Play interactive tour

Edit tour

Windows Analysis Report cA3HKPci26

Overview

General Information

Sample Name:	cA3HKPci26 (renamed file extension from none to exe)
Analysis ID:	496710
MD5:	a20e47d870f92c1787bc4a5622586859
SHA1:	f39d211787e0b114279030472ff75c99e413856b
SHA256:	cddad8bdfdc2867eab55f6cf96a82eaf0832cb6539ce3c3fd7c3355325a38095
Tags:	exe
Infos:
Most interesting Screenshot:

Detection

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Sigma detected: Shadow Copies Deletion Using Operating Systems Utilities

Sigma detected: Copying Sensitive Files with Credential Data

May disable shadow drive data (uses vssadmin)

Creates files in the recycle bin to hide itself

Deletes shadow drive data (may be related to ransomware)

Machine Learning detection for sample

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Sample file is different than original file name gathered from version info

Sample execution stops while process was sleeping (likely an evasion)

Stores files to the Windows start menu directory

Creates a process in suspended mode (likely to inject code)

Abnormal high CPU Usage

Classification

Process Tree

System is w10x64

cA3HKPci26.exe (PID: 4632 cmdline: 'C:\Users\user\Desktop\cA3HKPci26.exe' MD5: A20E47D870F92C1787BC4A5622586859)

cmd.exe (PID: 6692 cmdline: 'C:\Windows\System32\cmd.exe' /C cd C:\Users\user\Desktop & s.bat MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 5660 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

vssadmin.exe (PID: 5436 cmdline: vssadmin.exe Delete Shadows /All /Quiet MD5: 47D51216EF45075B5F7EAA117CC70E40)

notepad.exe (PID: 1744 cmdline: 'C:\Windows\system32\NOTEPAD.EXE' C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\readMe!.txt MD5: BB9A06B8F2DD9D24C77F389D7B2B58D2)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Initial Sample

Source	Rule	Description	Author	Strings
cA3HKPci26.exe	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0x6c54:$s1: http:// 0x278:$s2: \x0C\x10\x10\x14\x17^KK 0x6c54:$f1: http://

Sigma Overview

System Summary:

Sigma detected: Shadow Copies Deletion Using Operating Systems Utilities

Show sources

Source: Process started

Author: Florian Roth, Michael Haag, Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community, Andreas Hunkeler (@Karneades): Data: Command: vssadmin.exe Delete Shadows /All /Quiet, CommandLine: vssadmin.exe Delete Shadows /All /Quiet, CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\vssadmin.exe, NewProcessName: C:\Windows\System32\vssadmin.exe, OriginalFileName: C:\Windows\System32\vssadmin.exe, ParentCommandLine: 'C:\Windows\System32\cmd.exe' /C cd C:\Users\user\Desktop & s.bat, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6692, ProcessCommandLine: vssadmin.exe Delete Shadows /All /Quiet, ProcessId: 5436

Sigma detected: Copying Sensitive Files with Credential Data

Show sources

Source: Process started

Author: Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community: Data: Command: vssadmin.exe Delete Shadows /All /Quiet, CommandLine: vssadmin.exe Delete Shadows /All /Quiet, CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\vssadmin.exe, NewProcessName: C:\Windows\System32\vssadmin.exe, OriginalFileName: C:\Windows\System32\vssadmin.exe, ParentCommandLine: 'C:\Windows\System32\cmd.exe' /C cd C:\Users\user\Desktop & s.bat, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6692, ProcessCommandLine: vssadmin.exe Delete Shadows /All /Quiet, ProcessId: 5436

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Multi AV Scanner detection for submitted file

Show sources

Source: cA3HKPci26.exe

Virustotal: Detection: 29%

Perma Link

Machine Learning detection for sample

Show sources

Source: cA3HKPci26.exe

Joe Sandbox ML: detected

Source: cA3HKPci26.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\$Recycle.Bin\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\$Recycle.Bin\S-1-5-18\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\$Recycle.Bin\S-1-5-21-3853321935-2125563209-4053062332-1000\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\$Recycle.Bin\S-1-5-21-3853321935-2125563209-4053062332-1001\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\$Recycle.Bin\S-1-5-21-3853321935-2125563209-4053062332-1002\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Adobe\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Adobe\ARM\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Adobe\ARM\Reader_19.012.20034\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Adobe\ARM\Reader_19.012.20035\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Adobe\ARM\S\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Adobe\Setup\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\dbg\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Desktop\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents\My Music\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents\My Pictures\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents\My Videos\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\AppV\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\AppV\Setup\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Crypto\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Crypto\DSS\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Crypto\Keys\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Crypto\PCPKSP\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Crypto\RSA\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\DeviceSync\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\DRM\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\DRM\Server\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\IdentityCRL\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\MapData\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\MF\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Network\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OFFICE\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Settings\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\SmsRouter\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Spectrum\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Speech_OneCore\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Storage Health\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\UEV\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\UEV\Scripts\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\UEV\Templates\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Vault\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\WDF\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Caches\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft Help\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft OneDrive\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft OneDrive\setup\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Oracle\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Oracle\Java\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Oracle\Java\installcache\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\SoftwareDistribution\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Templates\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\USOPrivate\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\USOPrivate\UpdateStore\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\USOShared\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\USOShared\Logs\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Crypto\DSS\MachineKeys\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Crypto\PCPKSP\WindowsAIK\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Crypto\RSA\MachineKeys\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Crypto\SystemKeys\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Device\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Task\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\AsimovUploader\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\CustomTraceProfiles\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\DownloadedScenarios\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\DownloadedSettings\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\ETLLogs\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\ETLLogs\AutoLogger\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\EventTranscript\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\LocalTraceStore\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\OfflineSettings\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\Scripts\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\Sideload\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\Siufloc\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\SoftLanding\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\SoftLandingStage\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\TenantStorage\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\WindowsAnalytics\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\IdentityCRL\INT\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\IdentityCRL\production\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\IdentityCRL\production\temp\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Network\Connections\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Network\Downloader\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OFFICE\Heartbeat\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\AssetCache\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Temp\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Temp\usgthrsvc\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Settings\Accounts\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\SmsRouter\MessageStore\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\UEV\InboxTemplates\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\User Account Pictures\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\GenuineTicket\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Import\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Install\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Install\Apps\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\DeviceMetadataCache\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\DeviceMetadataStore\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\GameExplorer\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\LfSvc\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\LfSvc\Cache\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\LfSvc\Geofence\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Parental Controls\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Ringtones\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Sqm\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Sqm\Manifest\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Sqm\Sessions\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Sqm\Upload\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu Places\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WER\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WER\ReportArchive\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WER\ReportQueue\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WER\Temp\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\wfp\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Clean Store\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Features\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\LocalCopy\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\regid.1991-06.com.microsoft\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessibility\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Administrative Tools\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\AutoIt v3\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\AutoIt v3\Extras\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Java\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Maintenance\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\StartUp\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\System Tools\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\WindowsHolographicDevices\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\WindowsHolographicDevices\SpatialStore\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\ETLLogs\ScenarioShutdownLogger\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\ETLLogs\ShutdownLogger\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\AssetCache\CellularUx\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Config\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\GatherLogs\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Vault\AC658CB4-9126-49BD-B877-31EEDAB3F204\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\KeyHolder\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Install\Migration\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\DeviceMetadataCache\dmrccache\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\DeviceMetadataCache\dmrccache\downloads\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\DeviceMetadataStore\en-US\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Parental Controls\settings\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Power Efficiency Diagnostics\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Definition Updates\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Definition Updates\Backup\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Definition Updates\Default\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Definition Updates\NisBackup\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Definition Updates\Updates\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Network Inspection System\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Quarantine\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\BackupStore\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\CacheManager\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\ReportLatency\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Results\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Results\Resource\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Service\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Store\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Support\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender Advanced Threat Protection\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender Advanced Threat Protection\Temp\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows NT\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows NT\MSFax\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows NT\MSFax\ActivityLog\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows NT\MSFax\Common Coverpages\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows NT\MSFax\Common Coverpages\en-US\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows NT\MSFax\Inbox\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows NT\MSFax\Queue\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows NT\MSFax\SentItems\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows NT\MSFax\VirtualInbox\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows NT\MSFax\VirtualInbox\en-US\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows NT\MSScan\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Security Health\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Security Health\Logs\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\WinMSIPC\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\WinMSIPC\Server\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\WwanSvc\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{49697869-be8e-427d-81a0-c334d1d14950}\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\System Tools\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\AutoIt v3\Extras\AutoItX\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Microsoft Office 2016 Tools\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-US\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\Prov\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\Prov\RunTime\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{1e05dd5d-a022-46c5-963c-b20de341170f}\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{1e05dd5d-a022-46c5-963c-b20de341170f}\Prov\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{1e05dd5d-a022-46c5-963c-b20de341170f}\Prov\RunTime\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{23cb517f-5073-4e96-a202-7fe6122a2271}\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{23cb517f-5073-4e96-a202-7fe6122a2271}\Prov\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{23cb517f-5073-4e96-a202-7fe6122a2271}\Prov\RunTime\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\Prov\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\Prov\RunTime\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\Prov\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\Prov\RunTime\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\Prov\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\Prov\RunTime\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\Prov\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\Prov\RunTime\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\Prov\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\Prov\RunTime\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\Prov\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\Prov\RunTime\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{99b095d8-5959-4820-bea7-7448c8427b4e}\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{99b095d8-5959-4820-bea7-7448c8427b4e}\Prov\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{99b095d8-5959-4820-bea7-7448c8427b4e}\Prov\RunTime\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\Prov\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\Prov\RunTime\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\Prov\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\Prov\RunTime\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\Prov\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\Prov\RunTime\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{bf56ce5a-946b-45b5-858a-1794eb0125e2}\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{bf56ce5a-946b-45b5-858a-1794eb0125e2}\Prov\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{bf56ce5a-946b-45b5-858a-1794eb0125e2}\Prov\RunTime\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{c5dc3753-b6c8-4057-b396-bf13d769311c}\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{c5dc3753-b6c8-4057-b396-bf13d769311c}\Prov\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{c5dc3753-b6c8-4057-b396-bf13d769311c}\Prov\RunTime\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{c8a326e4-f518-4f14-b543-97a57e1a975e}\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{c8a326e4-f518-4f14-b543-97a57e1a975e}\Prov\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{c8a326e4-f518-4f14-b543-97a57e1a975e}\Prov\RunTime\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{ee4aac98-c174-4941-82b1-d121e493e4fb}\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{ee4aac98-c174-4941-82b1-d121e493e4fb}\Prov\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{ee4aac98-c174-4941-82b1-d121e493e4fb}\Prov\RunTime\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\Prov\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\Prov\RunTime\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\Prov\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\Prov\RunTime\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SecStore\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Network Inspection System\Support\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\ReportLatency\Latency\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\ReportLatency\Latency\19\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{12578975-C765-4BDF-8DDC-3284BC0E855F}v14.21.27702\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{12578975-C765-4BDF-8DDC-3284BC0E855F}v14.21.27702\packages\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\packages\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{19F7E289-17B8-44EC-A099-927507B6F739}v14.21.27702\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{19F7E289-17B8-44EC-A099-927507B6F739}v14.21.27702\packages\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{213668DB-2263-4E2D-ABB8-487FD539130E}v14.21.27702\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{213668DB-2263-4E2D-ABB8-487FD539130E}v14.21.27702\packages\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\packages\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\packages\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\packages\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\packages\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\packages\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\packages\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{F7CAC7DF-3524-4C2D-A7DB-E16140A3D5E6}v14.21.27702\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{F7CAC7DF-3524-4C2D-A7DB-E16140A3D5E6}v14.21.27702\packages\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\packages\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Definition Updates\{186FBBD0-81E5-4485-9A0B-058B395708F3}\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{12578975-C765-4BDF-8DDC-3284BC0E855F}v14.21.27702\packages\vcRuntimeAdditional_amd64\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\packages\vcRuntimeMinimum_x86\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{19F7E289-17B8-44EC-A099-927507B6F739}v14.21.27702\packages\vcRuntimeMinimum_x86\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{213668DB-2263-4E2D-ABB8-487FD539130E}v14.21.27702\packages\vcRuntimeAdditional_x86\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\packages\vcRuntimeAdditional_amd64\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\packages\vcRuntimeAdditional_amd64\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\packages\vcRuntimeMinimum_amd64\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\packages\vcRuntimeAdditional_x86\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\packages\vcRuntimeMinimum_x86\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\packages\vcRuntimeMinimum_amd64\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{F7CAC7DF-3524-4C2D-A7DB-E16140A3D5E6}v14.21.27702\packages\vcRuntimeMinimum_amd64\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\packages\vcRuntimeAdditional_x86\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_b187e4484c4831a1fe7677975c9505e17d6a36e_76d002fb_06ec5ec9\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_b187e4484c4831a1fe7677975c9505e17d6a36e_76d002fb_08c03c3d\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_b187e4484c4831a1fe7677975c9505e17d6a36e_76d002fb_09a460dc\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_b187e4484c4831a1fe7677975c9505e17d6a36e_76d002fb_0a8180d0\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_b187e4484c4831a1fe7677975c9505e17d6a36e_76d002fb_0b6c517b\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_b187e4484c4831a1fe7677975c9505e17d6a36e_76d002fb_0b8c4c0c\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_b187e4484c4831a1fe7677975c9505e17d6a36e_76d002fb_0f4939b5\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_b187e4484c4831a1fe7677975c9505e17d6a36e_76d002fb_12643e03\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_b187e4484c4831a1fe7677975c9505e17d6a36e_76d002fb_128043b0\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_b187e4484c4831a1fe7677975c9505e17d6a36e_76d002fb_13494425\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_b187e4484c4831a1fe7677975c9505e17d6a36e_76d002fb_13748f6e\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_b187e4484c4831a1fe7677975c9505e17d6a36e_76d002fb_138c4769\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_b187e4484c4831a1fe7677975c9505e17d6a36e_76d002fb_13cc4a57\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_b187e4484c4831a1fe7677975c9505e17d6a36e_76d002fb_15887bb7\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_b187e4484c4831a1fe7677975c9505e17d6a36e_76d002fb_15f6da80\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_b187e4484c4831a1fe7677975c9505e17d6a36e_76d002fb_169039cc\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_b187e4484c4831a1fe7677975c9505e17d6a36e_76d002fb_18713e87\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WER\ReportQueue\NonCritical_10.0.17134.1_3b14d13aed986ad7ce8ed84862a7c39c2972e_00000000_0f243638\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WER\ReportQueue\NonCritical_10.0.17134.1_59c14d4512be5b58e3be16cb2633ba5cb7a7ee0_00000000_056041eb\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WER\ReportQueue\NonCritical_10.0.17134.1_59c14d4512be5b58e3be16cb2633ba5cb7a7ee0_00000000_05f85294\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WER\ReportQueue\NonCritical_10.0.17134.1_9c1477dd5bdcc59dfc815b2942263c50f1622656_00000000_0eef26d2\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\Local\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\CloudStore\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCache\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCookies\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Shell\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Sidebar\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\InputPersonalization\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\GameExplorer\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WinX\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WinX\Group1\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WinX\Group2\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WinX\Group3\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Sidebar\Gadgets\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\InputPersonalization\TrainedDataStore\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\Roaming\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\Roaming\Microsoft\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\Roaming\Microsoft\Internet Explorer\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\Roaming\Microsoft\Windows\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\Roaming\Microsoft\Windows\CloudStore\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\Roaming\Microsoft\Windows\Network Shortcuts\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\Roaming\Microsoft\Windows\Recent\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\Roaming\Microsoft\Windows\SendTo\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\Roaming\Microsoft\Windows\Start Menu\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\Roaming\Microsoft\Windows\Templates\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\Desktop\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\Documents\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\Documents\My Music\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\Documents\My Pictures\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\Documents\My Videos\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\Downloads\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\Favorites\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\Links\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\Saved Games\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\3D Objects\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Adobe\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Adobe\Acrobat\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Adobe\Acrobat\DC\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Adobe\Acrobat\DC\Cache\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Adobe\ARM\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Adobe\ARM\Reader_19.012.20035\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Adobe\ARM\S\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Adobe\Color\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Adobe\Color\Profiles\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\Unistore\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\D3DSCache\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\DBG\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\Low\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft Help\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\MicrosoftEdge\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\PeerDistRepub\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Publishers\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Low\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\VirtualStore\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\Unistore\data\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\UnistoreDB\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\ConnectedDevicesPlatform\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\D3DSCache\e8010882af4f153f\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\Low\History.IE5\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\CLR_v2.0\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\CLR_v2.0\UsageLogs\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\CLR_v2.0_32\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\CLR_v2.0_32\UsageLogs\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\CLR_v4.0\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\CLR_v4.0\UsageLogs\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\CLR_v4.0_32\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\CLR_v4.0_32\UsageLogs\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Credentials\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\GameDVR\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\af-ZA\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ar-AE\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ar-BH\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ar-DZ\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ar-EG\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ar-IQ\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ar-JO\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ar-KW\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ar-LB\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ar-LY\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ar-MA\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ar-OM\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ar-QA\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ar-SA\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ar-SY\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ar-TN\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ar-YE\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\az-Latn-AZ\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\bg-BG\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\bn-BD\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ca-ES\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\cs-CZ\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\da-DK\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\de-AT\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\de-CH\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\de-DE\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\de-LI\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\de-LU\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\el-GR\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\en-029\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\en-AU\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\en-BZ\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\en-CA\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\en-GB\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\en-HK\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\en-ID\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\en-IE\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\en-IN\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\en-JM\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\en-MY\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\en-NZ\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\en-SG\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\en-TT\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\en-ZA\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\en-ZW\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-419\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-AR\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-BO\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-CL\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-CO\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-CR\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-DO\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-EC\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-ES\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-GT\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-HN\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-MX\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-NI\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-PA\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-PE\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-PR\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-PY\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-SV\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-US\readMe!.txt	Jump to behavior

