvKomHE7o1teftFcqFa+oju:YS+KrYN7gvblBvKomJA2qw+oC
                                                                                                                        MD5:20BCCDB3C3CC8AD7DABE49E8EED5ED37
                                                                                                                        SHA1:0833FA3491CF029AFF29D2EF0A1F29879E990389
                                                                                                                        SHA-256:84F5951931A4BBB422038CC02265E05E6DDD7932E22822545B08C6C7EF0EB8CF
                                                                                                                        SHA-512:BAA5716A7FF47C482B5F55528067381C24E42FB44B0215F1669D0C04891A0BE5530622250792D31785BE8577B717F9196757E74452606CAEE4809BC16BC07A71
                                                                                                                        Malicious:false
                                                                                                                        Preview:.gNM..>..U...t.F....8...8`.....l.zZ ....t..A./^.X2$.B(..x.....{P......<n..eb-..B..?c..\..].....%.\9..../R.j.bUZ....4.b.$&........_-[-{oa..YUwSp..U..#.R.FJL.[.}....I../....@.......Q...#..u`.AR....Z.t....E~=...]t..A...-..xN.....kP.....en..Mb=..B..!c..S..].......%...9.U."R.j.bGZ....F...{&....`...{-\-wox..Y.w.p..=.X#.R.F2Ls[.}..;.H../...,J..`3d.2...F.X..Y.m}!.R...h..M..Ii...ZF.W5..e...w..x...../P.......\n..7bV.FBE.ec.....].....%..89.l..R.j.bGZ....q.!.t&....i...{-O-joo..YVw.p..C..#.R.F~L.[.}...._../....[...J..C...*S..q.......cA.P.`.Y.mVx.h<.OH......y..x9....>P......fn..)b0.sBE.cc.....].......%..?9.l..R.j.bBZ....u.;.h&.....,...`-W-hoe..YWwXp..L..#.R.FDL@[.}..Q..../...T5_.cCN{;...q&.....l....PCab.%.X....K.9F.j..\.&..xL.....oP......n..=bQ..B..(c..8..]......%...9...0R.j.b.Z....h.$.i&......x....-0-.o...Y.w.p..`..#.R.FML.[.}..b.$./......=..Q.|...#..M.......P....U..kn[...J.F.....7.q..x.....>P.....!n..ybu.jB@.,c..9..].....%..[9.....R.j.b

                                                                                                                        C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Proof.Culture.msi.16.es-es.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):33598
                                                                                                                        Entropy (8bit):7.683163412516036
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:768:L9oozF0w46BWN6jlFTcwOoxwG73qto94TVRLOm8fVclrIp6:Luwx86jlFTxOoH3qtoSTV5UAUI
                                                                                                                        MD5:4A624E8D99081701BDA684CAECF5F510
                                                                                                                        SHA1:0B561F13DE1F29C617F10B3EA2868DC7E73AC7A4
                                                                                                                        SHA-256:A18D78B2BD3D62504EDDEEE9CAFAEFA7DFC0D60B2EE68123A6A5907D3CE7763E
                                                                                                                        SHA-512:42C9C834493630C5D72D4478E0ED76FE60B5B8A8D0A78D3A7813B92D7A06F270E825B14EFBDDE0ADFA1A2E99BAF8AB1ACE801A1F4064F5BF965081020E6078D5
                                                                                                                        Malicious:false
                                                                                                                        Preview:`&'lq~Qx...DD.S@....>.Y...=.w.q]..{.~..nH.?..QZ.B...G.........]r.[.0..\..L._|:...o..U.......q...U.<md...E.fb...:..o.....j.u&b9.r.$1..)..J....f...RCW@.0.*..a..e$.}[..T.....Q.@M.N_.1..O.....".Z...~....Y.zE..&/.Sk....(V.....]..]b...e..\....|....o..U........."....U.<3d...E.f....:..ob.....w.k&?9.r.$...)..J..B.!.cR.W..j.R......e..|[..........B.5.c..-.x......../Y.....9...7.+..~..n[.=V..V../..]&.L.k..\.,.9|h....o...U..........a...U.<.d...E.f.......oU.....0.k&)9.r.$...)..J....>...RXWA.0....y..e$.k[../........QK.P.<Q.uk.....]..Y....;A....U.Z._......!V..@.....]7.^....\....|v....o...U..........0....U.<.d...E.f.......oQ.....0.%&.9.r.$...)..J....m..RUW..v.$...'..ex.+[..^....X.).....SWY.J.;...X..wT?n..h%....wI....d..~V.r..)..]c......\....|d...o..U........P....U.<2d...E.f..j.?..oL.....;..&.9.r.$l.i)...J..C.,.>RPW[.!.-..+..eA..[..`...7"{*..E.h.+.T..d.mJ.9l.a7...L.>....os..?Xc...V..R......]7......\..Q.E|&....o..U.........w...U.<Gd...E.fY.

                                                                                                                        C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Proof.Culture.msi.16.fr-fr.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):33598
                                                                                                                        Entropy (8bit):7.708942613296863
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:768:JgyFbj2TltAiJsBpUQXGGPZkCHenb/iE0Hn6qQ3u4r51Y3eRg74+Vk6CJK4t+zEh:JgjTltA7LX/kCHKb/oaqQ+4r5+3Dk6C5
                                                                                                                        MD5:E2D6292C078B072CED98344C1A89900C
                                                                                                                        SHA1:99763D92B939D7BED48D56A7867FE0EDDA42FD29
                                                                                                                        SHA-256:EC7F22E83D4D6258B43C5BC7ED92BBE75573E992ADE6BE081BD9F84D24CDE30A
                                                                                                                        SHA-512:F5B0F3ACFC68D9CA397E65C78F5C2457B601F4D511821F82B7D1AF1C5C8C0265819C868E62C744606C99331631970FCC77B404572E23242B82E5EB3F2EFB761A
                                                                                                                        Malicious:false
                                                                                                                        Preview:Me.}oU...eL<RZKX..-.l..~...H.fs...L.7....6..%.Q..}.0}0.. .W..Q.[DP..*...;"yr.......n..!.....g.....X....L.p>..>u=y...Z.....7.Yd..|..>.dc- ...h.}.....a.!..sN.F...AaZA.Ee..V^...2....?..-aq.9..T)2k_s.|.j..Y...l...7..8...^gw.:4..W.....D...*..;}y1.....4.~..!.....h...........L.p`.F>x=k..H.....E.*d..a..>...cp ...h.}......&.y..s......9a3A.E...W^....u.....}...o]..c[...t....0.QE8(...........{./G..!.W.M.rD]..*...;]y......N....!......7.F..._....L.pZ..>A=R..H.\...r..d..&..>...cp ...h.}.....9.#..sU.G...uaUA.Eq..@^......0..F.plu.....ZU......W.+.(..w.4.Ih_&L....#:j..d.=.W.o._DP..*...;ay1.....P.s..!......+.W.........L.pY..>A=R..M.V...v..d..&..>..NcR ...h.}.....j.u..sX.....Oa.A.E....^...S.$K.Yvwq.S....q..'...n,C.I.3.]..&.:...\.M....b..W..h.tD...*.;by,.....B....!.....u..........L.pa..>j=e..!.z...k..d..-..>...c/ ...h.}......+.G..s].]...Fa\A.E+...;^...,.x.......;.....#...$]...?.&.D..me.....@8l.......W.].CDN..*...;5y`.......6..!.......J...[.....L.p...>%=:...

                                                                                                                        C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):114128
                                                                                                                        Entropy (8bit):7.65120948902244
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:3072:I/hfHEaKZMxj+wGNXUJSHTha5hNbRlLEq/:IfkdSGMwq/
                                                                                                                        MD5:6604B6EF07390BD6392B58D7987E8D73
                                                                                                                        SHA1:36D362E3A3E5EC27222DFA09A140FFD40CBE9C8E
                                                                                                                        SHA-256:DFCA4B9A690535ABF182CD7BA14D06D374645E0AE8B6BABE89743E971A5E38E0
                                                                                                                        SHA-512:E6C9B423A345B520B744AEA0A8FA560A075183F641094781C3C52623581E7D9C99E6CA317E9517A6C5AB99F239BA993E2886AA174FA4B6B8AD85695DBB9AEF95
                                                                                                                        Malicious:false
                                                                                                                        Preview:%...q..]..&.g...?.P...qh)....f..G.....1TM}(=....`....6..n.K.."h{V".yJ].d..H.....P>..k..F!.x.a.z>*..W.j.r.....6jZ.w.PM.b..=..[..Z...n!...eF.K.~...2._G.`y.P[=..e.e{*T...D.]|.gl{..C..w..[..5..'.1X|.M..x.!..u'.|8....o5.Uh...5..3..n\K..~hkVd..y.].d...>...B>..u..I!.x.a.zm*....3.,.....$j?.e.PM.b..N.G[..D...!..5eA.G.g.....2._/.$y.P.=.....{UT3..D.]-..g..3..D....c..w]...`;8...:.....-.....fnKK....].\...b.zn.K..>h4V:.yV].d..N.....L>7.O..m!.x.a.z?*..Z.p.t.....yj..L.xMNb....[......!..2eO.k.z...2._r.|y.Pv=..;.3{.TV.DF]s..gG..|.......HD.$I..9.&M.....,$8...q4.h....R...Q^.=..n@K..}h.Vd..y.].d...U...7>|....T!.x.a.zi*..r.:.(.....Wjr...6Mzb.j.V[......!..|e..E.f...2._r.jy.P.=..E.~{.T...D.]$..gS[..yj....w.o^.. 68H.U...T.F~.....c\L...{J..9...C.]nPK..5hcVe.y|].d.b.;...G>|.t...I!.x.a.z.*....1.-.....-j7.b.PM.b..?..[.. ...S!..ce..i.e...2._v./y.P.=..@.t{.T...D.]$.g.u$...Wp..Iqa.G>p....._...TU.j..7...Z...xp..I.Z.Ln.K..<h2V9.yJ].d....3....>|.,....!.x.a.z.*..z.G.P.....Fj@.

                                                                                                                        C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Word.Word.x-none.msi.16.x-none.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):143572
                                                                                                                        Entropy (8bit):7.674213952272221
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:3072:hl7RAT+04/BygV7/2t8oSbYJn05h+gjp4NDuaYusH0XlthqIF:33vVyqzA0JGSaYu8cz
                                                                                                                        MD5:EF13212338ABE72473A6CF1CF0347B28
                                                                                                                        SHA1:2DABD00F82B2810DCD6A4CBC85CB0140AC07D379
                                                                                                                        SHA-256:AE921C46AF8ADB49FFDD215DE650CB05781AF291A8FF627C923FFA82BDD2794D
                                                                                                                        SHA-512:C3A433931A4F32C36B0EEAFD2D435C898CC9060C118DB55B6FE3D3E36EF3FEAC8AD5D9EE5EE1F30F8E27F45151E07BA4CD47F100F81D18D7E84C9E846990BA65
                                                                                                                        Malicious:false
                                                                                                                        Preview:..x.....H._.....FFT.}k-..s...#."......b..l.q..+;........_1,.La....QZlp.=Z"I..O..^.....@}.H.1M.....j.U]Y...N.M...{.....tZ.I..[..c.....,.GS>..D5.yO..C.F..4...N.,.3ez..'}..y.z......./...{..."BO.=qnl.d..w....M.....+...20...Bx.>.._>,.L:...Q.l%.bZaI.....N.....^}.H!1]......j.U.Y......@..........Z.I..F..cN...A,.GT>..]5.y..RC.F..p.D...T.Ze...'B..y.z.K........F..K^.l..U...N....>m...A...=.a[...0.....6.._M,.La....QBlp.!Z%I..I......'.d}.H.1Q.....j.UPY...j...T.^.......+Z.I.4..c|...I,.GZ>..@5.yX..C.F..(...c.=.me,..''.Ey.z..a.WD9{u...:.M....,P..5.&q....\..%....MN..E.Z..|p.._?,.L9...Q.l8.{ZeI......!...l./}.H<1,......j.UxY......G.z.S......0Z.I.....cw...R,.G.>..@5.yL..C.F../.H.^.-.6e,..'Q..y.z..M.c?..?......5^...N.p..g........{.0../..w......+.._`,.LE....Q.ln..ZhI..... .....C}.HI1.......j.U.Y....k.F.{.j.....Z.I.]..cZ...a,.Gp>...5.yi..C.F..'...K.d.re,..'T..y.z.W....o.<.Op..q{.........|.S..Jnx.|t.T..L..S.7.._3,.L[....QhlF.'Z0I..E..%...F..}.H.1M.....j.UPY.....R...m.

                                                                                                                        C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.accessmui.msi.16.en-us.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):81236
                                                                                                                        Entropy (8bit):7.686853773301086
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:1536:vh8qtrAeA1XnvD0QgDDALO4UcRCrEhX6s9834HAlEQcA87jjK2wgPP0VPGm:vh8arLCvv+sLCr8NS34HAlEQIPPwgPs7
                                                                                                                        MD5:34239089D4417AFF308C0F19E98A66B5
                                                                                                                        SHA1:A5CEED17640DC6D72B3A165612419606028FEBD3
                                                                                                                        SHA-256:C8BF1CB195467608973DFC3924443FB2CD0F901014BCF22659FC5C62BB501322
                                                                                                                        SHA-512:D95102E0A42E2A24D4FB2A3FAFC6EB28340AD1C1DDB42FD7224F99495EC008401B116C63B35B83BEF7055D4B3B4C8485E671BE33D6640E4445985DD6D360F07E
                                                                                                                        Malicious:false
                                                                                                                        Preview:...M].vC.x...&.|...=.N..X..d..H..uB...,~..b.n..)Uq.2......qj.%...%A.,."."E?Pu....t3...;.=..i.L..3=.....R...0L.~.....M..j...C..V...>.a(.crz.......]...n.$...<.t....m.,.=Z....`...jv(.Gstw..i..dI9.E...a...3D\...I.'C"5B..bt.qe..~...5A.,."..aEfP+....f3..;.2..i.L.`=....R...0A.l.....M..j....OC..H....>.a..drv.......]..k.*.i....U.....m.,.=.....OB%6......K........F...(-u.........C........dptKq0.!...qA.,."..XE_P&....:3..~;..s..i.L..1=.....R...0".......N..j....zC..;...>.a..vrq.X.....]....X.......O....m.,<=8....b...=-d..............~|.`P..D...}..a..Q.<.H.Ptkq..m.HA.,.".>E%Pu....v3..^;..v..i.L...=.....R...0@.j....;..j....C..&....>.a..rrx.......]..6.!.i...q.M....m.,2=".....\.....B...a....".]..O4....(.]......}.:-..Jt.qd..f...5A.,."..qE.P{....%3..Y;..z..i.L.r=.....R...04......+..j....VC..J...>.aK. r'.Y.....]..#.Z."...a....m.,^=/...e.t.....i7'9r.T.E.i..6....~l.".Bl{......y.7.utWq..$...IA.,.".oE[P......3..T;..Q..i.L..#=.....R...0../...

                                                                                                                        C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.dcfmui.msi.16.en-us.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):13534
                                                                                                                        Entropy (8bit):7.715579385377424
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:192:FmgnD6wmkEuoOMiBt62pbABHDprmaR0/T7iBsJrvY4JEXtZzknCyn1cTZKIJZygp:MMfVVpelVOiBsvqX/z3ynWTZVs+yi
                                                                                                                        MD5:A9317AD6A22AD095B68BC11D94D8DF8B
                                                                                                                        SHA1:588EEDC776EB0CB626754FD93186F4944B054450
                                                                                                                        SHA-256:81E0A3B3C067B8555513F60167653D13A8EA3F635951442E5875570A71D708B2
                                                                                                                        SHA-512:7B9636C924671FA74F419F9FCE17C0A0B8E8E1664D5D6249418361C3771A0BA8287EE0CFD601406BE67337F4BB243EA5CCFC9ECF4994EECB6785CE228F6CDB50
                                                                                                                        Malicious:false
                                                                                                                        Preview:.E^.......[%.e.;D.H..4.|m.S9(........N...n...T,.>...s...u.....`.B.a.=9*......EB.pZ7~.....a..`V?.-T...;..[...-.%{.........=.7..F......n ...|..LxQ...3hg..hPR0.N......Q...1h......J.....J\X-$z-0%...z..4.4..l....h......~27t1..^i.u...<.R.'.h9u.....]E..`Z%~.....a..pVj.sT..;......z.({..w......=..D.F.....yn}.5.{..LaQ...3/g...P.0.NP.....dQ..1i.......>m..G.Vx.w..O8.5..-B.q...~k3.0)........kd.<..LiWu.........).U9R.....XEd.(Zy~U....a..%Vz..T...;........y{..&.8.8..=..B.FC.....gny.o.U..L@Q..3]g..LPH0.NL..._.>Q...1@......)L.............m.5...*I*A..;).V...O...g..... (.ji|u......S.$.^..9......8Ea.$Zv~W....a..&V..cT...;..[.../.D{..!.<.0..=..0..Fr.....Sn@.$.s.9L1Q.3lg..]PS0.N...y.#Q...1i.....s..Q.X..)....X.UI...H......$s./~P..l.)....f].vi.u.....M. .V..9......)E|..ZG~`....a..nVk.sT..;......+.u{..4.*.8..=..H.F.....TnH..._.$L@Q...3Bg..hPa0.N+...<.!Q...1h............v_.E./.2L.[o:W...B.......5..h..}Nb.q..i.u...0.M._.=94......E@.(Z+~(....a..|V..&T...;..[.../.8{..&.

                                                                                                                        C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.excelmui.msi.16.en-us.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):52250
                                                                                                                        Entropy (8bit):7.683896855247718
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:1536:Y9fFecptY0GornI2RymkapoUqgAjPEftN/Zli56Yn8NmpCf:YTvp6qxzCYF1w6k8P
                                                                                                                        MD5:204E9A6C34B49A6BEB1039D02FEC3524
                                                                                                                        SHA1:B18660620E81EE95F243301CB41B707FAD96C614
                                                                                                                        SHA-256:CBE77D39EFAE50C17BE5B22842EBA84E6ACE0856554BA548A49C387B539A102E
                                                                                                                        SHA-512:5EB9252795B40D65E387B4DC9CB6A320596BCF5F02BD9DEAF1FEBB4E985703B8FEBBE1892D6103328B092216AD3CC3DE1A6FF84D015F12A9163B06440019A2CC
                                                                                                                        Malicious:false
                                                                                                                        Preview:..s_..a>....<.c_aR.W.......K,....i....h....2...u.d...`...j...K.z....eN.......Y_`.a..../3...8f?J...x..3...9`.w...-.m...@.e.G.I`..3.T...z6...k...A,6Z.:Y.c#w:r.$.........&.%q.E:...Z....E@....*.y.W...v.K....4]..%...=..r,zN....j[..K.z....0N.....Y.`.a....13...8v?...+.^3...9>. ...?.....\...4..`..-.....'6..k...A 6..}Y.cKw~r.$.........&.%x..:......7.........A...c.........rk.6x.....5BT..?o.\.W..j&..K.z.....N.....Yy`.a...G3...8#?....z..3.9,.U...L.}.....%...".I`..].8....6...k...A.6t..Y.c,w.r.$.........&.%].4:..c........>U.../(.G.N.=:.'...Cb..._a..(<...,.Sf....j'..K.z....sN.......Y~`.a...b3...8.?I...r..3.98.L...?...l.O.t.?..`..h.*...'6..k...A 6X.bY.c>w.r.$........&.%".V:..$.7........^.._Px...}'.......-..".....P8...p,......jH..K.z....eN.......YT`.a...#3...8.?j...9.S3..9g.t...-...o..^.v.O.W`..E.<...66..k...As60.UY.cOwgr.$.........&.%X..:..x...(o.H..n.)G.3..Z.c.w...hL..........=....Y7.A....j`..K.z....lN.......YT`.a...b3...8/?\...%.~3...9..,...j.T.

                                                                                                                        C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.lyncmui.msi.16.en-us.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):30386
                                                                                                                        Entropy (8bit):7.704104932197922
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:768:CLcoDzIQep3ftl3FcE+KKd782MrzuozBMZ0B9SXF:gcoDzIfFv3wD76uolM2uV
                                                                                                                        MD5:ACBB998F4F56F9E86588B73E2541DA34
                                                                                                                        SHA1:FF6B013D4BAF73CEAC159CEBDDED978B77FA1089
                                                                                                                        SHA-256:33B3BDF02683DE1100214601CF49E761B554A1D86203E1C595D1206954A530E0
                                                                                                                        SHA-512:C1B20032F58DEFB15BC9003BCF5351E298CA8EC17F45CAC7767E8E87CAAC60EF2784FD0A3B31F57D1C7B38BF67139DE485027E55CCE6EC655A99839EF0E0BFB1
                                                                                                                        Malicious:false
                                                                                                                        Preview:....F....qB]".&..t#O. w/.A..2(.:...m5....H...+.Z...(.SV8C....w.[.&!.....L.I,..v...|.........X.W...bY.sj.iB3....G..B..Wh#.$Q.i..<.x.,;K@...8e9..=..a..1..y.xt.,.Z..H...s.x..w-.!8.C"..U.Uo..I....9..r.f...u..v..T..|<..,h.,1.j.w.3....w.[..z!..9..L.Io.v...|.........X.W...b.. j.i.3..N....P..Wz#.$M....<.x.,%K..d.ee...1..a..k.Wy.x..h..Z..0.d......w,.(8..'".aw..kZ/...3Ag.n%...A...R....._........<....bo......w.[.9!G.7..L.IV.v...|......X.W\..by.qj.iC3..\.l.....W.#.$$....<.x.,dK9.`.9eK......a....9y.xt...Z..o./.J.d..w...8..2"..>B...)......i.r...e...mA..)..@..b..n$....t......w.[.8!\.z..L.I+.v...|......X.W_..b^.sj.i.3.."....S..W`#.$\....<.x.,vK=.i.ge...?..a..k.Wy.xw.p.Z..s.-.)....wg.u8.R"~`.k..........pr..j...y..V.....9g..................w.[.'!V.z..L.I<..v...|........X.W...b{.sj.iB3..\....S..W.#.$@.w..<.x.,uK..a.he....S..a.._.Iy.xA.2.Z..T...b....w(.)8..\".~..o...AS_.....C|D.|q.(..d.V......,.9X)m.i..2......w.[..!q.H..L.I..v...|........X.WQ..b..5j.iu3..:.l..0..W

                                                                                                                        C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.office64mui.msi.16.en-us.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):15762
                                                                                                                        Entropy (8bit):7.680880338355361
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:384:yBzdRk2BeuRz/TUleBsnXOWe/oZuCVEMfQxAOv:y9d1eMz/me/UZu4fQxRv
                                                                                                                        MD5:ECFBD986B1F945C831EC10B8767DB800
                                                                                                                        SHA1:94F8B1BA9F5FB268EB9B779B0FC7C92BB5279C72
                                                                                                                        SHA-256:7043B942FC059A940E5792F0ADE8F3301457AB81A8729C6ECEFC81839351B4BB
                                                                                                                        SHA-512:B75883200E6900573465F61A50F92C385000FC92BAC158897019CBBCBAFBBA861A2753FCBB7E3E868366E113BDF88FD0B379509A87471ED2A56D890CA6333602
                                                                                                                        Malicious:false
                                                                                                                        Preview:..A........VR.e.....Q...a].r...8TC..2.]....[.n..7.._.n.....4.....`nV.?.u"..e.[v?.J.,..p...b....Y.....D.....-Bz.Ln..eg..X[s8...FK.2.V..x(......@y.~.%.qT...{.s...V....X|>..&..$.(54.WqJ..:x.......Q..*$...j...s*..;Vx..gA..C..t......4....`(V.?.ua.e.[Y?.J.,..n...m.....Y.U.CD..C.V-Oz.L...eg..X)sK.L.[K.2.Vj.%(......Yy.~.%..)Tb.{.s.....V....d|?..&7.c.8...V.7..y...LZ...=.:7....@..:.K..J..:=[../...#a...A..4.....`yV.?.u[.e.[$?.J.,.*..2....Y....MD..y.o-vz.L...eD..X.s{.C..K.2.Vc.%(......Ny1~.%..sT...{.s...V...s|?..&#.h..K..v....y.#h..m..,....Eb..\N.6x..hq....-o...?k...E..4.....`HV.?.u4..e.[%?.J.,..S...I....Y..;..D.....-.z.LU..e...X.sc.A..KP2.Vh.0(.......y.~.%..`Tb.{.s....V.....|..&r.2..0.....w......,.L$t....o...w.../.f..x9..(.I.iM..?......4....`5V.?.ub.e.[!?.J.,..k...x.....Y..W.0D.....-.z.L^..eU..Xgs..8.pK72.V)..(......^y.~.%..\T^.{.s....V..C|/..&'.&...s..3..X..Jx...x.a1.b.H...0#L........R.Y<..`.I...E..4.....`QV.?.us..e.[w?.J.,....,.....Y.1..D....9-Nz.L..

                                                                                                                        C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.office64ww.msi.16.x-none.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):390694
                                                                                                                        Entropy (8bit):7.697109421219935
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:6144:Ok/geZLWiel3aT8mT5K2Y9YM+Kj6Z8/O99IzZIW5f6jpFgZnd/DeNTjYX/NMmBuz:f28Y9Wu6ymWO9QOGGjiF9S0GTfbY+
                                                                                                                        MD5:4955337FAF99494BACBA8D0E0B6E4794
                                                                                                                        SHA1:B2741E8054F47632866E2C8DB5E1739B597F20A8
                                                                                                                        SHA-256:FD98311A6982C560D7359D2B63BD3509A74E58E2E6FEA3A2E9DE4FB0C086AD01
                                                                                                                        SHA-512:B7A94F7B6B6E87DCF22088C40296076525B2B0DBB1DACD9646336804F10575BA669A1E7B4C2F65E3209D0A9441D18E46287B6FB6D7ED03AA40A5494E544A743F
                                                                                                                        Malicious:false
                                                                                                                        Preview:Em.l.G./;..I.Q.i...G(..U..I.....e....-../...$'...}....b..m_O".Z..o.6.l.k.)........0.....AsF/..Z+L9..... XP@"..4.>A...t.!.H....5d,a>....SI.s...q..`m....S._......."U.#...MH...-Hd...7.YG...M......=._..../..rp.....!.....Wl.{...b_.".ZO...p.9.4..)....*...0.....A|F>....+.9..... .P."..&.[A...t.!.H....(d2ac.H.ISm.t...q..:m...5........."(.\...MO.P.fH.}..45>,X...`...@,..;.s..x...c..~(.hk.Z@Z..*.EPs...._X".Z.. ...l.w.).........0....%AXF3..A+M9..... ^Pd"..{..A...t.!.H....ZdgaQ.H.ASj.z...q..wm...f.C.......".......M....LH?..T.`;/I4...G.....6.km.>.@..W..Q..x.W..Y..d<!..5...c_.".ZL...p.$.-..)....F....0.....AaFN...r+.9..... .P."..U..A...t.!.H....cdtaZ.A.ZS$.0...q..)m...o.........."..#...M].S.aHo../.=..e....i.q....H.&.....7R......{......2e...&_~".ZB.m.;.O.,..).........0....mAhFN....+.9..... .P."..%.FA...t.!.H....Od*a.....S..o...Rq..wm...b.Y........"..&...MY.I.}H.J.c..1.@f......p..q.`.*..vR.#8..i..'&..j.{e...p_g".Z..+.5.j.m.).........0.....A.Fj...r+F9..... .P."..P.?A

                                                                                                                        C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.officemui.msi.16.en-us.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):184244
                                                                                                                        Entropy (8bit):7.705130371628374
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:3072:lqYVQ8rAsg3Xb1z6gJC702SvVpkD2wkSJ2xMZYoz3QJFCr0Qh2Q2l4oDaN7/M41p:lHG8UFGikapSJ2xoz3QkB2QZExIp
                                                                                                                        MD5:3DE2BB6FE065635BD377B9F6325619E1
                                                                                                                        SHA1:E6AA5AD9D0D394A3075274757328F04EBA3D728C
                                                                                                                        SHA-256:494AD02F5E87BA96963083F4C6E00687DE02838C18E4B2EC711C0B348AA7B115
                                                                                                                        SHA-512:E6ED1B9C6E47E9F9D0F0AEFC31FC950358A65A78C3E699DD600F8E3E56BA6AA4FBB7CC040A57E4C0FC4F12B4DC1A0B9FA4A57EF55093C5534DC029C9ADE9EB1F
                                                                                                                        Malicious:false
                                                                                                                        Preview:.....s.+.C...=5pB.o.j...z?@..9..1.+(b.p..rT.tO'...<.R=E..............5.".....D.P).....y.....9uE..".....v,%.....`_.A...w<..C....h.s.....#...V..\.Inl..I.TS.^57...s.-72....He"...%]..3.m.G,..Br..u..9..G.....8%Y2....A.<.RtE..........W..5.".....A.N).....y...97EE.."......d,@.....`-.2....w".BC..L.L.t.....#...V...\QI#l..1..T..!5....z.`7V.*.R....+......$...U..=J3..5.f:.U......_jg..D..A.<.R.E....H......n..5.".......8)....y.....9wE..."....`.., ......`6.$...wR.sC..E...0...1.##...V..\7ISl..{.Tf.P5...._.\7U.?%e.Y....N...8..g0...v*....Wj.>~8_..I#}}.....A.<.R.E....N.........5."........)....y.....9yE...".....d,C......`N.9...]wg.aC..L.[.w.....#...V..\4I/l..n.Tw.U5v.. .>7!......=......j..i.~X......4Q...!.W...1G&. K.A.<.RgE....].........5."......H.\)....y....9:E9."....v,A......`L.I...wJ.wC..].~.{....N#...V...\[IIl..P.Ta.t54...6.^7q.q>7.0..A..]@8IZ1.c...|j.]...v......Jn.)...q.A.<.RgE....h...... ..5.".....U..)....y...9YE&."...m..,".

                                                                                                                        C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.onenotemui.msi.16.en-us.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):25346
                                                                                                                        Entropy (8bit):7.683023461403792
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:384:lQjIRpWOq6Bb/yv6+ZJHzh8xBXrIGRiBlpoT00CfOWazPf20HdlFRKnrMF515RX:lQkRpWOJRG98fEMiHao8rzP+0H/bag1f
                                                                                                                        MD5:71D3AAB3C5614482DFAC68060C791187
                                                                                                                        SHA1:13A6B67074CA1A67CE5560663579DCC437BBB1AD
                                                                                                                        SHA-256:7440ECE076C24BB632E790A5E07220430F5938A4F03DA6EE04CEDD319877605E
                                                                                                                        SHA-512:8DB6AD811D144710280187B0B3207366C7E5EE8B4492288DAFA440FAE004C19B064A18FC648B845FAD6F04A0062761729D5CC9179A8FC3207FC7072C35EC469F
                                                                                                                        Malicious:false
                                                                                                                        Preview:.R.{..*HH.......m..08F..F...X>...M...K....>....F..?.........YZ4.['..S&.tL.u<n.y~.g@dL.z.%}..k.P..j.U..p<..........I..35A...8...4...l0...P...:.q9.0...ub<........R."oP.E.d.....<...!....`|.....d...=E.;.q(....VE.9[..b.6......V7.......Zh.K'R..&.t..,<@.&~.gRdI.d.,}..{....j.U..$<W..C.....,..35A...K..)...10..P...:.q .<...2bd.........*.Ko-.:.C......X.H.I..'U.S.G.E..}p.F!J..% ._....(\.7t<a...)...D7I.....]Z+..'\.;&.t6..<=._~.g.d....|}.......j.U..q<Z..<..d.R..3'A....F...X...A0..P...:.qp.t...CbU.........u..oc.T.J.......W.qt3P..Z...&tW.OA.....pT.N6.............N....a7`.....hZ...'..D&.tL.s<g.c~.g-d..2.|}....i..j.U..}<....B...}.-..3@A...,...E....0..P...:.q7.....}by............oj.C.E.......0.a..E.~O.N]..K...m.=.~...^.@q'i....E5.../.%Yfe.7.......Zk.H'@..&.t^.q<d.d~.g.d..1.\}..v....j.U..Z<(...6.....P..3.A...,...;...R0...P..:.q7.=...Vbu........-.Ho..).C......X...[..2mk|?\...Z..p.}..t.....U|.+..c........{D7I.....]Z+..'\.;&.t6. <I.r~.g.d3.5.x}..8.E..j.U..X<........,...

                                                                                                                        C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.osmmui.msi.16.en-us.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):2834
                                                                                                                        Entropy (8bit):7.640060819503572
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:48:LChbQ877i9orO9zfgukg3LMOeZwVdupGE0N+4Bdok1cMIZncYEz574OkwkUw6:LChbSIczguNL/eGApGE0g4FcMIZcY4E+
                                                                                                                        MD5:9D8CD3198D322B12545BFDEE16AB44EA
                                                                                                                        SHA1:D809030EF90AB6AC057103F95F5DE568E77887E5
                                                                                                                        SHA-256:8E778F3A1DFCD29CE6063CB4FF675CC47EEED873C161668BC229C20B75D16C95
                                                                                                                        SHA-512:8BAB4F4846A517C843197C0C39DE8178C7C2E04914F543117DCCE71CB355A9108E64066E9AA3F1716B733A0A7AFC365444F1CF7E85F3255EEC355C0E20492343
                                                                                                                        Malicious:false
                                                                                                                        Preview:.0.=........A....sI"....O.5.a.........[..~;....R...%/4...W..MaJ.=bD<.pG;./.$].?.`..V.RS.fB....M'....A.....a.C..|)..Z.N&b%.....f)k...ug..... -C.....+......3TaQ,.~.......-..0..Z(.3 )..[M...u.`...+.#.:.-.J.*%..@..N..|'7.D..~C..X.M:J.=rDz.%Gd.l.}].?_`..V.RM.oB....My...G........a.C...)..Z.R&.%..O..f7k....(g$.... 4C..M....+...\.iT.QE........9..0..9..ww'...3.8,..?.s0}..:... e......Xo.-...5.3V....MHJ.=6D+.+GD.V.D].?R`...V.R..#B.....M ..........a.C...)..y..&'%.@..f7k....(g$.... #C.......+......:TqQ..E.......%..0.......X...gc..s........v..I6+jMM..B.W.*...f..7\....MmJ.=bD..tG;.9.#].?S`..V.Rp.\B....M@...).J.....a.C..G)..<. &<%.B..fyk....=g..... dC..I....+...N.gT$Qb.:....T.e..0......I..]\.'V.............d-..j.N.l..5|....g......E.M<J.=rDg.%G..o..].?W`...V.RH.cB.....Mw...E.f.....a.C..L)..h.]&^%..;..f.k....g5.... 3C.......+..w.^T(Q..o.......:..0..7......s...C..I6....W.f...y.T.Z..%%.......RM/..~....MyJ.='D..qGt.~..].?.`...V.R..7B.....M-....F.....a.C..z)

                                                                                                                        C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.osmuxmui.msi.16.en-us.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):6708
                                                                                                                        Entropy (8bit):7.651625344440868
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:192:MbLaQBtlpcgYhJrhgbs2CeYFxCervd10XM5HoZ+:32zpcPDhgbG9FAXrZ+
                                                                                                                        MD5:D907D2F31D2DDF492D7A1A898F871259
                                                                                                                        SHA1:F69A00F8DE1F8200BAB10192C48D3BE551A0989B
                                                                                                                        SHA-256:1E2CC8D3CE278617E20F410E9515A7AAA983FC81F4844DB86F03A0B2A37D2CF1
                                                                                                                        SHA-512:385648D112B5D505D926896BD133FEFAFC3A1E2F283CAADBB1FD9E21174DCA734A8F33356191F6BE68A032DB93E0DE4E6549D96CCDE599AFEC12C9C752735600
                                                                                                                        Malicious:false
                                                                                                                        Preview:w.Y.......Yw.....Q.>H...{.... .....mPx.zt:=...Y..I.....$#4h.....|.H&U.../.......~.........LH.V..f..t~be..o^....[..H6.b...A.....|.'$6....1...K...ZH..<H.T..2........R..Q.....<.....A..,<..5...g...`".....'....w.......x..:.$,4!....|.HsU...v.......l.........\H.....f[. ~;e..8^....>..H6....A...W|.'y6....1...K...Z...xHMT.J.........S..QJ....7..A.|....]S.. .I....Mc.{..8.:JL.{K..2.H9...j:.$y4t....|.H}U..O.....k.9.........H.Q..f...~.e...^....2..k6..'...A....A|.'y6....1.."K...ZJ...'H.T.."........S..Q^.......)#W..t...m...B..........".6....RR.o....#.}`:.$}4d....|.H"U...(.......~.........eH..1..f5..~fe..g^..`...6..<...A...b|.'l6.....1..K...ZY..~H_T.w...........PQ....n......+....OS........C.3.......#D.a.....za.)4:.$14 ....|.HsU....t.....k.j.........H.....fY.S~de..x^..k...z6.^...A....;|.'^6....1...K...Ze..GHfT..{........C..QZ....!..F...wX.......o..{d&.<y*.M?./N..i...6....i,.B:.$}4d......|.H'U.........d.2..........H.\..f..s~`e..o^..].

                                                                                                                        C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.outlookmui.msi.16.en-us.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):155542
                                                                                                                        Entropy (8bit):7.681970605738003
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:1536:JLS5b9L6oYq70tpHSNOL+XWs8PPyW2mFuMWzJu3ooOLzivwrYWt9dEDHP5s8Hm4K:tPoYqwfHSa+mTnyeiJBdWMYwdSH6X57
                                                                                                                        MD5:65492969830FFC7FA31A0E525C660B1D
                                                                                                                        SHA1:F4AE38636A3FCF64BEDF7FF637E0F2F02DA9A7A1
                                                                                                                        SHA-256:4F87C2037B3DBA213A19606499BEEEE7B6A693F326EA8C08EC1C173E164A3D86
                                                                                                                        SHA-512:643C5EEC835F04999118491FD816F86F26FB759838C8D6A387331985E040DECFA95AB328902A8AB70D4205F5E0ABD5E7F5319C3D44FAC860066CC9DF7D5F3471
                                                                                                                        Malicious:false
                                                                                                                        Preview:..q..S..[.!.p..gZQ.ufc.Ic........C..L.q..t....P.&.I..._.`s_....}.C...3...."........39....DR.....2...feC..i.........W..b.....:.^m..Wl$9.H9..`U...Z..k,..........,6.U;.!b>9.L.....$W..N.......Vq..6..C....D.4....p .....}"p._.`:_....}.CL..3.....".......-9......R..\..2..[f;C..d..u......%.|b......g.8m..sl#9.H ..`......./,2..t...u.S6.U*.&bo9.L5......7...I.f...Q.|.../?.p..6..K.!.3h.W.(N...*p._.`d_.....}.C...3....".......9.....qR.....2...fcC.;..5........Mb....U.8m..tl-9!H=..`B......w,d.......^..6.U...b29.L".hN.h....i.f.%..R.....V...r........b.g.@..&#.kp._.`&_....}.CQ..3....."......_9......R..(..2...fMC.....8........Xb.....^.1m..:lg9SHb..`...C...;,0..........6.U:.*bw9.L>.../j.9.........&..7dF...q>_..q7..).K..T{/./Mb=p._.`p_....}.CI..3.....".......09.....eR..U..2..\f&C............W..b.....J.vm..Fl59.H...`F..G...;,0..........6.U:.yb!9.L.k.gHt{......4.!h..\X^.rz...N.o.V.....a..GZ.3m,p._.`d_.....}.C,..3.....".......-9.....R.....2...fgC..i..`.