Source: C:\Users\user\Desktop\cA3HKPci26.exe

File opened: C:\Windows\WinSxS\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_88df21dd2faf7c49\MSVCR80.dll

Jump to behavior

Source: cA3HKPci26.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: cA3HKPci26.exe, 00000000.00000003.657704086.000000001BDFD000.00000004.00000001.sdmp, cA3HKPci26.exe, 00000000.00000003.658532627.000000001BDFD000.00000004.00000001.sdmp	String found in binary or memory: http://en.w
Source: cA3HKPci26.exe, 00000000.00000003.658396718.000000001BE0B000.00000004.00000001.sdmp	String found in binary or memory: http://en.wikip
Source: cA3HKPci26.exe, 00000000.00000003.662252207.000000001BE0F000.00000004.00000001.sdmp	String found in binary or memory: http://www.ascendercorp.com/typedesigners.html
Source: cA3HKPci26.exe, 00000000.00000003.659744681.000000001BDFD000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.com
Source: cA3HKPci26.exe, 00000000.00000003.669689753.000000001BDFD000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: cA3HKPci26.exe, 00000000.00000003.670772289.000000001BDFD000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com&
Source: cA3HKPci26.exe, 00000000.00000003.673352305.000000001BE22000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.html
Source: cA3HKPci26.exe, 00000000.00000003.670625995.000000001BE22000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: cA3HKPci26.exe, 00000000.00000003.670625995.000000001BE22000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.htmlP
Source: cA3HKPci26.exe, 00000000.00000003.673512866.000000001BDFD000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com8A
Source: cA3HKPci26.exe, 00000000.00000003.673491041.000000001BDFD000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comTF
Source: cA3HKPci26.exe, 00000000.00000003.673281162.000000001BDFD000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comalic
Source: cA3HKPci26.exe, 00000000.00000003.669758097.000000001BDFD000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comessed
Source: cA3HKPci26.exe, 00000000.00000003.669090141.000000001BDFD000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comhavoitu
Source: cA3HKPci26.exe, 00000000.00000003.669635053.000000001BDFD000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comue
Source: cA3HKPci26.exe, 00000000.00000003.669758097.000000001BDFD000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comva
Source: cA3HKPci26.exe, 00000000.00000003.669689753.000000001BDFD000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comwa
Source: cA3HKPci26.exe, 00000000.00000003.670886115.000000001BDFD000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comx
Source: cA3HKPci26.exe, 00000000.00000003.659243556.000000001BDFD000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: cA3HKPci26.exe, 00000000.00000003.658889601.000000001BDFC000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/
Source: cA3HKPci26.exe, 00000000.00000003.659104890.000000001BDFC000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cnr
Source: cA3HKPci26.exe, 00000000.00000003.659243556.000000001BDFD000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cntu
Source: cA3HKPci26.exe, 00000000.00000003.658889601.000000001BDFC000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/m
Source: cA3HKPci26.exe, 00000000.00000003.659055285.000000001BDFC000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cna
Source: cA3HKPci26.exe, 00000000.00000003.659104890.000000001BDFC000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cnl
Source: cA3HKPci26.exe, 00000000.00000003.659180148.000000001BDFC000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cnm
Source: cA3HKPci26.exe, 00000000.00000003.659055285.000000001BDFC000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cnr
Source: cA3HKPci26.exe, 00000000.00000003.677970735.000000001BDFD000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/
Source: cA3HKPci26.exe, 00000000.00000003.677970735.000000001BDFD000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: cA3HKPci26.exe, 00000000.00000003.677970735.000000001BDFD000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/y
Source: cA3HKPci26.exe, 00000000.00000003.658786917.000000001BDFC000.00000004.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: cA3HKPci26.exe, 00000000.00000003.658786917.000000001BDFC000.00000004.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr&=
Source: cA3HKPci26.exe, 00000000.00000003.658786917.000000001BDFC000.00000004.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kral
Source: cA3HKPci26.exe, 00000000.00000003.660022837.000000001BDFD000.00000004.00000001.sdmp, cA3HKPci26.exe, 00000000.00000003.660247180.000000001BDFC000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: cA3HKPci26.exe, 00000000.00000003.660675266.000000001BDFC000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/(9
Source: cA3HKPci26.exe, 00000000.00000003.660022837.000000001BDFD000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/F
Source: cA3HKPci26.exe, 00000000.00000003.660022837.000000001BDFD000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/HI
Source: cA3HKPci26.exe, 00000000.00000003.661575036.000000001BDFD000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp
Source: cA3HKPci26.exe, 00000000.00000003.661891366.000000001BDFD000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: cA3HKPci26.exe, 00000000.00000003.661891366.000000001BDFD000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/ywa
Source: cA3HKPci26.exe, 00000000.00000003.661891366.000000001BDFD000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/r
Source: cA3HKPci26.exe, 00000000.00000003.660022837.000000001BDFD000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/x
Source: cA3HKPci26.exe, 00000000.00000003.661192220.000000001BDFC000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/ywa
Source: cA3HKPci26.exe, 00000000.00000003.682926943.000000001BDFD000.00000004.00000001.sdmp	String found in binary or memory: http://www.monotype.
Source: cA3HKPci26.exe, 00000000.00000003.657551220.000000001BE01000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: cA3HKPci26.exe, 00000000.00000003.658843541.000000001BDFC000.00000004.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kral
Source: cA3HKPci26.exe, 00000000.00000003.659695755.000000001BDFD000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: cA3HKPci26.exe, 00000000.00000003.659695755.000000001BDFD000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.comL
Source: cA3HKPci26.exe, 00000000.00000003.659744681.000000001BDFD000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.comic
Source: cA3HKPci26.exe, 00000000.00000003.658154503.000000001BDFD000.00000004.00000001.sdmp	String found in binary or memory: http://www.typography.net
Source: cA3HKPci26.exe, 00000000.00000003.658154503.000000001BDFD000.00000004.00000001.sdmp	String found in binary or memory: http://www.typography.netF
Source: cA3HKPci26.exe, 00000000.00000003.667166585.000000001BDFD000.00000004.00000001.sdmp	String found in binary or memory: http://www.urwpp.de2
Source: cA3HKPci26.exe, 00000000.00000003.659571393.000000001BE01000.00000004.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: cA3HKPci26.exe, 00000000.00000003.659571393.000000001BE01000.00000004.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cnva
Source: cA3HKPci26.exe, 00000000.00000003.659571393.000000001BE01000.00000004.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cnx

Spam, unwanted Advertisements and Ransom Demands:

May disable shadow drive data (uses vssadmin)

Show sources

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin.exe Delete Shadows /All /Quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin.exe Delete Shadows /All /Quiet			Jump to behavior

Deletes shadow drive data (may be related to ransomware)

Show sources

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin.exe Delete Shadows /All /Quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin.exe Delete Shadows /All /Quiet	Jump to behavior
Source: vssadmin.exe, 00000006.00000002.701220420.00000170AFA20000.00000004.00000020.sdmp	Binary or memory string: C:\Users\user\Desktop\C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /All /Quietvssadmin.exe Delete Shadows /All /QuietWinsta0\Default
Source: vssadmin.exe, 00000006.00000002.701220420.00000170AFA20000.00000004.00000020.sdmp	Binary or memory string: vssadmin.exe Delete Shadows /All /Quiet
Source: vssadmin.exe, 00000006.00000002.701220420.00000170AFA20000.00000004.00000020.sdmp	Binary or memory string: vssadmin.exe Delete Shadows /All /Quiet[0
Source: vssadmin.exe, 00000006.00000002.701284819.00000170AFCA5000.00000004.00000040.sdmp	Binary or memory string: vssadmin.exeDeleteShadows/All/Quietg
Source: s.bat.0.dr	Binary or memory string: vssadmin.exe Delete Shadows /All /Quiet

System Summary:

Source: cA3HKPci26.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: cA3HKPci26.exe, type: SAMPLE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 0.0.cA3HKPci26.exe.d50000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27

Source: cA3HKPci26.exe, 00000000.00000000.655199988.0000000000D58000.00000002.00020000.sdmp	Binary or memory string: OriginalFilename4 vs cA3HKPci26.exe
Source: cA3HKPci26.exe	Binary or memory string: OriginalFilename4 vs cA3HKPci26.exe

Source: C:\Users\user\Desktop\cA3HKPci26.exe

Process Stats: CPU usage > 98%

Source: cA3HKPci26.exe

Virustotal: Detection: 29%

Source: cA3HKPci26.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\vssadmin.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\cA3HKPci26.exe 'C:\Users\user\Desktop\cA3HKPci26.exe'
Source: C:\Users\user\Desktop\cA3HKPci26.exe	Process created: C:\Windows\System32\cmd.exe 'C:\Windows\System32\cmd.exe' /C cd C:\Users\user\Desktop & s.bat
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin.exe Delete Shadows /All /Quiet
Source: unknown	Process created: C:\Windows\System32\notepad.exe 'C:\Windows\system32\NOTEPAD.EXE' C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\readMe!.txt
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin.exe Delete Shadows /All /Quiet	Jump to behavior

Source: C:\Windows\System32\vssadmin.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F2C2787D-95AB-40D4-942D-298F5F757874}\InProcServer32

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5660:120:WilError_01

Source: cA3HKPci26.exe, 00000000.00000003.680638165.000000001BDFD000.00000004.00000001.sdmp	Binary or memory string: is a trademark of The Monotype Corporation, Inc. which may be registered in certain jurisdictions.slntqv)M
Source: cA3HKPci26.exe, 00000000.00000003.680855738.000000001BDFD000.00000004.00000001.sdmp	Binary or memory string: is a trademark of The Monotype Corporation, Inc. which may be registered in certain jurisdictions.slnt
Source: cA3HKPci26.exe, 00000000.00000003.681152135.000000001BDFD000.00000004.00000001.sdmp	Binary or memory string: .slnt

Source: C:\Users\user\Desktop\cA3HKPci26.exe

File created: C:\Users\user\Desktop\s.bat

Jump to behavior

Source: C:\Users\user\Desktop\cA3HKPci26.exe

File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\IdentityCRL\production\temp\readMe!.txt

Jump to behavior

Source: C:\Users\user\Desktop\cA3HKPci26.exe

Process created: C:\Windows\System32\cmd.exe 'C:\Windows\System32\cmd.exe' /C cd C:\Users\user\Desktop & s.bat

Source: classification engine

Classification label: mal84.rans.evad.winEXE@6/1102@0/0

Source: cA3HKPci26.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: C:\Users\user\Desktop\cA3HKPci26.exe

File opened: C:\Windows\WinSxS\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_88df21dd2faf7c49\MSVCR80.dll

Jump to behavior

Source: cA3HKPci26.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\$Recycle.Bin\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\$Recycle.Bin\S-1-5-18\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\$Recycle.Bin\S-1-5-21-3853321935-2125563209-4053062332-1000\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\$Recycle.Bin\S-1-5-21-3853321935-2125563209-4053062332-1001\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\$Recycle.Bin\S-1-5-21-3853321935-2125563209-4053062332-1002\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Adobe\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Adobe\ARM\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Adobe\ARM\Reader_19.012.20034\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Adobe\ARM\Reader_19.012.20035\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Adobe\ARM\S\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Adobe\Setup\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\dbg\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Desktop\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents\My Music\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents\My Pictures\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents\My Videos\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\AppV\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\AppV\Setup\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Crypto\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Crypto\DSS\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Crypto\Keys\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Crypto\PCPKSP\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Crypto\RSA\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\DeviceSync\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\DRM\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\DRM\Server\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\IdentityCRL\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\MapData\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\MF\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Network\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OFFICE\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Settings\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\SmsRouter\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Spectrum\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Speech_OneCore\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Storage Health\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\UEV\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\UEV\Scripts\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\UEV\Templates\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Vault\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\WDF\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Caches\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft Help\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft OneDrive\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft OneDrive\setup\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Oracle\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Oracle\Java\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Oracle\Java\installcache\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\SoftwareDistribution\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Templates\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\USOPrivate\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\USOPrivate\UpdateStore\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\USOShared\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\USOShared\Logs\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Crypto\DSS\MachineKeys\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Crypto\PCPKSP\WindowsAIK\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Crypto\RSA\MachineKeys\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Crypto\SystemKeys\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Device\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Task\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\AsimovUploader\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\CustomTraceProfiles\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\DownloadedScenarios\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\DownloadedSettings\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\ETLLogs\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\ETLLogs\AutoLogger\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\EventTranscript\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\LocalTraceStore\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\OfflineSettings\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\Scripts\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\Sideload\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\Siufloc\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\SoftLanding\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\SoftLandingStage\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\TenantStorage\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\WindowsAnalytics\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\IdentityCRL\INT\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\IdentityCRL\production\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\IdentityCRL\production\temp\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Network\Connections\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Network\Downloader\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OFFICE\Heartbeat\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\AssetCache\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Temp\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Temp\usgthrsvc\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Settings\Accounts\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\SmsRouter\MessageStore\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\UEV\InboxTemplates\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\User Account Pictures\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\GenuineTicket\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Import\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Install\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Install\Apps\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\DeviceMetadataCache\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\DeviceMetadataStore\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\GameExplorer\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\LfSvc\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\LfSvc\Cache\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\LfSvc\Geofence\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Parental Controls\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Ringtones\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Sqm\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Sqm\Manifest\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Sqm\Sessions\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Sqm\Upload\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu Places\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WER\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WER\ReportArchive\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WER\ReportQueue\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WER\Temp\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\wfp\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Clean Store\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Features\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\LocalCopy\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\regid.1991-06.com.microsoft\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessibility\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Administrative Tools\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\AutoIt v3\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\AutoIt v3\Extras\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Java\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Maintenance\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\StartUp\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\System Tools\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\WindowsHolographicDevices\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\WindowsHolographicDevices\SpatialStore\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\ETLLogs\ScenarioShutdownLogger\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\ETLLogs\ShutdownLogger\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\AssetCache\CellularUx\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Config\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\GatherLogs\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Vault\AC658CB4-9126-49BD-B877-31EEDAB3F204\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\KeyHolder\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Install\Migration\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\DeviceMetadataCache\dmrccache\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\DeviceMetadataCache\dmrccache\downloads\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\DeviceMetadataStore\en-US\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Parental Controls\settings\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Power Efficiency Diagnostics\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Definition Updates\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Definition Updates\Backup\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Definition Updates\Default\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Definition Updates\NisBackup\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Definition Updates\Updates\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Network Inspection System\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Quarantine\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\BackupStore\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\CacheManager\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\ReportLatency\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Results\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Results\Resource\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Service\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Store\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Support\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender Advanced Threat Protection\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender Advanced Threat Protection\Temp\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows NT\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows NT\MSFax\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows NT\MSFax\ActivityLog\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows NT\MSFax\Common Coverpages\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows NT\MSFax\Common Coverpages\en-US\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows NT\MSFax\Inbox\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows NT\MSFax\Queue\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows NT\MSFax\SentItems\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows NT\MSFax\VirtualInbox\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows NT\MSFax\VirtualInbox\en-US\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows NT\MSScan\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Security Health\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Security Health\Logs\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\WinMSIPC\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\WinMSIPC\Server\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\WwanSvc\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{49697869-be8e-427d-81a0-c334d1d14950}\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\System Tools\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\AutoIt v3\Extras\AutoItX\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Microsoft Office 2016 Tools\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-US\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\Prov\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\Prov\RunTime\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{1e05dd5d-a022-46c5-963c-b20de341170f}\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{1e05dd5d-a022-46c5-963c-b20de341170f}\Prov\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{1e05dd5d-a022-46c5-963c-b20de341170f}\Prov\RunTime\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{23cb517f-5073-4e96-a202-7fe6122a2271}\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{23cb517f-5073-4e96-a202-7fe6122a2271}\Prov\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{23cb517f-5073-4e96-a202-7fe6122a2271}\Prov\RunTime\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\Prov\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\Prov\RunTime\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\Prov\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\Prov\RunTime\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\Prov\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\Prov\RunTime\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\Prov\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\Prov\RunTime\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\Prov\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\Prov\RunTime\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\Prov\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\Prov\RunTime\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{99b095d8-5959-4820-bea7-7448c8427b4e}\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{99b095d8-5959-4820-bea7-7448c8427b4e}\Prov\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{99b095d8-5959-4820-bea7-7448c8427b4e}\Prov\RunTime\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\Prov\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\Prov\RunTime\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\Prov\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\Prov\RunTime\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\Prov\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\Prov\RunTime\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{bf56ce5a-946b-45b5-858a-1794eb0125e2}\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{bf56ce5a-946b-45b5-858a-1794eb0125e2}\Prov\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{bf56ce5a-946b-45b5-858a-1794eb0125e2}\Prov\RunTime\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{c5dc3753-b6c8-4057-b396-bf13d769311c}\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{c5dc3753-b6c8-4057-b396-bf13d769311c}\Prov\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{c5dc3753-b6c8-4057-b396-bf13d769311c}\Prov\RunTime\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{c8a326e4-f518-4f14-b543-97a57e1a975e}\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{c8a326e4-f518-4f14-b543-97a57e1a975e}\Prov\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{c8a326e4-f518-4f14-b543-97a57e1a975e}\Prov\RunTime\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{ee4aac98-c174-4941-82b1-d121e493e4fb}\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{ee4aac98-c174-4941-82b1-d121e493e4fb}\Prov\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{ee4aac98-c174-4941-82b1-d121e493e4fb}\Prov\RunTime\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\Prov\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\Prov\RunTime\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\Prov\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\Prov\RunTime\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SecStore\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Network Inspection System\Support\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\ReportLatency\Latency\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\ReportLatency\Latency\19\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{12578975-C765-4BDF-8DDC-3284BC0E855F}v14.21.27702\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{12578975-C765-4BDF-8DDC-3284BC0E855F}v14.21.27702\packages\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\packages\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{19F7E289-17B8-44EC-A099-927507B6F739}v14.21.27702\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{19F7E289-17B8-44EC-A099-927507B6F739}v14.21.27702\packages\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{213668DB-2263-4E2D-ABB8-487FD539130E}v14.21.27702\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{213668DB-2263-4E2D-ABB8-487FD539130E}v14.21.27702\packages\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\packages\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\packages\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\packages\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\packages\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\packages\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\packages\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{F7CAC7DF-3524-4C2D-A7DB-E16140A3D5E6}v14.21.27702\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{F7CAC7DF-3524-4C2D-A7DB-E16140A3D5E6}v14.21.27702\packages\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\packages\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Definition Updates\{186FBBD0-81E5-4485-9A0B-058B395708F3}\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{12578975-C765-4BDF-8DDC-3284BC0E855F}v14.21.27702\packages\vcRuntimeAdditional_amd64\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\packages\vcRuntimeMinimum_x86\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{19F7E289-17B8-44EC-A099-927507B6F739}v14.21.27702\packages\vcRuntimeMinimum_x86\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{213668DB-2263-4E2D-ABB8-487FD539130E}v14.21.27702\packages\vcRuntimeAdditional_x86\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\packages\vcRuntimeAdditional_amd64\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\packages\vcRuntimeAdditional_amd64\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\packages\vcRuntimeMinimum_amd64\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\packages\vcRuntimeAdditional_x86\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\packages\vcRuntimeMinimum_x86\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\packages\vcRuntimeMinimum_amd64\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{F7CAC7DF-3524-4C2D-A7DB-E16140A3D5E6}v14.21.27702\packages\vcRuntimeMinimum_amd64\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\packages\vcRuntimeAdditional_x86\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_b187e4484c4831a1fe7677975c9505e17d6a36e_76d002fb_06ec5ec9\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_b187e4484c4831a1fe7677975c9505e17d6a36e_76d002fb_08c03c3d\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_b187e4484c4831a1fe7677975c9505e17d6a36e_76d002fb_09a460dc\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_b187e4484c4831a1fe7677975c9505e17d6a36e_76d002fb_0a8180d0\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_b187e4484c4831a1fe7677975c9505e17d6a36e_76d002fb_0b6c517b\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_b187e4484c4831a1fe7677975c9505e17d6a36e_76d002fb_0b8c4c0c\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_b187e4484c4831a1fe7677975c9505e17d6a36e_76d002fb_0f4939b5\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_b187e4484c4831a1fe7677975c9505e17d6a36e_76d002fb_12643e03\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_b187e4484c4831a1fe7677975c9505e17d6a36e_76d002fb_128043b0\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_b187e4484c4831a1fe7677975c9505e17d6a36e_76d002fb_13494425\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_b187e4484c4831a1fe7677975c9505e17d6a36e_76d002fb_13748f6e\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_b187e4484c4831a1fe7677975c9505e17d6a36e_76d002fb_138c4769\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_b187e4484c4831a1fe7677975c9505e17d6a36e_76d002fb_13cc4a57\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_b187e4484c4831a1fe7677975c9505e17d6a36e_76d002fb_15887bb7\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_b187e4484c4831a1fe7677975c9505e17d6a36e_76d002fb_15f6da80\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_b187e4484c4831a1fe7677975c9505e17d6a36e_76d002fb_169039cc\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_b187e4484c4831a1fe7677975c9505e17d6a36e_76d002fb_18713e87\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WER\ReportQueue\NonCritical_10.0.17134.1_3b14d13aed986ad7ce8ed84862a7c39c2972e_00000000_0f243638\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WER\ReportQueue\NonCritical_10.0.17134.1_59c14d4512be5b58e3be16cb2633ba5cb7a7ee0_00000000_056041eb\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WER\ReportQueue\NonCritical_10.0.17134.1_59c14d4512be5b58e3be16cb2633ba5cb7a7ee0_00000000_05f85294\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WER\ReportQueue\NonCritical_10.0.17134.1_9c1477dd5bdcc59dfc815b2942263c50f1622656_00000000_0eef26d2\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\Local\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\CloudStore\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCache\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCookies\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Shell\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Sidebar\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\InputPersonalization\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\GameExplorer\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WinX\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WinX\Group1\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WinX\Group2\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WinX\Group3\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Sidebar\Gadgets\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\InputPersonalization\TrainedDataStore\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\Roaming\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\Roaming\Microsoft\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\Roaming\Microsoft\Internet Explorer\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\Roaming\Microsoft\Windows\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\Roaming\Microsoft\Windows\CloudStore\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\Roaming\Microsoft\Windows\Network Shortcuts\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\Roaming\Microsoft\Windows\Recent\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\Roaming\Microsoft\Windows\SendTo\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\Roaming\Microsoft\Windows\Start Menu\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\Roaming\Microsoft\Windows\Templates\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\Desktop\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\Documents\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\Documents\My Music\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\Documents\My Pictures\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\Documents\My Videos\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\Downloads\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\Favorites\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\Links\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\Saved Games\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\3D Objects\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Adobe\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Adobe\Acrobat\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Adobe\Acrobat\DC\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Adobe\Acrobat\DC\Cache\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Adobe\ARM\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Adobe\ARM\Reader_19.012.20035\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Adobe\ARM\S\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Adobe\Color\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Adobe\Color\Profiles\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\Unistore\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\D3DSCache\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\DBG\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\Low\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft Help\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\MicrosoftEdge\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\PeerDistRepub\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Publishers\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Low\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\VirtualStore\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\Unistore\data\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\UnistoreDB\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\ConnectedDevicesPlatform\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\D3DSCache\e8010882af4f153f\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\Low\History.IE5\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\CLR_v2.0\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\CLR_v2.0\UsageLogs\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\CLR_v2.0_32\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\CLR_v2.0_32\UsageLogs\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\CLR_v4.0\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\CLR_v4.0\UsageLogs\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\CLR_v4.0_32\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\CLR_v4.0_32\UsageLogs\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Credentials\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\GameDVR\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\af-ZA\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ar-AE\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ar-BH\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ar-DZ\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ar-EG\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ar-IQ\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ar-JO\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ar-KW\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ar-LB\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ar-LY\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ar-MA\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ar-OM\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ar-QA\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ar-SA\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ar-SY\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ar-TN\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ar-YE\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\az-Latn-AZ\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\bg-BG\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\bn-BD\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ca-ES\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\cs-CZ\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\da-DK\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\de-AT\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\de-CH\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\de-DE\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\de-LI\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\de-LU\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\el-GR\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\en-029\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\en-AU\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\en-BZ\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\en-CA\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\en-GB\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\en-HK\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\en-ID\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\en-IE\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\en-IN\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\en-JM\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\en-MY\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\en-NZ\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\en-SG\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\en-TT\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\en-ZA\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\en-ZW\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-419\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-AR\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-BO\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-CL\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-CO\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-CR\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-DO\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-EC\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-ES\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-GT\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-HN\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-MX\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-NI\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-PA\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-PE\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-PR\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-PY\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-SV\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-US\readMe!.txt	Jump to behavior

Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu Places\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessibility\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Administrative Tools\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\AutoIt v3\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\AutoIt v3\Extras\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Java\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Maintenance\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\StartUp\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\System Tools\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\System Tools\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\AutoIt v3\Extras\AutoItX\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Microsoft Office 2016 Tools\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\Roaming\Microsoft\Windows\Start Menu\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\readMe!.txt	Jump to behavior
Source: C:\Users\user\Desktop\cA3HKPci26.exe	File created: C:\Documents and Settings\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\readMe!.txt	Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Show sources

Source: initial sample

Icon embedded in binary file: icon matches a legit application icon: icon (3747).png

Creates files in the recycle bin to hide itself

Show sources

Source: C:\Users\user\Desktop\cA3HKPci26.exe

File created: C:\$Recycle.Bin\readMe!.txt

Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\vssadmin.exe vssadmin.exe Delete Shadows /All /Quiet