                                                                                                                        C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.powerpointmui.msi.16.en-us.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):38668
                                                                                                                        Entropy (8bit):7.686967076596579
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:768:lY8gY95qvsNUX6CPJgXxxijXJwXzkW38xH8PXUdxSdgMa8XUZN:l8Yb7hP4J8z5W8fUEL3aN
                                                                                                                        MD5:63CFFA5B59BA0A2E69D1715A7306272B
                                                                                                                        SHA1:6E000409E801E5ABDCAEDD89290F96C591F2340D
                                                                                                                        SHA-256:AD707CA04EC53A2AD56D5F798B227AF9157EBA2BFAEE1F234AA07097548E8B78
                                                                                                                        SHA-512:2090774D84EE94E37DDE049D1ECCA881E9BF87D5E4B2B16B28E43A563810A51F2709F587EE876406519D66636204B6E3A2239416003ABFF07AA0A15A4D3D913A
                                                                                                                        Malicious:false
                                                                                                                        Preview:.`......|...L.U..E..j.Z.mZb.F-...Y..X..,M0]...(..w..y.t.f.{U..~..8..h.D.=..Em...3r.%..U.......Y..f......D...{.>.....w8.......JU..q.."Bb.1...+o....=.RN.)o].. v.......:d..7>.,..R....$pv..8.rI.A.....<d.9..p.h...'E...@.(..D..f.{...~..(.h.D..~..E3..#r.%..K..........fG...........v.,.....w8......JH..q..DB?....'o....g..N@).].mv\.m....Ed..6>.,....!}.*.G{......|...2.h.FT....e...O.A.....1..ERV..f.{a..~..l.h.D..G..E>...kr.%..=.T.......f............K....a8.......J2..q...B..... o..X...tNk)v]...v=.0....>d...>.,.....3......X........?..C..YX.o.8.-8u..{.R.+.S\.v..f.{~..~..U..h.D.!..Em...zr.%....[....Y..f8.....I...w.*...z..8.......JJ..q..EB;....)o......VNU)Z].mv/.3....6d...>.,......q6c0%.e.G...=...F.z.h..[...[..}.+.U.sb.45|.i.k..f.{...~..(.h.D..n..Ec...kr.%....^....x..fU......o.....R...i..8......JW..q...Bm.R...vo..U...RNT)O]..&v.......sd..o>.,.....6.8..s1...{e..E....@Q}.e.o.Q....J.f....+S..f.{D..~..T..h.D.p..E...2r.%....M....Q..f......O.../.o..

                                                                                                                        C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.publishermui.msi.16.en-us.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):18398
                                                                                                                        Entropy (8bit):7.685356366456643
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:384:q0hXif3d6/c5xJi9mfbJezIccacAjTYfPeZZg9nQHIk1LLlzpe:t1iVL5ceZScAjTvtXRne
                                                                                                                        MD5:BEC66ED599AA799719431AAB4468335A
                                                                                                                        SHA1:CBA69F4CC1F7FC9570E91AFA71F98D3CE0A2A854
                                                                                                                        SHA-256:07F5B5316B20275991A4025557B5C13214DACDBC4322C84D7F4BF544E458DC1E
                                                                                                                        SHA-512:3EFA84F19A9663D4890D20EB6DEE9D3A91C97B91A3EE9E1AE828AB02CF4B4C515A9245735F7AC3D9ED817B4657A5D75C2A41DEA9EA50FE63B50B1572D7FE2D53
                                                                                                                        Malicious:false
                                                                                                                        Preview:)B..a.JG....X..i..+|....N.."tL.S!>.5".Uk.u._..9m...F...P..[....>vD.F..VU[..}....#.R.c.&....$$.C...nU$W......Qn.*.....5...H)l..D...\.G{....T.C...a.-aJ.=..>.O|.....b.<..n^.3E....cK$...j>-.>O.....4...9RS..rr.....}oe3.`.w..f\.P.........v.....V.[].#.....1.W.}./....$q....,UpW......Q|..*.....5a.RH4l........c{....M.O...&.ua".y.T>.O....`......nW.~E...4.f.t.?."..Y.9_09_.s..^X..3...I......'-...".4t\.P.o....jv.....V/[d....T.m..........$a.c...lU%W.....Q..*......5w..H6l..(....*{...|.q...@.AaE...$>.ON...(.l....nr.BE.......8.M.......S.R....M..E.&...}..(x..t..yH....N\.P.n....lv].P.V@[..2..W.g.....s....$'.K...bU%W......Q|..*.......5j.NH{l..:....t{....^.O...9./aW...X>.OZ...<.c.}..n.. E..z.../.`.f.Z.Dbh.P!M...2Z^.S.c.1).K..c..x.@?..g.-\.P........v_.F..VV[..q...x.E.^.o.[....$..o..!U.W......Qn..*.......5...H9l..,.....Q{....Z........a&.`.>>.Oe.../.H.?..nw.gE...V.....<.......1b.....%...B]....PK....A..8R.i\.P..).....VvW.O..Vh[......B.q.....s....$2.Y...UJW.....Q).*

                                                                                                                        C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.shared.Office.x-none.msi.16.x-none.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1128512
                                                                                                                        Entropy (8bit):7.714175754657222
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24576:icDa1diaNVmoCIz0YGiIJ3dldO7SNBtzcVwEVsuzUM+DfY+Rw:9azNdz0YJvaSUMKa
                                                                                                                        MD5:3BF9E9AAF537F45F9F4F568C5F8F032C
                                                                                                                        SHA1:54A3B2E5278ECF29662D839E5D1796D442885468
                                                                                                                        SHA-256:A7079B8CDC3CC3655052690FD4BA76006BA1A4E59BFFE9FC170785F639438AC1
                                                                                                                        SHA-512:DABE4B7111DC13B7B0EC57E96C697DDEDF21C8980EBB1D513302D135CDBD4C53D613A131781E88FEF2993BD61CCDF321107DA573B9A3474A3F26B98E707EE8FD
                                                                                                                        Malicious:false
                                                                                                                        Preview:.4.k.s.j..R=.... ]..f.D....*._.I3.....z...........4.'.R...d^.....,x.6_.S.}..z...G..<....x.e.b..O..>P....?.......79O....G.%..z....w\.n..^.oi._.1*..]...m.[..Dj.Bnc.k.N..L.8aJ.n..V.d...y..... ...zZ.IeL.-......oX.%f.A.-.l......d..dQ.E..px.6....".z...G..,....x.e.b.._..>..Y.X?S.N.Y..74O.c..G.%.tz}..j\.n..8.2i._.1&..Q..*....D...n9...'...3..a[.i.......\...p}...-...Y.:.-........5...E.b..5......l..d".....0x.6G.S.a..z...G..u....x.e.b..S..>K....?.......7kO..#.-G.%..YzL....\.n..8.:i._.1...Q...g....Dv.YnN.z.....t.ba..:..7..x..9j@}..xn..j..x..6.f...l.D...I%...%....:(.Z*..dP.Y..sx.6....;.z...G.C....x.e.b.....>x.].B?".G.]..73O....`G.%..BzY...!\.n..1.!i._.1...Y...(.8..Du.]nh.p.H..{..aJ.6......b...i...A....`.\...jni6.....?..V,3...w......Y..dV.B..px.6o...6.z...G.5....x.e.b..)..>z.D.A? .L.\..75O....rG.%..zE...h\.n..$..i._.1(.......(.=..Dy.Ynr.l.H...-..aM.n.........-n..@.I..i$...u%....X.BM.!\...m.....!..:.s..d..V...x.6P.p.f..z...G.$....x.e.b..0..>l.&.2?1.?.$..7BO....

                                                                                                                        C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.wordmui.msi.16.en-us.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):112724
                                                                                                                        Entropy (8bit):7.670046619777628
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:3072:0FRI7UZOZELpKV6oATm9WY5eMM/WpLpDCikmlj45c6P/axAMgt:+I75Z+cx0uMOpU9mCC+
                                                                                                                        MD5:71B7951BB9FA8EAFCC01533434861E71
                                                                                                                        SHA1:C792DC756FF09530B4CDD5633D61AB91F913C88A
                                                                                                                        SHA-256:5F2629CE60D00FC9FFD3FD013E9CA17BDD4432431E42E694E6BA16925303A477
                                                                                                                        SHA-512:6A1224DECB008F3451EA539147DE1CE762E1623F2295D769A8C27CC872331ED20E1BB02EDBE6BA9820DF1B4D2226502D52BADE86015B09194E9C72933F1F3721
                                                                                                                        Malicious:false
                                                                                                                        Preview:.9..2....(..d'?.4...]...f...i.w_-.."..w.D72...._z.......w5...9..B..b"..7....L...3...R........i....J....$...9.r..37.....r...y:*.o.Q....D.9H..sf....<....T(G}..D..B"..@7.Jz.2..P_.+5..j..p.Q......hW.e.}:|W......._....[ .0...p..B..bd.7........3...W......i..R.....D$....9.r...!7........-...g:w..... ..D.9Q..s<.....T.....(?}..9..B...@>..J....dd~..... q..,.N.j.L`.J.....@.......\.#F.`.2.e......B...bj.7...,....3....~......i.,.H....$....9.r...(7..........e:..5... ..D.9...sB....(....`(`}.w..B..(@...J..V..Z.=.T.Mx...T5A...3Bj1...........N..G8v.5......L...d..B...b7..7....J...3....^......i..-.O....$....9.r....W7.......p..&:J.....$..D.9F..s`.....Q....c(.}.y..B..*@...Jv.>,g.U..f.sW...Y...k....<....._..3=K.00.C.Sj.?..p..B..bv.7....H...3....]......i.5.`...#$....9.r...7......a...t:..G.S.h..D.9F..sq.........=(8}.....B...@>..J...<J)._.8g.k..>.B2.N....e.=.dP.....r..%n{.U....r2.e......B...bj.7.......3..-.Y......i....J...8$.....9.r..

                                                                                                                        C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\Microsoft_Office_Office Feature Updates Logon.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):5568
                                                                                                                        Entropy (8bit):7.6790711539925836
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:96:nk93Lq2cQNuqCDSXS5t8C5czgXhc/9+f6eNGYsbKqM2+1/2Ru+d2aajP8ZSLNyxh:khHNHCGXAtWzRhY6KsW/4B2aq8ZwM6O
                                                                                                                        MD5:2849300AF20B74E91EB8AE4E6A2E180A
                                                                                                                        SHA1:B767014D3F10C6C4FDF40C48CAD96F3D4D42B1BE
                                                                                                                        SHA-256:014F945A69B41EE202A012B3756B003CBB7BE1243F1D15D62C9F8147487E8694
                                                                                                                        SHA-512:F16DB81FD7696168335722479076DCC40E7AC511A900BBB474CC57D515A317C90F917B11DDEC41CD3F52E4B3C13702F5A43B40F0FC86E17E1855D49756687098
                                                                                                                        Malicious:false
                                                                                                                        Preview:8Fgm.E.....K.P5R.*v.\.U9.T...F.6..)4.......P.-.@WL.....cV72..6..x...k.N..q......<o.3I..:..F.5n..........XI..mH.aT...7.-......"..B..}.........JC.....X[y.x....."<..@g)........p.t?.'.g..0..%.O\....C......7q<E#G..w...At..~...:P.e2..s..x...k.N..9..@..<b.fI.f..F.5b..........X^..m@.rT...7"-......."....I}...'.....C.....[3.g.....b<..@6)...........%?....@....Q..|..Z...9.^z...L.....:....V.ev.].b...n2..'..x...k.N..j......<o.hI.5..F.5E...D.4....XH.Sm..6T...7`-......"..4..}....8.....C....j[}.~...A.@<...@L)..........g.k?.u.T..y....t........s.L...H..n...1.z../.f.....F2..-..x...k.N..w.. ..<g.gI.n..F.5...........X..`m,..T...7.-.......".....}....&.....C......K[n.y.....#<...@O).........{.z?.`...H.f.;dZ.0..w.{- ..j^...t..)..........D"...b2..:..x...k.N?.k......<u.oI.`..F.5"..........X...mN.gT...74-......."....E}...{..._C.....H[u.i..._.$<..@1).........a.v?@.)x.%.....:Gx....1...5......G...0...!M|......+2../..x...k.N..`...O..<n.|I..m..F.58..........X]..mG.rT...7c-

                                                                                                                        C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\Microsoft_Office_Office Feature Updates.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:PGP Secret Sub-key -
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):9264
                                                                                                                        Entropy (8bit):7.679117956740993
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:192:mDB4d4SVpXoyy+Q1ghNPcxbZ1p5oNtqhYc8l0IP30M:JXVpXoyvNhmZ1fQl0s0M
                                                                                                                        MD5:632AF5E5806BEE67EA3FE995DC386646
                                                                                                                        SHA1:ECDC2A2CBB2C0F71A4D7F8A4E365198611001FCD
                                                                                                                        SHA-256:7B4802260186223F4135D2199A2E7A5DE0DFEB0765307E2928DCCAF5ADFC9304
                                                                                                                        SHA-512:9202532E94EE3A7F7A128BE15899DADC3E152E6B07FDF4699D35E5C2D4E0359FF7442F9A92B4D0BDC7F75F026429D9A7A3D9E0162110BD40942893A7D3186868
                                                                                                                        Malicious:false
                                                                                                                        Preview:.8.:.T,.}F.u*..$U..t....[]....0....^....J-..,.e...|DE.... .:{...U.x,.#.].f.M.xl..../|.JC...`@.....&...XG....?L.p}(.?....<.....jv..5.v..r!.5..)...D....'....kE.\.%...`u..JL.F.v.p./$l.&~.D...e...e.,..|.o+AEf.k#.....6T..=nU.^....r.v{..U.xx.!.H.....>l....z|.J..a.#@...&...XG...(?D.pn(.?....U.B.D.2v.e.?.{r..;..)........A'F...qE.\.%..J`$..J@.K.v.p./ull.{...d....U[....)..9."...r...[.e.w...'..g.%....y.b{...U.x~.4.L.}.Q..l....t|.JL...Z@....&9..X\...y?...pq(.?...K.....mv.:.x.2r..9..)........7'....}E.\.%.."`^..J#....v.p./;l....vO..<...........}h\.....8[.kZ.4...)..-.....Q.l{...U.x..:.^.`...^l....{|.J..<..@.....&...XZ.U.J?(..pI(.?.....F.D.3v.4.y.>r..9..)......z..'....qE.\.%..&`]..Jk.I..v.p./*l-.f_.sA.. ............>2.F..r.B>.$.?.u..Y!...P...u.u{...U.xb.k.l.|.W.bl....s|.J.. .5@.....&...X[.K.3?J.p4(.?......G....v.i.:.grX.f..)....`.J..'....}E.\.%..X`#..J.....v.p./&la..D,C.C..6......JT+m.[]\.Y.7.~..6<.#.FkI..L.....<.f{...U.xo.=.].w.U.1l....`|.J..e.1@.....&...X]...#?C.p%(.?..

                                                                                                                        C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):6094176
                                                                                                                        Entropy (8bit):7.9759751040770634
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:98304:F2tzfPlcV2bRrDNQq24QMsVL8q55AnIzPoQ1d/fpkPXuOqugpJhoF9/9C7jYRx4z:MllcsY34sGq55+aos9fEXuUgWF9l48yz
                                                                                                                        MD5:A6A4CF5C8E35244D698EAB414C96EC03
                                                                                                                        SHA1:9EB43F066A3FD689B3BC774DC5DD37B924C0E3B8
                                                                                                                        SHA-256:86D10BFEA04E4FF483C038E00003C0EB9BA9BBA80D2E3A7C7EC0769173FCD64B
                                                                                                                        SHA-512:E3C5B818636C72CDBE48AFDD424C128FF955903A66A7157F8850B15B4C7DCF1AAC751B6C87D347B375F8F9C9F9564B90D1130AE670169DDF87795F896F5D887F
                                                                                                                        Malicious:false
                                                                                                                        Preview:...?..g...A!..q6.B.E......C..-1ds_EiD.']E....}.x....l...*..k31..W...?.jj[.ZD.q....nN..."#..+._.S.P~.:.*..=../.}..U..\....J..9k2J..O..@?L.i>..._..2..S...o..L..`...e.geIg...p.-..W..y.X...E.....r....R....T.....CYq...F.N;4O..jY..x.j...^....Qx..bW.X.....}....r..0....k._.(Pq5.am.<<'.....A.FNi.~..p.^1._Q..t`-..pO.8.#.i.X....]..';..C{.6.~.h....H.=.B....,GZ..=....g....B..W+...AwA...G........9X..x.....^.......bW.q....nN..."#[.+...V..}._.*..=../s|..P..r..\zk....Jf"..J.w?X>..b]`c.0y.P....=+..O...(m.si.h.mA.$...p..>.H.!../...x.%.E"....6....K.c..B.XN..f..+.1.].*..71.......zj[.ZD.q....nN..."#......S.P..:j ..=../.|..[..R.Svzk...<.e"..R.O/X>..I]`c.0y.P....=}+.O...(K.Yi.h.mAIg...p.....\. .|X.a..q..*..t4..~...*g.+...+.?5.........m*q..k.[..h.....jj[.ZD.q....n`..."#.j.._.S.P..:....=../.|..[..R,.v.E%...+f"..}.w?s>.K[]`..0y.P....=-..O..hEk...h.m..f..HM...;ER.C.s..o...H.w........kHO....u.~..K.3I.._..G*...k71.......jj..Z....u...n......#..+._.l.P~.:.*..=../.|.

                                                                                                                        C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):178441
                                                                                                                        Entropy (8bit):7.999037687236696
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:3072:DQkl5YqomsOmJGM9vi5Wh92yu19uXhGkEGizc7D7DbCYAZ4ZSTxjzW1P9O/XB:8kbY3m/mozAnWykkEpcHGY9Z4x/WJkPB
                                                                                                                        MD5:97F55EBD44A13D0F0CD6FCCE760AA2ED
                                                                                                                        SHA1:4D11DAEB4CA01C494B53B5752C88CC71DBB73170
                                                                                                                        SHA-256:D0EE72A0630BD023A31835E0E19549B88532128D20CDE5C06D7B332C6CA37B28
                                                                                                                        SHA-512:EB1C34E0C72C0C542657519CC59DFE120B27F424CA938007E80A82407B5AD0397F496ED13D079AB51738DE242BEBF6817BF59FCEC1BD7F5CEAAF0D59692AE1A8
                                                                                                                        Malicious:false
                                                                                                                        Preview:.....+.....(;.d.1q...JE2.>........'...r...C.y.e...`.o...O......*.F.~M.......N..#..$.)1.........(..J.D..BB......S......wI\.s.....oZ.....n.i'J\8......7.._..E&..I]w4...a.S...O.72.......g|g.]...=.m@.6`...G.&@^>........ .3.d..x....g.A..N.L..?............r...]....9!.A.hmC....v...|.../...fv.._.g..tC.I......(......\.,._..d......J..N....].j......!V........\[.8d...1.....FO....M.wzb`.U...2...:.m.@.m.j.U..m..G..S.[...8.{p.x. .Y.\.".K.^....+3.hl..*.]....-...'...5.j..&C..Q.m.[..E0.......+@,...._Ty..N......g...W......V.h..H.K.w!..g..;s...T....\.....Klc....;.q.Rkrx..j.fDerE.E.4.s%.6....R..e6....^.=..z..\.ee...+.q....6K....f..p?.U!..[,.G%.O1...*.Q...3JR$'.(f..J{.....[+/i..A..z.z.a(.....Cbb3.N_ a.6}.a.i...[.....;.....1.t...}h.I.{x.b.$...d.B.w.I.9...Z....:wG..I...P.q.........3.8.......D.5s.*.&L.~mq>.!.*.;..r......3..&E.....:.dvS.c.H.<r......s~..a3.-....B..,.N.V..v0VhC.w&lu..].....*.....nG..@..Zl.s~.sw.....o#.}..2..-.~R/.....L..T...^$...;.g.~...y6...K..;.....v

                                                                                                                        C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\behavior.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):4041
                                                                                                                        Entropy (8bit):7.942899994667368
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:96:rd+v1tGCHykwl9lhgAR96NIguNSRm9VgOi78gYiFN:rEtXxIhjvJSm9KOFBg
                                                                                                                        MD5:6A1772613AEA2A35EC313B714370C9D0
                                                                                                                        SHA1:F95D4E262A3958CA6B4E3EB3D251B943CD98F9B3
                                                                                                                        SHA-256:E206936090687C6665551D6987BE4AE223D7D82BAA6037D44AFA8A1C4D355483
                                                                                                                        SHA-512:6AF00FCA5553DB0D31400DD6AB2D87C28F9CADAF6321BF9ED7742E75240D1FDAF1A17BA9B0E6C2DE22E7AB6762F89C6AFF80FE273003D3E7D200DCB016E5D22A
                                                                                                                        Malicious:false
                                                                                                                        Preview:..P[!...._.....Au..\.&.$..'j...K~....KNs.....,....1...O..3e.^.,....Sv.%<H.`A..][.N...0,..m...+.C..Z...E......R.....b.`...@.g......9..a.=.i{...s.n.t.... ..dq.R.q.....m....h.df.\..<....r......&).9j/.C....|T.Pi..<..IwKS..C.{..N.RQ.'5.I.:.....z.n/Y.;......FR.&bc...].. U.....[O..R.....D..`.|..B.Y4.....v....).2-...v.;.x....}..:-.Y.h....2.N......i..v.7U..B..T......w[.^.q8,...W...*@..I.. ..6O........}f.}.o....Sg.t}..|M.P|..Q.6tc..9X..b.B..W..JZ.....X....%.6..C.Gu.Y..I)...3.nF//.[.q.|.S...Af..3,...b...Z.f....D.db.a.Fe....o.....BgS.]T.>...>.:h~<..fk.S.....;}.....>,...,.....&.;n..,...9?.S..+v!..>P..dX...3..J.....O..i..`.4..V.Nu....Kc..P.".}2.D.X.).*.W.Ak..7;.F.n.....z.......<?.....w.kEc......w=.j..75W&...xju.UNUz.....3..N(..|.....*.T.b...Aw.%X...N.._}..S.H9m..o...QH......JK.....F..Y...."...Y.6.....e..w.!.`}.E.X._.\.!.C/..YC...'X.....{.....Y.ms.F.wc."..;.%_$.yq4.Z.d>.;[W..(.0.......;......}..I.....66.../....">.a{..^P..@f..B.xxD..=M..v.S..j...H.....^...3.

                                                                                                                        C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):61216
                                                                                                                        Entropy (8bit):7.997180691746045
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:1536:0wTMudtlnHRd/PEw0XWyxAyCZ353kQSwFTUgU2PtRkxsrcTh8A:0WMgtlP0wasyGFtDTxtRk8O8A
                                                                                                                        MD5:BBC67402C01045F11FFBA2342863F08B
                                                                                                                        SHA1:D96E90998CF7801908CF6975AD52F4ACA1437C7A
                                                                                                                        SHA-256:39693CFA7089D3D75CEAB0BE2F85CDE1C36AA3ACAD0B6BBFEE8516D0C52C0FA4
                                                                                                                        SHA-512:D3016983B81FFB73100F6D17440D07CC240D7154DC684EFB65D77824F1939EA0AA1A0DFA85A52B397509956F6D618409654A4A641C9C39AF382286281C456442
                                                                                                                        Malicious:false
                                                                                                                        Preview:.x..~.....&b...>..P.y>.t...p..*....%.Q.>..9...).fO...yU.j...N>..)\...RK....)wJ.UXK)\.......|cY.(......(K........L....r9....r.....p....`...R.h.;..c..B.aT,a..9F.....;7.x..FP..2....u.J..|D,.{..Ww}Q.d&..W9L\Bz...T'.Y.|I|.z....)..a,M.A.@tI..Y..&0{...d...o...?Q.H..*.c.\....\e..U[G.2f>.8._...XA......(.A.!...=.U..d.!./..";.9.0[..Q....J...x......cO..../..BJ3B.M....x.ej....'j/...YX}.a\Y.q.,\..m.S..N~..L.....c...C.J.xk2$k.^..;..tbYOx.......55{.6[...f..V../.|sG.H. z..4...x....v..S...~..Q;..$....7.8..A....w.<...h</......*Ci.S.._.....Z <...U..,d....o}.....E%....%.6...6O.........@s+v.E.z.......v.cY.}..!..{..^]V_h.mE..|..BD...E].."%...b6....:6......\I.\bj........GB{Aa..T.<.a._...Q..`GC...f2.gq......\F.4.$f.Od.C......|...(.8s.gO...i.n..G..m?........q.`^.D..cd.qC.E.~.........gmC...../{.....85...W@.f5...nEDT4...@t.c.K.V....#... #i...P....'..%>..s\I.cZ.=P.^1Hs.D.N...Y......1.s..LKQu..y&.e<r...*.."...yo...~...Sg.5.u...cR.P..%3.]q.{u.......Ffw....[...

                                                                                                                        C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):39737
                                                                                                                        Entropy (8bit):7.995019569450945
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:768:JOsZjl0aTMkFvjE5qWUY7ENCX1Wb0dhLEsy8uiXJfFWc/+LzV+izIPwVO:JODoiqa0CX1SmhXyCUcmLzMizIIVO
                                                                                                                        MD5:D0195B9F0F42F5EA5A7C0D48D25204D6
                                                                                                                        SHA1:94CC23F206B137B1B5B847F36299F15ECC7A629A
                                                                                                                        SHA-256:FD30DB2BDF4A16CCDCE5281C51C5A230551EEF1C1AB021A832959CCAED607910
                                                                                                                        SHA-512:3A54B597E06B3A2B4A3838891B494AAAB5BF70A3F092FD560376F07511AAD796E4C1703D317006635379A5C930788B03981C37823FDBB2ED1922DC999CB26925
                                                                                                                        Malicious:false
                                                                                                                        Preview:...1....d?./..@.!......Bi.(..*#q.)......z.Y=....3d_..^5.a+n. .b.>{o.c....)S/S@.z@..r.t...I{...n.....H`&.|.F.......;;"*.Tr].[[...JZ.Q.4...[I...Q...$.......B....P.#]....Z...nN..*..0...k....../..;.W{.F..d.+.u.aeg..!V.u......%.V.@Z....[tF....o...t$...l.....5..x...w.s+....y1y...'=....t8R....v..._..,......^.Q....nj..<@`...@&Lp....'Q..+ff....s,.J.X.g.(.H...vv*..I.D.o........ww.....8V...n...pk.,..d...rK.d...$"...X.i.n.....2).......L.W.p~...].y.k....t._.U....g.r.`gi..".&.......}.a.C..:....*a.hMO...~H..Xg].p|...9..n.._.u3t*.4..fc.SO..z...30)w.x...eD(...fE$M.B.2m.T....`VY.....j[...p.'.|.B.&.*.t......T.7...../..}^D...q...l..@...^..0.........04.=..[<..nGlQ<Q/..4.[!.j.......z...1..y.I*..i.sa.....^.@|.-..... ...,h.(R+.V6M3Q#...I....W..y../.l)8..@.'D..".R+.\...mK.b0..'.....|:.y.`..L./D..W[."5l..%..?...x.....dy...[.hy...AcL.>wjb.Z..w.+<I....SR.=R....x.M.+t..D.=...cV..*.}*`l..8-.v...9f..`.a`...}..2.(.-..f&.1.H2-.f....#.......@.....g+k8.3.c..?MP.?......^!......A

                                                                                                                        C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:SysEx File -
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):54187
                                                                                                                        Entropy (8bit):7.996880462171266
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:1536:fhokSdDfV3YFVihuZZvgFC1YbPxZVvT/XfwITnBD:pozdDfV3aSuZZvazxTQITBD
                                                                                                                        MD5:C5C3B1DBF0D41426D0F656148EBD520F
                                                                                                                        SHA1:69FCC553323BD7D2693D9419ED134B99873A1623
                                                                                                                        SHA-256:EFF5BFB82D627E19793D4108FA512E64B4AD3AF0455C0D42FF5C7BC1E8E3F2DA
                                                                                                                        SHA-512:D3129ECE031CCD4DAE72034312D95552E849415AE1073F1370E39BCD0F3B147B3FB5AF1F9868E05F688CD306ADDDBA99807590CB2EB4775BCDA3D0EFCCA13115
                                                                                                                        Malicious:false
                                                                                                                        Preview:.d.{&......?YV..q.}.4$d[..w........a.N.r....v.b..NcV.=..-.l X..N..l...=.. ..K.I..8.......=.G.I....K..=J.%T{...{.{..5.#)9..W{....MA%.....V....O........d.}..u.J|?...j)x..6...:2.6dKU.a......N.....!.v.V...ou...5DX&DK.."..x..3G...n.....*..51.....'3...ha.'.....r'.t......x..L...B..S4Wi.P.....0xh..."7D;...y...A)r........5'..R...p@...Tpi...... .\.i9g.0.f..[.U3.V)2..|*...C.t.A...z.8.........4..*..x.....9.K..=L. ..h!.I...z.He.NM. O.I..6.D.&.6W..q...1}\.A2`AB.l...H...n...B.Z.v...Q9..)Dm.H:T.O .v..s&...._M.....W.k.$..='.K....rK+Si.\..9...C......Q.7.....- S.-..._..F.c..s...".7..=".(z...$H.....J..IF.....D.n......~e6..<.G.r#4....B..".8.&..U..8..x..03|....K.*IZ..b.WV@m.0...........H%..y..a..T5q.z.@..l@.........y.0!o..;V....wP@y .$a3..3y..*...'^.7......Q..P.....Mx.U)..i'.Q.Q.4....#...Io.k~..D..Z.ec.......:...Z&...g. ...3...r.../.......q.+...U.hs.....@.g.....^..2.N@.6.{4..1!...tM=...i.w....][.'@...m.......L..~..%....,..]..7(~.nM..e&8.,@.v..$...U~2.(.!.

                                                                                                                        C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):178441
                                                                                                                        Entropy (8bit):7.999018587014047
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:3072:+ugIgbEj8nqthrxkYAGwmzLIHjUXVkfhagvrxlLie8JLvgmNErfdNFEAmGMHo6SW:+DIgbEwqthrxXemzLIHjMVMhhvjmbgc/
                                                                                                                        MD5:54BEC5E164DF2DC60E7F7E2CE4CBF152
                                                                                                                        SHA1:1B3C790305C0C7392F5154C6014ECEB2D30A3653
                                                                                                                        SHA-256:2F5C1CA7F4290D1226A9618148F274B556005BE4493C7478FE502F6C2E0874AD
                                                                                                                        SHA-512:F90D2B03E2FB9CE5963D40A6301FF35CE06D298A14511D3AEF0725FBCAFA4EBFF3678F368C96DA55E655CA00E1DED4388CBF77CBE77D430A24086845564D0E77
                                                                                                                        Malicious:false
                                                                                                                        Preview:ISWM.......~.../.^V?r..@.Q._V8I.5Y..o..U:....w~+..P...&'.2.*U...O.%+......g_..b........o.)M..m1r.LO.<Y=,*...R&.nsc.{.4.I?..l)U..;..YWV.(.r......X7I.T`.......... $..%.Y....tkt`.;....I+.T-..a...y...>.d....!.....3.&.,Y$\a+.3.\sPwZA&.K.!.0...h.E>.a4.<.h<...o...@.f..c...x{...I.a.`.........J.2.%..lFk<\..Hg.....y.....{..Q.e.../......J}.".T..=.....?.V(.!Pb..ku.c...B.m..[.L.....}..E....].Nw@e.B$.P. -.7#~..b./...pKj....:Tf"..*......m*`...xH..S{.>..<B=...._......L..7..x....ItO...P...p.G...l.d.I..:..j.N9.t._..a...odOg#h...5h6...KV..i:...~Hy.............Q.T...Gk.....+.#..T;.-z\s.:l=....^.....=.!x.9.....o*.d.....>.}>...g.*......e.....p....4.p...%Xzm.o.....e._..g.G.Q.].t.Z0...U.X.!....M.3..-....B.f.s.;Fp..?.AnX.J..Q!/;_..+;.....{.6..$........D....<;m.*...gG....u.<3.Y=:.q#.5.q.qt....!..s...e{ .......a\......{.5.&o.._.|......bW.m.O....u<7#y.z.).{......(..m=......zV.2p..F.y$.......I.\I.!:.5.....l..D...s2=....7..,.K3...n..&.^....=.C...E...SL.qY.:.

                                                                                                                        C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\behavior.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):2439
                                                                                                                        Entropy (8bit):7.900252392462915
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:48:n9ZKfdDZpP0Fn4oRfuEzL2cWmsJBdIV0VfMDAb9Q8TUyQQUyUIlHDT7C:n9AP84I2EzL8mEBCVTAbjTvUyrlH/2
                                                                                                                        MD5:C124F1D76C72EFF6E1AA24162B8C34E8
                                                                                                                        SHA1:C1CE7B36E3FA2CAB8F27AC9FF57F5C4F7864F192
                                                                                                                        SHA-256:A48079E9185C907806270B78F46D63D86CDB789B7E87BF64F7FD7367BC86D00D
                                                                                                                        SHA-512:251E024F95841F3202A1FCB153E3D40009DE48B7C8F1E242AFD6CC8B2991152628532BA1F4C803DE5BF97AA6BEF160E7436E36EAD961CC2B866042122B2BC5F0
                                                                                                                        Malicious:false
                                                                                                                        Preview:Qe....K.t..B..gY..u...4,Yg.h....b<....B..a....G..M5R...]Yd...... .Vi.Y,..........Y%.^..2W.@N9v....%O...h;.`....<..5Z..GU.....z)...;.6.\.u^5.;z.U....G...A...o<.J....>......l..<....d....`!>~...,e......&............6X.S...,q..|..m...p..M..U'....R.h....pR..qF..U6`...~*....h..0....>A.S....X.....";...;.s*Y.`_{./g.^....O...D...;O....W.~."...C.......eR.:~.$.....t.....H..@........Zx.-pA......$.E|#.m....0...*..`....B.-...R..Q..-..G.j3..v}.....-..|....w6.8S..GJ.....4(.].=.&f?.'.i.8o.S....F...-m......%.....8.........I]8E........$...r}*P...ha...-^..|.....n.h... ....r.Ps.X.......|....yU...0D.G.d...j$....;O.>........+[...~.....wy.5...^-..(.K.}..E....]..[...+m......-.....u../.....9.{"L....S\.!........W.WQ../.V..{^b...m0.C.3.,....e..ru.U'......&...[o!U..sG..7d,...kjJ...^..|.....j..<G..N....96.H..).}...bG/.8}.x....M..S..&.......+......d..:....SO.<C...."..x .......1w7RH...+..SA~.D.._...9l..j....g..]i.S/....@.:...B..Q..VP.C0q5..}kH....^..|.....j..<..

                                                                                                                        C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):39737
                                                                                                                        Entropy (8bit):7.994946662581196
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:768:kpwpYrmKrUJy1c/Z09Abu1V+88kdrhyZDWAO1O0g5q/rq/BJegA+u7:kpQYrmKrUJwAbh+DGSACg9BJ7A+M
                                                                                                                        MD5:7CC817070C898A6ED754F23A35AF8DEF
                                                                                                                        SHA1:D4BBE056C001C3C71F1429CBCC08DDA7A3ACB837
                                                                                                                        SHA-256:7E7CBCE7688FC95A6BB6682495716A642BFD1C4AF2097B95741DEDBF71A96F04
                                                                                                                        SHA-512:09B80A58DB58D439AD8B3FD7C2E4AB085D05E1EDB9BDA11196DE0EF9765FCF38A9FAF40702096D11F003F8DD2D60F55D97FB7EB6B11AF62BEE61CFFC525F5109
                                                                                                                        Malicious:false
                                                                                                                        Preview:..%..3.r..Hl..J..`&...,...j.....-....w..c~....".n....i..^@.p7qg..%<.[...CAO%..].g.|......;...3q........ .R/-.r.i.|%.*w...8...M.i..I9..8L.5yg.I..N~.[...\p..$.gJ.v:...u..!.|E.\f....I.j.i.;.n*=z?G..aAM....6.y.../4.4e..k.W80._.....?..FU.4WT.1..Ne.A.~.s$..t.5p...-,.......D.\A...N......0...1(..oZ. iO..z.......38..Q.\0~:.X..R..<..v.7...B....@..k..^,}..[.&....m..n./.y~\..............vu.....O..?$slE.W.....\H..].@K!..../.9.....t.L....M.Z...L.e.....q~7..9..w..5...^om..L.hE..\.7.fp..>T$;..+R...T._..C.`...#...k...~......G.....Wv..*...]...o.4....[Q..Th..]....W@...p}9n5.....f.....y".)...).=...4...r&R....(.....A.<. ...zS.}j..aD.....%..T..ch......F.0...+"#...F...u&..m.t6.......5...#Kq..^Hz.0.q.N....R.b..M.N(......4|.....O..].....5.G.... ..B.h..95*m.N]!.[..N.g)...w.....i.[...4.....'~...E.L.W..I.G.5...3....?.Xa=V....D....XD...HY.;.5.$.R..:.....E......=S....(s.............e.....tpK.r....>......y.%..1..x:.ID.pb...d....Z..o..R...O.Jr.c'.b.c..C..h.J..)....:..h,..

                                                                                                                        C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-GB\resource.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:OpenPGP Secret Key
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1901
                                                                                                                        Entropy (8bit):7.874232002160714
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:48:YLmHJ+P9wimqlF3NTPpDJTElf82Ci2aTtUSTrY:YLmHJ+PTF3NzpDJTEWi5yMs
                                                                                                                        MD5:B0E71F48630E024F1CF6A518231CF6EC
                                                                                                                        SHA1:ACF49F6A29BC2690EB4F35A14102946A668D6E12
                                                                                                                        SHA-256:918373C292312F36B2D6DEFC344B1D0A120A102DD20442C22C44331BE8637E9C
                                                                                                                        SHA-512:A8EB400F16ED55D8E6A20E269BDA4195B25D965D0AE83E2F6FB2A2FC08AC11F25DC9B7FA8B74E7634C692BE554965EA988195CA5FFC07A1319558F635A56EEB7
                                                                                                                        Malicious:false
                                                                                                                        Preview:.......K..>..:N...L{.??...6.g{.&J-Z.{j...U...........n......A`DI"...A.W..H<...[..p._.49..F.....J!.5.."..+:..w.O.|.?.).V..K...CN.......,..H....5..D/..V...l...X....`.2..7../.xg..p..3.\.}...Two..^..d.6...B...` ?.X..f...\nBR...AzCAlR..M.....B......E...(O..#W....Y...*.>4..3 .p...5.b.$...e..M.TN.......a..\........t........F..*.m....x..>.(w.$.g.~.W.o.......K.T...>..J.u..+.o*..e......."D..J.ZwHI?..........<......P.R.ys../J...._I..-.64..HC..#.O./.w.#...=QE..OR........Z...6..q...... ..A..@..#.\..*..j.>......(~.......8F..A...}`.|.M...g..%7.....'..4.'.s6..I..]vrr-H..+.....S1...X.@.R.ro..#W....Y...0.8... :..p...).b.'.Q..]...OR.......-..2..1...q.....n..M....b.4..3...'.x"c.9UlV..o.?^(.i..p....+.!./...V".2n..]).........I..^vIO-...O......B....Z..P...q8..l....C...=.}...$..R._.'.D.9.l..KH..PH......'..M....-..Vr....f..Z..^.g....=..e..,X.PY..M.../..{.....\Fq.+2..c..u2.....+@...@.8..L#.../^R>R..O..JJ.I;.7....j...48..8...].C...6.6)..,&..0.O.

                                                                                                                        C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\resource.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1886
                                                                                                                        Entropy (8bit):7.871469339128292
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:48:S1DDQc4raFy8Lxc4vbOsUa3jCwNp9UHDRu9C:SNDN4raA8Lhva4DeHDx
                                                                                                                        MD5:6BC15DE78E515755176B482EE1552F33
                                                                                                                        SHA1:BE17B1B8D294EA33355791DFB02559B1AC0A27EC
                                                                                                                        SHA-256:7A75A0C729A1B4F95E2719E3543FBC2D117202D7AB9F80D5997D60382C5AC8EB
                                                                                                                        SHA-512:E33648F5C6F7BCAD5771A5ABAE2D04B014240B7971F7BBAFA7BC12E1B27FC0BBEEBE006A795260D411BA383F24B92F448AC48DA1BA19B025CE547EAB03A862FF
                                                                                                                        Malicious:false
                                                                                                                        Preview:...$...l4.#.....G.$.wB....G.fJ;0......G..D..~.oP.4^....-lY...(fT*..H.6.W..T...Q....+e.r.6{jBR......];...]&..C..7G....i..;...........#.8=.H.t..;2..I...'O[.z$.ka..I".7......zF$.\&6...!.|Y.Ers..SL)._...gD......]z1.7.7O.a.>....ap\...f2.&.....-.]..[..J......x.f<.byjOA.......Tw....!.X.].j]..q..qj.9...G......, .^..S..`]..^...4^w.dc_Vv.._..6M.....*..F..s......J.....m..Z.3...Vm.......y.H.C{....../(....5{.i....-....L..$.....gHj!.2|wIG.......Wi.d._r..AG.....^Z.?1."...*..../.*v....'..ee..C..]kYj.c/.<....L.0......<.w;...E3.Hq.*NZ..H.wd`h.K%.x.2_. .S..>1...vZ......./+[...'(.D.....1.L..TN..`......aD)!.bjqIT.......D8..._(...W.mF....a.4v.%...BH... .qY....t..bl..D..C.Kp.m$>Oa..M/.%..0...=...}'..gW."....,'..+\..ZR(....2X.9W...&..frHYd..../-H.../:Vt.....*H\..S...+.....+e.n.~zw^\.....R}6.......WG.G`...#L."5.$....R...*. &.^..h..+o..D..A4C}..3.q(.B..2.....Ww?.....P..g..6...ude.m...^.{L..Iq...^.k.l..;..../+.....5/.r....eJk..Y3.w......7VZ+.b|s.F......B>...rD.D.

                                                                                                                        C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\tasks.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):15159
                                                                                                                        Entropy (8bit):7.900946606390418
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:384:/vH41IkGvKkvv42TN4oPwTO1sZirPmNVYceD:XYek2zvvXN4oYTTSPmNZeD
                                                                                                                        MD5:89D810013D895DE937D0A8A0A7038220
                                                                                                                        SHA1:E383E2217ACA57CE1451F8966EFB427A5C9DF04E
                                                                                                                        SHA-256:801FD49C2E3E9CCA186D1B06E20B329187344B488884F11908D8285ACFEBADAE
                                                                                                                        SHA-512:DD1E3D019A855D0E7FBD7F1C05E3FB178CD0E899402A2C0EFFBCA3D7EA9D012AB59F65E4D8A0F45367ED772B6F787A44F09B5EDBC44005CBC2B50F1A3C1FD4C4
                                                                                                                        Malicious:false
                                                                                                                        Preview:.zv..5..8.7H..i..G....@m..b...gd\.K.T|.MH(.D.O....-..&....AE...gR..".f.x....H......g..|..K4.._...w.[S:B...'.>L.'..). /4....r.E7...A.....@...7.$.."&a...|..@.d.2..I.zf.U.8....+.J.jyS....-7.Y..E...3..._OE..~!._.UR&..].r.k...M<}Ne....:5K....`.x...D.O......?.Dn..^...6....6.z.b..U.7.n2...}.:<o.....fPN....Y...l.d).>..0&n.F./......w...P(/.O....x.g.j.C6-x`.A9<....s...,...../`d..t.|b+.1...w..}Ne].._<@..h.m.w...........;..1..A%..1...&...u....j.p..d..`.*"......3.KzN..].....N$..r.z.elc...u....7.g..4z(/..Q}....6.*.wY..'?^.l.#@K{.9.b....2P.....t<Q.F.;].f..g..AMR.>,......p..:.G..?........W..>Q.k...b..<...g.iS0h.W.!..Z.f..-.sou....3.KzN........1.W4.8..{<-...N....-.w....`n.\.<....9.,.32...u.gk..Lp..%W'...d.\...0..6..G...kD7....2$..-.x_=..".M..$.l..W........W../].i...b..&...}.}O1[.D.h..o.j....kHL...[..>.....t....a..`.j.uun.U.5X.W.`.9...}./..Q}....x.g.j8.F|191.~.SX->T0...h.y..A..:.".qCP.D.8..*.{3.}Ny....."v..$.{..?....I...I..z.P(..S6..r...$.<.u..D.:."K.W..(

                                                                                                                        C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-GB\resource.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):2112
                                                                                                                        Entropy (8bit):7.873633392171359
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:48:dQgcqQ6oimBdywVz3fR8ooJlcrhhVNRCB60ECTypGRugN:dQgcqwTdr1oJ8NNL7rgN
                                                                                                                        MD5:C01C54C169F6CED014E764822929BCC2
                                                                                                                        SHA1:1C83FE8D6738EDC87E7B06400A54B84FD209253B
                                                                                                                        SHA-256:D2E216B3245DDF992AA719535BAA5D501FA37EB115B85EA1940E518E08652863
                                                                                                                        SHA-512:F611B40D0A07349752A4658C22137A4F05690FE45E547F0A590D379113E95F832C85F8142CB30DA8E9877D451F81C18EAE4577FD5DBBBDB634E797DAE540BE6B
                                                                                                                        Malicious:false
                                                                                                                        Preview:.%..)."i[`..s.......85.f.M..R5..............6.....<,.U...W7....r9....~.#...*..p...j.......wg...F;....W...m~...0.VsX...z... P.........d...6..MC...p.i..u.ID.1!.......^..TX..U0i.f{.C.:.o..F......_:.{x68GK.f/.o..O.....zv6$%W.v..7...i?...W4.#... ....M.M.......,(...Z5...\?.[J!0..*.LdB.....=..kJ.....A..j...=...Q....:.c..v.Nr.n7......G.P..N./..c.W.~...'$..r..L...c.|..R.q.fw......a.h......Rs....%.....p.`...*..v.Z.R......"z...G>....F...f...xA.?....?...,...'........)...*..W..@.t.~..u.K?.LN......._..^Y....xS..I!...$.>...g..=..1......|-q.[..[.......g.\.B.Sv..o>.._=.-...0..n.J.J.....k{...Z|....W...dc...,.Km......?..zO......C...J...?...V..K.%.!..y.Ys.5=...........R.5{.h..y.^5....3.{.*....BSwkm..'a.}x..j.'.M.....\.Ix....r3...M$.h....O...7.J.L......|6...B)....@...!...7.Q?M...x.......D........`...`..V..B.h.b..i..!. =........A...N.)x.@m.....(-.1....y.1.Y..o.ao.+.\...ox..w%y.p[p......H+....r8...4p.!....7..7.]..........4...G)....S...u0...(.Rf

                                                                                                                        C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\tasks.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):15660
                                                                                                                        Entropy (8bit):7.894698631609073
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:384:xPkidgHYK5YTVjHiYnoyB3pP1oqwkrLxiLDvbW73NFcx2Zc0l3n90SZwVJN:mnSziYfB3piqdHCbVI2N
                                                                                                                        MD5:C06991780086681020246AA74296052F
                                                                                                                        SHA1:21355374B4F127170E7B81C44587D6C8E59539B4
                                                                                                                        SHA-256:3E20108A047775E883283D0CE67B52E547B0633F83945E2D66C43D0C01518928
                                                                                                                        SHA-512:F30D02FE389275C9D0D8E465BC00E23A483A70BA3800A31125CC5788916CA80F01E8ED949976E7E479E476FBC312F87A5610540B15E5A1761B940862584220FD
                                                                                                                        Malicious:false
                                                                                                                        Preview:...5....K#...........p..;...z.9.zP.y..."..B.....bJ.?...i.]p...J.b.~.#.}..|^.z....T.J.d#......bT.!SVg..V..mas.A...;.ZB....%./....Ne.~?.&.e..........|.sN.'HJ.O...F..j..0MmA..."93.Gh.:b&..r.)......R.j.X....3.{....U..`d?.........k.@$...P...(.~P...gM.k.........r.[.....<..j..v.CZQ.)kd.W...u..\....v.b.S..Na.4...k.2.S.@...f.!.7z.+^J....b...)..q.:F....=2m4...5.AN...|..6?).tt...+_..9..)..\.B.+1...i.U..D2.Hb.....m.n.9.l.s...F.....C.V.p$......T.q..7..H..J5<....$........q.^...<.(1..:R{...%..Z].+.*../G\_...B..+..qZcA... ??=.2.l'[..kC.F.?..9...w.M..N........@.......k.2..W6.]r...W.|.~./.6..|..n......U...hu\....1..s..7.S.\.".4.@..y.GU....v.b.O...*.*1..k........^X.-.rF. _\.^..J......q.&....tvp....E.S...~....|.....(..`..(.."v....B8.W?..9..U$.]&.@.V.o.5.ci:..{O.s.....D.E.d"2.....1..s..7.S.\.>|q....(.GU....5......Oo.o..kNv.Q.B.....d.7..n......H...)..q.&....y{..a..]...7.6J.CX.6.p..D...t..1..Bg%.jq!...4.s..,[..p...j.x...lX:..~\.m,.......m.f<......1..s..7.S.\.>|q....d

                                                                                                                        C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\TELEMETRY.ASM-WINDOWSSQ.json.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):125
                                                                                                                        Entropy (8bit):6.4776278845928665
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:3:SWYxFKrpFS/qFOKiPhRqD5JGZS8uWMZ+nfMrQT+YS:SRxQrtFlipgeZuV+nEcm
                                                                                                                        MD5:A57C822802908BB1FA79D4A550ED892D
                                                                                                                        SHA1:E59DBF389CB79D06FB71E3572E1C5B17C55ADC17
                                                                                                                        SHA-256:2450F26F7F87E2749A8543F50B91BBE331AF530C9D3171C8571682DD30452466
                                                                                                                        SHA-512:83AE47469F7595EE87A1323370718651762624D451A0D268D87A2783217138960E1931928805AE04944E5574204F8E397D2D103BBE392D94C332F4113EAEAC85
                                                                                                                        Malicious:false
                                                                                                                        Preview:.[6..rc.........N.4...,..P..T.....r..TfK.`W.jb.j9)..s.Y5..M%c..mcg.....[....-.....#|q.xj5:.w......e.......n*..h.q.N&."..}.

                                                                                                                        C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.ASM-WindowsDefault.json.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):207785
                                                                                                                        Entropy (8bit):7.965011559551878
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:6144:G1ALlXe6hmgJD25gVet13Ol9Zsyc545bTDnDjh:tXeymgV25Wet13cZTci5bTDHh
                                                                                                                        MD5:A9404BB5BEE11D6FA136E87A9DC964CF
                                                                                                                        SHA1:BE32DCD1FA53D92A9C664567F2648A19D3F8B5A3
                                                                                                                        SHA-256:DA5169ED2FCDB8A91B155F941B7B16DF42648F0BAEE0DB2CCAC3387A6F4985E1
                                                                                                                        SHA-512:46893C2051DB9D609E25A99E25529BC58D6C21BBDA0553B2AD5F8583F23986BE8435DE95019205A39123A8D03C3AE6A8B4B8BCB17AD6917B62A9EB97ED13E6CE
                                                                                                                        Malicious:false
                                                                                                                        Preview:S.,.-...:....'.2c.)....A6.l*.s,...&(7A@tMWI.3..]g8J.U.2m|A.4X..%....v*.:.....}.L.... .....{.5).E~.b...{-.6V>i.)....!..Y...B.1..,...3(G...2......\]*.[........i.9%.u`..~?..<B1..|C.4..A.......E....-u..x......j...O9.c....$1Hq.+..Jy....t(.t.....:I.....|.....{.5)./U.w...:`.,\$n.....fm._...H.)..*...,cm..........$..y=........v./..nw..*t.Ol]..r.V.t....0....5o.s..?<K.!..HRr...d.......i.4mjg.>..xc....6..a..^...q.G..$..L.....w.>0.mw.`...,m.!g%|.3....fm.I.$.L.0..x...0jl..y.S...*.i6.k!.......q.d..n{..{"a.`.H....h<./A]HJ..ln{.Aa_.q.H....8|t.g.5O..C..J.yHuz.7...^....q>.z..t.....l....j.....y.<5..dz.v...cr.(C&x.&..G3u....._.6..l...$i~....>.......d%.Tt......k.>#. a..v3......q..U.i....C.19....r.S..nT..h".B...P.....P.u%'$.tX.Fi....lc.|.X..K.L.]..}.....{.?'..;!.p...5d. G8d.4.....Q6._.SL..i..!.../`}....?.......k#.6.......u.8'. F..{"&h...`....6.....m.g.,.....Y...1_.t..v.A.........$1Hq.+..Jy....t(.t.....:I.....|.....{.5)./L.E..30`..p%s.

                                                                                                                        C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.P-ARIA-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):193
                                                                                                                        Entropy (8bit):6.91730800864735
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:3:b/KeDIx/uxSbvDWAgdW/HFClDNAeKnenAfN4YQcz+L5Tub9tKmtCCA5ViMmKcDa4:GuAaSjBgKlm+XW8C9k9tKs0gn
                                                                                                                        MD5:FD1C126C46AFE22A1230B286D388F7BE
                                                                                                                        SHA1:97DD16A32AF24358FC48D5BD7CD03B1FD7D21098
                                                                                                                        SHA-256:E67953FB5ABAC7CE4385BC68672FE0537CF7D63DEFF4425E223F88A83AAE6ED8
                                                                                                                        SHA-512:D353E76096284CC6BB5FA8102018119E647501AA65774CDD93EF89E3AD2A1F5881A8859769DCD1D7DE58BAB252107A6FBE299B42F02E2DC4B01436BDEFA80F20
                                                                                                                        Malicious:false
                                                                                                                        Preview:..X.HR^~K..>.@w5.z0&z.U..6.x..H..sr.%...bo....^Z7..I..{).L=.,....-.Z..Z........2......S{....{......z.m.....7n=i......y..YUQ...2.D.h...d..[...GH|...?oQ....7o.....).K51.-.a)CMo...&x=h.._

                                                                                                                        C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.P-ARIA-4bb4d6f7cafc4e9292f972dca2dcde42-bd019ee8-e59c-4b0f-a02c-84e72157a3ef-7485.json.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):193
                                                                                                                        Entropy (8bit):6.890131259953899
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:6:eYZgzVz/GJ89TqFBT4SReUZwA5MY49Wnn:e7zgSmo2wy4Yn
                                                                                                                        MD5:3FE44355C02BFD6F27BF4F296BF312E8
                                                                                                                        SHA1:F6307D5A0E0B74CD27E69AAB0A050EB3EDA54A5F
                                                                                                                        SHA-256:2EA1DE587B25F0B1B445E69F9D953AFAED46D7265140E39957D6C5F878CCC56B
                                                                                                                        SHA-512:477C1A9E5572FFADEB1363E5B1A3D2264D135EE626AA6C84D249264566D2B73415F2AF17A33065DB7F35921D3E8C3DC71E36C4C871D6E9A0A18793E7980DCCA2
                                                                                                                        Malicious:false
                                                                                                                        Preview:.7..X....%.....Z...i0...5{...uN9.{..6.^Z..............}.e.d...hM6!...c......+.)...L.....f7..J../u.&...f.^.C.........F....w.3..Ps}b.3....../.o.....=.O.<.<"..,.3h.....].w.%Oz.zq.QK<.F

                                                                                                                        C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):193
                                                                                                                        Entropy (8bit):6.91033921088597
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:3:Bk45vjMqexQlWxe6em5t0sT9CoAOFQ/qGjrR7NYmPROWa4h4QRHElAk/SKuNJiMf:pbjexQ8xe6vTiSGfXFziuHElu/Df
                                                                                                                        MD5:8824DB3401A9CA0E24D33697A42AA417
                                                                                                                        SHA1:DFA2BC90A9E0F7A411A6226E2B30A306BAD27777
                                                                                                                        SHA-256:AAFEE4AE6E90B7E0513409C34DEC79A6193753520A65B0060A36CC4258D7CFFD
                                                                                                                        SHA-512:46823542DC1A5864C0CF316279098A3DBAA6D9579CAD80267E06EBE87FC61693CD34493C0BA2868AE144C46EF6D32F51DABC49D2B6A216F02E6067A356C807E8
                                                                                                                        Malicious:false
                                                                                                                        Preview:.....\...AI_...h.0p.....aKZ1....._,.A.C..<NQE<...)......*:U|e.W.....}.BliC..7....^Y...v..;I...<Faqs.....3XCJF..E...fH/...B*t..c.Di.I8@v?.Hb.CA.o(.;..6...%...7..*s:B.,.S..@.Q.f[.1.7?..

                                                                                                                        C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.P-ARIA-7005b72804a64fa4b2138faab88f877b-14cf798a-05a4-4b7b-9d02-4d99259ebd4a-7553.json.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):193
                                                                                                                        Entropy (8bit):6.9064278766778715
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:3:Sk1iGyevPlo4sk3QCEo4xQUVyQ8Mw2pSC+j/hsZsnuAUqztbv/OoW1nn:Sk1iletlsk4vv8MFSC+jaHAnxD6n
                                                                                                                        MD5:30617C3C2790A23DD7040372D3797F7B
                                                                                                                        SHA1:7584B45A8615B0586554D110D710B41B278706BF
                                                                                                                        SHA-256:AFD5DF9F73FDADD6085B1C8239D2C03C185E3C14C70A6B39E0EC79B960BECAA3
                                                                                                                        SHA-512:1813550DBB52133F850A16FE88D56B07FF6EE925B7740AD0C6C17C0B905A6414F66F8CFCE76B4E5E32395BB1907CC85000D830401933EF699A40E36966F64905
                                                                                                                        Malicious:false
                                                                                                                        Preview:.........b[.a.Q.. .W.;..._!.~F w?..I...Qh......x1.d8.."<....c...5..)V....Q...U..{.iGSO..\.F9........M.W..\..^.m...L.us3.F&.&.4.{..... C....V...^...*ody..]f.....Mn8./.I...@.51.S.W=Q.QYB...

                                                                                                                        C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.P-ARIA-af397ef28e484961ba48646a5d38cf54-77418283-d6f6-4a90-b0c8-37e0f5e7b087-7425.json.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):193
                                                                                                                        Entropy (8bit):6.9349759336951085
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:3:lzwuZz8CCCSjQ1sMrciqsTS4d/LRI8QTQgCFhmUB/UMxnMRr8/25b0hkMdylCqn:GSxCCCoPThdDR0xGhmUtdM8eb0h3wX
                                                                                                                        MD5:5620AA71A7D1C64F60AE530A28474322
                                                                                                                        SHA1:8609D08037C3C2AE3E90733A32D45D7FA49F00EB
                                                                                                                        SHA-256:312CB5E11F4647267278416066F5C9D55696C0872955C7C034927B438E20923A
                                                                                                                        SHA-512:3101DF2BCE0BACACD9733AFA084E11E664E514D2A56F2448F330220C8FCA3A65ABC5F82A656723216D2ACCE811DD5A1308F05F13D8E837B52A2CD047C26AB676
                                                                                                                        Malicious:false
                                                                                                                        Preview:....3..'A......>..........7c.^.../l...r..N..).R@.Ry..O.....g.}[...C..re..6k.n.:!.x..|C.WY..t^q.......c!...r......q..}.......p....bx8'4.@........o.....jb.^.h{Dn....9<g..s...*YB......O

                                                                                                                        C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.P-ARIA-d5a8f02229be41efb047bd8f883ba799-59258264-451c-4459-8c09-75d7d721219a-7112.json.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):193
                                                                                                                        Entropy (8bit):7.044402956901134
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:3:Nw9OcBtNyX67om/KE33MBb/f3MnKiBLRDLUPm3ZIaHMY/OhkJhS7kbnxj+x5:mMcbNyX+wM3MBAn5dRD4PAZzXdJE+l+/
                                                                                                                        MD5:C65348BA5DB31DC10F86D30063DA735A
                                                                                                                        SHA1:E225F635E1531B625C54B76D03A9AFCF47F210EA
                                                                                                                        SHA-256:AAD863A5AB63824C3E70D220E4EE06F6F0FB332DBC828632664B8EB432C6198E
                                                                                                                        SHA-512:CBBDE4A4DF26EC4556D6F5F6CD1DDCFA15787FB1F44B60BA6699CE64218F48D1B8D1310547666D1475908D8C0B2CB96C4AF1F5D9D92966BB345EDC8E2B1DE0C1
                                                                                                                        Malicious:false
                                                                                                                        Preview:8.._8..k.2;.. ...[2.........G..O....mb.....+.....I0..,..Z.$cV%.:.:-..a7X...R........s...u.P.h^`C5/G8.K...CWT.f.......>.....G.mU.bo).B....2.t.o.kD...OD=..w.8.r.+.3.>......c.....T\

                                                                                                                        C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.P-Eco3PTelDefault.json.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):129
                                                                                                                        Entropy (8bit):6.664290143003373
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:3:BNYVomh5VebVu9hNZ/VWDWyBEsenJLW:LIDvebVu9hNZ/CWyBE1W
                                                                                                                        MD5:982A4FF69AD4DD229224473FF1E13269
                                                                                                                        SHA1:3E72584534F81B75114E08847854EE3680A6E5C3
                                                                                                                        SHA-256:FBF73A86E0A3521CB8CBF151BEE2FFFB74969DF92F0A4FABAAE0AAF134232994
                                                                                                                        SHA-512:1A5FD11BF288239FFF8E0F4D091AE79784DF4CA45EA29102C74AF855692F2164C78C8C89C04CEFFCB5A04B0729B87338FE10A1FBE8B18FC96B3DEC09DF1F07FF
                                                                                                                        Malicious:false
                                                                                                                        Preview:.xD`..6 b.=...^...?.g8...P,.k.[.d9.L.-.eUw.>.`.K.N...]..<.b.n..........wf......0l...y....;.2.d........#V8!...?..3a..#.hqG.P.

                                                                                                                        C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.allow.json.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):2664824
                                                                                                                        Entropy (8bit):7.962861489410977
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24576:0XdSYm0IOQijTvVRJw5X7ETpqz7lmYNgO27XPZjNvMsRBxQCuja0ccFQ63R14VMW:0465lWbVDt15ovwy7qSkLyVV
                                                                                                                        MD5:CD0989FA981694ACD16EE1617F5C227F
                                                                                                                        SHA1:327349721704911A1779527B9B287E899DF04276
                                                                                                                        SHA-256:6B60EA21BB779AAC8A4E30D086EC7CDECF742342E1142DDD969AA1F8DFD50E77
                                                                                                                        SHA-512:37405C0996018352BF26C48D14F30A48D9475BABEA2F9632A9ED8C009BA97D7259151D50BC62A6192918DBE3490AD8CA56020B727D45E7B5A034B9C7C5E7A58D
                                                                                                                        Malicious:false
                                                                                                                        Preview:[...:....2.?..U._...p..{.6"0M..F-..$3i.a..=.~....ZC. ..........J..........>...U}.... R.].}.t..B.=..$.^v..L*&.R...p...n........EN..Y.)...s8.5..3...D.W.....Mg....$..G...X..M.Uu.J....|..D...l.p.wS....l._ =O..VO.....e....jRq...............^.F.)....7......$....".s..X. ..R.d8..5X>.h...V.Cs.....DC..Y.3...t?.+..W~........!...98G...h.P....X....[....}[j...l^.}n...6;.O[m:W..M..~.G........^.....(....J....C.".n.t.P.......nH.F.4.=....q..$..5..#@t.}..."..Un.......-rgN_..`VB.*f\..."x......Y.v...ww.X.7...^........U...7.H..x...Y..Gn....F."...;.)'.....|a...[.,.E..c...G...R....'.'.5._.\i.....|.....0....q..j.@v...#.&.y.a..6E.....[.UGG..4...O......;......U...YD\K..~..G...X.UT..-....... A.G..m...*7.*.......z..:yVGy7.yP........_...........H.K.<.D..4..... Q...k.7.s.k..@.gl..-N&.h..."..M6.E.....UB..Y.;... tB5...%...fy..6...!8_J........;.[...'...:p..B..V..N..j5.!..I.....=.ui.6.......................P...5.S.D.....n..O.%.i.......j.J#..?R4.;...1

                                                                                                                        C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.app.json.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):153956
                                                                                                                        Entropy (8bit):7.973545813404772
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:3072:KG3nDdGadR+ThmzEvTD0fB4WuLsTZkagI9pqW0tXo/D+YdkZ649I72g6a8DIYRl:KkDdGaiT4zwD0FKiZkagI9p+tE+YdmH5
                                                                                                                        MD5:EC67FCB5B217796283A9E33247910D4F
                                                                                                                        SHA1:76AF2EDF3A790D848548674AA780711534974CBD
                                                                                                                        SHA-256:1F733EA596320DA9E5F99C20A8D530207B056ECB9ED30C64053337CA7C56DE87
                                                                                                                        SHA-512:2DC6E6EE13CB4EC934CF84A05049EC4F782446ED1547FBA87F0BD434BA638749E5C8ECAA322A83DB0D551D7098CBDA7D5A31540D2617A71FD0726A763A68F45A
                                                                                                                        Malicious:false
                                                                                                                        Preview:....8..z.2..E..Mc.J.w.`.:.<...j......`.{[....W..$.|W:R~....jW..en..f4.B.]..6.;.I.....P.j..%..r.\..s.n.2W..%....o!..:.............}i......>v.b?F.^dK_.....e.}..4.T.;.2<..Yv.qy.l...v%?x....P..#.../3/..&.W.O..........`.l.L..>-...........9z.n.`~.?.o.X.D...B.#..$.>"...C*...H...V.c..................PC...tb.*~.#k...6..^........ZbY.8.S3...>....v......+...J:t.'.od...p...,W:..d<7+.l..f..J lh%.nq]m....G..r*..7m.....L.7Zh.^.....C.q..".c/.......Y.DY....+....M..F......].......'w.*x.s8KGV1Y.@....e....M.-.".33..]r.cy....E..vS..)^..fOxZ.Q.>.......yK$\.<...gfU...*c.n...G..>*..6p.......(.;........."..x.ox...E+...D...V.,..................Q...ui.%a.scLXU7.I...w....:.".Z.(&..&o.i}.k.mv...q7..D,....k..A}b.....D?.MR4z..nH.._..W..n.."F......;(...q.J.....4.3...Z.....p..!.cx.Y..p....B]..T.+..................UC..lb..z."8.D.8......"....o.#.[.MD...>n.d....O...K.1.......9r..v./.A.W(.%....-.....y.eLf|`...>N....{`..}*..5!.......<.>...Z.....s..%.n}....*....$9..Z....o!

                                                                                                                        C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.cert.json.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):3803
                                                                                                                        Entropy (8bit):7.93838571401514
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:96:hGDtpngDrPTvSMVf32HFfG/IJ3ERzj7VME6DuP4O2c:sDHgDrTaM52l+/xRz6DuAO2c
                                                                                                                        MD5:6568114D400410C3E29D07952A035651
                                                                                                                        SHA1:66F8C7ECAD21FF8DF5F8AFE50EC6EA4E9B5B78E2
                                                                                                                        SHA-256:9B57F4C39ECD8F2ED8EE3A863FAC406D276CF30B08D3BA8F8364C3C568978B86
                                                                                                                        SHA-512:373648B3E7005CC77E6572C058440F103879C38550C70E151DEAA9E98E2308336598326EFC4E187AA9A5F20386E387E308272F831A637F1367B968C8F5D6DA9B
                                                                                                                        Malicious:false
                                                                                                                        Preview:....B.R5,.<>...m......py9n6.mhkW6@...T..U...y..TN9..W:l..=..a...a.ef.$.yv+..Ns] G..........A..]{P.6R....qi.4.3.....g9...0.....u..>:.bC..<.*h|.[..S!:..<.g......d..b..:]...@...%.4.,(JJ.eP&v'..l...."....'C.L.C.L).C.....(..@L..>t.,.B..,\......Hu...$`#L.u+.....'|:J.[b..:.....J........dn.......E..:5.nc....ngK...r%.j1...6)_.z.......I..aU...2....)...df.{..d...#...L..,.:,;.7.a....!.}...O.;r...^.2J...d.."Y.j....@F...+d#J.J$.....'j,k.s=b.9b...bV.0.e...hq:......}.&..HN....ncK..x....(y...A.W.....6k.%3....E....%...|.P....2..3.Qe...X...'..%l@K..P._...D..I.B;G...t...b......do-...Xo=<..Y..... r)R.Jfg.hv.....Y...a...mx8..M...!..N..ev..Y.kmO..A<.J..9..&J.m......6_..)Z...u.... .#..h..L.V...A....D...~.{.=.c.....P../.JQ.uj..H..}4{...I..DB.g'.0.N13...\^Y:z+......].v.uIF..^....L.2.&...;C+.......-...u.qE..C.d....M..I.&..4.A.f....g..\. =a...n.........N.v.a@....i.{._7....4.`w-.bwCRI}8G.&H?1...{S.j.5J.n../.X{.....P.65{?.....i4R..i..j.....O..._.....W

                                                                                                                        C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.privacy.json.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):2954840
                                                                                                                        Entropy (8bit):7.970709275134416
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24576:t0gkWd9QQrt07EFNojgx3HQG1MueOPH89uq41Hc14iCyRUV73Co9t9BLBkFX3tCs:tld9p6wdx3w+MvUBA/UVOo39Nc9CNi
                                                                                                                        MD5:CE04BF24BBFBA75ECB9D94CF93FE82E7
                                                                                                                        SHA1:14EED77CE11E2A2BB3FE29F6478D32573E3DC410
                                                                                                                        SHA-256:F6210C643DC6FFC47736F7EFB63935521F6B4A45F458404B945C09A5A2C6514A
                                                                                                                        SHA-512:0DF2E8ACF35B7D76C89F599794E6F82E3563A554592462C1AE7B9D6A36457C79429E1FB2C4441CCB9C59FF897AB106F30BFBB0E55D146A4524228AFA64DBF06E
                                                                                                                        Malicious:false
                                                                                                                        Preview:.......`..S....G8.a.;.c....EX0.8.R.f.}~4....A>.,.+.;..u.[.....-LWE!.sZ..r....P.R#!..iM.......(kS.....~.Hd.Q.'P.|....2.s..e......WrK...:,dP..Q.;IiEh.@...)..CP?.x.v...|........b.t.n.......r......I..|t.8.}{.`.}x..zD%U,F.>............/WU.t.."B.9.........x..'I.......~qX........l.yF.(.?:;h]...F...P"....WdK...;=/......i\.|.Z..51..P[?.7.H...pJ....K.. .q{..J..Z..e!....#..{.q....(..}. ....T..IGdx...,)/...._X.!..PM..n....K...by./h........(".$.......'.h..0.a.k+....`.(.Q4......g<...<1{_..D.UZKXe.B.$~..TQv.H....Q$.......,.zd......fq..{\..@.&.VWF~.L.N.a....2.MU.....(O......Q....Z......,...o........x=..5........ia.[......q.yH.<.kG.T...*.s..".....j....!(/.....M&.G`.I..g<..EK2.|....0.....F..t.p...E(.....cA%..0&..)......c....7..lV..c.&..q!........[..u..S...7A..S..X.... \........z:.C.......d.p..0.v.=sP...'.F..5...Or9...;;yp.....d.bR....u1..G^7.~.....1....K..). KM..w..'..\.....xCm.fx...=...Z7,j*..\".j....U.N..B.Z..."O..sA...U...e:..ih......s".[.....b.(..!.C)q%.

                                                                                                                        C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.tracing.json.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):113
                                                                                                                        Entropy (8bit):6.5480118163783585
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:3:i665+rdsSW1qau5rEVmUkqtxN4ezrrtj1:i65TWgavm9qtxPp1
                                                                                                                        MD5:F1A6A852E9B4E00E7A31EEFA513F8052
                                                                                                                        SHA1:AD25D92FB76D746135FE3EB58399B0B3646F8340
                                                                                                                        SHA-256:449C4F9ADCA6128E02BBA2C76BB732AF66D0454BF29B5EAEC40D90B7959717DB
                                                                                                                        SHA-512:567FD423408DE273BB7F368525E80BFD7AFB3C3BA0185631076937B1709AF1440385F5260B10CDBA76F6B91DB985144691F6071D85B92E090253C6E0E190FC25
                                                                                                                        Malicious:false
                                                                                                                        Preview:...4..V+...#h...L.[T....}U...[#..u..*.HO1..(.N.g..6..|...7....\..r.M.X..LmS~'e*.F...W.......JNxLCy._.w;'8.w..

                                                                                                                        C:\ProgramData\Microsoft\Diagnosis\ETLLogs\ShutdownLogger\Diagtrack-Listener.etl.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):360472
                                                                                                                        Entropy (8bit):7.618294965849231
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:6144:PqD0YfWasJJ704m4TnNSDwdV4h7g3vxX8T:PqD0YfWazT4jRdxB8T
                                                                                                                        MD5:E278AA89E6C33C7DCE55E7C44815BC10
                                                                                                                        SHA1:9C765A6FC65A896F53263F15CA938593FD420C85
                                                                                                                        SHA-256:96F124F03BCB230B26CD14DB706B235BC0C450CF7BC49D535A336B11236A1C54
                                                                                                                        SHA-512:CC6AB4A0A5E846F2213CB7226E71E1564AB4A5593A5C0DC37C2C4FC84DB452E6847AB3D8499F275F07B7CF7BCA916E03A9320C2C1B1C8C4E1AA086C53E49D440
                                                                                                                        Malicious:false
                                                                                                                        Preview:./.q..n..5M..T....a.....53...4@...........;...h.;..4....9MA..Je.o^.o...8}.......l%J...]....a1...H..|k.7..9..1......!....g..5..)......Q....=x...R.B.....&..yt.....<....;F....J._X.o5....w....-.\p.<..!z..<.".<.?j...._.....9.C...g.gZ.o...8}.......l.M...]....a1...H..|k....X.1..b..R...g....&...N..U..fm.x...R.B.....&..yu.....>.....y..K...R....:..........3.j.....Q..4..+|r...>..MG+...9.C..g.o$.....K}=......l.J...]....a1...H..|k.......1......!....g..7.....}..U..........6.9F.%...H..yu..=$ ..".....{..K.)...).Q*..|..J...B..>:.....f.....y....Mm.R...~..9.C..g.o?......}_......l@J..]...."1#..H...k...j.1..T..U.....g..T.y........!..."mlx....<.-....&...y!.V...Q......(..K..]..Rz..(m@..@w!./..f[..E.,13.{A{.j.....59.f./...9.C..g.o......_}v......lLJ..]....1z..H..0k...l.1..u.........g..5..)......Q....=x...R.B.....&..yu.....>.......{..KA[?...20Fm\.(..6.7.+..X,..*.....\..a.F....3G....9.C...g.o^.o...8}........J.......a1...HE.v.0.E.H........e.

                                                                                                                        C:\ProgramData\Microsoft\Diagnosis\EventStore.db.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):146456
                                                                                                                        Entropy (8bit):7.9688338215523
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:3072:AotFFxrIspHnf2MtQr2JDrI0olYIoOXsZcXd/dWDAr0VcT:A8JMspH/yreDrrGCcJdv
                                                                                                                        MD5:B8C146F63879CF31A8E0572331BF1EB3
                                                                                                                        SHA1:027AC7F6DB00E42DECC7B2CA0C87D3860897F13F
                                                                                                                        SHA-256:1A3E38EF1123AAC63344B8B9A8B978E68F9CF27E166BEE5B6A39357C9CEBBA75
                                                                                                                        SHA-512:F672B487DA1FAF74F22496A7B984C5A7E77F24C691DAEC263C77CAF87A365ACE1D30F408522F14DF6612EA2F6DDF6E38493D61255F49F7F0CA48AAD799054D86
                                                                                                                        Malicious:false
                                                                                                                        Preview:....N...`.0E...j..7...;}...~.<7....B.5.^.^.t-.^...4..........B...E.(...rq...W.5;.j{....a....:<...z>........".l..:.....q5.n f.O`..E-...8`.....w...^..C....."b..).d..)..X..\......I..-h..0..g.[.....q4.K......^"t*.f..).3.35.S..J..<..0.h.e.(...pq.<1W.5..j{....h....:<...z>........".n..:.....q5.n f.O`..E-...8`.....b...S..C....._hx...*..)..X..\....tR.}.S....vQ.^..."....brW.Ww.*.'z:`v.8.......b..J..<..0.h.e.(...pq.<1W.5..j{....h....:<...z>........".n..:.....q5.n f.O`..E-...8`.....b...S..C....._hx...*..)..X..\...........R.[(........K.Q........`......H^.@<{..J..<..0.h.e.(...pq.<1W.5..j{....h....:<...z>........".n..:.....q5.n f.O`..E-...8`.....b...S..C....._hx...*..)..X..\..... t...i..f....d.Vi$.*u...&~Y...6...&!!\t.,zDw._..J..<..0.h.e.(...pq.<1W.5..j{....h....:<...z>........".n..:.....q5.n f.O`..E-...8`.....b...S..C....._hx...*..)..X..\.......N..W.........6...Ig$.X1...P2.dK........|WUs..J..<..0.h.e.(...pq.<1W.5..j{....h....:<...z>........".n..

                                                                                                                        C:\ProgramData\Microsoft\Diagnosis\ScenariosSqlStore\EventStore.db.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):45080
                                                                                                                        Entropy (8bit):7.443568415332195
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:384:DF1Sw0W1v0Cu15UaNHGJsVhDUJ2iKix66oV7oX/Ms6:DCw3v7u12aDHI2iKix66dXQ
                                                                                                                        MD5:2B02DC6958D879291569D5A19E32DA4A
                                                                                                                        SHA1:96E3C07C504391F118BCA3353892F3694B618DEE
                                                                                                                        SHA-256:CB845E41008E09E1847D9C25A69F9F926C3B9185A41466CC1CD5C7D7EF4156B8
                                                                                                                        SHA-512:3A3C323C0683D361F9F2370E167924787CFCCB9A2906AE52D01FFE7C1D9AAF97B58DD034DA9DD95B1ED92E8685B21CC5DD2F51EDBA016E19A8DDF2CA4D943199
                                                                                                                        Malicious:false
                                                                                                                        Preview:.A..........(/.....{.....E."..+'P&C...".!...U.a.:v/...X.2^..6/Zt.E7..Y.T...D.X....Cc...m".P.....^.>.F....6.k..Q..Z..v...}[k..LA.... ?~H...;bW..or.....ko.h..{. .k.En..B.M.....$d.d..`5H.{.Q...??$.:6~^...........q.]@0.)..k....X..U~7...I5..$C.5Y.T....8x....Cc...m".P.....Y.>.B....6.k..S..Z..v...}[k..LA.... ?~H...;bW..or.....cb.h..y1 .2..d..*.....=.$d.d......[8.5"....o..."...!.....:.mv.q".."..:}...T.U~7...I5..$C.5Y.T....8x....Cc...m".P.....Y.>.B....6.k..S..Z..v...}[k..LA.... ?~H...;bW..or.....cb.h..y1 .2..d..*.....=.$d.d.......:.^.Z8..uXNr.D.z.9TG.a....9._<.........M..U~7...I5..$C.5Y.T....8x....Cc...m".P.....Y.>.B....6.k..S..Z..v...}[k..LA.... ?~H...;bW..or.....cb.h..y1 .2..d..*.....=.$d.d..vP[(.F...7-..H....+......rB.n.K..oM..9l..Q.#.l.U~7...I5..$C.5Y.T....8x....Cc...m".P.....Y.>.B....6.k..S..Z..v...}[k..LA.... ?~H...;bW..or.....cb.h..y1 .2..d..*.....=.$d.d....W....*r0...oY..o.0j..H.&b..n.L..u.r.....3..U~7...I5..$C.5Y.T....8x....Cc...m".P.....Y.>.B....6.[...j..+.