Jump to behavior

Source: notepad.exe, 00000014.00000002.1187675275.0000017478FA0000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: notepad.exe, 00000014.00000002.1187675275.0000017478FA0000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: notepad.exe, 00000014.00000002.1187675275.0000017478FA0000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: notepad.exe, 00000014.00000002.1187675275.0000017478FA0000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\notepad.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\readMe!.txt VolumeInformation			Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Scripting1	Registry Run Keys / Startup Folder1	Process Injection12	Masquerading11	OS Credential Dumping	Process Discovery1	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	Data Obfuscation	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Registry Run Keys / Startup Folder1	Process Injection12	LSASS Memory	System Information Discovery11	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Scripting1	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Hidden Files and Directories1	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	File Deletion1	LSA Secrets	Remote System Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
cA3HKPci26.exe	30%	Virustotal		Browse
cA3HKPci26.exe	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://www.founder.com.cn/cn/cntu	0%	Avira URL Cloud	safe
http://www.goodfont.co.kr&=	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/(9	0%	Avira URL Cloud	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.comL	0%	Avira URL Cloud	safe
http://www.fontbureau.comessed	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.carterandcone.com	0%	URL Reputation	safe
http://www.fontbureau.comwa	0%	Avira URL Cloud	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.typography.netF	0%	Avira URL Cloud	safe
http://www.fontbureau.com&	0%	Avira URL Cloud	safe
http://www.fontbureau.comva	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cnm	0%	URL Reputation	safe
http://www.founder.com.cn/cnl	0%	URL Reputation	safe
http://www.typography.net	0%	URL Reputation	safe
http://www.galapagosdesign.com/y	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cnr	0%	URL Reputation	safe
http://www.urwpp.de2	0%	URL Reputation	safe
http://www.founder.com.cn/cna	0%	URL Reputation	safe
http://www.ascendercorp.com/typedesigners.html	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp/ywa	0%	Avira URL Cloud	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn/m	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/HI	0%	Avira URL Cloud	safe
http://www.galapagosdesign.com/	0%	URL Reputation	safe
http://www.fontbureau.comue	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp	0%	URL Reputation	safe
http://www.zhongyicts.com.cnx	0%	Avira URL Cloud	safe
http://www.goodfont.co.kral	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/F	0%	URL Reputation	safe
http://www.fontbureau.comhavoitu	0%	Avira URL Cloud	safe
http://www.fontbureau.com8A	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/jp/	0%	URL Reputation	safe
http://en.wikip	0%	URL Reputation	safe
http://en.w	0%	URL Reputation	safe
http://www.founder.com.cn/cn/	0%	URL Reputation	safe
http://www.fontbureau.comTF	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/x	0%	URL Reputation	safe
http://www.zhongyicts.com.cnva	0%	URL Reputation	safe
http://www.sandoll.co.kral	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/r	0%	URL Reputation	safe
http://www.monotype.	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cnr	0%	Avira URL Cloud	safe
http://www.fontbureau.comalic	0%	URL Reputation	safe
http://www.fontbureau.comx	0%	URL Reputation	safe
http://www.tiro.comic	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/ywa	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.founder.com.cn/cn/cntu	cA3HKPci26.exe, 00000000.00000003.659243556.000000001BDFD000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.goodfont.co.kr&=	cA3HKPci26.exe, 00000000.00000003.658786917.000000001BDFC000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://www.jiyu-kobo.co.jp/(9	cA3HKPci26.exe, 00000000.00000003.660675266.000000001BDFC000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.tiro.com	cA3HKPci26.exe, 00000000.00000003.659695755.000000001BDFD000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.tiro.comL	cA3HKPci26.exe, 00000000.00000003.659695755.000000001BDFD000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comessed	cA3HKPci26.exe, 00000000.00000003.669758097.000000001BDFD000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.goodfont.co.kr	cA3HKPci26.exe, 00000000.00000003.658786917.000000001BDFC000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.com	cA3HKPci26.exe, 00000000.00000003.659744681.000000001BDFD000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comwa	cA3HKPci26.exe, 00000000.00000003.669689753.000000001BDFD000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sajatypeworks.com	cA3HKPci26.exe, 00000000.00000003.657551220.000000001BE01000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	cA3HKPci26.exe, 00000000.00000003.677970735.000000001BDFD000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netF	cA3HKPci26.exe, 00000000.00000003.658154503.000000001BDFD000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com&	cA3HKPci26.exe, 00000000.00000003.670772289.000000001BDFD000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://www.fontbureau.comva	cA3HKPci26.exe, 00000000.00000003.669758097.000000001BDFD000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cnm	cA3HKPci26.exe, 00000000.00000003.659180148.000000001BDFC000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cnl	cA3HKPci26.exe, 00000000.00000003.659104890.000000001BDFC000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.typography.net	cA3HKPci26.exe, 00000000.00000003.658154503.000000001BDFD000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-user.htmlP	cA3HKPci26.exe, 00000000.00000003.670625995.000000001BE22000.00000004.00000001.sdmp	false		high
http://www.galapagosdesign.com/y	cA3HKPci26.exe, 00000000.00000003.677970735.000000001BDFD000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cnr	cA3HKPci26.exe, 00000000.00000003.659055285.000000001BDFC000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.de2	cA3HKPci26.exe, 00000000.00000003.667166585.000000001BDFD000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cna	cA3HKPci26.exe, 00000000.00000003.659055285.000000001BDFC000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.ascendercorp.com/typedesigners.html	cA3HKPci26.exe, 00000000.00000003.662252207.000000001BE0F000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/jp/ywa	cA3HKPci26.exe, 00000000.00000003.661891366.000000001BDFD000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.zhongyicts.com.cn	cA3HKPci26.exe, 00000000.00000003.659571393.000000001BE01000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/m	cA3HKPci26.exe, 00000000.00000003.658889601.000000001BDFC000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/HI	cA3HKPci26.exe, 00000000.00000003.660022837.000000001BDFD000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com	cA3HKPci26.exe, 00000000.00000003.669689753.000000001BDFD000.00000004.00000001.sdmp	false		high
http://www.galapagosdesign.com/	cA3HKPci26.exe, 00000000.00000003.677970735.000000001BDFD000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comue	cA3HKPci26.exe, 00000000.00000003.669635053.000000001BDFD000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/jp	cA3HKPci26.exe, 00000000.00000003.661575036.000000001BDFD000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cnx	cA3HKPci26.exe, 00000000.00000003.659571393.000000001BE01000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.goodfont.co.kral	cA3HKPci26.exe, 00000000.00000003.658786917.000000001BDFC000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/F	cA3HKPci26.exe, 00000000.00000003.660022837.000000001BDFD000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comhavoitu	cA3HKPci26.exe, 00000000.00000003.669090141.000000001BDFD000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com8A	cA3HKPci26.exe, 00000000.00000003.673512866.000000001BDFD000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/jp/	cA3HKPci26.exe, 00000000.00000003.661891366.000000001BDFD000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://en.wikip	cA3HKPci26.exe, 00000000.00000003.658396718.000000001BE0B000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://en.w	cA3HKPci26.exe, 00000000.00000003.657704086.000000001BDFD000.00000004.00000001.sdmp, cA3HKPci26.exe, 00000000.00000003.658532627.000000001BDFD000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/	cA3HKPci26.exe, 00000000.00000003.658889601.000000001BDFC000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comTF	cA3HKPci26.exe, 00000000.00000003.673491041.000000001BDFD000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cn	cA3HKPci26.exe, 00000000.00000003.659243556.000000001BDFD000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/x	cA3HKPci26.exe, 00000000.00000003.660022837.000000001BDFD000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-user.html	cA3HKPci26.exe, 00000000.00000003.670625995.000000001BE22000.00000004.00000001.sdmp	false		high
http://www.zhongyicts.com.cnva	cA3HKPci26.exe, 00000000.00000003.659571393.000000001BE01000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.sandoll.co.kral	cA3HKPci26.exe, 00000000.00000003.658843541.000000001BDFC000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.html	cA3HKPci26.exe, 00000000.00000003.673352305.000000001BE22000.00000004.00000001.sdmp	false		high
http://www.jiyu-kobo.co.jp/r	cA3HKPci26.exe, 00000000.00000003.661891366.000000001BDFD000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.monotype.	cA3HKPci26.exe, 00000000.00000003.682926943.000000001BDFD000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/	cA3HKPci26.exe, 00000000.00000003.660022837.000000001BDFD000.00000004.00000001.sdmp, cA3HKPci26.exe, 00000000.00000003.660247180.000000001BDFC000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cnr	cA3HKPci26.exe, 00000000.00000003.659104890.000000001BDFC000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comalic	cA3HKPci26.exe, 00000000.00000003.673281162.000000001BDFD000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comx	cA3HKPci26.exe, 00000000.00000003.670886115.000000001BDFD000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.tiro.comic	cA3HKPci26.exe, 00000000.00000003.659744681.000000001BDFD000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/ywa	cA3HKPci26.exe, 00000000.00000003.661192220.000000001BDFC000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	496710
Start date:	04.10.2021
Start time:	21:05:38
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 11m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	cA3HKPci26 (renamed file extension from none to exe)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal84.rans.evad.winEXE@6/1102@0/0
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI Override analysis time to 240s for sample files taking high CPU consumption
Warnings:	Show All Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information. Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, VSSVC.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 95.100.218.79, 52.113.196.254, 20.50.102.62, 67.26.73.254, 67.26.139.254, 67.26.75.254, 8.248.149.254, 67.26.83.254, 20.54.110.249, 40.112.88.60, 2.20.178.33, 2.20.178.24, 20.82.210.154 Excluded domains from analysis (whitelisted): fg.download.windowsupdate.com.c.footprint.net, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, wu-shim.trafficmanager.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, store-images.s-microsoft.com-c.edgekey.net, ctldl.windowsupdate.com, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, a1449.dscg2.akamai.net, arc.msn.com, ris.api.iris.microsoft.com, e12564.dspb.akamaiedge.net, teams-9999.teams-msedge.net, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, store-images.s-microsoft.com, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, teams-ring.teams-9999.teams-msedge.net, img-prod-cms-rt-microsoft-com.akamaized.net, teams-ring.msedge.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information Report creation exceeded maximum time and may have missing behavior information. Report size getting too big, too many NtCreateFile calls found. Report size getting too big, too many NtOpenFile calls found. Report size getting too big, too many NtProtectVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
21:08:00	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\readMe!.txt

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\$Recycle.Bin\S-1-5-18\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Reputation:	low
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\$Recycle.Bin\S-1-5-21-3853321935-2125563209-4053062332-1000\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Reputation:	low
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\$Recycle.Bin\S-1-5-21-3853321935-2125563209-4053062332-1001\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Reputation:	low
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\$Recycle.Bin\S-1-5-21-3853321935-2125563209-4053062332-1002\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Reputation:	low
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\$Recycle.Bin\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	true
Reputation:	low
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\User Account Pictures\guest.bmp.block` (copy) Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	602201
Entropy (8bit):	0.28134963826761367
Encrypted:	false
SSDEEP:	48:Y0cy7gzQ65rJwzXfv+iwkeaG/Ni6B4vtctwsNW6B4RU4SQB5pmyhbvNSFfCXDvSo:Y0cy7k52sNW6BRg
MD5:	186AE1D82746352ACE2E04F4728B234B
SHA1:	0707595FAC257D9AF61DB793BD08CEE66385BA4A
SHA-256:	8AEE1C153C90870DDAFA279E185D1CFC3589AB2603AD5AD9904C36AA0CF54ACA
SHA-512:	314E2C98F38D9D3868C93DDCDABFA2495993E011D81924301C2667E82264F6448976B6DE3BF87AC5CBEC203B7E0901885D4EDBE03B9462390BBE054FF783CADA
Malicious:	false
Reputation:	low
Preview:	./6..1nI.N..m.1.&...A..o.......`n..$./....f.[..."t.0..-!......J.u..eY...:..../.....^...c'.=.tm....u.Vm....I.n.. .-."Z..I,.x."...#..~.e.Z.e.b....I.<..V{...s30.......MR....XV>H.A..(....ICn.Q....J.bt.c....sF..r.k...-..k...2>........e.o....{O)..$$=.......c....m..x.?.N3......0.f....rw. . ..pv.^[..>.....[..d.A....+....x.-....&..."..=.....3.@H..xQ.... ....%............a(Y.....f.i:N..RF.8Y..Y...........[.\|......a."]hA.J...9..W:....).W.#HI..Loq...@.p.....\|/;.;o.yXm%....J4..#.......>..'=.a..y=S9k.Z(...\4...(....!.1....*=x!.O........q.j ..#h.(...c........&..Tvs....(....F..^...t...(...,n.A.......m...tl.~........../.......v.f8)..z.......M8..{...ih..s.i=..I.Z.d.......?..0..zD.'"@..0>../....f.1.T...;...i...L#....A....a..]...heV.e.'.aF W2ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\User Account Pictures\guest.png.block` (copy) Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5433
Entropy (8bit):	7.845628794619717
Encrypted:	false
SSDEEP:	96:yqXnx9hcm75SM7+3r0dbrNpnGGOL79Xot5ytNT3G+MHBTLrK4ioG5K:zx9+m9Z+4VrnGGSbTW+MHBTvKTK
MD5:	9A6FA42AD336844FCB8AC4461F2720DB
SHA1:	5C4043DA4CA543B0DA9D7023B54A115A4A2F3A40
SHA-256:	8598682D334D237BA7D2C078492E8CC990269B2B5B4650DE24043CD7E6CBEE14
SHA-512:	471C5D66AD4AEEBDCCB2650B2D93842AFEDAE6EFC212FC432D3E4ED96B092BA7A756B0A1C45CCFA35D239E8F101DB0B354A30FE51A36F37C99244C58CE53FBA6
Malicious:	false
Reputation:	low
Preview:	...?Q<.^H.J....r..XX{$..K.{v.."@.!...~....I2.i.ha....[3.[}d....qQ..rqn.+N}/..#$a......}.+.s....$.....,.4n.!..:..T...<...s..kP.-..w....i.$.!.?<......3/:..>.1w..<...s........H...\"...E..'.h{...,I@...........iW....&c...i....._=[....:Q.A[,...{....\|....?M..^d`....'..U.U.N.I.$.6....c....u....@\.mV..X..k..gN)1..9R..>..U4........Us1.......\|I1...X.~(..,.N.#C...7..%I...3.7.Q...0M..y.=goNW..s......8.8..`..Jx.....IU.G....Y..@.?...\|].....[.D..l......[.x+.....,.cg.....2.T.2T.eO."....D{dd.".....+T..sZ..X.A~..1...I.....nVA........@..".?\..v.^..p/v.>....... ..Df..Q...F"...U.z%V.....Y.....b....T.n.jG.oR)...Z`.P+...d..&H...q..%W.....tJ\2j[....x.HEnGlid..9.n...o..z.....z.6H.. .d.).....c.....1.lZQ...la'<^.......f..R.".NNo..A.t.f.9...x.@..~...N.....!"......w....../..NMM9...2R.J../....}C.....\|.....c?V..3....x^.t.....r...X.GF.p..iLdP..WWW.~vg,.{W...r.].....T*....]A?..VVVj......I.(<...Q.\S..\|u......^]Y...?.n.....%..NI.{...Tt..........&...5..e8...g.}6."..l....x.......

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\User Account Pictures\user-192.png.block (copy) Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2440
Entropy (8bit):	7.832447597344405
Encrypted:	false
SSDEEP:	48:KcvTFi/E48kl36lZeTyUYw5BZ8JtDjnQ+lUC63:zTFi/C9zQ5Du96z3
MD5:	64F635A17E92CEBF2F2B76E4A53D9F37
SHA1:	F3DF3D7D6DEA0F890F8997BA04D9172A6364A3B1
SHA-256:	10158017F6B7E862CD8A6CE4005EBC5C8F9208ED9EF48E7337A92B3E045EEC7B
SHA-512:	175DDF3A7D26B54905B06175D5884C111C5A8737A459386A8F645054A07881B45579209B461C77F0089F61D8F108ADEFF8132D7BC22DE238DD90F59088243691
Malicious:	false
Reputation:	low
Preview:	)...2G9.h....X...7._4{.Z$>)......c"...y.Z_.D.}P/..t...@.A,.....u.ij..+..A.kK..h..?.7..Z.@.....eI-9........L`.``..{ 0O....w..4.^-.)....Y...V.D.lC.Q.0"..+..ar.....>...T..62..\....8.G'%..s..!<...&2...h1......%>.B..ng..zg.b..y.lV...N..X.`D..2.E.a .....o.:.ZL....i5.........=.wIr..Q..r...g..lv...c.....".Eq..+df.....;W..%Wu:8....q...(@H.0P#..`.V.T..s.p1.8\|.$.d3.7.6U)I..#G.\|.m..m]....s#..j..$..s........3Z..&v........]B..^wR..T..\|/.a.A.}.ix.........Yzl...~....A...x........w.....L...z.[....D./..A.g ki..am..zT.+..9..;."=.. .i.Ac}.Z.yD@mr7.Y....?P0A..;.m4m/..v..o"....t.~...}..#...F.:.l.....,l.C&.VU.9..d.E..x... Dw.....\...)..n.....[r...V0..p......os..8.L.U.J.O..--i }...\..X;C...p..h(.............D.W.lh.X..`.p..k/...s.S.;;ml.\|\m.GV..xha.7ct:g.s6...B.T.yF......Iuj......R...#.}..FR...y.H.JK.e....S... .F.T..#..O.G].J..A(.T:..lnqtt...L5..S.)..D......+..3..jj.C".h,l.seDX.D.m0.%.}..H.>...........nz.gc!.....+%.. ....E.TD.T...!......@......4.........BJ..@...\.