                                                                                                                        C:\ProgramData\Microsoft\Diagnosis\TenantStorage\P-ARIA\EventStore.db.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):39448
                                                                                                                        Entropy (8bit):7.719318045011643
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:768:PsCvCU/W53jMWJQtlTQbe7Tjweo0oGpjd7HsTP4InJxDxUCLRjcFR0le3/gGectI:EWjU08yXE1cO1T
                                                                                                                        MD5:5D1D1937DF872B91114EA590B831E22F
                                                                                                                        SHA1:4944FCE3944BE4F843D861D96385844409D431FE
                                                                                                                        SHA-256:BBFA11497F58DB9D9B7403C98DD1C6BB60DD0CEB66BED59EFF57D24CEEC1F0CC
                                                                                                                        SHA-512:0CC6CEACC6FFF65993D7CAA6013C3C0F6A7E2BEBD8BFD7FFBFDA2DEC720881041F53844223823E8FC308D26AB2127912A00786F5C29ED9876135FB047687A4DD
                                                                                                                        Malicious:false
                                                                                                                        Preview:...;.S~...(....V...)..\.VrM{... .QM...R;o.}.....G.(l.^.wJ.P......A.AK....:.....<..~g..1.u...........6HY....J.....83...E...K.p.W.FY.M.4p.in0.....g.H,.9u.WU..P1..=.{....../.u...h$...-sG.d..'.%..e....1.epK.m.....v...[../..;#k5.w..u..a.A[.....!....<..~g..1.u...........6HY....H.....83...E...K.p.W.FY.M.4p.in0.....I.E,.9q..U..Z..4.{....../.u..a.~2...+.b ..$.ZK.d.*..}.`.....T..c...Q..L.W.-....;#k5.w..u..a.A[.....!....<..~g..1.u...........6HY....H.....83...E...K.p.W.FY.M.4p.in0.....I.E,.9q..U..Z..4.{....../.u.....a.F ..|.......f...t.d....>..2.mf..`.-..Eh....;#k5.w..u..a.A[.....!....<..~g..1.u...........6HY....H.....83...E...K.p.W.FY.M.4p.in0.....I.E,.9q..U..Z..4.{....../.u..(.....#.E....)............Y...`...=.E.cD.W..;#k5.w..u..a.A[.....!....<..~g..1.u...........6HY....H.....83...E...K.p.W.FY.M.4p.in0.....I.E,.9q..U..Z..4.{....../.u...l....*+.\.n.%F..."[.....>.>R..g.5...`..r8..Y..;#k5.w..u..a.A[.....!....<..~g..1.u...........6HY....H....

                                                                                                                        C:\ProgramData\Microsoft\Diagnosis\osver.txt.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):82
                                                                                                                        Entropy (8bit):6.21121054120345
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:3:3wnPJNkvZaW4OVUodcfT7fOSP8lkL3G5:3oCwodc/fRDG5
                                                                                                                        MD5:5DAE1E72470091954468C8FDABE2B0D3
                                                                                                                        SHA1:B730EB0C52A5A2CF79557EFA99C90A4969BA1DC1
                                                                                                                        SHA-256:CCE57A54BDD33BE98290F28B3EC071F87B4FA29D9469C767B83904050B9E605B
                                                                                                                        SHA-512:133B53AC2D3D9F12987E3D6FAE6D5BA20C5844221E8AD5081F77DCF342194F84DD1CF810AA227B63C923B85825CC8523897E95C3A0F020FA1A95DE3A5CA69E30
                                                                                                                        Malicious:false
                                                                                                                        Preview:.Wl..Ah..!.u:1.......Re[I.>....M6.7....8.S{.(P......c.D.?v..jM.....*...X......J

                                                                                                                        C:\ProgramData\Microsoft\Diagnosis\parse.dat.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):24
                                                                                                                        Entropy (8bit):4.501629167387823
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:3:1Wko3WdH:kW
                                                                                                                        MD5:C9496046BD0F6FE693E7F677D29D32A9
                                                                                                                        SHA1:50BCDD51CC03D52377883FC292CEA0C47E2F345A
                                                                                                                        SHA-256:DE37E54A950F2122C74FFB2464D2A4C42B37E890E9ED9B02D573D836C416FEF5
                                                                                                                        SHA-512:38E3A5CB27407CFA57F8E6F4179D3BD045096B6B5D1B2FEBF89215C547AF75A8C1B1423EEB924B3978B5D7A3D2021280A7ABE65C677F6492BBBF3937849BAEFE
                                                                                                                        Malicious:false
                                                                                                                        Preview:.,".a.q.<...L.OYIW3lP.

                                                                                                                        C:\ProgramData\Microsoft\DiagnosticLogCSP\Collectors\DiagnosticLogCSP_Collector_Autopilot_2023_10_3_9_57_25.etl.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1081368
                                                                                                                        Entropy (8bit):7.917530676820081
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:12288:cEhH21GY1CIaGQN7AtETTYLyu1ta7WqfNAM9jgzFxcX2:VVYAIKMSVucWCNXkvcm
                                                                                                                        MD5:09638ACB99E4B2D87B808B736A45CB72
                                                                                                                        SHA1:7ED196DC8FCB6EF379F1FBB5BF115339DA55CD66
                                                                                                                        SHA-256:FC034EB9F815B03719275802D3396DBD64FB35ACD688DCDB7ABBA05FCC9580AF
                                                                                                                        SHA-512:D80DD4BC81D8929E973B46711499AFC7A879423E8FC461B5B63EA2C07CA39E29444EA14447FC300E858A070D14B7AFC47C999F3AE723266937FBC319357C184C
                                                                                                                        Malicious:false
                                                                                                                        Preview:....BD0..T...C_...c.].s.@.G...3..+.5-..gNr>....\.,.#.....o.s..".e...1~e..b.3.=.p",.......$...f.o7jn..b........R6d.2..A...c..t..91^m...gV....Q.E..E!#-t..[.._.<..29XK.u...%_...d$]P.R.?T.._m5x..ecD7..Pn||..C.)..L...'.5e.A/......s.V.".e...0~e..b.3.=.p.+.......$...{.l7jnH.b.......76..2..-...M....1.x..,pV.D...b...E!"-t..[..U.=..x9XJ..... _........U..6e..}.p.:..V...V...&M...<T.9...'.......s...V.....T~...b.3.=.p.,..3....$...{.l7jnH.b........R6d.2..A...a....<1.x..,pV...p..b..k......<.:.U.=.C....c....%_...`vrC..d-...%x{.@}.S...{.*).a...W*F......'..Ga.%.......:.M.....X~...b.3.=.pq,..^...$......7.n'..b.........6...2|.3.........M1.x..ap?.'...}b...#!V-(..[..4.Z..xVX9....F_......L.`....=>4..<..J...@=..A."..N..Z1W.D......i........#...a....]~...b.3.=.pQ,..E...$......7.n!..b.........64..2X...........M1.x..sp..1...}b...)!M-...[..e....xfX{.E..._....2..r[._.7..WX.1Y..K.....a..8...d...Y.......R......,.f...K..E~...b.3.=.r,......q3..vlV<..oL.b........R6d.

                                                                                                                        C:\ProgramData\Microsoft\DiagnosticLogCSP\Collectors\DiagnosticLogCSP_Collector_Autopilot_2023_10_3_9_59_39.etl.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):991256
                                                                                                                        Entropy (8bit):7.894585337280774
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:12288:WIUwoUVszsfFXjXESZM5DPHUFDBiplA9GY4jXCV89RtzdaPa8d9:WHpU2zGFXjESZOcBiploG8GRtzdaPLr
                                                                                                                        MD5:11F966AD7BDAD53400D93A2951F1A482
                                                                                                                        SHA1:A0811075DDE95682D3718CF234B2F17753464D82
                                                                                                                        SHA-256:137DEEFE7F7AA8BE406E8802C3B099D70A418CB2762350146B914CC9206DF703
                                                                                                                        SHA-512:84571B3C6EC8D7838DF726EDEFBFB4BE92BFF0C3E12FE5691834534F72FBA2540D65BB149A3E870C8A610CF16D7707F18CD9A610E6B606AFA44BD886D23A9053
                                                                                                                        Malicious:false
                                                                                                                        Preview:......`..l.....R.V$.x.n.;.7.{.F..%e..]..@G.h.Q........kr/...}...Rv.3._!6...\.S...7...OW..*i5.P..\...'.B....A...t....js... n.G.gK.>..d..{..n....2...C.....cGdB.'....i..~.!.TSh..H.4f....d7{..~./.......C..(.[......#m..M..M.....q/g..}R..J}.3.^!6...\.S.....EW..*i5.W.._...J$.B...;.......,j....Ln.G.7...Wp..#..n......#.@.....cGdB.'.......~.+....G{..T...".G..[....9m.P}..U.:.?8.ku..;L..Uh.X...c..ks/c..}...R..A.:!E...8.?.`.....}W...i5.P.._...J$.B....A...t....js... n.G...;.dp..#..n.$....#....../.F...'......?Q.....Gy..{.l..N0V.Q_.!!B...[..5....YF.e...U.t.?.F..?.8.k./..}>..R..G.6!U...3.4.O.d....W._iA.?...6...%$.B...{...$...mj...An.G..d.J..p..n..nr.g...P./...v.?G B.'r...b.~..U....G5......e.X5....V.....4......p.h...N...B.....l...k0/0.}...R.._.3!S...(.<.~.D....W.KiR.>...,...#$.B...&...'...]j0...Ln.G..f.J..p..|..nd.a...S.)...m..G;B.'#...?.~......G&..f.l.......4P..ZB.wN..O.e.S...l..P.....3.....R.kF/Z.}c..RX.V.+!Z...\.Q..|g...'C..r}5......x.I$.B....A...t...

                                                                                                                        C:\ProgramData\Microsoft\DiagnosticLogCSP\Collectors\DiagnosticLogCSP_Collector_DeviceProvisioning_2023_10_3_8_56_48.etl.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):360472
                                                                                                                        Entropy (8bit):7.8520206077999175
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:6144:jzwKn7f4LGzprlgKuphcgSf2gn620NEkArih9p:nwKcLCprKKah1gn620l7
                                                                                                                        MD5:C89499D7940DB29F43397624EA4A8091
                                                                                                                        SHA1:256386340991667733BE1FCB113AA63152D278C5
                                                                                                                        SHA-256:BDFA5C527DCF5D2D0F9CB26550E2C3CE76DBAD1A9982D85C4670A87EE8AC7A9F
                                                                                                                        SHA-512:2AB3D2D903607F52AB770EF042EFE1F54B9EE64830542EDE738D24A2CAB5C19CA155F8B331F03D22BA313EC6DF257561EFFD91146F2B53522A439F2CF24DBB45
                                                                                                                        Malicious:false
                                                                                                                        Preview:.T.t.......c)....e...'d..k.V.5.y^[../...]U..T.7..L..=s...u...D........N;.+.w[..o-.w...I.p......e9.*.Y...|./$.+.e..VS...@.........A...."..g.!q...`?...l....w.G..v*Q..}..J+_@'..y....xa.-...8.jX.1"E.....UaH.../...U...m..W.(.5....v.R.D........N:.+..[..o-.w...I.p......e9.*.Y.6.|.n$.+.e..3S.....@....4.'c..w...."..g..KV...l....w.F..v+T..}..@+.J...w..d...9uI....).d.6.".2..mPY.ZH.#.0..}H?V..c..b...t.V.D......dN^.X.Y[...-dw...{.F......e9.*.Y.6.|..$.+.e..VS...@......c4.D...."..g.(H......Y.O.*..*..v+T.J.TPK.*.J...w.N......]9.y.;..;##.7.)_.".+.qy.Ux.B.+D...D7.....:.+......dN;.h.M[..?-zw..;.....^.eM.K...{...M$y+.e..9S.....@....y.mcZ......"......$V.....<.......*..vNT...}.8+eJW.....q.S2EUb...|.....Bdq...s.z.............MU..G,......8.+......uNw.D..[..<-Xw..&.......eM.E.+.i.8.K$}+.e..3S.....@....k.cc[./.."..8..{V.....]....D....vtT.}..~+.J%.....l.^v.....vh.. ......*C).y.5l.Y}p...z...mS/.x....t.V.D......FN'.+..R....]^..+.J.p......e9.*.Y.6.|..$.+.e..VS.

                                                                                                                        C:\ProgramData\Microsoft\DiagnosticLogCSP\Collectors\DiagnosticLogCSP_Collector_DeviceProvisioning_2023_10_4_9_46_43.etl.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):270360
                                                                                                                        Entropy (8bit):7.814287270583475
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:3072:Ufh5YLmrZ4W5UGXCEQk7cu3B47MnsdE2aJbNx6zYMFcNbcvici:CY4Zx5xouxSlE9LsFBi
                                                                                                                        MD5:1E88B342F8627FF634365649652385CE
                                                                                                                        SHA1:70127F637A55B95B57BA4F6D3C719A837C0B697F
                                                                                                                        SHA-256:E64980B40D11CB6F964F8B58E6CF1446A8920E073406289864E542E342CDFD07
                                                                                                                        SHA-512:0DFF62F33E44E86C35FC9A7BF92D014CEE032AA87693DA57705DE25F88473152129B19F484CAE61968C5D625F6E3CA080512178FD5CC99E334C7278EB1F311D5
                                                                                                                        Malicious:false
                                                                                                                        Preview:=7..B...oL.;%.C.E.P.y.^.... O..Tf..Y..%.....m...m4r.3-+3.{..,..Xj....._P...Z.Kn.`......e.Um....z.'.i..G$.....{.W.9.H..V..3.8s.N%?..*^..p]o...q.y.H9...v..$..5.Ocf@3..S.34...&}..o-Bt.l...Hu.Sh...w..d.............%.~...~..TiwI0....-..Xi....._P...Z.Kn........e.Um....z.'.i..G$....h{..2.J.f..Vu._..s..+=...W..XNo......x.8...v..$..5.Nf..3..S.0.g.G..|t:9j.J.......c.PW'g..."..\.\..*X..{/M.;(.7B..a.-+2...l.mX....y.,P...Z.K..L.9....e.Um....z.'.i..G$.....{.W.9.H..V..3.:s...=...W..XNo.Z.e..x.8u.....D..Zv5.Nf....Z.=.2.b.E..|)..W......s........Ts.s...xc..mMW;.n.l|L.|.iw..+W.....K.~X.......P...Z.K....s...e.U)...z.'.i...$...}{..8._.<..V].Z.[s.w=...W..1N......x.8..vE..K.5..+f`.G..S..C.>....|.M.C.h....5............'.(5......V....3...;.6./L+U....._.mX....P.0P...Z.K>.?.W...e.U....z.'.i...$...{{..2.i.:..Vo.Z.Is.v=...W..?N0......x.8.v)....5..f7....S...L. ..|....:".}y6~Z.....%.Z.u..~;.X.(p.rc._.f.....V.A+2.......:...._P...Z..Z.Y....e.Um....z.'.i..G$.....{.W.9.

                                                                                                                        C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):439738
                                                                                                                        Entropy (8bit):7.679692176911042
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:12288:Bw32EIFxQA2TU0oNO+luilovcTxSM4ni21FY7tVQmJ3MR/:Bw32BIAj0egiqvccniOFPmlq/
                                                                                                                        MD5:23B8F5E4DD5F17117A3D6AB8D7F948EA
                                                                                                                        SHA1:D66DF4F0080C80542BB854523F3606538A1559D6
                                                                                                                        SHA-256:14D0A69632BB1132EE6FC40C92D026B476CF170D45A7D6DDCC3ED1DDEFA2C528
                                                                                                                        SHA-512:4A9774C2B7863EA80B78D2FF64AC5359301702A4CCFE19E4CC29E924ED9891BB8B1DA6C20B1881EEA8B347CB3B5EA06C8EC53896BA2322F10BAB0E1138A02145
                                                                                                                        Malicious:false
                                                                                                                        Preview:.....HnWa7<.m.9.Mp..i.?..#.e....;.{.#...s....m.f<.......8...sh...0 #.O.}+k.{..-v..+.....(...%..i.L.K.P....L....Z....ph.......L9Y.Uuy.|...*8....es.v.$..m4>^.V.W.@&.8.gG.l./hF.N.....R....?..,p.~......b.4.......`Hj..L..I2..P.Ko.7.U..rh.u.[ T...#+..5...gv...+....(...%..)...q.y....L....\....p}........LjY.UYy.|...=8....ys.v.$..m%>I.W.c.D&.8.gh.;.Gh;........Nd.....Nx..b......qV....w&-.P....m...3..f.hZ.U..1h..N.t U...(+=.....qv...+....(W..%..{.V.e.}....L....n..p!........LoY.U5y.|....z8....!s.v.$...m.>u..._.W&.8.go.1.}h..;......8...+.h..).9.._.....(...]..30....:Tn..7.^.U...h..L.a d...u+5.(...qv...+..Y.(N..%....".$.?....L.......pS.......L.Y.Ujy.|..."8.....s.v.$...mi>V......&.8.gu.=.ih......A.?.C~>\.f`..uY...4=.....'.t?..8).h.."..$..H..U...h..L.g u.5.?+<.:...pv...+.....(...%..u.J.!.W....L....R....p~.......LrY.Uiy.|...98....es.v.$...mp>.......&.8.g2.m.,h+.%....0j.....Z..[CW.....)O.......C..j..9$....nX....U...h..G.f v...,+1.:...Hv..+.....(...%..t.K.%.+....L.......p

                                                                                                                        C:\ProgramData\Microsoft\IdentityCRL\INT\wlidsvcconfig.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):17895
                                                                                                                        Entropy (8bit):7.965537981094344
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:384:d2saV0644QVeMQ///GsHztpzDUfVwE0kAA9PY2ukyEpP874Idq:d25LHOsHz8j1AEQeE4I4
                                                                                                                        MD5:4BF54C50DF569B869E07B3A6D4E76618
                                                                                                                        SHA1:F9D45EC0DD47A565D8BAE86955C5C28216424CD8
                                                                                                                        SHA-256:DF7296DB3D1618888BA8E2DCE32F51E00B5053047E50104313230E7CBD41CBC7
                                                                                                                        SHA-512:D8F3A29A40D1556815418604C310294953A11AB1EFAF79EF4C54637BAD9C8A282B915868B2422122E693A54C6A8BB8BE36B52A152DE8DBEC872B45644504008C
                                                                                                                        Malicious:false
                                                                                                                        Preview:.i.2...$..n....fY[I..5..w\R.K)......Z..09b....06._.c.=.H.|.....Plo..c.I......"&.._..{......5.....^Z..P..A...~..A..~.p..6..o..e...dr.........k......;4..-..".y.F..r....kj.....B*..v.<..2..$......Hp.R...}D...V......C..V.....T........BWv&..b..J.....e%.H...9......%.....^..13.......;.z...q.'..$".a./..24.......>.U...m...k..<..y..M.{..k0..R..\..~.o......%7.9$.......s.gFh....s.|........HW.t......@."3..(PK].T...k+.LG.."......y.....'%.AP....._.,..C..7.d..$l.x..8...v)..X.......r..'.B2..d..0..h.AM.t.....].....O.|.^..GOs,.qZ..b..*......8....C.<..X......wV.K.w.....Qe!...R..........x...0.....|.....FF..^..@..Z.q.4T..2.C7..9.f..t..3g.......-.D..G.....q".$..{.AF.x....f1..y.....p.t.3<^,S.8.....I..S.Xb..1..q(...Eg.......I..E.....^.2b..q..O.N%..%-._)..3......l......CB..........*..W....i..(!.o..t..3g........-.D..D.1G.d..0..h.A].C..p#..Y.X......9U.u6......J.|.]....H6.cm.3+.*...w/g.T.%a..\....."Zv%..#y.].7..."/.C...h.I...i.....CA.....H.\.x..E.

                                                                                                                        C:\ProgramData\Microsoft\IdentityCRL\production\wlidsvcconfig.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):19641
                                                                                                                        Entropy (8bit):7.972144470746048
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:384:E5fs7J3Lg2td63sha8sRjala+O6AAngAIcKB26ACKNnNUbDs7EFGZHllVr5:kfu7PtAQa3jaA+CL1BjAdNn6b2JHHVr5
                                                                                                                        MD5:B870D6291204064F79545B93DD02229D
                                                                                                                        SHA1:14DAC8218332565E505E2A3DC42ED4C7F60EBE7C
                                                                                                                        SHA-256:898CEFB82F1C33EBC2E83D4F195B6C0A3B21CA12853844A22A7B292FC46FC9C6
                                                                                                                        SHA-512:5EFBE16E522BB184560EB5FD6F34A42D65EEA916644997858EE7DF01A920D3DB55AAA6E07D0ECDB894C2A0D9DA5B0245849D36E822EB28611B5C954FFE26D7DF
                                                                                                                        Malicious:false
                                                                                                                        Preview:15...d.E&.~dsH1T.6.$7..wL......$...5.....ou..1...~'i..1.=k.H..b...R.m.r[...E,d..c?K..j ....p...O...|.:J.{t.lY....h....ae*~>..8!..3U......w...E...#.H....."..I...$.Cie|.<..F....#.<R..m(......?.....d..4.Pn...Z.....L.....c;....(h....x.....B`.|U..|..|~..d8....zNT_..q...m..2.uV.>.x<C..MNHI...o7.4~.Nng..hH......".........C.....c..C.].-._wc|.>.......I..V%h....wK..h....=>..0..%x.......x......v..}.A.....,...A.PUgBe\..r..4B..v%F...&{VX..pN......0.*..)C.n....~U.vg$#i..*z..y..%.....}..s...%7.........R.].".De4..>..I..6?.....T..@{.W...f...7!2.E......NU[.Y....v.`.%j..:..k.O..k...G...L.g].U.+]d..k4....#wVI..mZ..K...}.f..t:6y...*Qr..h~5o0.Ao4..oB......1S......PU.....y..U.W.$.Ymo}.j....Q..."7...|..v.:.....y.M.....O...~...y.KHj...%!...3.(z.R.c....@.8^>W.+..`...v.A... j....yN..S...u.<.. 0B,S....x...jC$<i.R|0..zJ.$...."Y..K....[....A.l..A.i.".YvoF.s....#J.Y.)8.UV...#.d.~....S.P..d.|u.j...zm.......'5..g."`.R.x...A..Dm.\Q.R..hx..j)K...a*...x...T...e.,..vt.y.

                                                                                                                        C:\ProgramData\Microsoft\Network\Downloader\edb.log.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1802264
                                                                                                                        Entropy (8bit):7.528602510688392
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24576:NUcnYa5VaJIrRbjQDXxCv0WTgWPez90K6Im/Ajf3GbF85Ka7X1xoC:NrnLEsjPYs/CfOF1QX1aC
                                                                                                                        MD5:75AF9AF8534D7275939D197840B987BA
                                                                                                                        SHA1:DEA0F8BB2C51844547BA27CABBAA7DE2F26ABC5D
                                                                                                                        SHA-256:4A0F86B3077D53EA52CF5396DA0C4227211892F85CADC65F5A76BF2B71A85938
                                                                                                                        SHA-512:B723B7B0CCB096D289667CE2E490042E551070443DCE76334E6568CE62FD93F1EB9D357DEA8BFFFC01245975467528768D2B78A399BB0AC12622121065CB41F3
                                                                                                                        Malicious:false
                                                                                                                        Preview:....].S.........gG....@.j..D%eG...$.R=P.....*=@]9.g.8....#.o..I.>g.\...[...&..."Uq.....Y....C..Ecg..].o.7.\.I....9"...*.|]../...N(\.;%.I.......:Y...F..!...4..>..zK..L.Br.>....f#I....kB.`.?G..N-..n..U#...f..I.]..|..^y)mk5..l.&J..o..I.?g.]...`...]#.."Uq.....Y.....C...L...U.e.\.I....9"...*.|.._...<I1\ZQ~...f..en\-...2.S.N.[~bR....e.L.Br.>....f#.....S..;j..'.`!.....s8....3{.&.+b.Bu/..?.....{.&J..o..I.?g.]...`...]#.."Uq.....Y.....C...L...U.e.\.I....9"...*.|.._..`.C3=#.x.....(.?_...T....:.4.....i@..-.'..>....f#.6Z|..I.I.x=a.r..E..B%..0}M^p.}.....q[.....s...&J..o..I.?g.]...`...]#.."Uq.....Y.....C...L...U.e.\.I....9"...*.|.._...<I1\ZQ~...f..en\-...2.S.N.[~bR....e.L.Br.>....f#S...........G...B.4..b..5B...r,..~-.*.E|c.j(....&J..o..I.?g.]...`...]#.."Uq.....Y.....C...L...U.e.\.I....9"...*.|.._...<I1]j$~..X..0..#.ou.3.S.O.[>cR....e.L.Br.>....f!G....9.~)....gG...g.. .....B..z.O.2vk...HA.4..u.&K..o...?g.]...`......."Ur.....Y.....C...L...U.e.\.I....

                                                                                                                        C:\ProgramData\Microsoft\Network\Downloader\edbtmp.log.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1802264
                                                                                                                        Entropy (8bit):7.324553798990314
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:12288:ZWoCKllM7fpOBfaOCZYil/xfhS6D1wNN132OyjVL2RYZbik:4BKl2EiOCZ/LDuNN52P8RYH
                                                                                                                        MD5:F81640CF6929F9062FFF14A425722A9D
                                                                                                                        SHA1:4B6880440D51E50DF372F5C0E4B739762EA11B8E
                                                                                                                        SHA-256:4094D20F6F1BD01904EC636D1A4F9EB1D6124D08BBE358D0948A240E307DC43F
                                                                                                                        SHA-512:938CD843FEF0738D7FBEC64741C45080D211ED4EAD285ECEDE46048BE04187821E9FDAC292B658D2F3BBB44E6BE28CDC0519FC90C0F6C7964B88F2813890E642
                                                                                                                        Malicious:false
                                                                                                                        Preview:....y.H.....`a..S.Q0(.Q/..1..I..L.`.aJzR.X..X......-...?C...r+.V-.....N....W.v.v..&.....Sg.S.@z{.l0p..\.6.M.r...%.Uy....O.].n...s...d.U..IRj......m<O...}...c..nh..Yr8....4.....d..r8x.P........(.....lE.GfY.!..I....n.2....?C...r+.V-.....N....W.v.v..&.....Sg.S.@z{.l0p..\.6.M.r...%.Uy....O.].n...s...d.U..IRj......m<O...}...c..nh..Yr8....4...<......?K.*.+.pvW......;*t./85.U...G.+..<F..m...?C...r+.V-.....N....W.v.v..&.....Sg.S.@z{.l0p..\.6.M.r...%.Uy....O.].n...s...d.U..IRj......m<O...}...c..nh..Yr8....4...w.jL.....7..g.<......&..k....>..(....8.v....?C...r+.V-.....N....W.v.v..&.....Sg.S.@z{.l0p..\.6.M.r...%.Uy....O.].n...s...d.U..IRj......m<O...}...c..nh..Yr8....4...'....U....`.....S.!.9R.!.r....q..v....Zw<...?C...r+.V-.....N....W.v.v..&.....Sg.S.@z{.l0p..\.6.M.r...%.Uy....O.].n...s...d.U..IRj......m<O...}...c..nh..Yr8....4......:@l^.D.....gx.|.Mujk.g.[....|.@%........|T`....?C...r+.V-.....N....W.v.v..&.....Sg.S.@z{.l0p..\.6.M.r..

                                                                                                                        C:\ProgramData\Microsoft\Network\Downloader\qmgr.db.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1802264
                                                                                                                        Entropy (8bit):7.333607133016604
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:12288:+XUC1yBumIj3qlqzg4OCsS7ZZxjyAT4mh1+MxlHgcPV3Row:ML1sMqKP/ZZxm44mtxgm3mw
                                                                                                                        MD5:1553BBF0593234A587AEDDA92A0E6306
                                                                                                                        SHA1:432F2B362AAA3D0CA0B3B136A33979F091D7E8AC
                                                                                                                        SHA-256:2730C605947999F0CB6A640C41936C091077BF3917B38B65C7ED03529342689D
                                                                                                                        SHA-512:C4F53D2B593EC0D5EF4E642310669D8651A2F8BC2A1392CFF59FEF0925E721E4625F77F6AD709456E2D163EDBBAA05253FA0FA378544A6C227CE1F27B553653F
                                                                                                                        Malicious:false
                                                                                                                        Preview:....4.L.w..y.c.O.J}y....i........Dx..?.q:.....M.6.Y..t.[..f.1.F...@..s.k...B$.~.\H.Ph.n):.(3...f.....(..8...X...#e."..*."..o...+..0.....|.... .to%.c_..Y.3...E.O.../....)QWZ...:...&......nS..-...Ibx.VC....1...E....|..N.a...%V..u...Gf...@..sRm...B|...^s.Sb../:.(3...f.....(..;...h..."e."..!.(.Ec."./....k...v.... .pe^.o.K.X.3...E.O.4....#*.\...:...A.......S.[..R...gk2=....w...D>/......]..=._..V..u...Gf...@..sRm...B|...^s.Sb../:.(3...f.....(..;...h..."e."..!.(.Ec."./....k...].... .pe^.oo..X.3...E.O.t....#*.\...:......#c.{........jb...:...k/..h0...#5Iuu...0....V..u...Gf...@..sRm...B|...^s.Sb../:.(3...f.....(..;...h..."e."..!.(.Ec."./....k...}.... .pe^.oo..X.3...E.O.t....#*.\....A2...Y%..tdF......Ej..k....uV..{.E}..Y,[..L.d*~96..`...Gf...@..sRm...B|...]s.Sk..,0.!?...f.....(..;...h..."e."..!.).EcM.g.....ar..}.... .pe^.oo..XA.6.E.K........#*.\...:......%.5j... ..I..j..........J\.........C.. .V..uy..G.%..@..sbo....B|...^s.Sb../:.(3...f.....(..;...h..."e."

                                                                                                                        C:\ProgramData\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):270360
                                                                                                                        Entropy (8bit):7.4277234865876
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:1536:6GkKMvAtLxlgNnX2mAl4DHQCIqbHrNeSVZIuX0ctzuiJuuVFPZmsz7OfoWguE19X:8BAZMpXNXgq/EgluiJ/HTzKfoWguE19X
                                                                                                                        MD5:1EC9DBBF89BE7800A8CB79FEE822005A
                                                                                                                        SHA1:EC5D33BF8BD63012824A6C0D446FCC2224417BE4
                                                                                                                        SHA-256:89DA281048154D9FFF5776CA2643DF2492E2A4E5FB61454B8074A307EBF35473
                                                                                                                        SHA-512:B7BA2942F40D2E639FC0082F0A5123825CAE60F06BC2544D6C77C70A29DEFC3DFD9CF6D35587DAAE78F78F11BC801A26C959ABC051009A735618A8C06F0D8502
                                                                                                                        Malicious:false
                                                                                                                        Preview:....J....!...F....P..9~m.....&G.m../n.......Q...OJ.i...Q`.A..EC.*.3 ....1G.c!.e.g.\\.L..mM...J.=...".....g...}U[fH....*x..du.w..&...X.r...Z..'.........gf...q.3...&.X.R.....^H."....l...=.......2..C.%_.tVEq.(...m......J.....EV..ka..EC.*..!....1G....U.`.V'.N..mM...J.=...".....g...}Q[fH7...QY.!V}.}..$f..X.r...n..\...........gf..W.....]"Z.R.....^BHav...0j........./|.v......Y...8...;..I.I f(.....EV..ka..EC.*..!....1G....U.`.V'.N..mM...J.=...".....g...}Q[fH7...QY.!V}.}..$f..X.t...n..\.........gf..G.....]"Z.R.....^..V...h..<..y..r..I......4.l..H....q7....k....EV..ka..EC.*..!....1G....U.`.V'.N..mM...J.=...".....g...}Q[fH7...QY.!V}.}..$f..X.r...n..\.........gf..G.....]"Z.R..'>r.-....z..>.....v....5c&....to........Ji.K*..7s+..(..V..ka..EC.*..!....1G....W.`.O..M...I...J.=...".....g...}Q[fH7...QY.....V.. l...r...n..\......6.c.Sn..<+....]"Z.R.....^..Q....U.#.<..J..S.....`G@.#7.X.n...%]P..S.(...E...k...EC.*..!....1G....U.`.V'.N..mM...J.=...".....g...}Q[fH

                                                                                                                        C:\ProgramData\Microsoft\SmsRouter\MessageStore\edb.log.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):90136
                                                                                                                        Entropy (8bit):7.349809420181393
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:384:C/SUrjFbJkEtvSmRmlaOecqyTQ7HuwLoR1Lm3jL/bRT15I6sLjgUQlRVIHtYWJqA:C/bpt1EgLpmBdKYoS71x5EOnoomlV4
                                                                                                                        MD5:66C9B7BADAF989A446F013C5697AF01F
                                                                                                                        SHA1:DC08870BA8EFFF20B75F517E76DD0A536BC78D34
                                                                                                                        SHA-256:677223F953A40B75DF90F8F964C48E1C32A13FAFBE2BAC671ACDD8693D7A11AE
                                                                                                                        SHA-512:A47A1753287B3CE7EA88B55F9D418C501B47A4D4CCA41B5BA88CA84508906B0F9E42F16CFBE0A77AE7A51547095BF18624F44C37487B7DF73C179B23F2627D2A
                                                                                                                        Malicious:false
                                                                                                                        Preview:.....[...).~.....v.-:....."..'......<.-.[..[F..3...sf.N..[.>......-.V..b.z.OQ.b...B.Q2..~..z..&...A..>){E.N.........=.\.I..|..N......9..5I...\...TNv.O-...P5......Js....A..P..^.......C.R...b?......S..:..T.\.4..'.Q....r...:......-.F.!j.p..S.[...9PU:..~y.z..&..m:N...xO...........=.\.I.F..<.o...M..x ..x/....#.. X..\.x..au....y....A..P..^.....=3..7.+....x.....r.}.H{.v..F.>.....%....r...:......-.F.!j.p..S.[...9PU:..~y.z..&..m:N...xO...........=.\.I.F..<...?..?..<A..$b...tLc.|....c....).jt...z.x....^.lK..J`".!..3O.R......{.T@v..?@..84.2...!.....8r...:......-.F.!j.p..S.[...9PU:..~y.z..&..m:N...xO...........=.\.I.F..<.o...M..x ..x/....#.. X..\.x..au....y....A..P..^P....h._...G.....<I.iV7z.....4..A.UCo..\r...JSN.r...:......-.F.!j.p..S.[...9PU:..~y.z..&..m:N...xO...........=.\.I.F..<.o...8.......Y.0{.\.. X..\.x~..u....y....A..P..X..A.6$..>...v......X. g.....>....<..vh..%.Y-..Kr...;.......|.Ue.y..~.S.[...9PU:..~y.z..&..m:N...xO..........

                                                                                                                        C:\ProgramData\Microsoft\SmsRouter\MessageStore\edb00001.log.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):90136
                                                                                                                        Entropy (8bit):7.725627432001842
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:1536:ASKCdiKFicI+sn+9NCslEGc9/FKb7JInsFl:ASbo5+t9NG9Abms/
                                                                                                                        MD5:855ADBB1C22A10164D460151293F5FBE
                                                                                                                        SHA1:8169D34DA3F862A7FB6FEFD62D4F96FCC0820DFA
                                                                                                                        SHA-256:C5750942F57888D001F7D923FD8F69517311A24C665A83CB8478EE3CE3BF242C
                                                                                                                        SHA-512:9B7736A2B6048DA65BD38CB725F7738139B0F13763D767C86B5A8AC23C58C1BA3588BDBE4A660417727E6A2873D3200BF524E53A7863AA7C05004FDC82673393
                                                                                                                        Malicious:false
                                                                                                                        Preview:..3..%...[.yDK...... ......44.W.|61.G..|....^.8:y..k.t.(.e ..Y..J.....$...gf..K~..;.2.t.OgCc...-.l{'.+m7..pF3Q../Su|.P..V....x..~...<.SS..H.....4..\......e.rt6....N...*...B +.:%{.+...:%....4l?..?f.K%...:4Z+..;EA....u..8...e ..I..Z...&.#....d..K~..;.:.t..hCc...-..b&.j4...D3Q../Su|.P..V..Z.$...{...x.'2.K!a.....h....3..........Q........*...Z..T=........qS.p..+ba.kf.....-........7d..Y.k...8...e ..I..Z...&.#....d..K~..;.:.t..hCc...-..b&.j4...D3Q../Su|.P..V..Z.$..RA....US..@.........o....t.sI.....Aqf.O...F:...,..2_.cpmC..t..4.%]T.yI@.j...!.,...s6.....8...e ..I..Z...&.#....d..K~..;.:.t..hCc...-..b&.j4...D3Q../Su|.P..V..Z.$...{...x.'2.K!a.....h....3..........Q........*....../.&...*...`.U|w.w.c ..K....?5.....Bx<...6..8...e ..I..Z...&.#....d..K~..;.:.t..hCc...-..b&.j4...D3Q../Su|.P..V..Z.$...{...y.R2...U9d.&.h...3.......v.Q........*....7a.n.......W.v.f..+.XG....6.ns.0D.{s./...F.!..8...e ..I..Z...&.#..M.d..K}..;.:.t..hCc...-..b&.j4...D3Q../Su|

                                                                                                                        C:\ProgramData\Microsoft\SmsRouter\MessageStore\edb00002.log.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):90136
                                                                                                                        Entropy (8bit):7.403599418125308
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:768:g3J9CGCUcwBFgViKtQHpi4Ec7GdBXGyTlXLJ5HDh8TP:OGG/BeVN6d4dBXpZl5jqTP
                                                                                                                        MD5:D2DEAA991AAFBDCDBF1DE258439CD409
                                                                                                                        SHA1:E3FC294291ECC1E2F463FA455D98F2332DEC32C1
                                                                                                                        SHA-256:2DD288CF18EC1CD94ED76C3E3949373009AC65DFE10FEEB88DEB355602125C35
                                                                                                                        SHA-512:C7A336310D19031AF172C99FEEE2F84706EE64C47A38BABB8AEE619C9AA535E6CB3BED6CE75BBCFCABEA5B60DCDAF37FB2A80CA8E4B30223A91136CA56080455
                                                                                                                        Malicious:false
                                                                                                                        Preview:P+...)..R.....~.O`3..Btj.c.T.P...!I...q.....f..<...=...;._....&.40]j.q...[.".E....`.P..K..;N....H..4...:.../.............y.tV.J~Q_oK"../VZ...+] ..,....~,....P.Z..{.".,LU8..oN7:!u.1.h.-c.>._...P$..H...JJ.@..GtU.V....Wp.}.<...gb]....6.4 ]j.A..-Qc..u.....kR..K. .;N........0x../.............y.7l...>8.*ON.[7..x..D.O..p.....Y....5.).g.CV..I.U8..oN7:^.h...U....))?..........tj........>.}..`.....gb]....6.4 ]j.A..-Qc..u.....kR..K. .;N........0x../.............y.7l...}.Az=!.)Vk....c&.......M......A.[.*{0%.,C!W.3N7:G.'...-....71......./N...n>..G\/.....{.)...k..gb]....6.4 ]j.A..-Qc..u.....kR..K. .;N........0x../.............y.7l...>8.*ON.[7..x..D.O..p.....Y....5.).g.CV..I.U8..oN7:..!9&rKs$.?0./..E....%......1.Aj...){.U......gb]....6.4 ]j.A..-Qc..u.....kR..K. .;N........0x../.............y.7l...>8.*OO..7...{....i.M..Y......^.g.CV..I.U8..oN7<...}i.h.-..f..../I..5......@.V..,c....(..Ov%.....fb\....6.4 .c.2...j...u.....kS.rKa!.;N.........2y../.......

                                                                                                                        C:\ProgramData\Microsoft\SmsRouter\MessageStore\edb00003.log.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):90136
                                                                                                                        Entropy (8bit):7.373079443029763
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:768:ENP9h5j2IvZAePw5/byoYmgQbJi6bYCGLNR:ENPb5j2Ivw5/OZQ/kdLNR
                                                                                                                        MD5:A7F62C1CD9E43B30586E934931C6E958
                                                                                                                        SHA1:CE22316B85F9215261F38E6D8C0AB2C6E36C3777
                                                                                                                        SHA-256:2BFBBD96A4B8D585C2B129C03AAEE40CDA76D89B0FF901F892CC48EC714A1AFD
                                                                                                                        SHA-512:ABD101FF9443F31792BF829D1D2A1B769BE20CDF4E2834E68561FA2E8D6257144F5B963ADB36418F5BCEE1B9CC88506650EE6A388F2D2209AB94A4019053F61A
                                                                                                                        Malicious:false
                                                                                                                        Preview:3..........B...5..V....x..{1.......&.F.I|..V...N1..tp.G....w:f..,.3.s.sQ..J.x..E.......J9.S......2.OO9.........d.%T.k.P..w.0X8T..>Y..yCH(..5..8......t...1.....K `..b......g......?.....dk-...3.......)k-..H.\Lk...H...@h2...Z.Q.9f..,.2.s.cH..I..>.u.......B9.Sn.....2..4|......s..d.%T.k.P..w.0....Q>...)\t..\..W.j.yB....mD.{v...S..}..q.`a.g......?......#y.........-.R-..1.nDq...o.....0@..,..Q.9f..,.2.s.cH..I..>.u.......B9.Sn.....2..4|......s..d.%T.k.P..w.0........fhN...=.......-.v..1...$..Z6a.0b.........h^..?O.c....0.....M....$PRP........fW..&.\........J.A.Q.9f..,.2.s.cH..I..>.u.......B9.Sn.....2..4|......s..d.%T.k.P..w.0....Q>...)\t..\..W.j.yB....mD.{v...S..}..q.`a.g......?b.@{O.Y....k...q&.=...#.0...?....z.|..q.,.v.D.Q.Q.9f..,.2.s.cH..I..>.u.......B9.Sn.....2..4|......s..d.%T.k.P..w.0....Q>....)t.-. ......+f..mD.{v..fd.}..q.`a.g......9.m~..Mg.i.bn...$.\vd.{...`o.....64.B..q..=.ZO.Q.8f....2.C........u.......b...o.....9..4|....s..d.%T.k

                                                                                                                        C:\ProgramData\Microsoft\SmsRouter\MessageStore\edbtmp.log.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):90136
                                                                                                                        Entropy (8bit):7.324609812678536
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:768:XDtxiGQs9gM6DWb+mWAquMSrhfE1JdEWqFGO5L:J4GLgZWqEPoJdoGO5L
                                                                                                                        MD5:9DF3E49D06E6B488BC976A8B8977F188
                                                                                                                        SHA1:CDB38E19B4F6A29F462BE55A19D8CA91934D4DD0
                                                                                                                        SHA-256:25D0F2C37B8B05C2AD8D48ED9138D338B0E080F2618FA9755BCE3C69D058F4AC
                                                                                                                        SHA-512:2048887620D557218CBFDBD437B49C1036D63CEECC9ADD0DD104604341FE53AAEF716B5EE24946BC84019D00D278ECFCFEA3E0B79A160EF9AC1F162376B78C32
                                                                                                                        Malicious:false
                                                                                                                        Preview:.d........=>....+..Z.....9^.O._.!...=....?.N....7+.....L.........V.5m'....V....t-54.......F..m.*.-G:@TqDN....9.$HD...G/N'|.a..*...0..[...5U\2...+...^...?p.A.*t....o.E..z..d.!L.j*.E.b.....3v.J..>5;.FPye....F.@..T.va..FNb.1.bL.........V.5m'....V....t-54.......F..m.*.-G:@TqDN....9.$HD...G/N'|.a..*...0..[...5U\2...+...^...?p.A.*t....o.E..z..d.!L...X.9a.L....s.l..........L.I.^.$...en.LNN...(eL.........V.5m'....V....t-54.......F..m.*.-G:@TqDN....9.$HD...G/N'|.a..*...0..[...5U\2...+...^...?p.A.*t....o.E..z..d.!L.lI.....k$...5...|7..kh..hb....F.&3?X....L.........V.5m'....V....t-54.......F..m.*.-G:@TqDN....9.$HD...G/N'|.a..*...0..[...5U\2...+...^...?p.A.*t....o.E..z..d.!L.U`..6.tj.<...mv........W...z}$.....bk.D....".L.........V.5m'....V....t-54.......F..m.*.-G:@TqDN....9.$HD...G/N'|.a..*...0..[...5U\2...+...^...?p.A.*t....o.E..z..d.!L..D._I..,.@.%.....ZX8....j.MU]P1...VT..v.PCi.(BL.........V.5m'....V....t-54.......F..m.*.-G:@TqDN....9.$HD.

                                                                                                                        C:\ProgramData\Microsoft\Storage Health\StorageHealthModel.dat.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):764157
                                                                                                                        Entropy (8bit):7.9997232621723935
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:12288:S9U72W8oaJR8kXwCApC1mLDrb2tW3pT/XAAT32p6E0b4q7iGnlDBUCDZuOl:SCVDolcpCgnL3NIATS6tLiGnXAOl
                                                                                                                        MD5:329D7AA70B0DF688C3FA4B65EB406358
                                                                                                                        SHA1:B6B1A2ACE2D34CD34B8E15A0AD1ABA7CDA6A1348
                                                                                                                        SHA-256:A8684E6DC32792B3BF98F984239BFC1455AC69C3E3DB219ADAE2D20A6D52135A
                                                                                                                        SHA-512:855A7EEB9BE1D1B5C7CD8197AFBBDB542D9342A9811E2F343EA52DF06F72C73A5CBADAE66866027372811EAA8DAEF24B03EBB7E050D8623E1D2CFA362975FCA9
                                                                                                                        Malicious:false
                                                                                                                        Preview:._...m.C..L.:.bj.S.V...I..zHpN.;.K..bHWkl@.m. |"{)..m..:u..X.73.|$..`m..4...P.b..%r............-...!..!zC.....&.....t..R...Yl..b............N-.H.a....J.8..x..m..d....cjj.....m.4}&W.v.ii.>.6.].m.@.C3..1Q.C.....T.....k..BJ|....+i...z|g./..&&..z.+..I.Bt+...P.C.._...u.V...O..8/C2..K-..Y.r..A..y.&x.?..yz.<<#..d'..[.....\.a...P.Uk....c...hz..'.......J.$....3.7I>.0M....g.JF.xm.R...[WV-S...M;%.s...2..h...x>a...Q..5.t...%Cc...l.LaBg...Ae1O`....a...$..$..`q.8..2..61{.....t.....6.s.6....$..2...l.Y0...{..0..%.w..4m.v.aa.8...l.m....`....?...%Q.".)?..0Y.+i.C.....''.I.l.<....+.x...*.r.......YG.V\..h.".M.+*>...a$2.#....v,g)e.a....5.)...pP.-#.6w;.[.i...Z..$.'.........2D':............2.-.eI...s...A.W.=.w..S.n........$......n|3.a#..Y..h..O.EfD...[.B{...H....'.wA..~u.....#...l.C.`.S..6..\.30...O..7+..a.$...D}F..8.&v..`*.nec.S6.,.....g.wb[.S.gG...w...g......Ou.._..+......9.>n.L....d.N.Sb.../.@..\H..... @o.B....(..3.oa..P.....S..c'!.y_|1#.k..

                                                                                                                        C:\ProgramData\Microsoft\UEV\InboxTemplates\DesktopSettings2013.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):25177
                                                                                                                        Entropy (8bit):7.967791838596784
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:768:6p/pXJn/h4GDHSTVDQpWqe2NfNnbCZurc3CX9:6Rpp/h4oHStQpTBNnoueCX9
                                                                                                                        MD5:204C659561A769B2B440CA0A09F72731
                                                                                                                        SHA1:20D4B329C1972156D1AE5CFAA89FC64E82CF426E
                                                                                                                        SHA-256:F1173CB2BD4488820D71FA7AAF47B543F3A23624937F29B8D88AFD8F0FFDD68D
                                                                                                                        SHA-512:3741BC4C53A8345B0DDE9CB440E5A58C07776AB44F4B32A93CB1222D4D56C97854D5D6690087EA6F09E14C04285CAEDCD2A76B0818001392D7476EDBE1419846
                                                                                                                        Malicious:false
                                                                                                                        Preview:p..ozA....YT1>.K....(!.h7.+.Y[C.......iV.>u.a=.T.......\.......V.Z.^Q.5.......p.YWW..<Fs$...C....ks7..L....5..v=\x..!2.h...j....?&.d.I._...3>p....^..Z.\..C(..n....H..........u.1..(4w."...[...".y...B_.....e+.....%...K....l...'..EM.....P.X.XH.l.U....>.^LV..xG'...@\..X87...d....8..}tRq..=9.....`....-7.x...R...;0t.....Y.F.I...,..s........d.....u..p..r.[......-.Z.\...1..>..g.sQx)3.)B........l..|.4y.w!l.....R...YX.z.P....V..HJ...jGn,......I#1t..d.:..8..1mDu..7w.y.S........]...U...&jq....IQ.U.T...a..n.........d.....|..r..s...V..n.uRs...0(..X..A..6.;.....r@.............GC.....I.C.S..>......[3..733..{Gs+..A0..I#1t..l.&.)].|qFc.:#.l.\.j..?!.f...U...&dv..W._Z.q.M..F$......R...l....(.."..9[......L4..R...W..Z/...=..W.....w2~.....l.o....BD.....A.A.Yj.e.]...H.....w..{.C'..F...&X>*s..r.e.!.....0...i.y...v...*;.l.U.s%..Xj5X...MS.N.Y..B$....O...T...h.....v..6..q...,v.......4(....(..@..!.U. .&e....".7{.f..........O...RJ.a.V.....s..04..>.I#...0..Q/c=..,.0.....e|^u.p.

                                                                                                                        C:\ProgramData\Microsoft\UEV\InboxTemplates\EaseOfAccessSettings2013.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):8229
                                                                                                                        Entropy (8bit):7.929446432458672
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:192:WZZ9POa4JcPSu+Yta4qJ0OvMCoSMYCQ+4dBV8KXnV/4w:WZDPOhByta57oSMYCQ+4Jt3V/4w
                                                                                                                        MD5:59CC606720A3935223756293B159F7CB
                                                                                                                        SHA1:CC98DDBAF0B981A9F680690D31B4F7168F111648
                                                                                                                        SHA-256:FDEFEDCCB0E8CF22A56B74AA3502CBC54267B2945C575207480F281F56F3E1B1
                                                                                                                        SHA-512:05D0A24F67D2592521CA83F622A80EDDCF1525523457B9D16A62955D00076CD6BC66B393FF836A74D44C498DB6574859DC028A59E7E1698467E942473D09CE35
                                                                                                                        Malicious:false
                                                                                                                        Preview:7.P ...B-S..b.J.....L...|..e.f...s&...+.P...^.Y. \j...nC:.:.C..M......1..:...(...r.3}..7b..L........C...1E.]......3......=...x\.-...}..{..e..........0.$..h..............rK>kBTx../....Y...i13.b.2V+..5w7mb...H.N.|+...Ei..na.\..........h..4...%...i..w|.5i?..7h..J...k...<Y.V...._...J.....3...1@.c..........l.\......<.9..c...........3Q71.....TS...J(.u..N#.eT8...I...Q.h...28....H.....@.I.......~..`...m...o...e|..}).Q.s..L...k...<I......E..."..hi.7...<e.}...r..z.v....@....s.$..<.............1W60+b..Xu_?6........dn#..;.,.......*-.]..T.@...[..lo.P..!....N:..,...`..e....t|..t=.q.s..L...c...-..W.......7..J..7...?^.n....w..}.,....L.....=.5..t.......UR..a..z.W+..>oK.`m....<....(.m5...m\..Ym..BN../.N......ih.H.........a..u..s..e;...<%.!y9.N.y..J...}...&K.....R...)..E...&...FZ.>...b..s.q....F.....5.>..o.........F...7..~.Gq..2.....Z....Oj.......l.......t.x..L9!..ufo.. i...........x..s.....Q...-A.^_;.X=v...F...k.../_I.....<.

                                                                                                                        C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftInternetExplorer2013.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):4335
                                                                                                                        Entropy (8bit):7.9139381021903485
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:96:xb89SuG0fTocHvSKTTDfkzfJJ7PixeffYSdFepMowTA648En:V8swHPNkzf6effbFed6dE
                                                                                                                        MD5:23651F55352F1282A2F0437FC6A7F4A8
                                                                                                                        SHA1:A15CE096675212C834327DF18DCBB65B49A0FD39
                                                                                                                        SHA-256:AAD812CE1CCB4643D65C14BE5AA7955C523911AA28E5403CF07ECCFD79CBDC6E
                                                                                                                        SHA-512:E54B6333D219AF623413DF6D95F0033FA741EBA41AF0CA195E0F83BCC9FBE22EF19DCF5556ADF3C5077EE4870D7CE7A92F0CF7A3BD096D86D48A65A99A75AD1D
                                                                                                                        Malicious:false
                                                                                                                        Preview:.)K..i.*..........e....P0.....(.z.d....K..z .F..._..).1_ .0.u.......D;]x.n#...bO..n..~.|..,........4k.;.s.......!.L.o...=...0.D..2...S.2...r.p.9[..Z..UV...:.J.P.Bg..|........50a.4.....Tr..}{."...3.sKu.|..s....'.@..t.P...1..6J.:.j....:..B"Z!.;-KZJo...i..j.8..........g/.X.[......*.B.~...i...:.K.. ...D.%...p.~.>......IV...v.F.M.Dl;.}...O...5gt.....J.s.3d.Z.w....I*.~Z........p:aX/.nV'.s.o.H.1{..^..%......V.C2\7.>yU\P'@.....j.*..$.......|)...[......f.T.k...:...I.@...&....4...}.$.%...M..Z....x...P.]3p.i....Z...<3<.(.....w..t./.9UF.....!..!..N.".X.0|.....M..a......$.$....t..Ii.s.g5.>4*......|.*..-......{..[.R......(...b...s....+.E..}...O.5...0.k.e...Z..K....8.L.M.Y|>.g.....F..Dkt=."...-~W......4Cdfa.I.,c.n8.~...V.K.X.zH..B.QV...=......u..H9C).+h..3....D..|....8......a#.X.J.......#...D...w......l.:...N. ...j.v./...X..I..F........5..c..."..Tz{\.*..w.......e&.....M..J.?..I.kN.t..NAw../8..h....<.%.....n..J'.j.>`Y.3....*..].=..'.......f...........x...\..

                                                                                                                        C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftInternetExplorer2013Backup.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):3523
                                                                                                                        Entropy (8bit):7.916475923174479
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:96:h0mxL6e1dZNKxqvXbWWSo486vxmyOzpomjTqkHr:h/G5sOo56vxtOzp3Tqqr
                                                                                                                        MD5:34E0382FEAA7E5AB8059FAC4F280E1E9
                                                                                                                        SHA1:9D4ACEE2E7F2ED4FFF4A09AE96CB14DEFAD7174A
                                                                                                                        SHA-256:C4658264FA12F9C44B5016EDD8B8CD590CE448A9EA4FDF398CFE082454681072
                                                                                                                        SHA-512:5E2D6034AF0DC07544713EE15031A441DB63F7E2A157D61492585C19CAC7A1A779FA7E3FD5CC204C145BBB8AAA33BDCD6EE83C14F196A0D38330233F70E356A9
                                                                                                                        Malicious:false
                                                                                                                        Preview:R../!G2.X...C.Xw.G....t.+a...p.I.H9..x.%........?.....|......d`....O..n.?.....Y>..l5.Hm.!!..O.W..8.S..7...c..I.\..R=.._M|.......t..2#P{.. ....Sw.i.m3.rq...;!.......l....`h.Y.S}..Bs0+[...}y.:.:...pI....'hX:'"G..9.,.M..9t.PD.c......ef...*A.:.q.....L.?...1e.3..xr.f,....8.^..<...r..B.%..T7..Q[n....k..:-T|..!C.Sb.|.i?.o~...t ....h...|....za...:....Kf.....=1r=.zdM!...J...l#...!. D.^...K4 .,.N...~g.../... .0.....F.?..'7....ii.mb....=.^..p...g....M..8D..U.H......}..'wQg..".......w.$p.rl.R.{4..e..g..^.|`.f.J..aw..l6W3i.....K.`.J....a?.\4....wx..U.m...NF.-.A....^mJ..vY..D.|......W."....x....rn.f/.v..4.R..>..n..\....V&..Q]3........08X'..*....d.|.g5.oj...8:....i...8.1.@h...-:SY.....<...B.Dp.ry .+c....!.HX....;.c.;Pt.PD.0.....y].../...p.[.....FE...;d....Tn.f0......Z.."..D..G.X.{/...#......)p..<$Zn..!.....b.a.h?.cj5..?&...B..(.6.kh...FwL..b..I../5..!.S...2.&.+.ww.[v......S.e.F;;KE.*......byK...6..<.7.....[w..9x.Hm.= .#~.{..o.E..?..c..

                                                                                                                        C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftLync2010.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):5480
                                                                                                                        Entropy (8bit):7.947271574291157
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:96:v36WbvSVdassEOo/4zqz+eaaUm4jroYf+Si6uqFKJh9VmvbDQL8al7WVO9f/Sr0s:hwEyOo/4zqpUm4P7bFwh9VmvbcL7lqVb
                                                                                                                        MD5:7BD1E06A52DD5734E29572342BC11A2F
                                                                                                                        SHA1:2DFD5F086FEBB980E87B5802D0B7BE663BBB3618
                                                                                                                        SHA-256:1EAD7EA4E162957EDD17E9D5AA44E66C8061A1F8EAA60E8EAD66CC49B1BBF3DF
                                                                                                                        SHA-512:A8E6FC8B9BF3563619389E35D071104F90C94C935D16BB5F4C2639332BB5FE1E1CF233A596AA79608ED4957A445F92EDBB78F52A50EA4FD3ED311BE937E6B524
                                                                                                                        Malicious:false
                                                                                                                        Preview:'"....>>.........qU0.Y...........p...2U.....s.?......../.w={Adzh):.g.$&......{a[F.|T.N.8..S/.S!..vq2.5....D..q........Pc.!..(>\..M..:......5......Q...4....4p|...r.O.,.<..........)..s..vB.:.1.....5*'Dj....._.8l$}.~%K....fd^{y=/..a.#..\..Qv/u@.gU...9...r.LZ../"v.V.....P..~........)..'..&(N.ZQ..7......2.......D...0.....p?}......U.<.k.V....1.7..U.....}*7.vu..g....0.pO....,W.B.vZ.SJ.X..G+K){'-:..`.%i.YQ.K>nZF.a....9...d..p..>9p......C..lO......Ao.K.."}h.Wt..0....U.)........Y...}.....;0i......I.'.?.T..../.].%_......8.A..t9....^.z<;V-...\.4.T....N...h*R&).61.j.x-...../3".$l)i...$...[..~..%>K.U........s.........%.%...&....A..0..S...i........B...>....usg........x@y.d.........mT.C'/.$..r&..M....pz..H.....\........c...r.Vjw<60.k.:w.L@..(./..(tW.M.$...d..k.93>|.....l..zQ........ic.4...!)q..A...o..4.K.L.F......_.^.e.....}p`..X.v.'...D...-p.G*..........-.&....9..'*".......Ba.PA#.}o. ..!d.5F:0<.}.G......."IQE.{[.......b..|..%"1.@.....N..~......

                                                                                                                        C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftLync2013Win32.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):3993
                                                                                                                        Entropy (8bit):7.920982897137452
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:96:nTkOEAB/YdcUMPTAEqCQExE4w+vplfzDw28SEJ:wOEAB/IyPTAEqpExE4wszr1q
                                                                                                                        MD5:FB106FC771EEE06394E52A013F13D6E0
                                                                                                                        SHA1:007EBF6D863CBB33F0EE6F49A3305D730ACA2F12
                                                                                                                        SHA-256:6202C042ABEE264048F33A0EF19219D5CEA71C1021D32D10C2BC3A7D1A02F7F1
                                                                                                                        SHA-512:BB534A95F9ABCF5E5BFB479EF148AB421298F3A890940D3419C742494F69F89F263E5BB9353886B7A5E2379458D2AABA17133126BF66DF2E967067FC6FA19D74
                                                                                                                        Malicious:false
                                                                                                                        Preview:.`......5.M...K.......c.CR/.c.........^#..8.Gq.....{..@..<)JMA..}.?.sav.s.W..^..>.e.3...7..o.i.7\!...p(yUF.H... d...N............^..-...i.....]a.;_...f..T...B3.Q......m....[..F._..D.a..Z.[.`...6'}Q.%r`.xp.l....-...L...?.3.y..t.g6URB..8.>.t81.}.....Q.9.d.a....Z.?...M.rY....6gF.E...ij..AR.........O..:G..v.....Z(.:._..f..A...G..W..J...9.......E.y.7*P.;..t.xwV.`...B.~.Vq.&..Q.Z...Az..4m....w....Fy@.@..}.%.r.9.)...Q~./.+.k...?N.m.8.\.i_....{AC.E...p|..[XI....g....8o..cY..`...E.A".9HW..2..J.SFK3.NB.E... ..F..E..C............Ac...z.Cj..j...R...~..q..n..7...%..j.ixY....v..../jd.e.x..."mP.X.z...6Z.".6.T.nd....wEJ.I...s-..\I..........CG..1F..b........1_|..#..A...u..J......9.........I..AS..F.....J,..{...r.n....[....!...J....<|....s.sZ]CL..w...m05.8.K...<\..f.0...#F.".#.q.nS..JT%.......t9.Rf\.....J.... C..,Z..p......p..DW..zO.`.~l.g.h......s...P.X.....U....|..C.........L..K....j.V....G..r..ki.*.f..=IPd]CH..}.r..=|t.a....Uo.d.....Y.q..$.2.\.e.....8TW...?.lu..EX

                                                                                                                        C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftLync2013Win64.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):3993
                                                                                                                        Entropy (8bit):7.931454920358165
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:96:2P5IJEGAQ5SjoFLEeDWK0jrVV1cMfvGTj:2P5SQEiVCLG/1cMfvIj
                                                                                                                        MD5:FC3455C3C2BA272CC02A2813CA1B117D
                                                                                                                        SHA1:B383825104471ED932A18B16D548D1F76F028030
                                                                                                                        SHA-256:2A831B1B6F9EA1EA13FE896F7769B6DFDC16655E05E55CC63D51DD06F3004CEB
                                                                                                                        SHA-512:07B86BCB22CA48E91A08B14BDBEB65ECD102C86A56BFE43612B1754E52CF0EA2B29218E01AE63EAFAF09588FD589E48F1000706C517DFDFFA809D17B955B17C6
                                                                                                                        Malicious:false
                                                                                                                        Preview:t.a.^....3).Y8YV.57*}V...8.Y..Z...t..`q..6.?.#a....s7.......{..H...b..*.c..C........n..Z....b....U....S.../.".....".TO..d.}>E..C..z.fN.w.U.....m_..d....Y...q..O.J.#p..@..%.X.~X..ZO.k.\..?..a2n.e'B....F..UT...p....fM...@.N..h$..d....V.c..-.$...........o.....X?..../@N..`:.....".-.....>..6..b.r0S....4.kQ.u.[......OcC..|...\...z..N._\G......r...w..1C~.q...V.P.....t.....&.[..}...` .......+....@..q.....Tx..+.,.......... ......L)....>QU...-...".?F....4.S^.....y4......*.lG.x.......GxP..{...P...%..Z..EG...]..&...v.^.9.O..H..;.......#..-V..z..Q&!...N.W. !.F.4.0...v&..h..$...X..v.q..J......y.S.....X.....6JR..c)..... ......%.....`..|0U.C.5.lE.5.N.Z...ltA..}....n...j..T.J\G......`.+.oXOx..)..!.cn..D..r...@s&.%|.....J|8L.....l....;.o-..l......E..4. ..Q......=.m..5...D)....\R..<i....b@......0.E...#..X....I..).eW.b.B.E...G:...]...A.$z..T.E..F..K..;....&."-.W....2~F...._N..x..s....o.......#p....*>Y.H..!v..l....../.d.a..#......M....X........>HY..w7.....jB......4

                                                                                                                        C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftNotepad.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1365
                                                                                                                        Entropy (8bit):7.870026982653037
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:QwSfuM7o+JK86nxXFW+ptTsc3JllzQ0LfAL6sMMF5ICeF9ADtZ5:QwSfuMs+k86ZFW+pNp5rzQWfAL6sf5T1
                                                                                                                        MD5:65A054F5830A9AA83E4E3245504D2297
                                                                                                                        SHA1:D29441972628A530F4F902833EB56A8246B81BD8
                                                                                                                        SHA-256:70E923552AC5D4C0956F29397A2E26A9837F4C001F95294C060C395ECD61B2E9
                                                                                                                        SHA-512:2CAD7EE4D781791F22F88D505CCACA581377E48B8878780DA4B58CBEFB5B0384D54166EE4034AC6B979BA48433A7424BD4628551F10EC2420F95C6C21C81AB7F
                                                                                                                        Malicious:false
                                                                                                                        Preview:..$...u......;).y..c1C........=`.N.A..zE.....f.m(..?.Y.z...^..H|.'..Q..?..........u...."3*9..RY8.V.C%b,.B{....V.YC..?.`1:.vz..P..)..N.S.KRq.f.{.s.=u.$h..Fq..W5...iYu"....h...q.=.+.I'.,MmIwh...jE`5d....&..7o}./ 6rTcM._'..pI...n..A...zW%..H...j..........t...v.td.),B....F...p{....].WJ..#.4HY.pp..F..`....^.TPy.b.2.r..3i.1p..B}..X3...h.`v...&..d..4........N.lo~_.lB.....e.>.....v.q.....Jm..Q..?.....T..x.u..X...oE...E.....;...?;`r...7S........V~......AN..)Dg 6........m)...Y.N]d.g.8.q..(z.,w...2..J*X.|.:o...u.,..5.....<...1.B...=..?...Aa....6..\...\....*.-....l..M..$c.>8....6....H....H...82tM... [....E...Rw...._.....8..j|.ra..@..)....Y.O.s.n...y..$k.7q..Lw..L....r.uv...4...-..,.i}..`47._..W...Xr.w..)....o._..6....:...1k^...g..I...c.;%.S...zT...o...v...5'hr...t|....I.].hs..J.;.....r)}&!.bf..\..0..X..7....#.g.y..5t.{).yw..W5...Y4>...c.q..R..(..R.......0e..0.>_.Y"S.....^.V@.EE..j.G.9D@nh4.. ..T...y.k|w...........%.....C/..)h.....F.......T.......#

                                                                                                                        C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2010Win32.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):100121
                                                                                                                        Entropy (8bit):7.943689999781486
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:1536:eExGPDmmEQ3+MbVKodazKofjwuTy2bYtaVJu+m:hmDHlppKFzKUjHyoCaVJZm
                                                                                                                        MD5:850C1C2F51A51BE71CC07D20B4BF6B4F
                                                                                                                        SHA1:AF7102E52E93200A7DA74BA0CE9FB9A8A063C961
                                                                                                                        SHA-256:BB7A4BE5D10376D78E1D7C26C4986EAFD7A1F725F3DDE0A517735F9374E678D3
                                                                                                                        SHA-512:06E4FB7962047B7FC41C26BFF0A7539ACB479F5D3D6092D18E92FE99CAB100CF6710429FFC365955D17D929D17975A70C8FEA19B6CC37E4566D4009463B92D85
                                                                                                                        Malicious:false
                                                                                                                        Preview:i~.Mr.r.C.1./Q.....nJVk....".NG-.....>j.....~.fS4B...~.....).Y..2...N.q.Q..B...e.-....q...X..w.QM....v.................g.o....<u*h......$. $..r..3...W.H!.V.....l........gC..%.w.L...]...O..i...i.;i[...S..?/.J....".....U.33r.F...0.....$...XO...b.,..H.\B..#...Y.....D......6......O...a.o....-<6.......,.$#..sO.=...O..%.S......)...<..g....,^..Vy..'w...I@..d...:........f...J..l,6..\M.PI...WWS......`.....!G..B../.t.c..Z..y.......?B......b....../.........K..;...(.1.&.....1.!8..p..&...H..h._.......#...)...n@..-_..QN......SZ..w\.....a....r.....d8.BY.ZJ.P.....-1|.......+...E.x.X.&..s......Z..p......$E(.....f.E....,.L....U...c.*...S%u&t.....&.(x..x..*..N.J+.a......6...5...9...4...S.8...i....h.F..+..6^cG..8.?..`...h.,......).4:f..W..........4VC.!-.m.O...c..e.......-M.....#.E...=.........U..o..9vQ,e........#>../_.b.....g.s.....#...e...(...!..k1..=2./RI..H4?...|..m.X.......o`>Y.....:1....d.z..[..4.....o}..I..G.!.c..j..x....Z....qj..........1._...

                                                                                                                        C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2010Win64.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:OpenPGP Secret Key
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):100121
                                                                                                                        Entropy (8bit):7.954076210581558
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:1536:8cm3q4ZtP6QSpz6ZCtr+ZcwBbGnAPRNU+Dud04Wx5Ct6l3lMU6Xr0A8:8d3qwP6QSiCl+OHHK7rlz/A8
                                                                                                                        MD5:24E27F356C6CB81F5B2475E1414E7BCA
                                                                                                                        SHA1:3CE9A4DAC5CBF9F8456B0649FE886BF642CC1072
                                                                                                                        SHA-256:01189B0E23B41267C681B928858C6886EFDAC2A9D70ADE58647F3354D11F4631
                                                                                                                        SHA-512:484C92C1C69B0E647C1CBD02151F02185434FF18C46F9226FCF2673562FF2CF8FF594F43A64AE247B90E3EC03BA7A27AA80535AE09FEB8805FC9FFAA7E9C97F5
                                                                                                                        Malicious:false
                                                                                                                        Preview:.......@Z.e.k.....L.S..V...P......C....e!I...R...Q......... RVv..~...12....f...MT...@)..E........6.n...P`a...@y..5..Z..CZ..;.....7?..tL.)H.\...P1&..I_6.A.!1.p.<..`._B@..#i.d:...e6..p."b..[0..%).D....H.{mx.........<.!..q.....?Q.pS......vg.\..k^4.JO....A}.......Z...U.FP..Dm}...Ih..>..Y..CU..*C.....( ..zH.`A.....P$>.\MS3.N.e~.5.hepP..R@K.bs.>....[>..l.G..T@.%.!.D=.y6.....R.4....&A......b.R%.w...mS.r.Cd....~b.B..#...\I....A4......K.....F...Wmm....M}.p.......^....N.....>:.. M.j[.K...99.R..?.\...q.?.qe}E.BII..`u.?.3.b.......Z..y..x....7..|w.I.F.P.c.........c.....b.:i..D..#;.....SG.#.....\3..1.....P...V.O....ae....t. ...G...[.."......<;..oD.\].\..."?..CY..Z..`2.*.heqY....Y.P..d&.T.t.y.....M.....F.....u.m....y..2..5.C.....l......_.i..Y....rw.....^Y.g\...\>........Y...^..@...1>_...\5........C....q......5)..fO.jK.....>`.@.u..%..!b.?.qcp..;..K.?T.}.j...3$..3.d..(-.a.s='.}....\......_.....`.>..."PVS..y..../,.J..=ss........>........{......P.Sk{....%..

                                                                                                                        C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013BackupWin32.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):18128
                                                                                                                        Entropy (8bit):7.945928941879322
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:384:/TBpFlKB8ibzFC8prk6EBOhlUwBeId0kipQBluvJOhzShHLscLfAHd:rFlkf3Fpr9sOhlPBr0keMzAsmAd
                                                                                                                        MD5:FB9CB603A8EB231769112A090E4ECBA3
                                                                                                                        SHA1:77D7165E1FFD6B8B09D270A6142192CF8E192B8C
                                                                                                                        SHA-256:0E388F2F624F56FF59847245C43C660FEA7B46CDCE13F38E2746ACF0D931A74B
                                                                                                                        SHA-512:E41A0B39A6BEFF675D9E323019EC08E6AC1188AD1CF13C16B3DB1CE5C43D9289D865577D0E6158E910E9F265A5E3F8BF51310F5A97C19781716E3D3601B840EA
                                                                                                                        Malicious:false
                                                                                                                        Preview:..,-...A.q.6...-......j.e.{I@..fd...1E..d.......[1..NB..$...T.w.5H....(...W.^.PO..4....i.&.;..-...2KU..X.w.i...1......`.."..i....9U.?.......q.;....N.2.P...5D.J|L.0...L..p.z.S......U.i0N...oh...s..k.|.}IBc1.(.H. y..`.........sN...0*.9S..3.u.YKS.T.Zr..y....f...%%9_&..xoR..D.p. ...=..Q..s../..!..L...^8I.N.....li.....d8.OX=.6B.Tj@.gA.QX..o.k.S.V.D.t.5.X....0..j.._.OW.$u...S#.o......G..}S.>v......B.".Q9.5_....i._DW...WM..5...!.T.jcl}"F.L.....Z.y.>..t.OM...%..!..;.....w.Y+..N.....li..smo.RZ#.>..{H...uQ.B&..v.r.T....Mv.....j.`..B.@|....{b..k+..2v.N...?e...}........GLO..|.[.a.c.BA\.N.9,..)...R..a.`kq^1..*CK...P.o.c...:......../..1.....u.Y8/.......q......R[>.TM/.9Y...#..uQ.B&..c.h.H.g..1.a.e.Q......L.....b....Bk.z`..7U...lZ=.g.k......|\...Q9.=S....`.AI@.a.]E..z...2..b.f`Y rV..aT..Y.Q.n...8.@!...~..n.t.._.M.Z)^.......t.<...._e>.\C'.>E..BH.k|.B:.$.;...._.|-jV.V}e.5..b...-.......w./.A...T.O.4...7.....3..L.^K.1BE.W.&.......QA..}...cN.$.%%%-.../QO.:.6. ..t.S

                                                                                                                        C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013BackupWin64.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):18128
                                                                                                                        Entropy (8bit):7.952000755669768
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:384:nhoYdQWUh3zsCLyHVchgxHc6vcBAO/CkMk/b2Jv6cxhPi/6OVj4O4nvF8q:nOaB4zsCLyHVchWHkMk/bGFxhq/6OVL2
                                                                                                                        MD5:21D1D7411A927A124E8E05C2E671339C
                                                                                                                        SHA1:39E1A6DB7ACF901A9CD94897462CFA9E35A96A27
                                                                                                                        SHA-256:6AC0A275D78C571C98615F200CFF57B1B282D61ABA7C6A0440B793BCFDC21A02
                                                                                                                        SHA-512:FB71575DB1E6A9B59A75CC57CF1CB01BA729FA24893F9E363B42AEEC5C291F17A843A449D16A80E8417462FB21C2E47D543ECD07681F9C0CA1D99A4F9C915CD3
                                                                                                                        Malicious:false
                                                                                                                        Preview:.w.!..'.....yh..s...o@..F..&5.Vi....C.........N.....g$......v....E.w.OR%...~...Z...k.=..=...!....,:.{..U.+(.)..() =.c..e..-.c..........CwR.3..<..V...(z.d....7......._..M..,I.<>d.....Z..g..`&@c...m....Wq......*......T.O.....&.......39[..^.#...Y..d...g..%.=..;.$...y*.=p.|..v.'/.`...%.(T0ARv.P .{..M\B..H....=q.-..X.N.I..b..h....4...........=V.-.d...4.....`...-.2.G..A8..!.&.G.[s.l........F.=.|.D..L..... XH..R.....s......X...f. .Ta.\QJ.[..UD.5./v.%&.~..\lmmHL.. .Q..}..M'...C....=q.-..X.N.U....h....<.._.......;O.4=c..=....t...a..9,.i^.......K..'.Hl.m....Fg.y.KI..._....nFy...Aj.-.a...w...9...i.iFaw.X[B.x=.*".e..w..0.#..."$7.v..+.t .c..B$...O...]wM.!.<..j...4&.e....;...k.......;Z..&.....ai...s0..=..6.o..'P.;.. ...+...x.8'"@...g{...z.... XH..^.t...a..u...P..&.=&~c.G]I..~.h..z..v........ qb$c..{..a.0..MTT.K...{`Z.%.9..]&..9..h....<............~..}r1....+...Q.....q(x.ve.[.b.Q7.1.0=M...3.vD.J.^H..3.......<W:..O_G.^\5..,...T...;.ww;%........?'.a..'.Bi.`..\lmq

                                                                                                                        C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Office365Win32.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):14604
                                                                                                                        Entropy (8bit):7.929786791588228
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:384:5MuxnE+F8L+Bk0hpgnW0s04b+l1vd49Vi1rv+8y1lEKTo:5MutE+F8L+vpb04b+7w4rvqCco
                                                                                                                        MD5:622FF21940BF1291B804625B3EC8C83B
                                                                                                                        SHA1:203DA8273D469BE616323D32244434CE2A6561B5
                                                                                                                        SHA-256:AA4FACA261240B2803ADA932DE08206E5DBF08A8CA74425504D19DCAB896BD88
                                                                                                                        SHA-512:D55258443603134BE844D2212E1515CBCC86027E252E26D27E3F8B4C1EF6ABCEAAE1D64AC7E7609AFAADED08D51B0E2090B8D722528C1546CB35B36EAFAC3EEE
                                                                                                                        Malicious:false
                                                                                                                        Preview:.....P...2;...'...F.3.........\?...... .....Qo.p....`..>Ukw..!&..k.....b..?+.o.ys.0d8W[.D..t.A0S3.c5.}.............U|.. ...u.r.5<h5......"......j...Xk*&..M...o;G..|..lf.~..Y>.~..h.3..P...}.ua ...{.i...0...Yy....<Kj.!J...A...!.8&..}7[%6.....W4G.rh.u.yy.;nu.O.G..[._.eA.k$..z......6..?..../.x...o.5.w}8'.....f..g...&..E....w..{...E%C..s..j1z&.1J9.t..,...t..}.2.4lf.w,.............o..E%.k.k ....s...!...:G-].f.....[.pd.?..7.~#9;O.G.i9..R7/.c5.}......s.pSL...!...;...i.l...&....].....Z...&..J.I7: ..&.h..c..5p..}W%X..E<.$.d}..u.I...........s....q.....&..&...#!.B.ju..ZB..m&T7|.....Jm9.=+D!.6+.,fs.@.m.O$..M)f.a..p......b(.7R..Un.......c.$.7-jc.......J...v...E*'w..8.B..c...r..{q3).t...7...m.8o.R....{.:.=..T.Z....t.oR$...e..<$z...I`..k...%8;.......e.].od.n.bK.6bw.J.v.E:.#m+`.`(.3....C8q!....Vp...;...h.".$;$ .....E....$....E6=;....B..c..MG..fp>e.@!U.7.....f..2.....!q.^.....[.........../.y.%....c.2`..wh.,r.ZJ.....K6h.th.n.yq..Lc.G.G..c.Oa.`.k...<....x6a]yL..