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\User Account Pictures\user.bmp.block (copy) Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	602201
Entropy (8bit):	0.28154964106722064
Encrypted:	false
SSDEEP:	48:olej5san7urhZICXfv+iwkeaG/Ni6B4vtctwsNW6B4RU4SQB5pmyhbvNSFfCXDvR:osjOkiAisNW6BRg
MD5:	A2439515219F28CDCC3A75FAC0B32683
SHA1:	E7C30218E7A690400E6EFC0117DEDF00CADA51BC
SHA-256:	5B9A081CB3133FEF85A5B8D9088CC0177A9F005953893E5C529A9FE5E2F85C45
SHA-512:	DA460157376F5FAAC9E74330A862FA795E66A6E56729ECF4B6743BED7E5F7F2DC9BB7FB66798055F7550FA32956F0AB4081377A3FACD1BD3C8EF2AC2AA663910
Malicious:	false
Preview:	O..G.....e`.=U.D}..A.D....[......;..'.8....l..J&p....t..C..'Z4X;Q7Q,.6....]..!.>...<v{$..4.s..5...e.....s3.R....`......l..wz..M.........1.\..t.(z.c.8..lRm..z?..)N..v<....].O..%.e.%.M.Y..D"q.B..D O,JhF..._..M%....k.....=.Q.....Ew..z...?.F.P....hNe..Q..>J0.I.f.g?..g......!..5WV..h.,....`..........n..Y..........!u.E}.\.x...8...<...0...dF...6../x%;Jg.h....d.....'...(.).Kc.aqO.....:.o...D...>...)#....7.O.Nx...U.."..9@?.7...XW...,.q..5..id.U.N...)..}F...........&....K^...H....3u/..x.hi...!.#N.F_9.o....z.u..\|..s(uG...8.b.....?. P;Pw..*...fy.....T1....{....5.....l...[jA3Y..Y.7r..<.x.n6.mX.~..@..l.X.....N.j.E.X.M.......E..+tAo.0K..s7Z.F"..E.....;_........8..LX.Ur.Q=.B.k..Q. ...;Z.2..S.-.c...k..wI...K...B..:..s#.w\..g.N..j.z.?..Lffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff

C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\User Account Pictures\user.png.block>. (copy) Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5433
Entropy (8bit):	7.852556747354003
Encrypted:	false
SSDEEP:	96:4HVYt8ufk7+3r0dbrNpnGGOL79Xot5ytNT3G+MHBTLrK4ioG5K:41TufS+4VrnGGSbTW+MHBTvKTK
MD5:	E50431E9EEFC432D83F7197FA3533750
SHA1:	47870B1F874CCBC4A51859820E7882F42F6DBC1B
SHA-256:	AF3064C19E688F8E3D3571F92CE0FF4EC9DA1D07C63171A595FCCBE84332E1BA
SHA-512:	D69E760AD5D733A2909B5C543FC1427A8AB5CC1B85947EAB2CDDC8C9F72A88FDA882094A8AB1C844F71EAE0BC81F59EA4D580FF6D39798DF740DA01F4CFB1194
Malicious:	false
Preview:	...4.a.k..XKl.Y.."\|p_.\|...z..F'f..g.n3M..-r....'...h...eM.........D.j.$..%I.px..:.3...Q...1.....MJ...q..St..0..}~...V..U..G.8UX\..C)~....7.b..Z.....32....)..~...1....c..].....e..K..#....9..tf4....gh..E.S.M....8.].2H.pI....s"..."...l..<F....".).4.XC.wr...I0..._,...5....S.......9.4..o.E.9.O. /.i.I.X.q.a..d.o#.4/D@.1xHmB.(r......_^.....:F.l....C.....UA..$.M.O....V.....pi.y.].r..S.!......:.j..............k...!..;n.f....y0......lv....@.k..*L.3M....J...1i.....in.\...:.?0.G.].q......Nm....5?&...Pl....5\s.9>.Q8....:..m.K....;..E`....U...mHQ..8.....8..^.....w].#..8.h.v.g..j<j.N8}dn.........._/...R{..; \|.......KO..l>...b..J".....v.A..C....e.hT.c...6..n...N...Y...ZS..2..U4.....rZ..X.8.7.1...X$..F\|/..q.../.N\|.^f.h..Md.=.a...!"......w....../..NMM9...2R.J../....}C.....\|.....c?V..3....x^.t.....r...X.GF.p..iLdP..WWW.~vg,.{W...r.].....T*....]A?..VVVj......I.(<...Q.\S..\|u......^]Y...?.n.....%..NI.{...Tt..........&...5..e8...g.}6."..l....x.......

C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\ConnectedDevicesPlatform\CDPGlobalSettings.cdp.block<c (copy) Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2022
Entropy (8bit):	6.618701120201026
Encrypted:	false
SSDEEP:	48:va3qLPNP0tcZdGot30KzPPaSRjUFtlTFeolVK1Wmf/srLi0:va3qzSt7ol0JVtTeoA+Li0
MD5:	D637650A0D4A6291461A95319D05F252
SHA1:	ECB6653DF0690236D38515FC8C705959E66BE433
SHA-256:	05B65CDBED5733BDADB0AC9E84C3ECCE1A5621120BEA6D2C8E81E183FDF25D8D
SHA-512:	997FD29232A090C3C473EEE6B21610DADC6EC8C49637A9C519BB0AD5F2722D6E869D61B22445962A7BF9FD2B7F425E6999ECB0F2E9962A1AB532E403E06CBA65
Malicious:	false
Preview:	.Q...A..hY..sbWW)....Q....B...5.........~r...(..q.4.k(.:.....pE?.......'...6c...j\fe.wm9.8.....m.A...XuX.....E...}.0...%..6...ua.).&.?t.j\|..FW..mj......0`...."..BoI.^=...7.......N-d.i.<p..5..,.# .!=...!9.[,.".h..J..{3ER>...K #x.0+.R...w)......Uan...@.k.h.3....Q.z)'...#.A.ff.p..%..rQMo........h........_.IX..}.$.2.Y..........HG.$6.E..u?..lrfM....+..2i.<U...Un.)$.....$.C'....n.....G.....G..................\a...h.Q.....a.y.7vb8.NA.:Ya ......Cz..Q..h.....0g.......&...G..4...H.{b...x.........y......./GZ~B.`p.F....w?.........vV%..`..]S_...[).Z&$.z..Cp+.}o#..&.[..`@iV...P.....\|....e.q.......=Sx..DX]./.G..K...YR~'..N..f.#.Y..e>.I1H...........'_....'.c......u.2.C....D$..P.Se..k...ZxP..!h..w..N.Vp..:....n.J....q.$...(..h....P.rA.V..e,. "CustomAuthClsid" : "",. "DdsAadRegisterUrl" : "",. "DdsAadSyncUrl" : "",. "DdsMsaRegisterUrl" : "",. "DdsMsaSyncUrl" : "",. "FastPathEnabled" : true,. "FlowControl.AckSendInterval" : 100,. "FormatVersion" : 20,.

C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCache\IE\2WF3MMUU\BBPfCZL[1].png.block (copy) Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2346
Entropy (8bit):	7.81282555868632
Encrypted:	false
SSDEEP:	48:YL4cQyUUUz/RlzQi33fS+PuSsgSrrVi7X3ZgMjkCqBn9VKg3dPnRd:FXyU1LR1Qi33q+PagKk7X3ZgaI9kMpRd
MD5:	106336EFE373E51ED2232257B9E68FE4
SHA1:	FA898DC44B435F74CF15260BB4D6E5B04D5C4923
SHA-256:	BE366A5CFCA886332871ECF37E0B79632DA2820A6F3D88E05151DB4019CF1717
SHA-512:	1C71F9FBC77EACDA87873EBC725B4FEA73BCD2D723C3C7EC6C49D66ABF50FE45A2ED884C1B5B0C17C953BF5365210191A0707CB6F970241AC1E6FF09463F3E63
Malicious:	false
Preview:	....P.Y...t...=b9.#...U...{.;..p..(.37.VK.[..n..KJ....i.f9.w.IfG[..?..$...4.f.E.]...Q,..0.J..q............Yn>..Z..p6...27..u.....6.sF....U.V.\|..;..\..&`.EL..B.A...w.(......I.U..G?.....}....H...2.WE.N......iP7hR....n'...z9..Yt.m..F,~,....;.?b...j..8._.Dqr....^......\%..&.h.$._..c.4..O..=.I...rWx.l.\.(...J?'..[1....o..Be...d.{.....m.R.\|.G......<H..O.b9.:$.....c.....h.$eO..._.s..a.........\|...m...{S....qJ/...;.8..%2z\...a..\|.sk.k./.8..b...n#.....VK.4.V.X.Mg.3.\|..xm..T...Q....J.......veF...7.........j.cy.D.b..,{...H...36.Z...6H.(..4Qd...o'.flW.).qo6ya....VP...A{]"...i............I.c.'.!..".fr:........6N..X.r....~.O].=.Z..m(.n.u..iP.}fnRC/.._q......h3......w..o..R...-.8......7.}.......m.DCl.....0.M.^".B..W...%`<I.ge.~[...!..=.....O.y.......6..J.......)V..g..5.......!..NETSCAPE2.0.....!...d...,....2.2........3.`..9.(\|.d.C .wH.(."D...(D.....d.Y......<.(PP.F...dL.@.&.28..$1S....TP......>...L..!T.X!.(..@a..IsgM..\|..Jc(Q.+.......2.:.)y2.J......W,..eW2

C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCache\IE\2WF3MMUU\RE4DnuZ[1].png.block (copy) Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	9939
Entropy (8bit):	7.974765289136986
Encrypted:	false
SSDEEP:	192:cYPfG2ztxCm7y6Wzv/aKFBRFGYbXfjIn45vSnAEIrxyqLFMSrlFWM:cYGatxCmbWz3bBbFbvM41w2xyoFZrqM
MD5:	A1F11AD9A9E299CDB8376AE827D94AE8
SHA1:	A9D3C80C4EAA917AFAFFDA347E0E289E1F7E0DBD
SHA-256:	21F4373A320067CA34EA11C37FB38D2B74F9F0C0F544989E97F37106BEB2A6EB
SHA-512:	779C1DB2CEAD28CE84168E743FCCAD52E0B5E0253B2242750DCBB2ADDA2C63DC6E27EE1EE40865CD39582E7B02A3D1EAB29275C952E3BEE515CC08B0A33BAFA9
Malicious:	false
Preview:	C(4./@.@.OF.y.c.>=G.I..J..?...Ec:Y...v..;e_c.5..E.....`..Yp...k....K...k.'.+S07.....`/..,sT...v..x..#..#.......)o...1a.@........g.%s.9..5;.z@..V............r.p'u.$JO..J....N......~...2......... ...+.2..........t..?.h...,...K.wXe..E.....s..P.....s`...,...&H.+.#..Il.#.@W..Rc......k}.....\|........A.........Qlq.f.-z.M.u....7...9M.G._.H.K..%..m.....W'..rh.Y.2..............%.t...P...P.z.......l"..\|.h.7......:..L...B.\o..Pp..f......FS..n.'.....kPawg..%V$Y. .P.3....5..\|$.n.Oo#w.l..#..L.K...k.P.....U:..$...p5.... .HK.........J.y.?....N.6EP.k...-..H.q..#.{..l.......+..a:..6`b...[NJO06 ...../....:..pPu.8.]V.c_......t.H..F\>/.....g.....^.4...[..$.....g..!....T.....~..UF).uFx[...<...\|$!(7.R..c..q...p.XhD0...8J........c...g.../NT>+s..d*..a..2%..6......{...._Rx......f0Vn.#.3...3.A...Ueps.. .=...HK.%\|..G...FZ..g.m.I..Y...z~]..sY&K..d.....Z..}`..ms{..TE.>.d\|.....u....L&k.w.l.}p..N.e.b...hM.!7!.%.S....F.g..._O.8..m...E@.88.........8.......x9..

C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCache\IE\2WF3MMUU\RE4Dnv6[1].png.block (copy) Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	10526
Entropy (8bit):	7.972899480000252
Encrypted:	false
SSDEEP:	192:zlHkVmy8SiQfLUq5cwGD8BL8HIXNDLMutho0ClDHidju9sFeitlg:zlHc80Qq5tGYBL8o1L7tuFOm0/tO
MD5:	65225935CD7010F2F2232542433FE5DA
SHA1:	1F8B7FA2AB88ADC111776A081CC7D809E0A26813
SHA-256:	124083F163E30D095C55653718B08F3D91DCA6BCF8422DA78A0BD5BF5AEB32AA
SHA-512:	A52A79FCD6B037B9F0905B9F2C41D6A2ABCF6991D75972D648A7758C1334B65EF6174EF9E142DC5ED0BF12447FAFE49C704A1DEBA172CD0F79DA1DD8EC008FA7
Malicious:	false
Preview:	....(_.....X4...H......%....E..(...........N...;.EKXA.w^.....3.s..E...\..........AY..a.Qq...........).....2s...%.Qm...n\|ok6...i.A.Eso1k..G.K6&..4m...w.N.4.l.&R..~.../r[..os./."..T..z....%R.b.......N....N......($...c.$../0"..%f....p.\M.4.n"..h1p?......hH.Ac._l.^h...F...m..6:CK....>...............V...".i._N`..d7....]}Q...X,.DP/.. ........n`"6M......[.....ipZf.nm....E.....\|.g...PO.rR.......k(..4.+.^t.d.....l..#.b3.%..`.4J.J....iMcz...8pA.@'..J..{..E.\|....`k.......i....q=.../4ad./......wK.........x".}..EKx..J.......s^f.Y=..}8.@......B....B...Sx.u.....B.^...o;.&^Z..........).O......y..mR.....m..b).j]..o-T4Ev,Gzd...C=%X.pQ..hM...a*^..l......}..K..5)..=.......'.....d..2$.....M.,..R..`....U........X.T\v_...=7.....5.PX.u..`..&......).$....:.i.G..x.......O............3.c2..ps...h<R.H.D..3.HM$/...dfd...`..A`%.JY..}..zD.=......i%..=O.................Vi..l........u.0.\|..!."..Z...O........i...xQ...xubz4S.........H...^Q..v.I...8{...x.,.H

C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCache\IE\2WF3MMUU\RE4n1yl[1].jpg.block (copy) Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5871
Entropy (8bit):	6.760214013224134
Encrypted:	false
SSDEEP:	96:K2f5KCNOsk1eftTk2kCx6uY5Hfpp2URYEYVzKms8Ygh9daGWJjHnAN:KgskOsk1ef+DCxeVxIURYVljdiHW
MD5:	4B6D7964122CD9C2375FDB9C7C540651
SHA1:	E8D695002836BCAAF10E68F930FD0D1EE5544AFB
SHA-256:	DDB652AA8833B2F3FD5EE8E77393FFEA1A0B5CAD2961AB3FF0414D4073E606CB
SHA-512:	4B509B9DB12FDDA1C6713F02EF95B4765DAE567B545CD0D42DE90903B1E7F57052A41EC223F08631383C7EC7CA36D4C5B94384ECD6444F396A3BA5446535D4CA
Malicious:	false
Preview:	.....c5...$.K..+@...a.I..&z..G`..+..4:....7{.Z.E....<5.....H...,...'....l....<..s....].A..Y=:...V..U(.g.3..0...Z......R{<=.@YNU'Rs.1....B..6..{B...5...6.s^....,-.. R../J....A.6..}....[R[.!(a...x........^!N...4...H..X.w.i......]fH.@...$.._R..o..*.)....4...E;.([+ .v....CP._..%....%".....h...............Y.c....i(.Y.K8.U}....bk.............%.\WZfa..g...LQr+..w\.0..a..Q%[.0..)..0..V..s.v.P.......4.......~...d.R.0..~.%......T.x..q...CQ.Q.......k5...<....B..Y......H..K.........@c.]l.tv...dBI{.....UL9+..RA..`.1....S?..Y......P.\....s......;...i.P..Y.SA.j.]..Tf.........e.+F.......e...^..PRB..g.J^.Z->..K.T...Eu,.........F..l....g..C./C.)...jv..X.R.."\r.Xb.D._..\.lL]..h.@..$-.%.~.C...>!~.c.)#.......}.....\|..._..6.:....E.P.......R.1t...v.\.u..6.!t............t.-.N.?.!65).Z^m\...........Y.Y+!B...<..C.................k~...;o.k...........=.`..zx..........).p.]...\|..............,..>..@..........%....T~.n=.^..........,.-ZW;..Yc.c....p...........o?.l.RK.