                                                                                                                        C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Office365Win64.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):14604
                                                                                                                        Entropy (8bit):7.9368317754710604
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:384:1zYgjxWJz6vT4nvQAQxn2iu52qZ6uoqiWyz0hUutwfw:1z7I8vT4vFQkiRqAjqiWyzkwo
                                                                                                                        MD5:67DBCB97683DA17F3BF4DDC3BBC671EA
                                                                                                                        SHA1:6116E9CEDCFCA9317DE9385BD2EDA15353CA5414
                                                                                                                        SHA-256:547ABAE6AAD939717C2480B4716788CC7F67A1721ED04C86A30846DED845E1CA
                                                                                                                        SHA-512:EC880F2EC4C921C1A615B0D1AED35C6FB667C379B2F33F7D1960D2CCEAD72081DA7BABDA44A3D627FD9DA71EF696C5A7512F78A2F58634F0046ED621068C7BF4
                                                                                                                        Malicious:false
                                                                                                                        Preview:.R.:.d....G...C...,.C.9P|.Q..uN..50...=.`#..h..v...}...M{..4*.1....(..Z.Ra.k.(.F..&.czq.Q..t..$/....F.......x.Z...k."..mP.Rf.Yl....E.P8s.ed.U..@h.......H..u...:.\.;....`."..IB|..;/x.2....FH.../...c.t.]Ut/.i..Q.-....p.$_..*P..%o4l....|.....".q."..L.\2.`uw.d.9B.=,>Q...G..........v..X..xG...w....'.Ku......X..)...M.'O..N....b.._...<.:.z....j...r.......2..lE\.{.....g...%a.?..5U.j.$7....N...v..&-...(s<..kb.5.......;..l....~2.`i...Yv...$/....F.......]5I.V..u. ..q...oV.nI.....~.Qew.):..;..x..I...E-..,0..+.e./....:O....cA...-8.7$[.Ojb.f+..!..BF.$y.....'Tth..J.4p..|N_..4`&&....r.y.Pa.%..p..D.U=.J!,..Ui..2&.....G.....Cs.Z...d7=..{...Pw.."....{.Muv.yb.[...e..-...E-..B...-.s.D....)Y.c...b......4%.(*+4..lo.KW(............-.,...e..M...*..%....p.......j....@.U7.Q8&..hI..3'2....Z.......f.Y..".;..p...Ca.L......"..6>..+$._..........E-..0H..0.~.0...)Y..vg..I.....7Q......8.j..;w..k...go.N.....%)e..QdC..`4K.....t..(..".j..*.n.V:.`.x.@.E=.1,4...T......]5I

                                                                                                                        C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Win32.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):94071
                                                                                                                        Entropy (8bit):7.953227638773414
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:1536:/r59Q5CGC/614gcFIBlTQLLmzZVdUGZFsEo/s9u1d4KKxHgvT3E/+:/r5OAHClCLmzZJZkBdIxAjEG
                                                                                                                        MD5:4BD0B45DD25F26FA86B788FB28D58E00
                                                                                                                        SHA1:ADFEA5711A6F565CB053CB79A6BA539DEC13EA37
                                                                                                                        SHA-256:9A861044D047AF0FF0F0068E0191A3D5C48C8CE8666CDBEC8FD95FBB0E83104C
                                                                                                                        SHA-512:A8D2702215AFA5AEBD119EC9A4BC8443ADF6AEF228DD1EDC60CACC9620A5753D6AC3C00599D0D9A2D07E97DC80B6B4236648A72BC266C4262B39F8B9C714B1CE
                                                                                                                        Malicious:false
                                                                                                                        Preview:b......K..........].D.............j...>......Lm.]6..W9...f.x.2...i)l.q...9......?....%......-.y....a\.~...ZP....\,..L.=.#....%n..r<2....v.PNe9~.V....z...\...,.."m<N...r.[.....':.y........b...|&....h...P.....r..^....1....@|Mx.R.y.g.g..h/u.(..~...!.8....a...W...V...\B..591...WL...U=..GOD. .$..+x..; %\..i.X@a>7.W._..z....X...#..f"=...J..AT....f ...5"?.........SH.H...y...c.F....F%...E|}..9.b.N2 ,u6.6.5.}...s.e.>..`...........s..C...|...GD.L"9|...W\..Q(....,.m.W../-8.6.|B...s.E.d%=.T.W...........1.--)..J..].....d&..$6.O.+.o........y.F.j[.5..3....s.....7.I9|.9..j.P.7.:W^...S$>.z...0..RbQA...s..W...r...@...&0p...[T....!..YUf.>.5..+~C.r0.]...r.RUme..\.|..?....V...7..cn'...J...F...T,.z..d...Gt....o{"/...a.y.+*....FHF..B.i{...#t..e.[...v.f...N%n. ..+..LS.....J..K...g.<.HB..vn!.V.......@`.g.$.s.W..vD).V:?@..`.~\f#=....K.3.......H..">....L..?~...;...z...#....VD.M...+.&.U..;Wp.'.Hw.Z..~.w...iw{..}iF..4.z.22..n)m.?..h....fO{].P.C...I.../.:..&.Lv|1.3.QJ....u..

                                                                                                                        C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Win64.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):94071
                                                                                                                        Entropy (8bit):7.947709153752781
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:1536:zP6lPZusjlWckzT+QPrKztQuCgK5jI0qSaayB:6PZusjIj3+QAFz2sqaR
                                                                                                                        MD5:3DDD8BBD78E740C59AB35FB6D6DDB164
                                                                                                                        SHA1:B4F0473C15D4A770F01F8104BF7B702E5D8A546C
                                                                                                                        SHA-256:CF5F23296C6FDC1F40AA8CA82028751E9896198D6E8CB77490FF8D7CC8236AF4
                                                                                                                        SHA-512:CE7BEAC512FDD4B43DB70514B6C538FAA61DB611A3B281C5F8F8DCF03C1C3C2C680791DC455F68736776E942C58C256412BC97ADC85A0D602D513711C1D6E7B4
                                                                                                                        Malicious:false
                                                                                                                        Preview:.....a..^.q.d..M.......-O0...... .^.5.....d].t.C1.yo..eL..8.,..{...N....2.9TC...].4SI....X...yd.b.O`...!....O.".w......].i.E7.$|...^O,...{..o.._..S.z.\.."@<..W6.aR...t.1.1......F.f.4y.*.r..LS.$.2..K..w.bHUCZ....'....^.H.Ec.1`.zS...>..-..|...@..V.|.?SX.....``....g-.DX=,..%.R...=....F.k.|I.....].g.W&..32...AM$...2..=..C..K.6.P..-F7CTVs.56a..:..f.p..Et6C.y.vJp.j...r.P..F...h.F.....W#..N.`........LU..5F...<..6..z......L\=.9E^.....)[..M6.UC;'..%Mt...-....B.q.2.n.]....c.q...j,...[@9...8..x..P..L.8....?_h.[By.,6l..i.2Dr..D.X.......3...*.k64.A...8.pg..,..3..at.".K].h../b.4_..'...V'...X..(Qq.[:.......R...C!.ND.,..,Ap.T.%......v.bS$......g....83...Z....X...o..A..J.x.Z..9['F.Ll.56`..(..tEB...0RM.....`.&e<.qD..d...p...._7.AFpi...q.H.0S.A.6i..[...'....e....../v|.j~K...2.#G...Vu.GL=*.Hr.5.T.~...S.>A\.f.C..].:.`}..)....HW....8..-.f....*.v..F%r.Hfy.,0a.....fJ->...g.*.^.SA.^.>..!.A.b...f..F.......z7GV..6.#...fM.7Y....+..r.....GBQ.v....;.#Z....z.e.YC.H`.8...;......-8

                                                                                                                        C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016BackupWin32.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):18128
                                                                                                                        Entropy (8bit):7.940211492497301
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:384:1BS9LP0iOnLBYrvF4pq1OakJ/anPMJ/gJSkqEVD3VjPoLmNp7hAZSa2sd2j:pLBYTginEJ/6R3FoKn8ST
                                                                                                                        MD5:5BEF9D0558EC97AB2EB2317E54CE7D85
                                                                                                                        SHA1:E3EABF5B900464743C6A45D274EF9A33AA489181
                                                                                                                        SHA-256:006A5711FD77BDA87162211A11C20FFCCC09C35C8651CD8DE1FCE055D962DB72
                                                                                                                        SHA-512:B19C85A5A5368C62414FFB0A92860F52F11267BCA655C1C8DD72D5E17A4BBB23A49122A6F055783069FF9F26803856367D8B140EAD6CEC557F1ED9584BA631E5
                                                                                                                        Malicious:false
                                                                                                                        Preview:.eg...1.w<.#h>..Y-.+<h..kv.z.=8+:.1...'.....r..^....c~,..r.....O`...VB.d6.~.`poS..+...*../....Xj....g...[....*1..".f.L...Qq.a.Ft...)....%..].#SC!...........;^+@.[mL...9{....2..Y...a........2...#,5_@..i.~.......,Q...#..G..=..%......C{.....)u.d.`zRX..e...%....5.\jb....f<..\..5&?..q.2..4...#.=..c...c....n..4..luak.....(.....-R:LP.?....&{.....#.L.^...nT.....p0...a..{yOP..!.%.....R..V.....Rh..N.......Ow....../z...nwmH..&*..bM.b.s.~n1....CW<..U....so|Q...n..5...=.F.B:...9....n..4..p........6....9..T#B.... .?}....?z#%I..(..y...Io&.`0.iZ.|..Q...:O..q.5...FpR.....\{..x......./..4..2..w.1....)L..W[.f.{.]}j.....}=..C...<!5..7.l......o.E.S8........{..P..)RF=....:....NF1y.B....$.*g...(.a.b...%.Ui.!?...).......WS....nE.....d..3..m^..*......G{......1w.u.B}eO..f...HO.y.p.#=!...y<..}...2#`^.".k.9|...Ls.5......t...y..Q..]S0.....2...._.Z4L\8...V.m.......-..-..#;..*.....p..p}.1<....%/.....,...]RH..1..e......Kj...GL.f6.,.]qaT..{......0.5..Yj....mm.......so|M

                                                                                                                        C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016BackupWin64.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):18128
                                                                                                                        Entropy (8bit):7.939815973088786
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:384:bTYUFm5bIifv06xq6JG/90+zmZ7UVaHSkfu0aiqQRbxmiuVfX1:PYCm5bIQ06s/90xUuo/6xmdX1
                                                                                                                        MD5:2C2ECA4993DCFE832A693FF24A470B72
                                                                                                                        SHA1:A893B926646A6AE4C5AF2B82BD89730EA073822A
                                                                                                                        SHA-256:16BF74D4B1D9DB0BC2EBF2ABA3211ABD7F9E309607F19F5897C7BB212422CBEE
                                                                                                                        SHA-512:A975FA0006B060EFE452B34569CC10E2332A2E648B28309B2C9CB6FA93290B451F50E26F6902E3D3741A5A1C989FF702A62404599E741D0EF8D26FBAEB6BDE60
                                                                                                                        Malicious:false
                                                                                                                        Preview: 7R$.Z.Y.S...1..0.......^.. .7...9y....@.].......{..@.!Ua..;}..B._...Vz.XW.o..Jew.t....M. f;".!.W...~.0.+.).....,`y....=.$tuE. !.@+a 7W....B...A.7...w.hV..1V....^..-...'5..M.1t.Ls-...;....).D.|..".S...>K...o.A..o.-.U t{.."Rx.2..d!..f......6..+.,..@e}......M./`.....%...4.7.*.5.....$Ru...Ey.2,ZH.8i..w#d .....a.D.%.e.L.UA.\..qp....@..<.O.uf..R. O.X.......[..:..C.qQ.$p..b.hU..%B......ipD.cy..//..r..h.3...j.........#..kkp.o....P.h:Io.J.......~...+....H.<.Y.9(.a2[F.>s...p$y......a.D.%.e.P.-6....sn....o..Rr].dp...K.9w..._...zZp.>.......x..7..Ar....*...plx.aT.>v^(.....%xV...&...Kd....&..Z4..:.....],|k.B.$...f...1.!-....0[r.... .j2~H. y...g5{....].Q.A."...r.4Z..db........X].dp...^.#l.O.y....3%j.[...1.5..l..A...|......5..o...~...$E.'..}.v1....|...U........uGz.h....M.B8.t.I.Z..V.1.5.("(...0Up.V..=.:....s<...5lC......J.S.D.0.#.g..Z..jj......2.C.Np.....p8Cx...9..M...Rz7|......bq. ......L.y/.=.|..$......x..c..#.]...M...fR.VG.oI..Xv.s.......~9=...W...c.*.!.KtO..b.<.E

                                                                                                                        C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016Win32.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):90427
                                                                                                                        Entropy (8bit):7.933919910075154
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:1536:rvNu1ueMGrNRsuwZvescMP0sggQ4uoFA+bpzbpyKaNSqKZhJLJkHsEMYq:rg1ueMG5VOuB0vpyhSqzMvYq
                                                                                                                        MD5:67B7E4461033C2A5C664E7D73F959790
                                                                                                                        SHA1:A526F8BC4EB69E88AF1BC6CBCFF6C20095B1A142
                                                                                                                        SHA-256:4B5D0DD2834B724C930FE990496AE8EEADA6F8121532997A42A0B8EE3A48159D
                                                                                                                        SHA-512:B2CC269E849D384F50AA5DFC9E05B368EE661A88148CD0659F32220C67CA20B79555991DD0F3B430398D43535EFE6A74D9D27814AA4B6AE78E386D1F6E061F31
                                                                                                                        Malicious:false
                                                                                                                        Preview:..:+...g.y.t.....u{......;..;.K..S5H*a~......,.....$!.cl.... .......<....8...,..P....).....s.M....5l.F..w.W......V....JS." /}a..Z......bJ(%.FZ..UF..u`..*.}%].w..,l|...S>..OjO..B.9...o}.,(eS...:..b...E...G>~..o{S-.....wC;..|...?.A....%....6.K.!.V....m....#..8...V.=...z.\......./....J\.42>4}.W......e.!$..T..MS.ye..,.9j\..#...v2...F.................d......km@.t.....>..HX...m.g..\.~....F.m.[....5....b.M.i..P..........q..#......=D..z.......[.G..s..W.a..9X...P......~.;'..O...JX..6i..5.reH..:...ja....}........8m5zZ.'g>..J....,.s.......6.Kn...Epa.;>.~.G.b.x.....n....../.d..2..........>..4....U.4H...v.^.............R.2o6}m.P.....>?=/.#C...LS..sW..1.<&F..#...* ...M..OR..R.....Im.[,/UK!...tj.....6.........s./..V..u.e...@.....>....s...C.......F....>..`...]Fj....&........5.O..s.J....eYg...L...?..x.+x.W.<......_E..O.}vl..:..E....."..VaJ....U...../"...<..k...]x.=../..B.P.mdXc.S.s....Q.D.".......=....X.O.w.......OH...>..o.....Fx...|._.....

                                                                                                                        C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016Win64.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):90430
                                                                                                                        Entropy (8bit):7.952925735591742
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:1536:DCs3U7VivKH+Qw+eN0Z4v8qGh4+NZKae6YJjbVHKWUjD:DL3UYvEPw5BZGBNZy6ejpYv
                                                                                                                        MD5:57AF148A321D12BFEBB0B4A3B3243C2F
                                                                                                                        SHA1:8847D92E75FF114067E4AAD878C08BF635F5C7B6
                                                                                                                        SHA-256:17945EDFB90A91684B893AD841E797E1480ED05C71990BF98784E22126FA8165
                                                                                                                        SHA-512:F51FF254F66568642C8CF74462687D589660F8BAA4432141EE599DAA1AEDB2A8E711E8969598696437CCCB4FA356E73F98037507B4EFA2D091D9D0C25A6B41DF
                                                                                                                        Malicious:false
                                                                                                                        Preview:S..gC.a...^.<....x$G.ZL..`.....a:X..5I8...'.p.....V.^..0f..N....VE1.B.%1r....3.....?n..V...,..|O.|0........1...h....B...e..V8(X4.1CC...*....8.jN.t...o"...t....+..1&e....,..s..>.....&fJ.).^..l...Z.N.~.\..,....L..Y.VF.){.=`.Q.....WC(...p?5.G...4......k]......u.4,.T.........8..........B...w..J/fO9..AK...c..\6.j[.a...j?...0.......<+....m..).E`R...\.|......zV)..Ur....7a.......` .FK....}.../......_LB8...uk+.]....".Z...."f..T...d.?b.T2....C..<.....y..r....Q..ovx^>.4LV...i...T-.>F.j..f"...{..Tf.. x...o..(.g{.X.y.N8zR..8.IW.ys.."`.....2.)....m(..q..p.;e.3........lHc.I.,'{.9....].)....%o.........4/.]>........{.....3........*..Z$g_>.5.A..._....!./].a..X?...5.......`9.Q.._..s...(;......~...{..&.....}.(...O..t.z8.6..%..4|.)..@.....qI3...`z`.>...........(z.......v.2'..o.....N..-\...q..r.B[..@..P5zC".'[m...i....o.#A.0..Jh..t...f.XB..@..0#.jQ>.6.....3..b..n:L...V..n....;.u..E..g......8,.5-.L....QE0...;Q#.V....w.ZU..T(g......T..[b...........hI.

                                                                                                                        C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2013CAWin32.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1838
                                                                                                                        Entropy (8bit):7.882101999279904
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:48:SYFiHlCsxgur+avvVBYfxuIJVnFJPxyXjMAVmG/GRFG:Q8Lur+avvEJuIJVFRxi4RFG
                                                                                                                        MD5:9EE343893EF72306556D841A7E274BA0
                                                                                                                        SHA1:1807E9AB6EC75D886570F266CD01C82945B02549
                                                                                                                        SHA-256:FA5978D5E4719FD9A28EEAC6A499726D81331CDFB6BE838AD0BB09E37B838CF6
                                                                                                                        SHA-512:A5546FA0B143D530CF4A4A9619A01D507E694ACD33852E8C351C52001CD42B21C125F8B1A23CBFCC4A60889C26173A82B5C025E6DB27C1109D67751DC00291A9
                                                                                                                        Malicious:false
                                                                                                                        Preview:.y)NT.i!r.iak?8v....S`?.QA{_~...g.5..9.].T.....H..FXf........~Nj5X[g.....'..xX.O[.w.#\0.h.C.R..w.o._.<..68M..,.........~...#......b..w......]"g.*1U].....$...aI..%.2.j.)A..2.6.;L...g.h|..b._uC....5)\.KL..53.c..@#u/...N#.......Y..|Ol,_. ......i...C.[..vB..m.w.6a...?w....<..*7FA.%...._....~...1....I..}..y.......,{.2$.Y.....`...t....|.j..h[.f.R,....k.Q...6J....D.:...Z|..?......u*....e..v.F.\...K.C.,Tm<Y.(......(..iE.[..v.+.{.;.-p...49..].9..:%.X.!..B....{.*........W..g..#......7h..5/......+....../.c..j]. .4.JC...c..L....O.2.5..z.v......8a....D.#......D.`.gtgg.Pu......d.....M..k.".D.4.:x...?t..Q.0..2:D[.c...E.....;...l...H..fY.l......8;y..3$WW.....e...a....n.4..&a..2.6B,.5E...^\.....pr.`S.V.w..../.@v.85.@.X6h\C..9....M.cSW?[.)......C.. ..E..O.&.g.8.:1!..6v....e.A.._[.+.........v... ......wI......3.0*j..)._@.....o...3*...o.9..M...f.d....?s.M.P...(..[....i...B..&C.zG..l@...........C..>.,.S.6.....i..LC.K..q.6O..w.n1R..5z..C.X.R.v...x......

                                                                                                                        C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2013CAWin64.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:OpenPGP Secret Key
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1838
                                                                                                                        Entropy (8bit):7.872398094796909
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:48:TfX7Zldnfs1fGBlNJPVOhAhN9tk6kbVox:TX75nXVbN9mp6x
                                                                                                                        MD5:CF3610715E8D79053468F66D5869A702
                                                                                                                        SHA1:203BFC8215C363647597CBB64B96F8A342E3A207
                                                                                                                        SHA-256:E18E0B199BFC09E0545744DEAAE82610B16EF0D064F0488E46ECDDBA3B9BB718
                                                                                                                        SHA-512:8F25081A6D76A6EA2319BCB4626742A4F5ADEB7AEA1B3825E6F3684D168B6C7762631B97914071FD211BA5331BC80F63E8577B7AA4FF4798D507A2724CDC6A8A
                                                                                                                        Malicious:false
                                                                                                                        Preview:.}...EpP.U.g....._..<..JlO..4&.j..n....!;..p..O.Z.1].3A..c...;......I8pm....+.\f.MJ4....kaJ.Q.........E..0.....p.`M...y....;....R..F.8yW.r[.,?.......O.uB....O.R.Ag...)-..S...........>.pDi.......g/q..GU...........u.C).r....|.R.~....K..67&Z.T.-.Gg...5..;~1|+.S...>...Q..?.....9.k....s....).L.....Y.:qY.u..-m.......K.p_...D......|...9-...........]..:..B...b......?......-...;.h.....;....H.;....]..b) @...+.A(...5....i2.g:.H...>..B..-.....#.%J.....T.....A.....O.7l..n...(.........|B.......]..q."$.........~9.....%..F...5......,....^.,..#.78....._*'.;...!.k.0.....@.yB$.Y.I..[...(...&=.p2.O...7.....2..P..$.u.....bE...t.......M.z{L....&?.......E.B_...AL.....}...}s.\.............@".rF{....=.|b..(.s..._.]......q.......#a.F.7...._..b%h..~.d.{i..V....:1.p{.T...0............p.fM...*..N.8...]..F.j.).!G..s.......R.aB...K.TC@"+E...y~..7...........;...z.]._2..P>...`./...C.o^U.T...]....qE.+..}.H.`....]..y.q#.T.x.Gg...2....C~T${.q...(...)..~.M.89.`W.

                                                                                                                        C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2016CAWin32.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1841
                                                                                                                        Entropy (8bit):7.885596121873415
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:48:tAgFewwy/bOy7Apa8a6MBWfft/g/Q/pKAtn8v7Bp1wxigM1:OgAib0a8TM8f1Io/pKAtn8lUxdc
                                                                                                                        MD5:417219C5977DA558E6AA3A526B3791EB
                                                                                                                        SHA1:B0E54571082F60A7ECBF43568F2A64BFD7062073
                                                                                                                        SHA-256:327F48AD956CDD25D5BF1CD0F5DFC2589F17E477FF0A04874FEAD6D8EB974D4F
                                                                                                                        SHA-512:655DFBC5A2A90B59FE2B9AC9A24DBA6857A632E77C038C26D94B2119338FEE564B357F7A7D79A3D23E92DF0874F58ECD4F7C4419F10E7FF099ECE58DCBE6FACF
                                                                                                                        Malicious:false
                                                                                                                        Preview:....*b.I.A..}h.Xu.83&.J.^Z.i n).h.g.....7...s.....r.........j......m.=...S.....<!...D/\|...9.<rI..D...~..5+L..c.. .+.p..C....~w.J8..$..v....G..2>..4`..s.....m...L.d.:..A..-.}.....Z.?..(r/.v...'r..U...2...mOf...p.3.K.bY......?......V*.3...r......(s_..wq.,.r.C.o6.~.l.".s..>bB......Yb(.z..U.......sh.H0..#g.w.@..G..'r..1}..xY....W......d./..HF.I.0?...B...F 4R..h..,_....UN..a...$.b..`....x.D...%......@".g..:\....[(yM..Le.~KX.R.t0.0.l....s..r{T...u.1.e..V...7.....t~.E-..8m.t.H.....,|..=`..'.....N..Q.m.g..IG.3.C!..h....=...w..$...#...k6...8.n..k...@...C..E..E..Q......Y....+..7....(>hM.Eq(1DV.Z.s..}.e.......<x....d..{G6.kG.S.....t|..:..x[.|.c.....'<...}..h\....W......:...9A..-...P..;9...pJ0.....w....|c.O......~z.+..[0.8.%...X...+.....B#.g....7.....6y..Ap.-HQ...h+...b.F..1..'xL..Q..=.+.#..........zw..T.w2.].k.....-4.. `..rV.S..`!....7...T)b.d....JL+...d.}A..N]..h^:b.`.....;..E..d.3.C.N...%....2.@<.|.........8yJ.Q<iT.....M-.s.z.J..'.r+....|..5

                                                                                                                        C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2016CAWin64.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1841
                                                                                                                        Entropy (8bit):7.862700003881347
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:48:n+hP5hOCMJbdgGuq45sSJj3QKsMxYniVa3:+jhO7bdRuq45ZJzmu6iQ3
                                                                                                                        MD5:35BB180BDBDE2302FF239396A2A75F4D
                                                                                                                        SHA1:D618876E9FE4FE7B2622EEA7D367A450119C7351
                                                                                                                        SHA-256:B53E8E3F648E5A1BAF8E687C7251B98AD3906D903FF19B2423B2ED63F1D84538
                                                                                                                        SHA-512:A1438857AFB22E2369C6A2A6B27B81E347B5B9165F91CB448304284C08B19C342A45F180CF3C1340BD3BDAAFAAEDE287E8EA57BC369090D104DA02D179E46235
                                                                                                                        Malicious:false
                                                                                                                        Preview:..............{=...ZJ..o.b.m)..."V....r......b4y..7A!-.y".....i.psv[Wi-cf.L&%P.E.*........A....%.H.....l...b.Wc.B..V.Q..a-......R...!.)...^.../..4E8.W.\.9..!.o...C.......4.y...._.]xN...pH.&..8 ^lC..*.}.N.....!..U...tz2.f!..:..o.w*1.Y.f7k.b "K.Q.n.......;....G..z......%....~....A...Y.G..(1......P...&..(...B...:...1X7.\...|..E._.N.C....v..l..._.......=...0I{'..YP45..A+.r...I....=9.u..J...[}.4#.....n.q<9..0`-#.M&4M.Q.|.......*....P..\.....<....t.Pr.....R..-.%.@.....]...=..+...QQ..1...=E%.....v.E.J...J....w....[.?..f.GN...|..F4..-.0\!.e..u<.[..L.Q.i..Y'.)..t|.;q..t..d.,xdRA`.I...DK..G.|......."....T..X......?EV..e..8._...W.AV.a!..........}..#.@@..:...X#.L._.c..E.V.\A.........a..R.:.5:m0.B.i]..<8.xwL.$.........=n.Rw....&pza.{-..s..T.s>8..<(}...i}w.O.6......k....K.....$.?...P.W~.B....]...|k\.........r......SW..0.. E=.V...(.m.Q.XE.......A...N..S..z..G.bA....V..zD8.......w..-d....R..Kw.g'..$../.{<'..71N...u.K.A.{.......k.....A.....G.lXM..}.Mv

                                                                                                                        C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftSkypeForBusiness2016Win32.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):4019
                                                                                                                        Entropy (8bit):7.919044874864671
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:96:N2Hvv7BvgC1llkZ2Pz1S/86XyiFgwXsh0lMUPiwRFALFd:UHvv7BNLlTojXNFg2sylJPf6z
                                                                                                                        MD5:05E6CC16130D6F8996C3BBAD21D463FE
                                                                                                                        SHA1:315016E89270F855339B964C2CCACB768C56EBC8
                                                                                                                        SHA-256:AF14074A148DB79F14017D9E11F8F8FA66877251BA3A9372954B3DB7CB0EA16D
                                                                                                                        SHA-512:F1A89FD7A983A80CA6CDDC8765D92AA6114DC5D83121DB8003FFA2C06F9D4D1BEE9E17D7F9CC66AAEAC85A85ACCD85319D576418796545F226C40104C8C151A4
                                                                                                                        Malicious:false
                                                                                                                        Preview:.!.5z..uF%}.......|..I...........D....h..NwR:.i..8.|Vh.Bz.P.6..8\.x...../q.A...%..W.T.y..N....X%.....|..\....zqu...K..`.~..kh.P.N.A...I.~....-8.#.N;.....%.T3[..M'.5P.AQ'..].._l,...+0...d.E....N.Ne.3.G..Xs....+.DG.Y.% ..K..r....)..mZ.z....h$.....A...L.@.=....L..e"|.Z.....N..Q....s`<..H2..f.~..}z..L...L...A.z.....k6.#.V......*._w...Xs.Q`..A'......~G..i.^m._...r-.!.....9.........H^..+...W^.,....*.<..wX.*....`!....L.$..J.@./.......~3m.\....h..Q...wu&...Z..{*..(\..i...K...\.......c-.w.Q%.[...8..<...j.\u.\Z........=....P./...V[...BztjO^Yf.~..)$..M..8T.q........%.TC.a1...=x.H.ALx}...V./..:Q.i;v.g....l.U]....0|!..R...d.;..{'.\...K..EK.v.....H!.f.W....7.>.OrX.Ms.Pi...y....._..7..W.~.=.e.f.#~-.)j_..9]..,o....Z.P......$.?.....!..lC.d,...l4.S.fAfL._.V.....Q.=.r.C....8..V....2&e..H...*.7..4&.R.P....Wa.%.....~6.w.U2.......IzZ._5..1.F[{..R.......$.^.`*...q$..7.h."3HxA.~4.:s...k!?....BU.o..L....kC.dF...h2....RlLP...A.8......=r9......k.K(....24i.

                                                                                                                        C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftSkypeForBusiness2016Win64.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):4019
                                                                                                                        Entropy (8bit):7.911820285488356
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:96:SAOGZInuXacN8rA2D54GAtGeUEJ1OKgIvws7VHb5TTatZww51Z0a:SuZmh31nC3gIY8HbAN30a
                                                                                                                        MD5:0014585C79DD791A352F81FA19B2C0A9
                                                                                                                        SHA1:F022326D6AD1E89A417424A9D9C43D9A394ADF30
                                                                                                                        SHA-256:AF5531FD72E1CDE05BF11501CBBC7587673DEF962CBB201A75C9A34D09E773D9
                                                                                                                        SHA-512:13FDD2D64575C0F7C04BDB86381F3A0DA931C83243AB5FCF720E18F7C364088EC239D5C207132FBA8DE824CEEEDD37F4CD0051B00BF0FABC8CE6958FBF758983
                                                                                                                        Malicious:false
                                                                                                                        Preview:..'.*.D..k.1..Q.........F......vH .?0R..Np...?]...eho......1..6"........>...b^f...8.k....$T.I!F...&/.....q.]J..\%1.n].=8D.I.x{.(2...6m.e.0.W......9...*d).wm.=V..O=J1.48h|...x...Z../.P.Q....P.>.2...8v..5ZH*...y|."L7..._...g.8$.....0g..(.....0..o.H...9.9B.F.z..VZ3.T.bg.......|.V....9:..>.;2D.G.jj.4%..)r.m.4......q.9...f`%.jb.6....(.U.."&l....b.......&..O..72..lf1...N..ZI..O[...<.'...%.Z..Q3.\...|..2"S.).....d..'Qg...v.3P...n...p(.E.dl.....|.......3t..Q.WA..C.LJ..|..?h.p.1......j.m...h-j.wp.iY...r.U..>uw....d...wx....B7$....EP.x .......f.x...L.[..'...`..-b.u.:*..s..))..#O_...(..*.;.H.."P...z ..~?.^._g......p..T....."$.5..9#..G.7b.$...=i.g.8Y"...f.|...(n/.jv.&....=.U..~4(...n..&z.......9..P...R-.....$...aks..l...#ZA.R....!z.10..?..)(..".....u....%...;.hi...f...kk.Z.{g.....{._...Lgb.2..w)....6A.*9..r{=.M.k;....q.m...6h..qF. ..../X..U.ov...B.....c...\...O.y...L...../../..K.M.z.]f.........vc..9..)(..vNB...c..9=..H..9G...l..{.k...7R...........J..@.

                                                                                                                        C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftWordpad.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1413
                                                                                                                        Entropy (8bit):7.832404332133415
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:2TJ900/guwZFb9D0zlRJb+1OKbIjJ9saqF1GMKkoBQa6WqbuPJoAOLvk3UGyOj:2TJ/gPV9D0xKcZkaCnoBQaHVPJf4+UhY
                                                                                                                        MD5:09057293EE550417D9B29A49C01008C1
                                                                                                                        SHA1:E448E3F586C0E602F2C693BB3D15E6652BC8AA09
                                                                                                                        SHA-256:8E7C56A9090B3B77B400934F15F7559FFC1EEC4F8B07982ED84FCCD4435FA748
                                                                                                                        SHA-512:5B1CA5AFC832AC8D25F4ECF7162B73634421100FAD4277059433518DF34070FCD224C03980044028D3A61F1E0E330D24A398A7F4144D2569E6A34A9A7E9CBD93
                                                                                                                        Malicious:false
                                                                                                                        Preview:.vE .p..n..#`.mB.t&..........t.....<.....9."}.YC.F..d.IU....+y..(...i...~.I.>..~I.S....U.\]H.p.E...y.'.q..m..o..b.C.]..U.......x....F.llB .e..]..%n..\Ox3..mL.(.....9..WlF.>.%.....K|...u-p6U..U.^.?.u.G.\}d.II..fu......s5.q^.6.J...4z.m...p...+...j..PO.H....TCo...o.0..}=.DkY..m..s..+.J..A...6.......j....XQ.ss@(.a.CT.c`..DZ47..pC.#...m..gv..>.0...W......2L.....[M._=#.8.....74b...E..w.~.............fx..(L..`.......p...I.NZ...T.T...#.+..f;..|Y..h..c.I2.N..K...Y..}...L..+.F@.eiM5.d.IN..k{..CQ:z.mQ.|....t..rj[.7.x...V...!2......z.~:....S.8%J..H...&..V@...t.?..9C....H...i*.#.,.;L..w.@....#+..)...I.].<.,.<..a..GxP..a\.k..1....Z..........7....YA.gh.".m..H..@w..EZz9..pW.3....m..n*.Y`.y........?......>.A....~.....[.......\}..*}N........C...%t.".1.k...;.^....=..[....I.H...).h..}0.Kl...e..8.cb.......N.......k.......HX.L. ..m..vf....;...jL.(....%..ofM.".%...Y.....'.. ....`..TB....E^I.K.....Y.m.l)8..|..p........)v.>Rh.&^..o.E.w..sG._D...d3{4^...t.f8.DiQ..v.&.Ib....A

                                                                                                                        C:\ProgramData\Microsoft\UEV\InboxTemplates\NetworkPrinters.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):2983
                                                                                                                        Entropy (8bit):7.909591210780104
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:48:oOOcLmxSl0X4e2uWDAJnlvymP6DJauI405ucAF2W4Lx6qobs+cwvlcsniRAm9D6l:yJSOXt2cJlKNDJfczhd6qIs+cwvy1Ul
                                                                                                                        MD5:6F61B991BCB5B1DBB9909A3944C6885D
                                                                                                                        SHA1:36A97B15A4E05B38D7573442E879945D4B10F1B6
                                                                                                                        SHA-256:0FC2921402EAB2A2E3054B07FAFE50C77F8912A7BE1C5DA9F0CE30B753301067
                                                                                                                        SHA-512:AA36251A79299AA0530D3CE3B7FD65A1FC2781CA2FAB3B0E8040ADA43FA515D62F5634016669F679E58F0F93F2A7299B37046105AF383EB63BD1FB511386AA67
                                                                                                                        Malicious:false
                                                                                                                        Preview:]..I......e..Q#.... ..d.3..lF.$W....0{...<.....:...s3.s..g./..4..U.. ..l.fp....3.4..mH^0c.@.h+9.v.{m.g8..3[.y...m.Tu....*8.2.M..>.....H.8.....rw@.=..?......+j..n..j4...b....S...ZhA.Hy..pO..n6v"....te.q!.E.&...2e."...Nm(..x.z.F6..L).g..+.2}.....'.p..^..`|m5..;oq...4_.s5..8..p...f.-.....<*.{.Z...!.......9......g;D.8..4N@.K..O.1. ..=!....6e.+ =..C)rU.S..B.........0......O.|k...9].v......*.`..f..\/.o.G5.(5.....'.b..e..20G... iz...yyz`5..t..t...(.Ey....i..v#....7........:.......l5.^4..k.O.AA.O.$.s..ii....p...~:.PquS[...fZ..6..'....?w....'..........Z.F.&.%.C..-8..r.2..e.L8..z...1.b..l.*}?I9..'Rq...u}s!9..:..6...x..3....:w.2.Q...5....]=.2.......guJ....$K..T..O.8.2.......b.......(./nh4._..p.^..ue....}....<.h..+..V9u.2...(.e.n..).._-.n.G9.x...W...9.(:....`7....'rq...;Gwl$.^[.-..XF.Tk....'-.)....m..O..>..6.....!.o~Z@Q..q.\.O...,9.a.. `....eO.=..+.u........].xpW.F..`&.?....f.D../...S..B...}.}.F...T4.p..s.'x..z..t.*:.f.F^3K,..t!w.Q.n.(R.Bu....8..a.K

                                                                                                                        C:\ProgramData\Microsoft\UEV\InboxTemplates\RoamingCredentialSettings.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:SysEx File -
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):4737
                                                                                                                        Entropy (8bit):7.927749566282596
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:96:0Acz2s7r+nq0v8Ng+G+uH/xkPp8y2owxuwfS6hd6LfVw+gxXsLIEvBM1x7:0RDmq0kGtjxw8y2b4Zy6LfVw+8/ECb
                                                                                                                        MD5:45C1CDE2E5E3D41818EF33EE017B37CA
                                                                                                                        SHA1:33A43F2BE276926D28352C3AA56F94F65D0A7462
                                                                                                                        SHA-256:30B1ADFCAC48EA637CF81BAFD9BD29C7B3D44FEB87BFB042D8B909FBECF24644
                                                                                                                        SHA-512:6E5C9F76072C9106D9B20CAE84A0AC2F6760FBFA82548B6B74CF7D9F4A783F4AECC371EA51C27DFD5D57C84F45A50B4EF75F3D4490D7EB30F61F679137F676E0
                                                                                                                        Malicious:false
                                                                                                                        Preview:.p.d.1...~.....!.I.=...).9........5...A.....E...........n!..A...3.S....".+,.D.V}AO....b...D..W..5.<..mq$p+...u}d.!.../5q)...z...qbF.+3.d..5[..CP.7c.J.nr..T..Q.m.[17)K....(k-.n..18!g.^........W]..D.%F..EZ.a...M..<..?@*.PS.%g@.q>......2.J....,A`x....Qf@[...TQ...1v..\.V..D.me)l$.F.|l-.*.j.,3{)...h.B.f,Q.41&j.|R..^.7v._.j~..[....l.NeSM{....~l.gG....uh2.5.9.%C..R..^.....4.GB2..`0.d..c_.Cz1....q.$.>+.....).Z....x_fb.K.G`.[....j....*g..Z......hv)|6._.xy7.d...a_.}..N.O.?2@..<;0..vH...E.ck.T.'1..I..^.x..|S@n...+6n.fF..q..d.......sA7;....k...B...`..'...Vv."-zf..`.7yB.?2.-......J...4.......8.%.....m....*g..Z.l....ec89=.C.n%c.0...n}qj...z.L.v!@.49;>.x....C"or.H.b...k....~.Sk[Wu...o)>FX....%zLm...I.(K4.Z.s...V.R...|]CWj..l..0..n..8 .%zG.6*....../.h....mBl+.'...(......e......t..P.L....wr)m,.H.=5i.I.G.}.cd...t...q%..>;*~.tQ...E.~l.I.(_..XN.{.?.sU.qs....8[..o..R.FRu.&.x(.}....N`..<........>A..i.?[E.s..M...?zG.=.......3..1.....)0.E.^}UM....a....i&.J{.U.Q(.gv1|x.J.0m7.

                                                                                                                        C:\ProgramData\Microsoft\UEV\InboxTemplates\ThemeSettings2013.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):3638
                                                                                                                        Entropy (8bit):7.919260312465645
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:96:hlyGKthWeFt+TuGV6n4sNvXUc5MpZZs5Bu:hlyFWeFt+iS6n4QvXUzZU8
                                                                                                                        MD5:B90ADC18E424AD0159B94508E197437E
                                                                                                                        SHA1:389D2C9A645DC5DFE5D704216F990179E4EE0A85
                                                                                                                        SHA-256:773BA519FB6DF252A516C64F4ABF5908F7DEB850A105F0EA5C3232718A09F0FF
                                                                                                                        SHA-512:D1B3444170CD61F41A18AECADEF0D73E7C399C4760D3E5E96D860AFA5644A22EDC822C4C4C69085413AFDBC61F220CCAE337C277E4F78EA74174A790FF5870F8
                                                                                                                        Malicious:false
                                                                                                                        Preview:p...)<.z3...d.X;...RX...>...Z.*... C..<..= ....f..'W.+Koc^..v..*H.Hrk.4Y.4...O3RB.....e.1.........n.2!.eH..a.-C............c).7%...P.,$\"..L...v-._.d......w._#:.....w..S..=..l...:....p.$..!...^.....~3+............|..|.........i..,..Itr.m..:.B}|D....!.e8..V.vc..*.QH&*z..l."H..........c&.!7...G..!;C ..H...$k.C.q....j.Y(~M......I..=..Kv.C.R{.F8...V..[....:\....2S.)&.`.!x....W....ZNf...$..;...H.Rub.{..n....<SB....3.,.....\x..,.._&g\..l.0............7-.t......&-Y-..M...ac.P.l......w.@w5B.....U..4..Ip.BZF.P....E............s...L2.....q....b...7.M.....4.5C.r.9.?K."....p. v...".1...W.\x..,.kN.z@..}.;I............ -.9%..W..&:C(..J....wh.t.u.....f.Y?n.......U.P`...0.....T.....w..~...S..m....u.EI.*.+...s.~..;oY.....W..=Y.TuP.d..{...P;.\....g.-.....Vo..$...n4!.J8..E..........*+.'x..S..DC.n..mB..ih.T.q......J..@.M......S..6.Gz.S........Y5.L.0Z.y..2_O.....-...>9......PZ/P...B._'..1H.wtg.e..=..._...(...g. ...J.@'......&I*..J$."I.N....

                                                                                                                        C:\ProgramData\Microsoft\UEV\InboxTemplates\VdiState.xml.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1252
                                                                                                                        Entropy (8bit):7.829493857247319
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:Ez0tp2DCyrQhw7SKx8pOB/3kqGbaMdcM/JvI01SUlOi0xjE516oXsO:Ezip2DNrLSK6C3kqSLBIndxjE546sO
                                                                                                                        MD5:0856AF6B2B3187D4AF6E41FC3D32AEB8
                                                                                                                        SHA1:0D8A4D80787CD3FD33E87865BFCED44A93F121F6
                                                                                                                        SHA-256:5788164DE2BC8611D78BC972DA49413CADE2F2E483CB07855554965A0BB33EDF
                                                                                                                        SHA-512:65084515E0F378D57ABB3E8EE3305F6949524AEAEEF0818D742E02F52FED81254CFC0D47CD69FC8700D20DE58A1F04B77F0B50CC4BA388608D1C3ADDFB8A0CA2
                                                                                                                        Malicious:false
                                                                                                                        Preview:..e..t.|5@5.^....4....Y,Z..j....?.e..O.4.....;$.K...:[1.....Q.1`W@.....1./..G1..Y..j..?|v....."............~6WHM..w<......?.;~.}.FwLg&.......h.<&iK.\....%.Y..mL...{"...v..Y7f^...s~,].c=..tQ.B.Q.<.}.)U../J.7E..O.t.V.g./.|.."yO.#n...K.. %s......}Cr`..5..Y..`.+|u...,...{.........|#F..5..4....<...iU..SwYa&|.Gd|.'g4=yP.A.F.../..,.f..u.>l...p..B*tB..._.2.Fh.asT..U"..i}......`......Q*..%.X.'..%....&s{...D.uF@].......!..7&..S..~..@(0...u.J.Y.......s..w...+.}2.....xX.u1o?.FjR:z..sIV.'a#*|\.[.....+..,.om...v"...o..Y*|....zM..]E.7J..b+".;|.c.T..<9#..0-8. ..c.....&G..'&h...J..b}D....cMoK..:..D..w.#g~...............m.=w..p..fo.....Ur.u1y4.[qS3dP..?...zS=*4u.l.:..(..".Q'{...l?...{..Q7{J...7...WX.`B.+.#H_.m6...u..oE..}..`}.(G...;h..k..vO.g..D..-9`]...x.3.!..Gh..B..+h.8{y....].P..=.....>.{#.tg-.7....'...H.f.bbH578.YIV.;..7iU.K.H..Xj.VeM(../.j8.4.v..C,dNJ..{..L....8..0..b..+(......KZpPL.h.~.|.#D(.G...|.J.7.e.J..9UG@.....;.+..H...^..s-..j(0...`.C.x......$.x.BRIE..q.

                                                                                                                        C:\ProgramData\Microsoft\User Account Pictures\defaultuser0.dat.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:OpenPGP Public Key
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):24
                                                                                                                        Entropy (8bit):4.418295834054489
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:3:MPrOQcaD:crOJaD
                                                                                                                        MD5:E3A00479CEC54ACDF1D38F19095C9154
                                                                                                                        SHA1:DA6237EE95FBC5406CF4C25AF69D4F174C36FE44
                                                                                                                        SHA-256:CF9D5CDEB30FD9EC134F8CA9BE06CAF80FD0EBE14369DD1D1F463A2D02FBF1C0
                                                                                                                        SHA-512:5BB60D04CC09AF4813E4848564BCF855165A7D81DDF5BDBD4EC0902AAB403A933C81CB0EE32D816CD8D1CBC9698B788C3969418E56DA09352AF3A22736AE697B
                                                                                                                        Malicious:false
                                                                                                                        Preview:..kM../&..m./..ON...-..

                                                                                                                        C:\ProgramData\Microsoft\User Account Pictures\guest.png.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):8381
                                                                                                                        Entropy (8bit):7.97655665189752
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:192:5tuLQNeXfkaQi/Jk9ervqfTHdzKwwQ5AVJu1WxqUmls3:5cLQoHzji7H1ZwQ+21KqJls3
                                                                                                                        MD5:2DD21D093C53DF8ADAFB7C5D6D436573
                                                                                                                        SHA1:439914CFA5BF739113BF4EC547685423AA53CC0B
                                                                                                                        SHA-256:1C31F172ED389F523BE03D0B44032E1321E0A0BC2EE1D2E3523F056357A83B57
                                                                                                                        SHA-512:9425070C5A56C5974DB4A19A36C5AECDE286DDC412283407875523E78E4EA839936A15F9307CC9C054607D2F4B93C0432360701EEE073665D4DE384057835185
                                                                                                                        Malicious:false
                                                                                                                        Preview:.t.U.'V.o.+.KB...4.#_...%D..Nf.V...R..l..k...V.T.-.....y..N..Z...;J..._...]..4.(.....>..%.yZSC..|...Cil.<p.... .*.<.tS._.U.&....5....~.S...$...g.G.`....w.....9..D..nT..<1....o.F.[.@.IT../..<.E...{]..L(.9..."c..o.!..[&.}(..5..8....X.$..G4...4.!....J...T.{..C..J.vS..y.H.U4..."HI.{@.0..<......Lu...V.[..T[.i.Nz....|.!...{....$$jbQ>Y=t.L}..ctv.V".>..O>Y....3.N...e/r.h.6.........HS}G.D.(Z....q^&.W.......,.....t....xy.C....z..a,..e.L.."'RM{...HQ......F.t.2.No.......!a..........%..4.%f.<=A....3.p3u.W....v.;.:T.k.n*..+61..G.Ud..9f...)2......@(S.\NDD.....r&......X...t.*.0*.......6..y.eC..'.|Cr.m...}t....._-{..p.g"..f..>!t..P.B...7.9..ln.<.C.&.H..LI%`r.<M..... vJ../Z}./.q.3.La....)..c..ygp."...'..d.@x...U...7..Q.D+...L.As.............).....a...Y..y.S..>J..;..k<H.q....bKY..F....|...P@.Lt....D.[...Z.!@M...ZJ..F.....i......C.A.....m..l`Z....sV..U.@.._.H>.u.w9..&r.Tx..s..@....................m.L,CMf.....S.\.q...v..FA.fN.E.(..zr.M..1P....

                                                                                                                        C:\ProgramData\Microsoft\User Account Pictures\hardz.dat.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):24
                                                                                                                        Entropy (8bit):4.41829583405449
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:3:F3Ys+jy0C:NvJ
                                                                                                                        MD5:146277519F8303CED4824FF919BD9C78
                                                                                                                        SHA1:F1E4B13DE06D8EAE443E704DD560FB3E7039EA34
                                                                                                                        SHA-256:90FA82F25D7404247D15186631C67668BDC419BECF615024648EC15293E1C562
                                                                                                                        SHA-512:7228C90F0E60EF36756B6596BE64E2A70D58CFA972A159C4A80649DDFD08159A0A60D45CB0C160476F7ECA9F7366647BF0021C3A7A834F705FB9D37F8A109E30
                                                                                                                        Malicious:false
                                                                                                                        Preview:.1..4.-[.-.B.'.......?..

                                                                                                                        C:\ProgramData\Microsoft\User Account Pictures\user.dat.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):24
                                                                                                                        Entropy (8bit):4.501629167387823
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:3:xULdzhQrn:xUpSn
                                                                                                                        MD5:66C30AC23307C15D881410E55B36A1D0
                                                                                                                        SHA1:C75EC167C1A5A4E7185AAAA2115307A7BD8BFC0F
                                                                                                                        SHA-256:4FB52B4564C99E31B5E4982861C0D20CDC2A2BED52605A17D5B90BE02CADCF7A
                                                                                                                        SHA-512:44E3A61D8E4DBD81FC39E88A198D498AD539CFD5669787CC9A8FA9E13524CB300535BBFAED1994B724B09B1D0FDD2D5460A62091F2B78AECB67E3D739943FB7A
                                                                                                                        Malicious:false
                                                                                                                        Preview:.n*..q.m..k..-.......

                                                                                                                        C:\ProgramData\Microsoft\User Account Pictures\user-192.png.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):3328
                                                                                                                        Entropy (8bit):7.940320304842515
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:96:DaPyfQ7BqmAvCuwRKyfOAO3OKbMtU2MFpL:DahFAqNgNEEMtU2MFpL
                                                                                                                        MD5:AFC3551D9CC302D9867DD7EEDE51800F
                                                                                                                        SHA1:65E3E748E5B0FC1791DC172076C93568B300A08E
                                                                                                                        SHA-256:B0C62225EA733765382274B8277E70B9D54EFBFB8FE9F2ACF2A9A46764C75B81
                                                                                                                        SHA-512:56EA57187B2274CD1E298932818EB0344C0E2878C0DB0541E38771689829F9D44BA0E7A6D0A567634F5950F49B6676ECFC96098EFB8CFF861BD0D06AA5CCC0DF
                                                                                                                        Malicious:false
                                                                                                                        Preview:.D..A%..s..\..q..Nw..../f....{Q.......[p..R.o.6.[.1..Q....vB..E..%.6.#.....`...@...P.8.#b.P...Z...=.{M.J...Ke$....=.-....Z.....U........A.2[.....p.5....;9=......N..$......c..)M;=#......L....*C#.R.f...u....[<..T...u(.I.l..=..C..w...JB.t....HS*J.Q?".SA.#...<\...8q.#.......+XE.V.....3AK...y)..#.i...Mc.....Q.1..g.h]..2 ..Z.S....>..v.......7..;..-.L....K.I..Yy...e...%..../m...?..\j..B.wpC/..[.g.........b........9.I..H..mu.A.....%.Q...D.....%qr...0$..c.o..`.:.N.4..~>y.'=S..f.#..q.Y..,..[.g.;...P...TF....S.e.[W.^>......5q<..TYg.}..j`.......s.Q....c......<..`..<Mh.......P..P.B..l....Og...X.......2..n.L3qe.].Z......l...O.....)....P#.:~.%.%..6..l. ...O......ab(J.P.......B..........*.A.u...m......x"....*.`.o. .......V....~....A.....T.....u..r..1o..t7..sk,.k$;y<...a...C..:......"......d{H....y.Y_.tc..........\8.u.mw.a..J.a...+.].B.wjT......C.(...)r.`.i..q(+...u.."i..V......\..;..@i:..G$......V..?....5<..4...4.&..1.0...4G.D.GT.1.R9.v.)I..v.i...4z.

                                                                                                                        C:\ProgramData\Microsoft\User Account Pictures\user-32.png.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):657
                                                                                                                        Entropy (8bit):7.6914333266112545
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:12:szrYQBE5HpFg/f+j8oOOhH+PnjQbu8B+ZI23d5IJbncMdGHZ12I8JCOR4cW2V8GH:SYnJFg/ShunjQbD+K2T8TJ4/vWCK4cWK
                                                                                                                        MD5:D83104A1466CD03B1E968733B62673FC
                                                                                                                        SHA1:A86E878C5676F6564F25A419B43602D82A828536
                                                                                                                        SHA-256:0468DF266A03213D96B2BF58DC34B659F95EEABF4542AC8F034D7255976D958D
                                                                                                                        SHA-512:F2C1CB439E656481A4A7537234758598F68B06C6CA9AAFAA87DBFB36674077C4A596C0D1E471E530B6F0C010B35B875DDF940ECF13ABE5734889467AB54E57F5
                                                                                                                        Malicious:false
                                                                                                                        Preview:.......`p....6.a..)"O!%u...hv...4.......Q. ]....7..O(RGqw._*...9..P.......2Pvw.w.EI...^...v..x.[..88.[H.K!..4..m..K..M.R.y~aX...T.t..c..d...'6F...gm=./..h..*....ei.>.e..._.cR../]..C..T.G5......>.*.N..+'..4...!.&9S...(....?........wtB.<Q..w.b...l....J.T.U....Nu.....&..f.......SFlP...f......&.qw3~N3.'..z.KM:'/.Z".V..8..%.?.t.M(P.<.....OW.d v:.....l..w.H..@s.6.......;....b...5%..;8.#9C... ..z.M..[7"..\.....:mw'm....d.b.D]".>..%.E3.E......tc...I...a..nO.5..\..[6..../..M...z..!.29.Z....(n.W..^...W..H..../.E,.n.{..._...O.y...v%..5e.YPa..[Z.C.Bx....e.c.e?t.c<......Q..:..C.....[.....Ni$.. Ph:.3'x.P.......(..m.....I......

                                                                                                                        C:\ProgramData\Microsoft\User Account Pictures\user-40.png.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):789
                                                                                                                        Entropy (8bit):7.782441955541668
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:tHicOGBYYRW5MBHv9DewV3DVK9vQDJWH6ACma36ldZ:tAi7u+D+IWHa6l
                                                                                                                        MD5:271FA2C10C24E7BCEEF452C1839473F3
                                                                                                                        SHA1:DF14DDC8497207AC37C70AA200040C7716290167
                                                                                                                        SHA-256:9D234C963050210B848DD947734A177BE1056306411E26328E303E6C60988CFA
                                                                                                                        SHA-512:65A1FF70074659070C395C54529A3C5D9A4C22996EE55682084B1F81A532151CF270B8E60F1C3923A4B908ED06E68F71FB0A948FF95B4281709B1FDFB7F3C5E7
                                                                                                                        Malicious:false
                                                                                                                        Preview:..|C,.dh..Nh...:.[e...K..~."fX@.|.aO.....Lh..r-.L.o...G&c...r>q#.C..^<de......Z....?'..4oD....3..S..RT.....J.'....]._.....0....F..d...G.U..}&..g.t..0.Z.C..bEK.Bi_.Xf........e uT....Z..9t..%..fq....`..V.7.*.Tb......=......42...R..~..s^.....@.X3"...\.....+...VaP.).?.L..[...g..U..p:...w..I7.......QFi..M...C.....%6....6..q.b.WG#...kzVa%....p;...sQ.I..xK<.......m ...(|..V.........Y.......k..gZ6...:9J.N.T.2....`.PI..1...MTo.-|p..z..L.....u..2_.z.1K.........Mi%M{....w.<u1.F..7..7e.W..5.-....k.II.e.*..B..{5..W..yH..)......q..Z...c!4..Tz..._....^.n.....jU...F.._).X.^K.....z..C..K..Z.v1!.......[.5...C.yTq..<....W...8l...#...Ra..@A........+..:...b.mu[.{..Y...!IM....%O...Y.........L.l=<.......05.|H.^...q.!.9&5#f...[.^... ..sz{...an[.6.3NQ..*-3U...4.6//.

                                                                                                                        C:\ProgramData\Microsoft\User Account Pictures\user-48.png.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):881
                                                                                                                        Entropy (8bit):7.792376395627888
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:fxaMowX2ScoCUJ7TTWUWItkRiSaoLeg8kwsE:fxaMl2MxJP80oLNwsE
                                                                                                                        MD5:80FF9E7C76BE8FF712FB66AFBDAD6DFA
                                                                                                                        SHA1:16692BEF36DDF7C64B621D790D56455BD5976495
                                                                                                                        SHA-256:E2959C8AB61423D670F732550803EDB235D87CFC7B60FD29EF4F232EFA523851
                                                                                                                        SHA-512:659A754C79FE39C5D1D770341D8CEF69573651A9B0EC58EBD730EB13C4E4EBCBEA496A1501666627ED6A5054E9129493547AAB2F0E018264CBCE27A8CBC8B882
                                                                                                                        Malicious:false
                                                                                                                        Preview:.G..i...../.6.hr........J.>..b......Q..@..&.#E...s..{../a._.v....k:..(bT...K...E.=..Z...0|...!........W.:.w..p... .j;'..R..P:.wG.....(>...$....AO..p(v@z..Q....q.r.z....\U0...&.,[#.q.B~Nx..;..F...=..4LL...7..14..4..{z\.'....X`@=....+..n..q.w..p....."......5..dNU.................Ag..R.Pc...+:.+.P.c.~...Xt_....J.,.v...\..S......... j..@.-*B..g....0..v..X`?...V~..,\_....&.....[..1g....ar.q..DX~..z.;pgFf.H....D...~d...r....X<z ..A...G._...h.b9.Z......<.7....+%_.~b....@..\>%5..j...R.{g....5_,a:3v...%f...Zg.SH...%......mIO..[.yd.|F.*[l.....>..w..D..F......Ng|....j.Y.RL=HY....J...v..e8...V...D.N.........^_..$.*...............A.f..s.)n .SS.G..~}....%l'T...('}.n.....y%......i..&F.SC.|.e..k....g.8t.U..].....#{.>......i....c..5.M.";.`..Z...Z:O.x.L.....t.D...I-.o..t*....Q.AU.....0.#.y..!...h..Yu.T...et....e../v.S}Z.dOV.F..GEB.&.

                                                                                                                        C:\ProgramData\Microsoft\User Account Pictures\user.png.funksec

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):8381
                                                                                                                        Entropy (8bit):7.976944024664655
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:192:ua9DmguPbVPD7p8zXT8ywQ2ghZqsCGX/H956wqvQ7Fafs+HX/Lty:ua9aguPbVPD8D8HQfdCOHKwf5afxvLty
                                                                                                                        MD5:0A530639AE6E5B1B270629077500E132
                                                                                                                        SHA1:F7B726E8C626EDF548F3A12E218276D490962DDE
                                                                                                                        SHA-256:CAF9329E83883AD3CA443FBA03F7C1D9270603DB5C508B3284468975C8B9254B
                                                                                                                        SHA-512:544C2ABC0419A0B7E991CEDEBCDFA297E17D2C459E53A7BEA0426AFE4CDB7A81DD5F2FD2FC3E615481D685F013B784B4699178F6EDBC84E7F2E32C70A6071297
                                                                                                                        Malicious:false
                                                                                                                        Preview:&..+E..|........%.kLR.tz....$..fL.E.N..N.1.c.......E.lz.oF#......a.0.7.,....H.})..c2A:..o.N...n..1^....!.w.B.4.D.....@.X.....hK.".|....s..qs.....0....U..w.JQ....E..P=....`.....V.D6.h.:.|.t.>.....9..r,...R.P.h..........n5e_..Q.5,@.........K.,.......)E..{0...4uN.F..L..N2...e.*.........l.t.....d..rQc.AX.OY...g.._)+q`. Y....X.B.e..|...H....... x.7.J...g.P...8..;N.o..XX1z.Y.O.....%.......,Bz/G.j.....c..qb=.l....=)..z.m..L.N.......V.@...e'....C.....f..w.E......<`......!.{g..]....p.. Z....6C.....>..p....L%+4_....b...o7..Y..7.pi....eQN.N...7.F.{..^`......t...oj......3...>.l...b.])..SzR['...N....\..Z.-..%.!.^i.#....7.vA(..y...b.a.a..g...K.).=...kp...[Jn....C.u...\S..$..f..eG.c.|..NN+.t...i.R?...XAXl.."..V...u....P.B.h.o:.%Y.'w.....a.?....n..m.C.3z=@.....r..$..\.....".....T....,.v..{..d...Qa..X.k...S'...........|.....I.I.U....UA........94..E&.f7.k...E.t..~@J.)...2|u...C......7')..G...<..B..o.}f.rD~...u....t>Fy(@"...{xHKd.G.m.?.G.b>..|..

                                                                                                                        C:\Users\CK3Wg2mN4T.exe

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):5482496
                                                                                                                        Entropy (8bit):6.240396435896552
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:49152:vNrjLXqz4aEXEMvTR4CY6C74bC6xxXjWe/l+XYq7p4BFt277t19sJpoc74P8TKWQ:OMvTRdxAG5/TuIx5f3
                                                                                                                        MD5:834C7FD865EEE5F7E17A3A1FB62E7051
                                                                                                                        SHA1:0246696395C8514494435F645CDFF034D70D0951
                                                                                                                        SHA-256:5226EA8E0F516565BA825A1BBED10020982C16414750237068B602C5B4AC6ABD
                                                                                                                        SHA-512:4245D2933935EF329C91D32B3CCF3719CD137AB90FBD4436A327F24C9825CA72A0B9ECDEAFE6750F9290D8930FB472878C6780BED6F216412C96E457D1E804E1
                                                                                                                        Malicious:true
                                                                                                                        Antivirus:
                                                                                                                        • Antivirus: ReversingLabs, Detection: 71%
                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<...o...o...o...o...o.G.n...o.G.n...o.G.n...o.G.n...ok..n...o...o...o...o...o/G.n...oRich...o........PE..d.....{g.........."....*..7.........\.6........@..............................S...........`.................................................t.P.|.............P.(............pS.La...zG.T....................{G.(...PyG.@.............7.`............................text...O.7.......7................. ..`.rdata........7.......7.............@..@.data....3....P..2....P.............@....pdata..(.....P.......P.............@..@.reloc..La...pS..b...FS.............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                        C:\Users\CK3Wg2mN4T.exe:Zone.Identifier

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):26
                                                                                                                        Entropy (8bit):3.95006375643621
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:3:ggPYV:rPYV
                                                                                                                        MD5:187F488E27DB4AF347237FE461A079AD
                                                                                                                        SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                                                                                                        SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                                                                                                        SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                                                                                                        Malicious:false
                                                                                                                        Preview:[ZoneTransfer]....ZoneId=0

                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                        Download File
                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                        File Type:data
                                                                                                                        Category:modified
                                                                                                                        Size (bytes):64
                                                                                                                        Entropy (8bit):1.1940658735648508
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:3:NlllulxmH/lZ:NllUg
                                                                                                                        MD5:D904BDD752B6F23D81E93ECA3BD8E0F3
                                                                                                                        SHA1:026D8B0D0F79861746760B0431AD46BAD2A01676
                                                                                                                        SHA-256:B393D3CEC8368794972E4ADD978B455A2F5BD37E3A116264DBED14DC8C67D6F2
                                                                                                                        SHA-512:5B862B7F0BCCEF48E6A5A270C3F6271D7A5002465EAF347C6A266365F1B2CD3D88144C043D826D3456AA43484124D619BF16F9AEAB1F706463F553EE24CB5740
                                                                                                                        Malicious:false
                                                                                                                        Preview:@...e................................. ..............@..........

                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_23p431ld.q00.ps1

                                                                                                                        Download File
                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):60
                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                        Malicious:false
                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5rjmi43y.hpq.psm1

                                                                                                                        Download File
                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):60
                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                        Malicious:false
                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kchrplze.bos.psm1

                                                                                                                        Download File
                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):60
                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                        Malicious:false
                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_n0wjkcgy.0zn.ps1

                                                                                                                        Download File
                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):60
                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                        Malicious:false
                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nfsuuj2i.g1u.psm1

                                                                                                                        Download File
                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):60
                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                        Malicious:false
                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ogrn3413.5lz.ps1

                                                                                                                        Download File
                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):60
                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                        Malicious:false
                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_om5mhhpd.bwi.psm1

                                                                                                                        Download File
                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):60
                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                        Malicious:false
                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ov0tfje2.cv4.ps1

                                                                                                                        Download File
                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):60
                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                        Malicious:false
                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qium4uej.uyu.psm1

                                                                                                                        Download File
                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):60
                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                        Malicious:false
                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_skonclze.w52.psm1

                                                                                                                        Download File
                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):60
                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                        Malicious:false
                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_slrbgfbh.qvg.ps1

                                                                                                                        Download File
                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):60
                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                        Malicious:false
                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vmdz15gz.uy3.ps1

                                                                                                                        Download File
                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):60
                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                        Malicious:false
                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                        C:\Users\user\Desktop\README-IeCSISq4gi.md

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:Unicode text, UTF-8 text
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1636
                                                                                                                        Entropy (8bit):5.202597135655108
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:48:WXufmCFpWyj/E2RUFKUn1R7ARj7qQXPHrHATBbB:W4mOp7o2SFKUn1WeQfLATB9
                                                                                                                        MD5:2C97DAB34E4AB7F089F0811866C7784D
                                                                                                                        SHA1:7C526F204D066FC5E1C59EB765F42F7B363F74BC
                                                                                                                        SHA-256:3583C0EB329CA6499C64EF5E84F7F888AEF5BF2892F73145DA9A75E336D56657
                                                                                                                        SHA-512:AE8B3E3083098E124397DA4E0DF6779A6D745FB1388D656F530C052906B06B6C1B895D01AAD371EAB24988F4E379E98379959F9966EE9631200D5C6937AAA0E3
                                                                                                                        Malicious:false
                                                                                                                        Preview:.# .. Funksec V1.5 ..... **Congratulations** . Your organization, device has been successfully infiltrated by funksec ransomware!..## .. **Stop**.- Do NOT attempt to tamper with files or systems..- Do NOT contact law enforcement or seek third-party intervention..- Do NOT attempt to trace funksec's activities...## .. **What happened**.- your files encrypted by funksec ransomware, becarfull to play or try dercrypt the files becouse you just will lose it more..- We stole all your data..- No anti-virus will restore it; this is an advanced ransomware..- your data will be leaked if you don't pay ransom..## .. **Ransom Details**.- Decryptor exe fee: **0.1 BTC**.- Bitcoin wallet address: `bc1qrghnt6cqdsxt0qmlcaq0wcavq6pmfm82vtxfeq`.- Payment instructions:. 1. Buy 0.1 bitcoin.. 2. Install session from: https://getsession.org/. 3. Contact us with this ID to receive the decryptor: 0538d726ae3cc264c1bd8e66c6c6fa366a3dfc589567944170001e6fdbea9efb3d..## .. **How to buy bitcoin**.-

                                                                                                                        C:\Users\user\Desktop\downloaded_wallpaper.jpg

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 696x516, components 3
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):25447
                                                                                                                        Entropy (8bit):7.009816137563603
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:384:icpk7sPEFPLY2xiy7JDk0Ot+A+AedexytJ0e:i5NLY20y75fO8A+HexyL
                                                                                                                        MD5:D10E302877008B2567890DE25F6D3711
                                                                                                                        SHA1:318D25D53DCD8765D79C6CEF07A6AEA72A4BF76F
                                                                                                                        SHA-256:EA627D5499996BDA0BDEF215B41FF4353BC9E9C6886AF45115D5EC5E170EAD93
                                                                                                                        SHA-512:173A2F5F2357E44D9A7C7E29D089AB81CC61495830CFBD40506B66992F41652CC7691E64CB7D4597F323C4B12EC96B0B5BD61BEDE4D0A69CACDCE56D0E4AE761
                                                                                                                        Malicious:false
                                                                                                                        Preview:......JFIF................................C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222.....................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(

                                                                                                                        Static File Info

                                                                                                                        General

                                                                                                                        File type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                        Entropy (8bit):6.240396435896552
                                                                                                                        TrID:
                                                                                                                        • Win64 Executable Console (202006/5) 92.65%
                                                                                                                        • Win64 Executable (generic) (12005/4) 5.51%
                                                                                                                        • Generic Win/DOS Executable (2004/3) 0.92%
                                                                                                                        • DOS Executable Generic (2002/1) 0.92%
                                                                                                                        • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                        File name:CF537GfmKa.exe
                                                                                                                        File size:5'482'496 bytes
                                                                                                                        MD5:834c7fd865eee5f7e17a3a1fb62e7051
                                                                                                                        SHA1:0246696395c8514494435f645cdff034d70d0951
                                                                                                                        SHA256:5226ea8e0f516565ba825a1bbed10020982c16414750237068b602c5b4ac6abd
                                                                                                                        SHA512:4245d2933935ef329c91d32b3ccf3719cd137ab90fbd4436a327f24c9825ca72a0b9ecdeafe6750f9290d8930fb472878c6780bed6f216412c96e457d1e804e1
                                                                                                                        SSDEEP:49152:vNrjLXqz4aEXEMvTR4CY6C74bC6xxXjWe/l+XYq7p4BFt277t19sJpoc74P8TKWQ:OMvTRdxAG5/TuIx5f3
                                                                                                                        TLSH:D6462922BB5A99ADC49AC0B083564B72697134CB0B35B9FF44C446783E6DAF42F3C758
                                                                                                                        File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........<...o...o...o...o...o.G.n...o.G.n...o.G.n...o.G.n...ok..n...o...o...o...o...o/G.n...oRich...o........PE..d.....{g.........."

                                                                                                                        File Icon

                                                                                                                        Icon Hash:90cececece8e8eb0

                                                                                                                        Static PE Info

                                                                                                                        General

                                                                                                                        Entrypoint:0x14036b55c
                                                                                                                        Entrypoint Section:.text
                                                                                                                        Digitally signed:false
                                                                                                                        Imagebase:0x140000000
                                                                                                                        Subsystem:windows cui
                                                                                                                        Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
                                                                                                                        DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                                                                                                                        Time Stamp:0x677B011F [Sun Jan 5 22:01:03 2025 UTC]
                                                                                                                        TLS Callbacks:0x40352510, 0x1
                                                                                                                        CLR (.Net) Version:
                                                                                                                        OS Version Major:6
                                                                                                                        OS Version Minor:0
                                                                                                                        File Version Major:6
                                                                                                                        File Version Minor:0
                                                                                                                        Subsystem Version Major:6
                                                                                                                        Subsystem Version Minor:0
                                                                                                                        Import Hash:de46efa2ebc1886f978c8fb5ad471f48

                                                                                                                        Entrypoint Preview

                                                                                                                        Instruction
                                                                                                                        dec eax
                                                                                                                        sub esp, 28h
                                                                                                                        call 00007F2950F00908h
                                                                                                                        dec eax
                                                                                                                        add esp, 28h
                                                                                                                        jmp 00007F2950F00527h
                                                                                                                        int3
                                                                                                                        int3
                                                                                                                        jmp 00007F2950F00CA8h
                                                                                                                        int3
                                                                                                                        int3
                                                                                                                        int3
                                                                                                                        dec eax
                                                                                                                        sub esp, 28h
                                                                                                                        call 00007F2950F00F70h
                                                                                                                        test eax, eax
                                                                                                                        je 00007F2950F006D3h
                                                                                                                        dec eax
                                                                                                                        mov eax, dword ptr [00000030h]
                                                                                                                        dec eax
                                                                                                                        mov ecx, dword ptr [eax+08h]
                                                                                                                        jmp 00007F2950F006B7h
                                                                                                                        dec eax
                                                                                                                        cmp ecx, eax
                                                                                                                        je 00007F2950F006C6h
                                                                                                                        xor eax, eax
                                                                                                                        dec eax
                                                                                                                        cmpxchg dword ptr [001A1CECh], ecx
                                                                                                                        jne 00007F2950F006A0h
                                                                                                                        xor al, al
                                                                                                                        dec eax
                                                                                                                        add esp, 28h
                                                                                                                        ret
                                                                                                                        mov al, 01h
                                                                                                                        jmp 00007F2950F006A9h
                                                                                                                        int3
                                                                                                                        int3
                                                                                                                        int3
                                                                                                                        dec eax
                                                                                                                        sub esp, 28h
                                                                                                                        test ecx, ecx
                                                                                                                        jne 00007F2950F006B9h
                                                                                                                        mov byte ptr [001A1CD5h], 00000001h
                                                                                                                        call 00007F2950F00C5Dh
                                                                                                                        call 00007F2950F00970h
                                                                                                                        test al, al
                                                                                                                        jne 00007F2950F006B6h
                                                                                                                        xor al, al
                                                                                                                        jmp 00007F2950F006C6h
                                                                                                                        call 00007F2950F00963h
                                                                                                                        test al, al
                                                                                                                        jne 00007F2950F006BBh
                                                                                                                        xor ecx, ecx
                                                                                                                        call 00007F2950F00958h
                                                                                                                        jmp 00007F2950F0069Ch
                                                                                                                        mov al, 01h
                                                                                                                        dec eax
                                                                                                                        add esp, 28h
                                                                                                                        ret
                                                                                                                        int3
                                                                                                                        int3
                                                                                                                        inc eax
                                                                                                                        push ebx
                                                                                                                        dec eax
                                                                                                                        sub esp, 20h
                                                                                                                        cmp byte ptr [001A1C9Ch], 00000000h
                                                                                                                        mov ebx, ecx
                                                                                                                        jne 00007F2950F00719h
                                                                                                                        cmp ecx, 01h
                                                                                                                        jnbe 00007F2950F0071Ch
                                                                                                                        call 00007F2950F00EE6h
                                                                                                                        test eax, eax
                                                                                                                        je 00007F2950F006DAh
                                                                                                                        test ebx, ebx
                                                                                                                        jne 00007F2950F006D6h
                                                                                                                        dec eax
                                                                                                                        lea ecx, dword ptr [001A1C86h]
                                                                                                                        call 00007F2950F00FB8h
                                                                                                                        test eax, eax
                                                                                                                        jne 00007F2950F006C2h

                                                                                                                        Rich Headers

                                                                                                                        Programming Language:
                                                                                                                        • [IMP] VS2008 SP1 build 30729

                                                                                                                        Data Directories

                                                                                                                        NameVirtual AddressVirtual Size Is in Section
                                                                                                                        IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                        IMAGE_DIRECTORY_ENTRY_IMPORT0x5083740x17c.rdata
                                                                                                                        IMAGE_DIRECTORY_ENTRY_RESOURCE0x00x0
                                                                                                                        IMAGE_DIRECTORY_ENTRY_EXCEPTION0x50e0000x28d28.pdata
                                                                                                                        IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                        IMAGE_DIRECTORY_ENTRY_BASERELOC0x5370000x614c.reloc
                                                                                                                        IMAGE_DIRECTORY_ENTRY_DEBUG0x477a900x54.rdata
                                                                                                                        IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                        IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                        IMAGE_DIRECTORY_ENTRY_TLS0x477b000x28.rdata
                                                                                                                        IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x4779500x140.rdata
                                                                                                                        IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                        IMAGE_DIRECTORY_ENTRY_IAT0x37e0000x660.rdata
                                                                                                                        IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                        IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                        IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                        Sections

                                                                                                                        NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                        .text0x10000x37c44f0x37c6003cdde8ad736cadc7039e4157f0c0fe4cunknownunknownunknownunknownIMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                        .rdata0x37e0000x18bb000x18bc00335d454e8d9a0d332e3231970c7ea839False0.26264781072331017DIY-Thermocam raw data (Lepton 2.x), scale 10757-14400, spot sensor temperature 0.000000, unit celsius, color scheme 7, calibration: offset 512.000000, slope 3250994570218613914771524346183680.0000005.394928298151681IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                        .data0x50a0000x33100x3200e60990d6d7b6eb8bba2215cafa78a1ffFalse0.1609375data2.37717939628913IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                        .pdata0x50e0000x28d280x28e004f7f16fc2ad7661ce5aa9b4bbc34086dFalse0.49999402714067276data6.413335908883142IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                        .reloc0x5370000x614c0x6200e39eed23d057020af7ca276a61a11d9dFalse0.4321986607142857data5.452874903711012IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                                                        Imports

                                                                                                                        DLLImport
                                                                                                                        api-ms-win-core-synch-l1-2-0.dllWaitOnAddress, WakeByAddressAll, WakeByAddressSingle
                                                                                                                        bcryptprimitives.dllProcessPrng
                                                                                                                        kernel32.dllGetOverlappedResult, ReadFile, SetFileCompletionNotificationModes, Sleep, GetModuleHandleA, GetCurrentThreadId, FreeEnvironmentStringsW, DeleteProcThreadAttributeList, CompareStringOrdinal, GetLastError, AddVectoredExceptionHandler, SetThreadStackGuarantee, GetCurrentThread, SwitchToThread, PostQueuedCompletionStatus, SetWaitableTimer, WaitForSingleObject, QueryPerformanceCounter, GetSystemInfo, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, SetLastError, GetCurrentDirectoryW, GetEnvironmentStringsW, GetEnvironmentVariableW, GetQueuedCompletionStatusEx, GetCommandLineW, SetFileInformationByHandle, SetFilePointerEx, CreateIoCompletionPort, IsProcessorFeaturePresent, GetStdHandle, GetCurrentProcessId, WriteFileEx, SleepEx, GetExitCodeProcess, GetModuleHandleW, QueryPerformanceFrequency, GetProcAddress, HeapFree, HeapReAlloc, ReleaseMutex, FindNextFileW, FindClose, CreateFileW, GetFileInformationByHandle, GetFileInformationByHandleEx, FindFirstFileW, DeleteFileW, GetFinalPathNameByHandleW, CopyFileExW, CreateEventW, CancelIo, GetConsoleMode, FormatMessageW, GetModuleFileNameW, ExitProcess, CreateNamedPipeW, ReadFileEx, WaitForMultipleObjects, GetFullPathNameW, GetSystemDirectoryW, GetWindowsDirectoryW, CreateProcessW, GetFileAttributesW, InitializeProcThreadAttributeList, UpdateProcThreadAttribute, MultiByteToWideChar, WriteConsoleW, WideCharToMultiByte, CreateThread, GetProcessHeap, HeapAlloc, WaitForSingleObjectEx, LoadLibraryA, CreateMutexA, SetHandleInformation, GetSystemTimeAsFileTime, InitializeSListHead, lstrlenW, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, CloseHandle, DuplicateHandle, CreateWaitableTimerExW
                                                                                                                        ws2_32.dllsend, recv, shutdown, ioctlsocket, connect, bind, WSASocketW, getsockname, getpeername, getsockopt, setsockopt, WSAIoctl, WSAGetLastError, WSAStartup, WSACleanup, getaddrinfo, closesocket, WSASend, freeaddrinfo
                                                                                                                        user32.dllSystemParametersInfoW
                                                                                                                        shell32.dllSHGetKnownFolderPath
                                                                                                                        ole32.dllCoTaskMemFree
                                                                                                                        advapi32.dllRegOpenKeyExW, RegCloseKey, RegQueryValueExW, SystemFunction036
                                                                                                                        secur32.dllAcquireCredentialsHandleA, DeleteSecurityContext, DecryptMessage, QueryContextAttributesW, FreeContextBuffer, AcceptSecurityContext, InitializeSecurityContextW, ApplyControlToken, EncryptMessage, FreeCredentialsHandle
                                                                                                                        crypt32.dllCertDuplicateCertificateContext, CertVerifyCertificateChainPolicy, CertFreeCertificateContext, CertFreeCertificateChain, CertDuplicateCertificateChain, CertEnumCertificatesInStore, CertAddCertificateContextToStore, CertDuplicateStore, CertGetCertificateChain, CertCloseStore, CertOpenStore
                                                                                                                        ntdll.dllNtCancelIoFileEx, NtCreateFile, NtReadFile, NtDeviceIoControlFile, RtlNtStatusToDosError, NtWriteFile
                                                                                                                        bcrypt.dllBCryptGenRandom
                                                                                                                        VCRUNTIME140.dllmemcmp, __current_exception_context, memmove, __current_exception, memset, __CxxFrameHandler3, memcpy, _CxxThrowException, __C_specific_handler
                                                                                                                        api-ms-win-crt-math-l1-1-0.dllroundf, pow, round, exp2f, truncf, ceil, powf, __setusermatherr
                                                                                                                        api-ms-win-crt-runtime-l1-1-0.dll_crt_atexit, _initialize_narrow_environment, _get_initial_narrow_environment, _configure_narrow_argv, _set_app_type, _initterm, _initterm_e, _register_onexit_function, terminate, _initialize_onexit_table, exit, _exit, _seh_filter_exe, __p___argc, __p___argv, _cexit, _c_exit, _register_thread_local_exe_atexit_callback
                                                                                                                        api-ms-win-crt-stdio-l1-1-0.dll__p__commode, _set_fmode
                                                                                                                        api-ms-win-crt-locale-l1-1-0.dll_configthreadlocale
                                                                                                                        api-ms-win-crt-heap-l1-1-0.dllfree, _set_new_mode