C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCache\IE\2WF3MMUU\RE4n4cm[1].jpg.block (copy) Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7164
Entropy (8bit):	6.983944400935104
Encrypted:	false
SSDEEP:	96:amj6mMitxHSXUFVk2kCLww3bhPLg6NNuIvALBdzlpIoNuYMMN+C9v7doo9O5AN:l6ZOuUoDCLwkdp7RvAV9ltuYvoC9J5UQ
MD5:	FA3CE3DC1C2B0FA95929707F0221FF5E
SHA1:	253CF807C88435C45DA0A4A6AE42DBCC31BAD697
SHA-256:	326AFFE3F70FEC8500D1DEBE2FB1A133F56463EAC98D4AC147740F3C28BA77CC
SHA-512:	5E831C1830460F5FB2CF3E9238C988F016BE30226051B8121156BAADA0678CE1262EF0218B2736184D7D63BC6C2EB8763EDEC6E2BCF1576E97A8008ABC2A05F6
Malicious:	false
Preview:	R~..3p......,.[..?mC....S~.....mb~....uC..Y.x.b.Tx.e....^%$J......r.F.zk.......Gp.t.....Y......26.1..[([......g.-.#"..'..R.q.X....c...>..V;...7V.,....~s..j.uY.Z..+.....3S....E.[...X`.&......t..-.5.<..n.+.V.UkBl.R=:g....H.Z......{.x.........1.....H...A.V.4.B`\|2..07.......Y....i....26..6....H....{.'...E..a.;.L(.h..4....SE'f.....Qz....0..\Mz.2..s..i..v ..e...N.R..v24[......MD.V...-....j(i.6...;...S[..@.v+k.pa!..K:&.>L}=H.C...=..4q..m...@fH..G.....5{.5....=..QV.67wPT8...T@.&...4`..9.!..#d..kDy2.YN.5.\|M.\|.D.g..i`.......76........s.&..`.g......i......i.1.i.+W...y.l.`k--..N..F.h..7...&.:.pHZ...UZ....vW..a."'.....w-v....r.K.......a1..k.N..>6...{....`jc...O.L....E\|....I....^@....M}...F\|:^]./MC....m.{...@.S.7.....<U....S.....L5c>.........../......~.~_..<./fo..........Ddj...l..................."2<&&,..d*...&Z1g.6o.............].......?\..1.'6o.............].......?\..q.'6o.............M.......?\....(6n.............I......c....x.m.{............1.v

C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCache\IE\2WF3MMUU\RE4ncJ7[1].jpg.block (copy) Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8229
Entropy (8bit):	7.165650495915239
Encrypted:	false
SSDEEP:	192:gX22DCUlh3Lk2YSUEcmR6wzB73xJpaBDXjO:k22D5lBLk2jtcmRt0BDXjO
MD5:	E248FD5A87AA40FF3DA7BB0DE2034759
SHA1:	AE122ADA914D5D104A3AEC3B83E7C86E54875757
SHA-256:	581BB003A33A523365D5B53B9530C99285CEF158EEA174DC92C1FE307D3C2DFD
SHA-512:	F947F6764030CE819B0232C2647C1665C40697D15DD93D5BFEE25C5DDEB482463B2700B625D705FD34DEE280B27513AC7B74E59E75FC561FF712C983A9E55179
Malicious:	false
Preview:	.;B....>..1D.....s=k.../../.......%c.J.7NS....K... w.>..9.j.....Ph......=.o.C...........L& K."F....h.~.=..m......!......\..#.J\.....5.bq.....2.....dK..P...W...U. ...5.k....I.-V...?......$:.B...C....I7.Tfp.K.3..JpmX.-..k.....WsE:M.....ZT.X.5..w...\..R.0...~...I..B..2A...!...B?.+.. kpHA....x..."..`...d........h.)..9.....<....N..?y,.f.aO..T.9.V...GO.....R...h...c>..MK-(!..&c.}Kg........".%.%b.}.wFs.Z..!...J..c9.e...g.n.7D....k..[....GJ.$...Np.;!~...[V.Y.#t....M....s=.,`.FH....<.A.l>...J.`.~.~6.^..~......K...~..Vdp...]+.#.6.a. .../...A..GN.!l..c...`..d\|S3y}....." ..GY.(....eK...j....Z@..$......5.n....S...B..=..B....M.....H.V.u......bj.}.tq.j..W..G..V..>......./.......o.....d~42..\|o.0.U.d...$..d.u.gp.....#%..[LTw".............<e...R..>.........<.I!............-.U\|......c..{.{....a...............y..VN;..B..r...W.......c..`...........0...>......M.Y}z..K.-6.^\|............./c.R./..{.C.}.....5.r.@........i:..P.<+.:....-.......

C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCache\IE\2WF3MMUU\RE4nqTh[1].png.block (copy) Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	24653
Entropy (8bit):	7.971012191449033
Encrypted:	false
SSDEEP:	384:A96SMdUe+v6MtCfX85n5aUQ2V8iQ0kgh4zFITc6oQGQhp6i8UaYcAG56GyP:AYGv6Mq2aQV8iQudTc6iQ9ax56/
MD5:	B1CBE8E9D9F1DDE90AB6A0F2E37415E6
SHA1:	56B7E00E70D05E86B3887480B98BC34CDEF8B18D
SHA-256:	56B43CEF26A54927117EA77EF2EA9271054240D28EA69B8BADA442AEBF16624A
SHA-512:	6B18FAC7F38B719E08DFD87FF17A606DC52B0452BA08FF7938CAACC091A41CDA80B5A0184E51D40F639A64C8CF333036E15CB10549FE3122B0564012446BCE40
Malicious:	false
Preview:	....T......7=.6..B.1\...YU.<......}...<..v..D.h.X5....{.Q..u{....@...2...n3...RQW...f..J....E\....K...1...Y..C.......J...........f.OHX.\|.RDw.../..w..n...!..o&R...c6.O....8\|.j.....S...+O...[6.'G.....i.....)...x...A.6.B1.Z..T..F.>.......Q.F95a.....]..)qL...-.{.... O...O..M...z`....O.:.%v.^%`...-.c....{.4.h....tD.F.p...1.4&f.....(.ow....P..z{<qB.I..I.XmF.k....V........c.x7r.....m....6(...t.s.,...!.s....2n".D....H....Ci..^.6...d.;p..........x0H..Oo=..o...........WkR...;...D....t..-e..-....~...c.v.BpI.........8.s.H.......U.x...{..cD1Q._...p.i...s..Sc.l&.{.<..=E]>q ....%..pZH...V..:.].6..".....@)..@../.....c.,:v..bZ.~..y/r./!f..A.....-..].4..Y+...3.[i..."!.v#'.\.}^.4...F.q.[.)..YR..F......2..B...\|\.....vk....<....%`q\|^..L..7...do.~B.1.]....g...._.x8pC@N4.D9C..$.7=.?".........H.....6..8...u....KL.7kE..N..#.t7.j.O......j.t..%.w?C...8.....{../...1..]....D.-_n....C.3.g...n\|.".;,....7...>..5.".n.2....(...op.@...;(8.0Z..,.]...g...4!....{.M...A.O..-.A

C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCache\IE\2WF3MMUU\images[2].jpg.blockk (copy) Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2551
Entropy (8bit):	7.904082169408622
Encrypted:	false
SSDEEP:	48:RTVOuOiF7BjsRqbxmG5yg7LW/GZofuUaz+uSNTG2ChaiceTWksi94V:XuiF7Bwmkg7sG2f6zaGQiceTW3V
MD5:	18FDFED2F064B4E125C67475245C5472
SHA1:	4A1040D38D22DF5135C7061A2EDF0287287C80C2
SHA-256:	B4272CB70FF926308AD7502CB6731253033E4F452E1EAD585B1037C1310D0EAA
SHA-512:	D6D9484CBAD528EDD37DACCE1F1B60816D1AF9F7327A7ED31A8EEC80CEEB9CC61BF1223AB437212853089BFDB3DB116949E4BF492286ACDEDC403D1BF351DCBB
Malicious:	false
Preview:	g.e./_..<..I6..v.........3....8.w.N{...;....3..eu..-b...}'AG.n....P.6..../........)f.....$..coF..f.....:-,........W....A2.W.8I).7.\.M.c....p..E6.8..h.DQ8.32F.....V..5a...)....,.A..Ymd.....z7?.8..H.t.m..z....}..t...RK>..s'.I....H)I_nIc..x.a..e ..aW.y.....].T..W7...N^.........k..".E\|a..e.Z).......\;f...bV..p._.9......%.p..f...;...wK.!;...ep..\|_......o.bm...J...8\.I...[.aW.M.).......4.#/.]...%.`:.-Zfu....CT....G.{e.%.\#....8...ef.0E\...dP.....5.........)...8...........-..pR.A....).\.h..{VG..9..!9.}.v........O.q......`$g..5..c..U..)......q..6S...>.......\!......E.]..G\.3..y.y....^.4...I/..d6...e.p..,..w.l.B..K..$ g.)....=^I..h.!..pz....#...@.....@[...'l...P.U..ru..KH..h......_R._..J..#....9.[.6c..w...ODTz.~...T3.l.cg..$..#....4.......f...-H.....c2.A...M.3.OU&...3..\..6.yE.^k...-....$)7.,O>...?I.>........u...e...... .....8..8.<..+q;$..6u;..(.^..Zl.z...i..K.....8..+.9..1.9{!.H.P$.+.b..r...........*N..0.C..:..A....q.y{:....6.....U'.Y.aI..T..UH.

C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCache\IE\2WF3MMUU\images[3].jpg.blockk (copy) Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3216
Entropy (8bit):	7.915354926372153
Encrypted:	false
SSDEEP:	96:bGQHiAWL/B69JThmfXB2Os5+D3O4lvOkop2Tv:bGRL89JTcB2Os5ml210v
MD5:	5611C1F6FD8C9E2A0AC13FD7ED2E6EA2
SHA1:	4C35FEFCC72471CC273D55C0AD9C9A0BD650C624
SHA-256:	4F7C288D24844336A0A94BD6746A2428B9D7D7E04AD052521C7DE0B69C7B1347
SHA-512:	4AA1658348B69F3EECC0109B10B41517D92F209187BCB8677DF004179ADFD83FA21DB8AA2961016598E3CF2E0CD5B9294470E73A7A7B721713099C24F342916C
Malicious:	false
Preview:	.. 1....1Fe...{.$....y,.3#...!...-.k'.9.J.Q..(..I..#1.u.{...0...>}....A.'r..F.>.....#^."X.4q:.. R......x..M..R...3....V....Z.-.m=...=...&k..6....U..^..5..C...vR..e .3i...#..C..R...A.......e..F..k... gW..]+.}.?....f..b...7...:...$n.2.N5}a.@..e...w..k=e\..SH.h.G.H)...xbI.....@R.X.w...Z..pB1.:.Fu.MjI._..E.?......A...%...2E...0..t.K0\|+.N..j.R..2.nBY..L.C.g...O.JX ....e..@..7"K..~.7.I..............T...L>.R..N."....a6Ap...9U....QG.......S.@..?...\h.........0g.U..{,N4..`.....<up.)..q.../...X.iL..%..vF......."%.E\|H....&..'A[.!.....I._..l.-..%.U..R..W2..o..Jx......."@.0.g.^@..9...........8M...9.."..b....d../.G.sZ.K.L@.l..B%C..k..l}...U.y..`.mi..Vm.q.Oj..?...p.l....&.>..."..y.}1_,.\.:..\.......GAW...pw..s..g.h....[..........RJ1Yb9..............#Jz.%.,....IfX^o.u..i..8..u.8........S..7.G.}....W.q...[...p.M...U=.S......^.S%.0..9+4...h..)...$.(...JyY<....S.Hr.*Ve......>...g.8....ZJ.7..0.Ja.....%.w.J.-Q..R..6g........@...#4....}d%%f..:.

C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCache\IE\2WF3MMUU\images[4].jpg.blockk (copy) Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2301
Entropy (8bit):	7.91180341261411
Encrypted:	false
SSDEEP:	48:4bE+J8KUGP5dL1At/2qbu6KO0DDBu2NU63zcSraR/xc5+:WEMUGP5ZGteqbu7DIy4uaR/c+
MD5:	3878EEBACD44F6E22569A6FC459A1192
SHA1:	1748A9BD30A62E9887DD765945A5975008BEC727
SHA-256:	D50F8A9319E2739D173213DED41E0C0C168EB7445580DDB27DFC0529886A149F
SHA-512:	857F8E3DB5405B0F9C1062F760AF30CFFFD8E36641D70026333CFEE328DE170B0F90C45BD1EC7A350D18B41435516DED09B2D2B26794B658972B268D68787DBA
Malicious:	false
Preview:	ZG...Yf$...K..:E..A......H..Q.D.F..w.......z.fH.+.sO..lL\....m.e@o...t....`.2.s......4..)o..V.P..W..4......t.d...`........t..9.....q.Qa.X..]L\|.m..IMd.E...{..K<f..N..Y...........+..&..f.$..CP....}.n[.<.....G.=..A--E.........Te].X~.?.U.8.....>:..%.,..\|...Q<x.j...s..d\(...p.0C-.7........\.c.e.l.l..&.m.a...5rh..T+ L7..4.`(.@./.F..u-..Z.Z...7xZ`......f._..._.EL.x1Ww.....;Z..=..h...J...t..o.......Y3.S..qN..\|...[...#..h.7.l.....Qod.9.....b..S....TN.'?..d7P..+....3.Vpd..Rw.P.wOx.S.^..F.....}........z....\...y.[..?..z.....s..7...Qr..N.&...Z^.V...f.^N$...V...0yM.i.;o..`.q........n`..6U[......$WB.fV,.....E1......+(\&......l...s.2 ..B.n<..N......\|.w.5S-.Y.c.sFu....}3.....A.<.d..(.......g..jyL..yY`...?..>..%.....3.vA.V.5.8../...fk.D..99R..%%SpA.........$.dI..>.L.%{".y....E..RT....Y....,...s....2.'g..<=..i....BFR.UQs...<....J.\.j..RG_0.MP^.i..d...0.......e....p.<p......Y.g...OS.//*g. .H..-.....B....X6..dh'.4H...2....4;z...4..t.....7..+......

C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCache\IE\9026IKNJ\RE4FBmQ[1].jpg.block (copy) Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	124783
Entropy (8bit):	7.975226002723387
Encrypted:	false
SSDEEP:	3072:WVT1s2rsGlFs6pboua8pzmRGOhQo/LL+1e:WVS2zEw5yUOhHLye
MD5:	D2C08A02183E05723AC279ED86C71CD9
SHA1:	89AEED1572B09AB9980BF3C1A9EE89F85A5A0EAC
SHA-256:	5BE22C562DAFC32C1A5C7FA44BF78C3B293A4E02FF3447D9E5C2055E9902EE50
SHA-512:	32C43ECBEEA4C19256A8D88F3EBCF983C7E5B0FDCEBB68A7F139F2E9761F7382BA485B0DE80BE801B696965B8A85D06525396A7F72873F0B09C99441F2441178
Malicious:	false
Preview:	5..;.`.h.\.eW..E......bC.....Z..%..M....\...J......\|s/Dd..H..9%.....V.)b:..9....Q.\.{.~d~....-Z.J.b...a8......'7....r.......~.[\.!.$...Q5X@...../...p.h.9.}..itn.B.0..d.5{.'.....<..P.p..+..)=...y..m....m...#..rK..T.\k.;....%......0W.Hu..R..;.Oe.".....@.4...e....D..\.#o...G.Y.@....9....j%.....$...........7e......_...vK.m[L.JaJQ..t.h....'.PBp......~./>S.=......S.MR\|...{v:..Ig...\4...c....=..L..9a..>......C....K8W./J.P......XeP.8r.o.;......!N..~^.l..Q...h.J.....0^...l..!z.?~.d."U.....m.....m...oD.......rP&.G.<..&Rc....Pvu...p<.Q4~V^.z.(.W...........\....<...rY..f...y.$..w..%..#E.D...4...b..WB..pM.Zql.f..h...*.i.[F.%.'..#...v[...U."SX.L.<;8..i<?.ap...a.t.....^...2..(.;.......T...sN./.8v.r's../a....5s..jc..2.n..w..S..w..pMM:DerivedFrom stRef:instanceID="xmp.iid:138b084d-3c9c-4541-b718-c628b6913011" stRef:documentID="adobe:docid:photoshop:55f71296-615e-3f44-961f-90d1c4adee58"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.

C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCache\IE\9026IKNJ\images[1].png.blockk (copy) Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2440
Entropy (8bit):	7.915659352062932
Encrypted:	false
SSDEEP:	48:231KA1iiE+4nO7xNnThD5WChrkHeDJZ935q1joPh0u063V/Rg7V9:23W9nOlD55Ief7mu06F589
MD5:	376D2F7836F0885B7586CA26CB78B8A2
SHA1:	00E06C710584537AC66A8FE7F2BF5F5E3835509C
SHA-256:	06A6071FE7018B43B56FCB4D164961C1EAB02096FAC4186200954B012FB98D09
SHA-512:	ACE757C09246C3B25D7D68018074D99E8FC9046D20D09835DBDD0F4BF49449C25819434CA463FE6796088FFFAA73E500598EB1179FA0FCF8BBCF2EFAA6482368
Malicious:	false
Preview:	F.t^..27..a.1.U_.L.j<dgX.bY.XQ.z..:I.F....%D..5.R.O.G<F.........+$WS.X,s......f4......7.zJ..X0.bJ..DzIe...h\.E.\|..eF...'8!.FF...........:.....k....F....H\.Dy...O.........,..4...y...+...(......0...$../....3..&'~.Fw..F.@....L.....G...Wv.0m...C.4...Eg.,.C.+..a.^..u!F..wFz\.:.....cl..v.R.@...Km..@A._.?..".O...)...,.z..\|.0"ML.'6j.r.Cd.4....vL.H..Y{.r]].....LK6..<..B...y2\....u.Dv.xv-.5.M-..;...d..p.Vy.....t.y..KK$.V...s..f.....6.......-WA<.$..m+.S...I..........l TJ.Sgu.^.K.x....:9....u..Z.&G^...Xd..<...\r.8...R.>...<..]...+.G.4..j.Y.<....(14......a..w.;..! .......h+.F+...A......g.#..b.....(h..+.W=......e.f......[..(.... .#..Cl.{u.<.i..`.`..VLm.... .o.f.,J...SRa..Y..6.?.=."z.O1/....~..p..C>jp......]...u........`.I.T...{..Wp?.......Cj...+....2.G......'.\>....._.-<.E)46.G.=PZ..[}ix./fr...r.\"..A._%A X,......pE.H...k.u........'O..%.\|m.z. ..s....!/.1._.l>....ok2..y.....[:.......Sn....{.b~..[H,...7...~.B.......;+...Z.g......uzbY...'_?.z.

C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCache\IE\9026IKNJ\images[2].jpg.blockk (copy) Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2281
Entropy (8bit):	7.899937524878011
Encrypted:	false
SSDEEP:	48:5rVweset1nGdEFkwXB+yutj23CGAzyzWeuHo4h81b1P8rCOw:Z3G2R+yw2LAanv6w
MD5:	9FA237363ED8F8EE65F461B396C866FE
SHA1:	C457F2A54ADF66161C477C1103CA4006550C8280
SHA-256:	DB6FFE3AE82B08461EC412589B8F54697689E74811E16653377CEFE7336FF364
SHA-512:	E79BC3E53CA2678114D793BED7F6A2D675B56A7A3854B16425F91BA3A938511BB279225D4207F408F6BBCEB5E754596A42970A61B6CF7F5C60AE9D8BD98C6D2A
Malicious:	false
Preview:	b'm.d,..Y.V.!..B.....8...9...8jk..`.....f.....Ym...:.s...I@.......t...H-R0}.b..P......%DkM..K...b,.........3...@L...vF...".]...\|...C>[...?.@.W...F..wE.^.~-..v......w>o.;o..5.j....B.X,..o.l,.-.[P..s...o0.......\|../0A.S..U...#..b~.w...E.5.)...o(...HD..A.%.?..-...4Y.E.r..1..:.....=R!Y.$&...-..f.e..."8..(1...=.........7...{..5...`. ....FC..Z..mKw....f"m._..~%s.q...B....an...5....}-.^@.J.6>Q....G.EP..Hs.~./..(..~< .M....q...fe.b.R{\......B@\e3.....x.......b..<)....b..D..G..<..!u.(.hf#`W+b.!....7a.."..:..........@..2..."36].r...#f..Ib...H@2.. .{r..AH.^....E..g.;.N.y....=......8.-OiQ.![...;.....t.<........P..D..Z:..6.T...b.....f.m.?..D.c..0.P..4i.......#...X.z.AxL........i.A.)9.2...#G.........A.....\|..DEH.B{..C...Y.c.<. .F.e......v.X.._x....j......O.\|......%g>.Ga.....s.-.....m..55N.TW.....?.=.%N..0....4.. ..V.<[.}.n..e..T...N..}........?......F...U....O.#.t..9>G...n)s..].k.X.....>..:.._J...{.=..r..4V..s..8?.v/=$...).N3.4.t..a'..

C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCache\IE\9026IKNJ\images[3].jpg.blockk (copy) Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3058
Entropy (8bit):	7.9236382389497
Encrypted:	false
SSDEEP:	48:W+ahh64ygs6lHTGLQv/haaCQ/P9mc60eTXBUkUBByxbctBJUW5RkA0DWz36:4hhvypuTGUWOPjyxgtzUWPkAjz36
MD5:	E18483285B5E81F6E999CB2FC089C0AC
SHA1:	0387964C4047AF772A0774FB003B2FB1C9B091C1
SHA-256:	89A8D01FE0E364BB59E7F0B55F28C5A41CA718ADF1AC4956CDF695FA62C925C1
SHA-512:	7CAB6665A38215633AC5C70D2F8979A06DB0E2D0B49A83EC7937D2913770E35ECD7894EC145B7DAE8E228DD9F1158AAB0F48ECD7412621A2511F71ECC2BAE09E
Malicious:	false
Preview:	.. ......[.c'qc....!0...b.'p..zi..._...`.\|.....d...&.c.$..4;m.........v..J.?.c....@.&.<..m%.s..a.4{...j.d.!.X.3.B......6U.._.B.O-.yV....z..K..A...`g6.E.nu....^..}..YcE..<.\|..+.{.5....%..[..tu.5...Qw.?..9{..U.6..u..1~`...)...J.5..37..8._.......q.'s..W......m.[.t.G6.....e.5..'..fxx^..}hY.t..L.u.1...t.".X.$.O-bw!_\|..S.%.Q2.w..b.r.J...3.@.Tv..q.P~..:..z.......8V..".5..O.."D...7......[.\|.t.zx.ub..Z}.R...:...;.X.?.j.V.\H...%G).....[...O.`i.`O..kj....9d.x.z..I..^.I^z.!7.v..#F...9.'..G0.....Vt..b...s....Y..u.[)Y.h.Q..9B.9.........c..[..ih'..5L.~..p..G..A.x...\|c......r..=<..@.Zi..!...=..X...Fg....;.(.}.....#.l."..Kv...O./...\|a..\Jf...c...6z.8MHS...].....T..d...a.. ..H.....2j.tQ.....-@s.V.I.y]P...7@Z[.&..4.2.J....a.......p?q..T.....P...2.}M....r`n..3.G...Y......R<.E.e._.[(.\.,.t.%..X..Y!Y..Z].C.h..h....?.......y..H.....S@9.^.v..7....L.'..v7h....2..;.....n\|G...'h.6&-../k!...~.ks<....g._..He.X2.ua..S.,...x...Seu...`...'..q..2...&W8..}.X....s.:d.....s

C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCache\IE\CS6IXJW6\RE1Mu3b[1].png.block (copy) Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4087
Entropy (8bit):	7.9303009655033545
Encrypted:	false
SSDEEP:	96:ERtCGfx3vE724xoiRQJPrjpLKSFl9oX31Z1d:OhOroLtIclm31Zn
MD5:	02F384F387EF98BF4D60C2B20854AFED
SHA1:	B2DDC7D4CCDC659D088AD7C7D076127A8B3B67A0
SHA-256:	63D1E1A9AB0D3CC815352AA08B448943268EB10BFFADC78A5FA281F47065EE4A
SHA-512:	848128FA2EBEDDEA2C183CEBE4344F1109FBDC623E152FF4004C0CF8137820DD4045FCE9FB5EF8F4554C67362AC0D87B4197B22CCD8E923EB0FE09B8EB7C15FB
Malicious:	false
Preview:	h:C..=.x>..1m.$...U..q..Q..\K)..FI.9...a......!.V...BE..`Y/....A............k.@..(.)...!.vL..hS.m.^....R..CZp.}.g9aJ..Z.a.+..y._...#&..[...W9..C....&.`#..J......]....X.s...v.Z3.....?.....b...Ta..9vF/..y(-.....i.N.X. .k....F3/N.y2.V6...lo....S.%...`."yZ..0..r..Q..6EB..B......,CZ.[.p..%..Q.s.......B..D....(.@..o7.........I..=.l..CW..c......Kuj....z.V.....gBDHm)..I.$.......$W.k...O.`..N.=J..A(#..g.`.=z..2.....i..8..y....}...4+.B.I5.O.A.N7.....+...Hr.g9..8q..p.A.2.\|q0...=..5q...#.;..5:SB...z......a..:(hy..>.x..UAQ0i..Yd.Y...i.)p+....\|@..{..$..C..r,.....Wi...DX....=A[.l.g..9.!E.!_0.9....$..0..K].....]e.........K..g......T...R.J......D..s...-.Z....2.v.e.0...$.....Cj.E...u...........T.w..p.;..W.~[.....8...t ) G.4".Tv{.7.f.470A111E6AEDFA14578553B7B" stRef:documentID="xmp.did:A2C931A570A111E6AEDFA14578553B7B"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.......DIDATx..\..UU.>.7..3....h.L..& j2...h.@..".........`U.......R"..Dq.&.BJ

C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCache\IE\CS6IXJW6\RE4FGwC[1].jpg.block (copy) Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	134098
Entropy (8bit):	7.979824958174559
Encrypted:	false
SSDEEP:	3072:ddA5jGA1mxEwLzUbPm+6x30mFj3MmzTUAC2I7Wl74wYBnqZ:d+5/196Rv2mzrkGYBqZ
MD5:	7B0B6E66250EDE69411422266F7C3DBD
SHA1:	700F23E5BC577413561317CDCDA125BBD3DEDDF0
SHA-256:	F8BBB29017D9B7C612447172F5C16C286CDC4B63956D5ED740751FC88A90B0FC
SHA-512:	E11F55641FF9D142E9207018700362774E4B98CE346BF5C3FE677EA0B2632D62EB53CF0152980B4F9DFF22BC255636CB7595EDEC6B1F5A1301DD2FFE1A7590A0
Malicious:	false
Preview:	R@B9..G..].V..7h&....O..S#.t+.=.O..c-..'d..u..Fh.;.. ,.l..Kz....8M..}.@..Re.R[.7,.lqtb...8.;(.7l.D.8.g.$t...d.......&;..K..X.....:..Y^....).v....=...p..b.@.5{,..s.......T.W.&..."%H.a....{....!9w.S..+m[.FA.ez........{5..j.C7"&.....0...I%...Y.."~.hU.~1.. .X}..._P....S~.3...r.m..".+.;@vJp..-.c.v.......Q.......+@G9<.Li\...Gn:..h.o....[...>....]z.:..+..RC..m.8@..I...GM.V:...X....v.>....B6=.!...,...S..G-.....9......#..].L\}.0.._......f..N!~.pM".2.l..(..}E.\|...\|...S..~2QJKQ.]_C..6.......rk..oX...K.Z_7..y<$v..Y.T.".....$5.\....V......0.:.b.]O.;......X}.,^../.%..'..L..x.....a...\r.+.%.XO.O...l1fw.......R.....L.-.5...._.._.D.^...ZhuW[.h...`.....)[.!G'uo..k0.h....\|....CrC...b`..y..X.M.1.o.4.&E..&.{....['~"d..O+..+.i]^.R\.yI..*+3..1(.lXpMM:DerivedFrom stRef:instanceID="xmp.iid:01975f7c-45be-4eec-892e-ddf3cef31740" stRef:documentID="adobe:docid:photoshop:81832270-9d95-4244-b31a-520c871695ac"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.

C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCache\IE\CS6IXJW6\RE4sQww[1].jpg.block (copy) Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1331385
Entropy (8bit):	7.985896205502885
Encrypted:	false
SSDEEP:	24576:NGe/77J1xXvIZgeHgpFoYZJP4kiOJwFaMJ/QltP7Dtb/pWMDKvHr:NHz7JzSgeHgDB94QJwF+tPVbhevL
MD5:	B09AC1CB8B3D8B030EEA8C3E33BE6863
SHA1:	50F54C34D257927C7E41059441BEC16F7942E9D1
SHA-256:	0B0EB766F53B102B862EC771FF3D065DF98A6B31D37686A030973FD30F1D9DCF
SHA-512:	31C6221306D49FCB7AE7EA30D3806786564E5E2C02F278CEF40CE47073F825CFDE262D4CD244C376C3FB7774FA17E0DCC9E217086970D8A149A70E6F1ADA9385
Malicious:	false
Preview:	h...X..2.+.......\|....].G.9..9.L.!...5...?y..Si......(.8.nY..W.....7o8.C.J0.I.R.xU.r.....2..x.o. I........[.".{.b...Dd..D..Z!..u..V:#...QM....<.h.g...,..R..I3.u.Q.o....K.......m..]`.o......3A...h5M...W."QG....@.z..^.2...C......W.7...J,M..H.g.........1G..(.Hr...j{...Ze.....H......L....+.!....Y.m..)"F.J..F...N...k~.`&.+.z.#...\|..4...ir.w..5.u...B.Tk3Fd..T<.R8..MV....U....!.nA...k...)................]ON.V+....w....y.............M._.....r...vI.>../...f.... .x...../.z./!.T..v[...%)...j.........".7._.(84t..T.@O.8Z\|&.z.O.......!..P{.5K.!....Te].$U.hF'.X.~...L8...0.pM.S.V'f....}R6?.....j...txX.uL..5L.....3PTj...\|.....qs)n.Ya..1..P8.#.n..a.. ....q.r].d..7..2..x.AQ.^uN...E..k/.l1.O.........p...o....iJ.Z8^.P.F...v"..d:.,u.#1..),..u...ns:tiff="http://ns.adobe.com/tiff/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:creatorAtom="http://ns.adobe.com/creatorAtom/1.0/" xmlns:stDim="http://ns.adobe.com/xap/1.0/sType/Dimensions#" xmlns:bext="http://ns.adobe.com

C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCache\IE\CS6IXJW6\RE4tIoW[1].jpg.block (copy) Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	17036
Entropy (8bit):	7.099337277899407
Encrypted:	false
SSDEEP:	384:fjUPWnaC57MZzsl+v1svJMknvMY1lyMNME502kMlyMgFMuMuEJPmMBMOMBMWMfS:fj1a8Z+v1YDTmqd502kFhNBEJ+ofuNKS
MD5:	0CC3E13BA8057B6E60544ACBC83D4239
SHA1:	2CD3FF6E2EE680D0B821493DB229091B4ADFB5DA
SHA-256:	004D24C9202F113B8985719099C97AECF2F2473E7C8DFE5B9240B6C2E0CD7037
SHA-512:	75FFE882FA08225C5F705B111691A0CD3795AED927AD23D21A9035CAAB3DB4BA011F616F683D58BB717999BB474BD5F6AAC74C95A18FA6120E05D888D4130DEC
Malicious:	false
Preview:	.../D..U.lu;.......8.....or...o+.6........d.AJ.....K7.U....F(...Z....o.. 2K.Y.D.=(.=.a..2..J.`.I.kC.[..2&.>..hH..N+Q[{y!..Z...F..:.#.F.N.t..(..[..x..$........+..W...(..".;.5A.1.)..'.^O +.b...7..P..>O`uZ...f....0.KB.iT...2V......(A)d..,@.].26tYja;]`.B8....y.Ja..s..ld..&...^..I.B.+.{^9...ia.\|W)[b@.ME..9i.pT<tz.....l'P..Oj.N.Xp....OQ.n8A5.=...(...eZ..*d..i......[?.Q6.N.$.U...e.E.i...c..D..E....... .9.c....S....%s.aW .&.....".H.x.../?1..uo.^..^...A...=i ...v...g.......M.s....\|.....7..hX..=....w.....y.3....cx.-..s. {+.zQ+...K.._>...:...\eky..+.......u..\|@....@.1....z.&......8.Iw.......?.e.B.H....z^.......5.r..e....+dC..#4.3...<yT..M.[......_...d<..........$S6..\...W....b.r.i.tc..\|....}. C.w......\|..h..K5...'0V^..#....Z.5Llk.....................................?.........................................................................?.........................................................................?.....................................................