                                                                                                                        Network Behavior

                                                                                                                        Network Port Distribution

                                                                                                                        TCP Packets

                                                                                                                        TimestampSource PortDest PortSource IPDest IP
                                                                                                                        Jan 12, 2025 18:47:13.570919037 CET49730443192.168.2.4199.232.196.193
                                                                                                                        Jan 12, 2025 18:47:13.570971012 CET44349730199.232.196.193192.168.2.4
                                                                                                                        Jan 12, 2025 18:47:13.571052074 CET49730443192.168.2.4199.232.196.193
                                                                                                                        Jan 12, 2025 18:47:13.583720922 CET49730443192.168.2.4199.232.196.193
                                                                                                                        Jan 12, 2025 18:47:13.583739042 CET44349730199.232.196.193192.168.2.4
                                                                                                                        Jan 12, 2025 18:47:14.147083044 CET44349730199.232.196.193192.168.2.4
                                                                                                                        Jan 12, 2025 18:47:14.147186041 CET49730443192.168.2.4199.232.196.193
                                                                                                                        Jan 12, 2025 18:47:14.151223898 CET49730443192.168.2.4199.232.196.193
                                                                                                                        Jan 12, 2025 18:47:14.151233912 CET44349730199.232.196.193192.168.2.4
                                                                                                                        Jan 12, 2025 18:47:14.151655912 CET44349730199.232.196.193192.168.2.4
                                                                                                                        Jan 12, 2025 18:47:14.206774950 CET49730443192.168.2.4199.232.196.193
                                                                                                                        Jan 12, 2025 18:47:14.212649107 CET49730443192.168.2.4199.232.196.193
                                                                                                                        Jan 12, 2025 18:47:14.255321980 CET44349730199.232.196.193192.168.2.4
                                                                                                                        Jan 12, 2025 18:47:14.314896107 CET44349730199.232.196.193192.168.2.4
                                                                                                                        Jan 12, 2025 18:47:14.315089941 CET44349730199.232.196.193192.168.2.4
                                                                                                                        Jan 12, 2025 18:47:14.315165043 CET44349730199.232.196.193192.168.2.4
                                                                                                                        Jan 12, 2025 18:47:14.315212965 CET49730443192.168.2.4199.232.196.193
                                                                                                                        Jan 12, 2025 18:47:14.315223932 CET44349730199.232.196.193192.168.2.4
                                                                                                                        Jan 12, 2025 18:47:14.315273046 CET49730443192.168.2.4199.232.196.193
                                                                                                                        Jan 12, 2025 18:47:14.315279961 CET44349730199.232.196.193192.168.2.4
                                                                                                                        Jan 12, 2025 18:47:14.315613031 CET44349730199.232.196.193192.168.2.4
                                                                                                                        Jan 12, 2025 18:47:14.315684080 CET49730443192.168.2.4199.232.196.193
                                                                                                                        Jan 12, 2025 18:47:14.315690994 CET44349730199.232.196.193192.168.2.4
                                                                                                                        Jan 12, 2025 18:47:14.316237926 CET44349730199.232.196.193192.168.2.4
                                                                                                                        Jan 12, 2025 18:47:14.316306114 CET49730443192.168.2.4199.232.196.193
                                                                                                                        Jan 12, 2025 18:47:14.316312075 CET44349730199.232.196.193192.168.2.4
                                                                                                                        Jan 12, 2025 18:47:14.316382885 CET44349730199.232.196.193192.168.2.4
                                                                                                                        Jan 12, 2025 18:47:14.316431999 CET49730443192.168.2.4199.232.196.193
                                                                                                                        Jan 12, 2025 18:47:14.316437960 CET44349730199.232.196.193192.168.2.4
                                                                                                                        Jan 12, 2025 18:47:14.329014063 CET44349730199.232.196.193192.168.2.4
                                                                                                                        Jan 12, 2025 18:47:14.329073906 CET49730443192.168.2.4199.232.196.193
                                                                                                                        Jan 12, 2025 18:47:14.329081059 CET44349730199.232.196.193192.168.2.4
                                                                                                                        Jan 12, 2025 18:47:14.378618956 CET49730443192.168.2.4199.232.196.193
                                                                                                                        Jan 12, 2025 18:47:14.402165890 CET44349730199.232.196.193192.168.2.4
                                                                                                                        Jan 12, 2025 18:47:14.402364016 CET44349730199.232.196.193192.168.2.4
                                                                                                                        Jan 12, 2025 18:47:14.402432919 CET49730443192.168.2.4199.232.196.193
                                                                                                                        Jan 12, 2025 18:47:14.402447939 CET44349730199.232.196.193192.168.2.4
                                                                                                                        Jan 12, 2025 18:47:14.402532101 CET44349730199.232.196.193192.168.2.4
                                                                                                                        Jan 12, 2025 18:47:14.402592897 CET49730443192.168.2.4199.232.196.193
                                                                                                                        Jan 12, 2025 18:47:14.402605057 CET44349730199.232.196.193192.168.2.4
                                                                                                                        Jan 12, 2025 18:47:14.402698994 CET44349730199.232.196.193192.168.2.4
                                                                                                                        Jan 12, 2025 18:47:14.402757883 CET49730443192.168.2.4199.232.196.193
                                                                                                                        Jan 12, 2025 18:47:14.402770042 CET44349730199.232.196.193192.168.2.4
                                                                                                                        Jan 12, 2025 18:47:14.402930975 CET44349730199.232.196.193192.168.2.4
                                                                                                                        Jan 12, 2025 18:47:14.402985096 CET49730443192.168.2.4199.232.196.193
                                                                                                                        Jan 12, 2025 18:47:14.402997017 CET44349730199.232.196.193192.168.2.4
                                                                                                                        Jan 12, 2025 18:47:14.403134108 CET44349730199.232.196.193192.168.2.4
                                                                                                                        Jan 12, 2025 18:47:14.403193951 CET49730443192.168.2.4199.232.196.193
                                                                                                                        Jan 12, 2025 18:47:14.403445005 CET49730443192.168.2.4199.232.196.193
                                                                                                                        Jan 12, 2025 18:47:14.403460026 CET44349730199.232.196.193192.168.2.4

                                                                                                                        UDP Packets

                                                                                                                        TimestampSource PortDest PortSource IPDest IP
                                                                                                                        Jan 12, 2025 18:47:13.558760881 CET4991253192.168.2.41.1.1.1
                                                                                                                        Jan 12, 2025 18:47:13.566344023 CET53499121.1.1.1192.168.2.4

                                                                                                                        DNS Queries

                                                                                                                        TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                        Jan 12, 2025 18:47:13.558760881 CET192.168.2.41.1.1.10x7f1Standard query (0)i.imgur.comA (IP address)IN (0x0001)false

                                                                                                                        DNS Answers

                                                                                                                        TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                        Jan 12, 2025 18:47:13.566344023 CET1.1.1.1192.168.2.40x7f1No error (0)i.imgur.comipv4.imgur.map.fastly.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                        Jan 12, 2025 18:47:13.566344023 CET1.1.1.1192.168.2.40x7f1No error (0)ipv4.imgur.map.fastly.net199.232.196.193A (IP address)IN (0x0001)false
                                                                                                                        Jan 12, 2025 18:47:13.566344023 CET1.1.1.1192.168.2.40x7f1No error (0)ipv4.imgur.map.fastly.net199.232.192.193A (IP address)IN (0x0001)false

                                                                                                                        HTTP Request Dependency Graph

                                                                                                                        • i.imgur.com

                                                                                                                        HTTPS Proxied Packets

                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                        0192.168.2.449730199.232.196.1934436760C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                        2025-01-12 17:47:14 UTC62OUTGET /HCYQoVR.jpeg HTTP/1.1
                                                                                                                        accept: */*
                                                                                                                        host: i.imgur.com
                                                                                                                        2025-01-12 17:47:14 UTC763INHTTP/1.1 200 OK
                                                                                                                        Connection: close
                                                                                                                        Content-Length: 28864
                                                                                                                        Content-Type: image/jpeg
                                                                                                                        Last-Modified: Mon, 30 Dec 2024 19:23:51 GMT
                                                                                                                        ETag: "70f83e99427ac54b92283eaecb69c5df"
                                                                                                                        x-amz-server-side-encryption: AES256
                                                                                                                        X-Amz-Cf-Pop: IAD89-P1
                                                                                                                        X-Amz-Cf-Id: w1veLHWiaEcBL8caleHyCc4jlmIU2__N_q7NNoWzZBqTAalmsqn0vA==
                                                                                                                        cache-control: public, max-age=31536000
                                                                                                                        Accept-Ranges: bytes
                                                                                                                        Age: 1068597
                                                                                                                        Date: Sun, 12 Jan 2025 17:47:14 GMT
                                                                                                                        X-Served-By: cache-iad-kjyo7100042-IAD, cache-ewr-kewr1740076-EWR
                                                                                                                        X-Cache: Miss from cloudfront, HIT, MISS
                                                                                                                        X-Cache-Hits: 85, 0
                                                                                                                        X-Timer: S1736704034.259108,VS0,VE7
                                                                                                                        Strict-Transport-Security: max-age=300
                                                                                                                        Access-Control-Allow-Methods: GET, OPTIONS
                                                                                                                        Access-Control-Allow-Origin: *
                                                                                                                        Server: cat factory 1.0
                                                                                                                        X-Content-Type-Options: nosniff
                                                                                                                        2025-01-12 17:47:14 UTC1371INData Raw: ff d8 ff db 00 43 00 02 01 01 01 01 01 02 01 01 01 02 02 02 02 02 04 03 02 02 02 02 05 04 04 03 04 06 05 06 06 06 05 06 06 06 07 09 08 06 07 09 07 06 06 08 0b 08 09 0a 0a 0a 0a 0a 06 08 0b 0c 0b 0a 0c 09 0a 0a 0a ff db 00 43 01 02 02 02 02 02 02 05 03 03 05 0a 07 06 07 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a ff c0 00 11 08 02 04 02 b8 03 01 22 00 02 11 01 03 11 01 ff c4 00 1d 00 01 00 02 03 01 01 01 01 00 00 00 00 00 00 00 00 00 08 09 06 07 0a 05 04 02 03 ff c4 00 49 10 00 01 03 02 05 03 03 02 03 06 03 06 03 05 09 00 00 02 03 04 05 06 01 07 08 09 12 0a 13 22 11 14 32 23 42 15 21 52 16 31 33 41 62 72 24 43 82 17 34 51 53 61 63 19 25 73 18 44 92 93
                                                                                                                        Data Ascii: CC"I"2#B!R13Abr$C4QSac%sD
                                                                                                                        2025-01-12 17:47:14 UTC1371INData Raw: a2 55 8f 88 1a d4 13 43 74 ed 90 35 3f b4 3d bb 67 dc 3a 97 cd ac b0 ac 2a f7 9d 32 35 12 97 65 56 a7 c9 95 8a 62 b6 da 9e 79 69 97 06 3a 70 6d 3d e6 53 c9 2a 56 3c 9c 4f 89 0b c0 00 00 02 43 ed b5 b6 f6 7c ee 99 a8 c7 34 c7 a7 6a ed b1 4e ae 31 6f ca ad 3f 50 bb a6 c8 8f 09 a8 b1 d4 d3 6a e4 a8 f1 de 73 96 2a 79 b4 a7 c3 ee fb 4f bb 73 ad b0 f3 c3 6a 3c f6 a4 e9 e3 50 57 f5 95 5e af 56 2d 76 6b ed 2e c7 9f 32 4b 11 e2 bb 22 44 74 25 c5 4a 8b 1d 5d cc 55 19 cc 78 a5 2a f1 e3 e5 e4 04 6a 05 89 eb 17 a6 9b 5d 5a 19 d1 8d 63 5c 59 df 9b 19 4c 9b 62 87 06 9e fc da 3d 2a bd 54 76 a9 ca 64 88 f1 da 65 2d aa 9c 96 54 e2 5c 90 8e 5f 57 8a 78 ab c9 5c 7f 3a ec 00 00 00 00 00 01 23 76 d4 db 1b 53 5b a8 e7 a4 ac 86 d3 23 34 36 27 52 e8 8e 55 ab 35 ab a2 6b d1 a9 d4
                                                                                                                        Data Ascii: UCt5?=g:*25eVbyi:pm=S*V<OC|4jN1o?Pjs*yOsj<PW^V-vk.2K"Dt%J]Ux*j]Zc\YLb=*Tvde-T\_Wx\:#vS[#46'RU5k
                                                                                                                        2025-01-12 17:47:14 UTC1371INData Raw: 1c 85 c7 5c 97 54 a7 1f e2 b7 b9 27 b9 8a 94 9e e7 1e 5c 78 a5 3c e6 6e 63 4c b6 e8 7b 8e 67 fd 0a cd 8c cc 7a 3c 3c ec ba d8 a4 b1 1b 0f 46 9b 8a 8a c4 a4 b4 94 7f 4e 09 c1 3e 80 62 1a 61 d3 bd fd ab 4d 43 d9 3a 67 ca e5 42 45 c1 7d dc 90 e8 b4 a7 aa 4e ad 11 a3 b9 21 c4 b7 de 7d 4d a5 6a 4b 2d f2 c5 6b 52 52 a5 71 4a b8 a5 58 f8 93 e3 39 3a 4e f7 44 ca 5c c6 b1 72 ae 9b 54 cb 4b c2 ab 7d 4c 94 dc 7f d9 4b 82 76 2d 52 22 c6 4b 4a 7e 74 e7 25 c1 8e 96 63 a3 bc d2 7d 53 dc 71 4a 71 29 4b 6a 52 92 93 cc e9 42 c8 c7 b3 8b 79 5b 32 e5 71 cf 48 f9 79 6d 56 6e 69 6d e2 9f 5e e6 18 46 f6 0d e1 ff 00 4e 2f 4f 65 5f e9 2c 53 aa ff 00 79 8d 45 e9 32 ef b4 f4 29 a4 6c c6 a9 d9 75 9a d5 b5 fb 41 7b dd b4 45 a9 8a 82 22 bc f3 8c c4 87 16 4a 55 ce 32 95 8c 77 dc 71 4d
                                                                                                                        Data Ascii: \T'\x<ncL{gz<<FN>baMC:gBE}N!}MjK-kRRqJX9:ND\rTK}LKv-R"KJ~t%c}SqJq)KjRBy[2qHymVnim^FN/Oe_,SyE2)luA{E"JU2wqM
                                                                                                                        2025-01-12 17:47:14 UTC1371INData Raw: 6a 90 69 c8 b3 99 b8 5f 7e b6 d4 a9 29 52 d2 ca 90 98 be db 15 25 2d b8 a5 60 99 0a e2 96 d5 f2 f4 3a 3f cc 9c ef a1 ec 9f b2 4d 12 f7 bb 29 0d d5 a6 65 26 52 d1 28 b1 29 98 f2 69 35 4a d7 b6 8f 0d a6 d5 c5 3c 92 87 25 2f 93 8a f9 25 3d c5 7f 23 99 0d 7f ef 65 b8 0e e6 76 13 79 55 aa dc c9 a4 54 ed a8 77 62 6e 1a 3d 16 95 6d 45 82 dd 3a 4a 63 bd 1d 2d b6 b6 93 dc 71 b4 b6 fb bf c6 5b 8a f2 f9 01 11 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0e 9c 76 09 d6 ae df 1a 01 d9 46 83 1f 30 f5 8d 93 b4 cb e9 e8 55 db b6 e0 b4 55 98 b4 b4 d5 1c 94 b7 9e c6 34 75 c5 ef 25 e5 4a 54 56 22 37 db e3 dc e5 c5 1f a4 e6 38 01 64 fd
                                                                                                                        Data Ascii: ji_~)R%-`:?M)e&R()i5J<%/%=#evyUTwbn=mE:Jc-q[vF0UU4u%JTV"78d
                                                                                                                        2025-01-12 17:47:14 UTC1371INData Raw: 4e b0 ab 7b 2f 5e af 52 e8 a8 a6 23 17 1c 5d 0e d3 6a 67 27 11 8a 98 4a 9c 71 ce db d2 5f 57 6d 2a 57 71 e5 76 f0 f8 a4 b7 bc dc db 47 a4 cb 55 d9 87 1f 51 94 7d 74 d8 56 0c 79 cf fb fa 8d a5 69 e7 55 22 8d 06 72 95 c5 6a 4b 90 66 a5 52 22 27 d3 fc b8 fe df 8f 25 78 a5 5f 10 9b fb 19 e4 9e dd b9 23 a6 ab 92 df db 42 35 52 af 64 33 79 3b 06 7e 63 d6 a4 f7 df bc 2a 11 d9 6d 2f 4a 6d de db 69 76 3b 6a 57 65 2b 69 b6 d9 52 9b 77 b6 9f de a5 51 66 50 6f 41 6f e9 c3 a8 df 32 37 02 bc 5d c2 ab 60 dc d7 95 6a da ad c9 a2 a3 17 dc 5d b7 dc 4c 58 52 98 f2 fa 8a 42 61 c0 79 5f bf 9a 5b 5a 52 9f 24 f1 9d 1b 99 75 04 6d fb a0 cd 11 bd b7 f6 cf 95 5a 55 56 b6 dd 09 da 0d 22 ad 69 a1 c5 d1 ad 58 af 60 ae f4 a6 e5 ab fd f6 62 bb 8b 52 54 da 9c 4f 79 6a 71 c7 31 52 78 39
                                                                                                                        Data Ascii: N{/^R#]jg'Jq_Wm*WqvGUQ}tVyiU"rjKfR"'%x_#B5Rd3y;~c*m/Jmiv;jWe+iRwQfPoAo27]`j]LXRBay_[ZR$umZUV"iX`bRTOyjq1Rx9
                                                                                                                        2025-01-12 17:47:14 UTC1371INData Raw: ae 5d bf 2f 15 25 5a 1f 79 7d 20 e9 df 41 1b 86 5e ba 43 d3 45 c1 75 d5 a8 36 5b 34 f6 24 54 af 2a 84 59 32 9e 9a f4 36 65 3b e8 a8 cc 32 df 6d 3d f4 b7 c7 b7 cb 93 6a 02 2a 03 d6 b3 2d 4b 8a fd bb 29 76 3d a1 4a 5c ea ad 6a a2 cc 0a 5c 26 d4 9c 15 22 43 ce 25 b6 db 4f 2f cb 92 94 a4 a7 ff 00 d4 ba 2d ed fa 73 f6 f1 da df 6f 4a 96 a5 ec 8c ee cd 29 f7 c2 ab 74 aa 35 bb 02 e6 b8 29 6b a7 4d 99 21 dc 14 fa 7b 4c d3 59 79 7e 91 5a 96 e2 52 97 30 c5 3d be 58 f2 c1 2a 4a 82 91 c0 00 00 00 01 b7 b4 1b a6 99 3a c9 d6 8e 57 69 71 9c 26 60 cd ef 7b d3 e9 55 47 e9 ee b6 db f1 e0 b9 21 3e ee 43 6a 71 2a 4f 26 e3 f7 9c f2 4a bf 87 f1 57 c4 b1 0e a2 2d 8f 34 17 b4 56 46 65 fd d1 90 19 b5 99 55 7b c6 f6 bb 1f 88 9a 5d ef 5d a6 c8 63 1a 64 58 aa 54 97 9b 6e 3c 18 ee 77
                                                                                                                        Data Ascii: ]/%Zy} A^CEu6[4$T*Y26e;2m=j*-K)v=J\j\&"C%O/-soJ)t5)kM!{LYy~ZR0=X*J:Wiq&`{UG!>Cjq*O&JW-4VFeU{]]cdXTn<w
                                                                                                                        2025-01-12 17:47:14 UTC1371INData Raw: 2e 1b b2 24 c9 75 2d 47 8e c3 78 ad c7 16 ac 70 4a 52 94 e1 f2 56 38 ff 00 20 3b 49 db 53 49 ba 1d db 0f 42 df b3 da 66 ce 56 2a 59 59 8b b3 2f 09 f9 91 71 dc d0 1f 62 63 2e b6 95 39 50 7a 7c 66 d9 8a a6 51 1d 86 d3 dd e2 94 a5 a6 53 c9 5e 3c 8a 67 b8 36 49 da ff 00 56 db ba 58 1a 7a d2 9e bc ee ec d4 a4 5d 96 dd cb 7d 67 75 e7 44 cc 4a 15 5e 64 37 12 e2 53 17 db 49 83 07 db b3 21 c9 8f 72 71 0e 25 c5 76 d4 95 27 06 fd 53 8a ac 3b 7c 39 8c ed f9 d3 a7 5e c8 eb 19 d6 a2 2e 15 81 6e 65 dd 31 0f 2b 97 26 56 a8 b0 e4 a7 d7 d7 c9 4a 86 89 3e 5f ab cb 1e 5f 99 05 ba 22 72 2a 2c fc cb cf 6d 4b d4 68 e9 c5 da 55 0e 93 6c 52 2a 38 e3 f9 f1 94 f3 d2 a5 b6 9c 3f fd a4 25 2b fb 93 fd 40 46 4e a8 2d 32 5b 3a 32 d4 3e 59 e9 d6 91 ac 5c f9 cd 99 c8 b2 5d ad cd 56 76 66
                                                                                                                        Data Ascii: .$u-GxpJRV8 ;ISIBfV*YY/qbc.9Pz|fQS^<g6IVXz]}guDJ^d7SI!rq%v'S;|9^.ne1+&VJ>__"r*,mKhUlR*8?%+@FN-2[:2>Y\]Vvf
                                                                                                                        2025-01-12 17:47:14 UTC1371INData Raw: 61 ac 70 6d aa b5 d7 5b a7 fd fe 4a 6a 1c 27 3f a5 3e 35 04 ff 00 d7 fd 25 03 16 49 d5 6b 9e 92 73 9b 79 7b de db 4b 7f e1 32 f2 dd a3 db 10 1c e5 8e 3c d2 98 b8 4e 7b 1f 4c 70 f1 f4 91 3d f4 ff 00 a7 97 dc 56 d8 16 91 b2 c7 4d 4e 68 ee 5b 97 ec ea 87 3f b3 12 46 5c e5 1b b2 1d 45 2e 44 38 69 76 ab 70 25 95 29 2e b9 1b b9 f4 e3 47 4a 92 a4 fb 87 12 e7 aa 9b 52 52 da b0 f2 27 2c 6e 91 cd a7 75 0b 97 d7 0a 34 59 b8 6d e1 5c b8 68 92 9c a6 cc aa 35 74 d0 ae 1a 7d 36 a6 94 f9 47 96 c4 08 ac b8 da d3 f7 36 a7 92 a4 e0 a2 7f ee 31 52 d1 46 85 f6 95 7e c5 d4 5e 4c de 97 4e 46 db f6 ed 22 d7 ac db 99 65 50 5c 69 4a a6 f2 66 3b 3c 9e 6a 6c 37 3d ba 94 96 d0 e7 17 b0 ee 25 dc 52 a4 a9 2a 52 4a b2 b3 3a 92 b4 8d a5 ac 8d b9 72 bb 64 3d a6 eb b4 67 9b a5 c8 ab dc 15
                                                                                                                        Data Ascii: apm[Jj'?>5%Iksy{K2<N{Lp=VMNh[?F\E.D8ivp%).GJRR',nu4Ym\h5t}6G61RF~^LNF"eP\iJf;<jl7=%R*RJ:rd=g
                                                                                                                        2025-01-12 17:47:14 UTC1371INData Raw: bf 61 1d 31 d6 f7 53 cd cd 00 ee 27 a9 e8 b4 69 59 65 2a 9a c5 9d 4b a1 dc b4 fa 54 eb e2 44 ce 33 22 e2 c3 13 52 f3 8f 36 a8 3e 8e 3d 1d 94 a9 c6 d5 21 b4 f7 3c 7c a4 bf 44 fe 99 73 56 8a f6 70 6a d6 bd 42 99 06 d0 ad 40 81 6e db f2 de 47 16 aa d2 9a 79 c7 a4 a9 bf 5f 92 59 fa 48 e5 87 8f 27 54 9f 92 55 c7 dc d3 f5 46 d3 d7 77 59 05 eb 99 36 cd 4a 3d 42 89 92 d6 dc bf 6c f4 54 7a a1 e7 a0 53 a3 d1 df c1 cc 71 f9 76 ea 13 de e2 a4 f1 fe 0b 7f 2f b8 2c 93 78 8c 9f d0 1e a4 b4 cd 0f 4b ba fe d6 2d 3f 27 2d 8b 92 b2 cc d8 72 5c bf a8 f4 09 15 65 41 52 55 8b 2d ae a8 db 8d ba db 6a 75 97 16 96 d3 c9 2a ed f9 27 d7 cb 9f 5d bb 3a 79 6e 2d cf 75 37 99 93 32 1b 34 5f b7 b4 ed 64 66 1d 46 8d 46 cc 7a c6 0d d4 66 d7 22 b3 25 58 30 98 b8 32 96 59 90 f2 a3 f6 5c 71
                                                                                                                        Data Ascii: a1S'iYe*KTD3"R6>=!<|DsVpjB@nGy_YH'TUFwY6J=BlTzSqv/,xK-?'-r\eARU-ju*']:yn-u724_dfFFzf"%X02Y\q
                                                                                                                        2025-01-12 17:47:14 UTC1371INData Raw: c9 c8 df 97 15 7d 4a 11 3a 0d e8 86 c8 d9 b1 ed 8c f8 d4 b5 42 0b 58 b1 36 7d 1a d9 a4 c8 f4 f3 4a 99 44 89 52 d3 fd b8 f7 e1 7f f0 ff 00 d0 09 31 d4 a1 92 1b 60 ea 3f 29 26 d6 f5 7f ad e5 5b 17 f6 4f 58 75 ca d5 8d 95 54 5c cc a2 d3 a6 d6 a6 48 8e 97 18 4a e0 cb 65 e9 0f 29 e7 22 32 d3 6a 6f 8f 8a 95 c4 83 f9 f9 d3 4d a1 8d 32 ec bf 27 70 2c e5 cd 7c d5 a5 e6 35 3f 27 29 f5 e9 b4 47 2b f4 b4 d2 d9 b8 a6 47 65 2c c1 52 30 a7 a9 cc 59 f7 92 5b 67 8e 0f 72 57 af f1 3e e2 21 ee 9d 54 8d b8 7f 51 6d d9 96 88 ac 49 f6 37 46 79 52 72 f1 87 b9 62 af 6e 88 f2 22 d1 56 a6 bf e0 9e e3 4e 38 9e 3f 2e 5c be e2 e2 fa c2 f3 8f fd 95 6d 39 4c ca 4a 2c 54 60 9b f3 32 69 54 97 9a 4e 3c 70 66 1c 56 64 4e f5 4f e5 fc 9d 89 19 3c 7f e0 a5 7e 90 2a 97 a7 4f 64 ac 8a dd ee b3
                                                                                                                        Data Ascii: }J:BX6}JDR1`?)&[OXuT\HJe)"2joM2'p,|5?')G+Ge,R0Y[grW>!TQmI7FyRrbn"VN8?.\m9LJ,T`2iTN<pfVdNO<~*Od


                                                                                                                        Statistics

                                                                                                                        CPU Usage

                                                                                                                        Click to jump to process

                                                                                                                        Memory Usage

                                                                                                                        Click to jump to process

                                                                                                                        High Level Behavior Distribution

                                                                                                                        Click to dive into process behavior distribution

                                                                                                                        Behavior

                                                                                                                        Click to jump to process

                                                                                                                        System Behavior

                                                                                                                        General

                                                                                                                        Target ID:0
                                                                                                                        Start time:12:47:02
                                                                                                                        Start date:12/01/2025
                                                                                                                        Path:C:\Users\user\Desktop\CF537GfmKa.exe
                                                                                                                        Wow64 process (32bit):false
                                                                                                                        Commandline:"C:\Users\user\Desktop\CF537GfmKa.exe"
                                                                                                                        Imagebase:0x7ff7e12c0000
                                                                                                                        File size:5'482'496 bytes
                                                                                                                        MD5 hash:834C7FD865EEE5F7E17A3A1FB62E7051
                                                                                                                        Has elevated privileges:true
                                                                                                                        Has administrator privileges:true
                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                        Reputation:low
                                                                                                                        Has exited:true

                                                                                                                        General

                                                                                                                        Target ID:1
                                                                                                                        Start time:12:47:02
                                                                                                                        Start date:12/01/2025
                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                        Wow64 process (32bit):false
                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                        File size:862'208 bytes
                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                        Has elevated privileges:true
                                                                                                                        Has administrator privileges:true
                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                        Reputation:high
                                                                                                                        Has exited:true

                                                                                                                        General

                                                                                                                        Target ID:2
                                                                                                                        Start time:12:47:02
                                                                                                                        Start date:12/01/2025
                                                                                                                        Path:C:\Windows\System32\net.exe
                                                                                                                        Wow64 process (32bit):false
                                                                                                                        Commandline:"net" session
                                                                                                                        Imagebase:0x7ff6b2140000
                                                                                                                        File size:59'904 bytes
                                                                                                                        MD5 hash:0BD94A338EEA5A4E1F2830AE326E6D19
                                                                                                                        Has elevated privileges:true
                                                                                                                        Has administrator privileges:true
                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                        Reputation:high
                                                                                                                        Has exited:true

                                                                                                                        General

                                                                                                                        Target ID:3
                                                                                                                        Start time:12:47:02
                                                                                                                        Start date:12/01/2025
                                                                                                                        Path:C:\Windows\System32\net1.exe
                                                                                                                        Wow64 process (32bit):false
                                                                                                                        Commandline:C:\Windows\system32\net1 session
                                                                                                                        Imagebase:0x7ff6b7020000
                                                                                                                        File size:183'808 bytes
                                                                                                                        MD5 hash:55693DF2BB3CBE2899DFDDF18B4EB8C9
                                                                                                                        Has elevated privileges:true
                                                                                                                        Has administrator privileges:true
                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                        Reputation:moderate
                                                                                                                        Has exited:true

                                                                                                                        General

                                                                                                                        Target ID:4
                                                                                                                        Start time:12:47:02
                                                                                                                        Start date:12/01/2025
                                                                                                                        Path:C:\Windows\System32\tasklist.exe
                                                                                                                        Wow64 process (32bit):false
                                                                                                                        Commandline:"tasklist" /fi "IMAGENAME eq vmware"
                                                                                                                        Imagebase:0x7ff779fe0000
                                                                                                                        File size:106'496 bytes
                                                                                                                        MD5 hash:D0A49A170E13D7F6AEBBEFED9DF88AAA
                                                                                                                        Has elevated privileges:true
                                                                                                                        Has administrator privileges:true
                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                        Reputation:moderate
                                                                                                                        Has exited:true

                                                                                                                        General

                                                                                                                        Target ID:5
                                                                                                                        Start time:12:47:03
                                                                                                                        Start date:12/01/2025
                                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                        Wow64 process (32bit):false
                                                                                                                        Commandline:"powershell" -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
                                                                                                                        Imagebase:0x7ff788560000
                                                                                                                        File size:452'608 bytes
                                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                        Has elevated privileges:true
                                                                                                                        Has administrator privileges:true
                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                        Reputation:high
                                                                                                                        Has exited:true

                                                                                                                        General

                                                                                                                        Target ID:6
                                                                                                                        Start time:12:47:03
                                                                                                                        Start date:12/01/2025
                                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                        Wow64 process (32bit):false
                                                                                                                        Commandline:"powershell" -Command "wevtutil sl Security /e:false"
                                                                                                                        Imagebase:0x7ff788560000
                                                                                                                        File size:452'608 bytes
                                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                        Has elevated privileges:true
                                                                                                                        Has administrator privileges:true
                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                        Reputation:high
                                                                                                                        Has exited:true

                                                                                                                        General

                                                                                                                        Target ID:7
                                                                                                                        Start time:12:47:03
                                                                                                                        Start date:12/01/2025
                                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                        Wow64 process (32bit):false
                                                                                                                        Commandline:"powershell" -Command "wevtutil sl Application /e:false"
                                                                                                                        Imagebase:0x7ff788560000
                                                                                                                        File size:452'608 bytes
                                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                        Has elevated privileges:true
                                                                                                                        Has administrator privileges:true
                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                        Reputation:high
                                                                                                                        Has exited:true

                                                                                                                        General

                                                                                                                        Target ID:8
                                                                                                                        Start time:12:47:03
                                                                                                                        Start date:12/01/2025
                                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                        Wow64 process (32bit):false
                                                                                                                        Commandline:"powershell" -Command "Set-ExecutionPolicy Bypass -Scope Process -Force"
                                                                                                                        Imagebase:0x7ff788560000
                                                                                                                        File size:452'608 bytes
                                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                        Has elevated privileges:true
                                                                                                                        Has administrator privileges:true
                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                        Reputation:high
                                                                                                                        Has exited:true

                                                                                                                        General

                                                                                                                        Target ID:9
                                                                                                                        Start time:12:47:05
                                                                                                                        Start date:12/01/2025
                                                                                                                        Path:C:\Windows\System32\wevtutil.exe
                                                                                                                        Wow64 process (32bit):false
                                                                                                                        Commandline:"C:\Windows\system32\wevtutil.exe" sl Security /e:false
                                                                                                                        Imagebase:0x7ff667d80000
                                                                                                                        File size:278'016 bytes
                                                                                                                        MD5 hash:1AAE26BD68B911D0420626A27070EB8D
                                                                                                                        Has elevated privileges:true
                                                                                                                        Has administrator privileges:true
                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                        Reputation:moderate
                                                                                                                        Has exited:true

                                                                                                                        General

                                                                                                                        Target ID:10
                                                                                                                        Start time:12:47:05
                                                                                                                        Start date:12/01/2025
                                                                                                                        Path:C:\Windows\System32\wevtutil.exe
                                                                                                                        Wow64 process (32bit):false
                                                                                                                        Commandline:"C:\Windows\system32\wevtutil.exe" sl Application /e:false
                                                                                                                        Imagebase:0x7ff667d80000
                                                                                                                        File size:278'016 bytes
                                                                                                                        MD5 hash:1AAE26BD68B911D0420626A27070EB8D
                                                                                                                        Has elevated privileges:true
                                                                                                                        Has administrator privileges:true
                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                        Reputation:moderate
                                                                                                                        Has exited:true

                                                                                                                        General

                                                                                                                        Target ID:11
                                                                                                                        Start time:12:47:07
                                                                                                                        Start date:12/01/2025
                                                                                                                        Path:C:\Windows\System32\wbem\WmiPrvSE.exe
                                                                                                                        Wow64 process (32bit):false
                                                                                                                        Commandline:C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                                                                                        Imagebase:0x7ff693ab0000
                                                                                                                        File size:496'640 bytes
                                                                                                                        MD5 hash:60FF40CFD7FB8FE41EE4FE9AE5FE1C51
                                                                                                                        Has elevated privileges:true
                                                                                                                        Has administrator privileges:false
                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                        Has exited:true

                                                                                                                        Disassembly

                                                                                                                        Reset < >

                                                                                                                          Non-executed Functions

                                                                                                                          Function 00007FF7E162B7B8 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000000.00000002.1928302155.00007FF7E12C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E12C0000, based on PE: true
                                                                                                                          • Associated: 00000000.00000002.1928283797.00007FF7E12C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                          • Associated: 00000000.00000002.1928614404.00007FF7E163E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                          • Associated: 00000000.00000002.1928614404.00007FF7E16DD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                          • Associated: 00000000.00000002.1928614404.00007FF7E16EC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                          • Associated: 00000000.00000002.1928614404.00007FF7E16F9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                          • Associated: 00000000.00000002.1928614404.00007FF7E1719000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                          • Associated: 00000000.00000002.1929014144.00007FF7E17CA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                          • Associated: 00000000.00000002.1929036097.00007FF7E17CB000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                          • Associated: 00000000.00000002.1929098076.00007FF7E17CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                          • Associated: 00000000.00000002.1929119332.00007FF7E17CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_0_2_7ff7e12c0000_CF537GfmKa.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 2933794660-0
                                                                                                                          • Opcode ID: eaa2e2806d0817fad0b552ccf9bef788826787fd9c98dcef92834be61a6c05dc
                                                                                                                          • Instruction ID: e38d94a90b1ae076f0efc01631d9b50e6c9224e5e5e17a3c6ec5b292eb210bc0
                                                                                                                          • Opcode Fuzzy Hash: eaa2e2806d0817fad0b552ccf9bef788826787fd9c98dcef92834be61a6c05dc
                                                                                                                          • Instruction Fuzzy Hash: CA114C22B14B018AEB009F60E8453A973A4FB5DB68F840E32DA2D467A4DFB8D1A48351

                                                                                                                          Executed Functions

                                                                                                                          Function 00007FFD9B8733B5 Relevance: .0, Instructions: 49COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000008.00000002.1762357148.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_8_2_7ffd9b870000_powershell.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID:
                                                                                                                          • String ID:
                                                                                                                          • API String ID:
                                                                                                                          • Opcode ID: 76d70864090ee490991c90939bad70b8686d9afa50a49723ed7ebb2cc1aa164d
                                                                                                                          • Instruction ID: 240e77624845bd21eb498471991253802ac2a52bcd73a2482a697d82a952278d
                                                                                                                          • Opcode Fuzzy Hash: 76d70864090ee490991c90939bad70b8686d9afa50a49723ed7ebb2cc1aa164d
                                                                                                                          • Instruction Fuzzy Hash: 9201A73020CB0C4FD748EF0CE451AA6B3E0FB89324F10056DE58AC36A1DA32E882CB42