C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCache\IE\CS6IXJW6\RE4tMOD[1].jpg.block (copy) Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	17043
Entropy (8bit):	7.0981856237063905
Encrypted:	false
SSDEEP:	192:27T078g6a2jbyAFnvr8yE8n1daGUA+3pH8i2W/92T9JMf14U8uxs8miBmiqif5vo:6K6a2iAdvrRuAHzoEH2CyPDVBoBfNx
MD5:	D8FAE01814E764C6B7B4CC7785B98FFE
SHA1:	325A072BF0EB99BF768F663E51296DD78C7ABDF0
SHA-256:	21DDF9D2E85E8362D457D353BF2FCC3BF7854403F2D7B1DA49056DCCE2B5C62C
SHA-512:	4E9F9DC77FF09B99CE9149A313076D0134B32F6D3A65284C9439D997E5D4349625FF5E9758DBAC129D38E356370D6E976F427FDA43F0AA61FD6E3D70EEB54CB7
Malicious:	false
Preview:	c..D..,..E9.........{....o....8.s%.3.1.H.G.-.....]6....sc.........3.i.CL.L.a.."}....[........;.b.c...v...C@....Xe%x......v.._...."d......F.......'.tnN...%..:p.pOS.....~.....dA.....]j..k.Z.yI.e....Wp..KJ...G5c...4I.g..d...b...z.>...@.....e.v..@L&....D.$i..7h..(..g...S..S..Sxj...j...c,^$"s.....uj.M!...W......:.D..o!..(..v%..n..iS+..:...au....l.........W......D}".....mp.-..e.......;.H.o.Y...6..q.P.UQ!c.....y]\.O^y..(.i..z.7.?.fv...,L.......4^`X....p.c....~.I...^.AS.w.....r/.q-./k.}.;MU.8.@\.Z...r8y.........4...1.@O.....H.../TBK..$w..wUz=../8..X..).FO...O}.....B-.O...P......Vl..T@*Q.....^.9.`........hQ..f.H...,....E. .{......"..#...P...P..c.........?....1..e.V..&...b.Vxu.!{5N...d....B.~..2!.x..M.f.?\^.h..f..Y.....$._P.B......................................................................................................................................................................................................................................

C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCache\IE\CS6IXJW6\images[1].jpg.blockk (copy) Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2140
Entropy (8bit):	7.89397874824521
Encrypted:	false
SSDEEP:	48:FS5Ric1X0LNQ2OtEjO/I4NpC4nWW3L9/+3PIZBoqyXpQmOeIb3FNQ29mZ8ln:FSvd0S2abNpC+W69qxXpQmOeIb1u2cOn
MD5:	873175DE8F7426331D415606074CE050
SHA1:	E9B68D0999D8DB46771DAAACB8206C238B450489
SHA-256:	93C8A6C049947AC39666472A5D52769D9EE3BB2F29573F444CF056E56CBD6050
SHA-512:	3857072EB9E4733E9C1597828C6798D51A21C85548E4EC2360C4B9F10EA642E149726252D34F12C02A540DA7471AAEFFFEDBF72310CAC5DCD27FFA0B4DA2A2FA
Malicious:	false
Preview:	'.:.&y.qG0.l](...\..s.....^0.\;..Y.T..W...N..kms...(s...q...L...a."L{.....y#n.. .:..d.J+..(.yV.w~.&.l.M.u..o....\|..5qF634vg..?..@.;N1W/X.....#..w8...o.>x..%""s.......%N.Z.Tp.VB..5.-<.v.Ut..:.Di..5...gX....s...nq.@X...x../.J.8\|I#.V.k.no..2.Z.P...f...$........ n..'..l:..2......V..W.2....k._1.tYqx.=.....1....=.....1.]\....L...y..By...-........P.....Z..O...V.jf\|...... ^..j2;.}....i[=..A....Y....8.V).c.8...q..:...../..#b....t.g8.. ....!%.`.a....Q.....M.M..A5.K3..]..]...6.G.}[.%.......vH~...I....z.`.0......."..#.HYwVa01O..H#.......#.z....B_x9&i}...E....j.i.\|.t......7.Z...\....qd...Um.z.....L..O.;..:.f6.}.xB{R..r..1...p....\|.F:p\.h..CZ.;&1).>a......n*.PJg;...Et.[..B...H:.,.n....%.........t....;J..r.....+9tFk.1U.I1.a.O.....SE...u..O.)I...........7...,.......z...s.z.W..&..zQA.Q...F.z.:..?..w`Mb..u.m..Vg......'.n..`X.'.2......)....2V.i5L..$.;..~hkZ......`.I..a..G."%?......$.mx....-..^rl..0......`...0...7..q<'.,...-.U...].r.....:..9R.\.NM%\:.r

C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCache\IE\CS6IXJW6\images[1].png.blockk (copy) Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3692
Entropy (8bit):	7.948185724857944
Encrypted:	false
SSDEEP:	96:ck8Bnn3poy8BszHC0tRxviyjObX+Gw0NPmovh1r94:cpBnn3pNfRi9+GDNPmea
MD5:	08542AC8A38BB84DF63E3AC2DF76ABFC
SHA1:	80A160E8114DE2D0B4D6589BA9538466DE0A28F6
SHA-256:	910546309B72B8E5666650BAE9182F4C66763F6DA4FEB7EA78F6A5EF98DE2EA6
SHA-512:	F5AFE6A0CED243EA58DDFD99B1B235A846865E94C9A245D049879D51D2B313EF140A091091345D44B1080E382A67E8840D80226348919E50599F6D1404F1A3F3
Malicious:	false
Preview:	/.......j.{..c.N@.......r...am..._..c...x.@>o...".T....aR-4.1....h..g.q..F.C`...#....C.....&G.4d...........+b.$.r.)E....!..(.L.,.P1..(8..... .0..h:....=.X.1cm.;.M..........3T...u9NQ0......7.t.5...O.?.BI#.Xq.n.A...I....D.~....d....}..4.Z!U50.F..mM..g&........'...ca..,)..w......6....y[..Ox.".....LCG..Y.y...B...`.k....FE.,.P.7...DC...QM...ud.Zm...[.>..9..).y..`.JX~..v.(h...bu.YG..:.}..Y..:o....\.".l.G.8..m.x....Z.....h.[zr......1]...^.)&=3Zb.<x+.....Ya/...xy.T.....V.uM......:...[..lk..x;...\|.....t.\|/x...]V.;.m.eJ......p,....^(..(V.Y..D...).8nDx....GO2V......\|..?4..d........\|...h...%....J.,....\.2....m..=.......Wr.#.iC.%..9}..=&..;.=.kC........^.(0....j.\.! ....7.....^.......Mt...._..2B}.Kw...B.S....\|+\.zhq.Z4.....(..:..\c.u.1....r.U......z..aG..J0~...??....b....2.......F.....v.V1..Y.:.[.=I.\|.p..}.=..2z.{.G.=..\|#:..../E..;'q2...g.......osB...N...>`.z.`p.Gf...../.tm.....h.?60.P6........).,.=%....4..q@IIe;.....2......=I.{.\.S'%X"..K...

C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCache\IE\CS6IXJW6\images[3].jpg.blockk (copy) Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2190
Entropy (8bit):	7.914089175077123
Encrypted:	false
SSDEEP:	48:kk1LwKgglv1VIFdMssY5nGiArVm03jAmbkkxTb540HzGNx3In:4gFIFKssAnGiArVm038mbkkxTl40HaIn
MD5:	9F2BC9A492B5C5B52C6E260B3914B311
SHA1:	034E624EEBDC2A8D579A8403B3A98166D77A05E7
SHA-256:	9CABB04E7E6CC8EDAF8DD62C88541E7620396AF74347D7A6AF5B9ECD967AA950
SHA-512:	3912CA2777C7CB702EB063C45E41FB3DCC5244B694F419721910B270EA40498A3345F4C00E6525F9050177E4842225D955B8AD214616D48A7CC925ABAFF942B2
Malicious:	false
Preview:	..BP.}..~@..]~....gF.?......u..Q......... ?...fa..F.....Jju...K..c........`.Q.Y...@\..s....Q..j.[...u..pD...F...}u..d...3\|..........F.pA.p.)E.j.G.b=...X.......N.iT.v.......@YUT(..H12kG.U..F..g.b{(..Hb....s.....<.._.5.Lf&.......^cc....lJ...2..0...6..b4T..;.I....K...\|..v..TZ.T....<.V}..C.....rS.@...]......'......:..r..2.../.....L....."._..O...\.JK...9.....h P..zeWl....^....e.... .5...0..QY..U....vf....UI...M.ns........P..8..h.......f...G"..L.Vt]:.z.....A..Z..dL......e.. &.UYH.......'...D..'+.l9.;....k...WI.Ht.:....%.$`...x._r;(.>.<.~~U..T0.....(..'={.).O..<A...d..h$..z..G..\d.....}7(.l.?..rK.....v..IJ..vP......k.Xl#..G..'....2r.(....%..Jr}.x..KKD........z....(..e... ........u..n.....Q.......B.....TiD.u......fs._a....t....43.)%s..g.......O.J....7;+.@..\|.q..))v,.Y..'..'\...`h.E4.sw8NH.X.T...y2...F..L..P.....c...h..$.....B..HM'V...mp.....C.\|.U......i.m.-I..t.V.@.0O`..C...".O.:.........p.3..Q....K.k.-..5...8..<..p.{I...%.9...O...

C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCache\IE\OR0WKIO1\RE4FBmV[1].jpg.block (copy) Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	256040
Entropy (8bit):	7.975334519201422
Encrypted:	false
SSDEEP:	6144:+Op5fRJINYSXXz0j48yx625/AwyJzQfuhO+26nF1rPer:D5i7nzs48yI254wRfbn6nFFWr
MD5:	EBF1A082825C3D86C4F13A0E0B3C6E13
SHA1:	48557408C5A0E145C7244AE182B86BAA4EB35A61
SHA-256:	5AFA2E911291F15581435F216A6324BD5A37F30945771D393F4D792EEEA6C299
SHA-512:	61A7EC4CF1D761E0A085A99D74FC33396A5E068F77592BDCC3E30C1AD25AFFCC2E5B082D6E2AAD19A5FB293A19F2C15C9D20EDE3D2EC46BEA441D9D4B9F88802
Malicious:	false
Preview:	&...N4].q.....j.2.7}Q.'z..l..~U...jW....+.5..L2.....5..@.7}.o.D.q..A. ..F....Ki....!.....4......;]..../x+\.5.\|..6..6.<../...4.....>.q]...WF.....sO..t@..s.......mSH.......x.......OV.4E......g"R.2..Y....`..E.....gM{..<.s..~kb...d6...lnD\..... ....~b.J.E.. .....\.....z..Jf..x.\I&....iPi,.P.]..Xa.po{...>.x..D.k.`...L ..tu9}....G..;.Z6;.......4(.ho....S...O..9Z....p..%.gCn...Q..(.t.0..~u:J...E..8......TR.]..KL..........+.$....^.,., .......N.[,.a..Xj......tG...C]....my..%....d.....i.....-.e~.z,&.`.....tN.l...!..5S.Y.Q....." b..'.q/..5.{.gH.......G.2....jd.2.....7.O.7m..V;Z.?.......A.U....#......T...+.]...6...\..~wF.m.C....!..jKp.."..I:hUo<.n.u.=hsy:.w.j....g.8.n...F...a.A....p.....8.4.m..v.6..2.(...=......?.(L.(.%...6.pMM:DerivedFrom stRef:instanceID="xmp.iid:1436F67CE40F11EA8185BE8D2649EDC0" stRef:documentID="xmp.did:1436F67DE40F11EA8185BE8D2649EDC0"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.....................

C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCache\IE\OR0WKIO1\RE4FBmZ[1].jpg.block (copy) Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	272125
Entropy (8bit):	7.975760621011833
Encrypted:	false
SSDEEP:	6144:lpeS2zBRuPY8Kv5pKKfp+dkPylrfRpBIOFb8l2dmP:lcSeBRuPY8KvJfpmkqlrJDImOEw
MD5:	23E4410BBF0791CD05E7FAC62B92604D
SHA1:	E8551AF130E66F43C327EF72C0EF379F06C5A97D
SHA-256:	F3346598886BE77E62AE0A3A57B129161ECF90F54DEFE977FF4A199A5D735C04
SHA-512:	DBD9F7DA91D90BA4394689581D40D183697020C525E76A70341C168199C82BEC8F4E4FCD1EF5DA2BFC7CE0C6C18E986AA1132B5940D7E554EE9E9E64FE9C2040
Malicious:	false
Preview:	S.....(.\8..<....W....5\]/....1. 1(.bh.X...+M.....".P3..u..(.......<.fZ%.o1..q...3..L.>....\X.J.i&.......C..:v.(c......5....fG:....;{.MLn.A..2...$.5......6^\|.n5>.D.Hx.3e....C1.q.>.y$...[.......s.&..x.:....:e.....[W..^....F.n...y.e...ms5.B.Hp$,.kWi..v.@..Tj...8.?\|......ct~S...HQ...1.....C..-...z..z.j..EM.{......A..7.)Y9..^..Rz1S'.V.bmmL.a....HK....$..*!.V.!.S...j..B.0H$............II....o.A..2(.?<U.jQ.ZGl..r.T..!.nk.=...g?.:....a...F..v...%.\|..P.....U...."fFRlS..x. .RB.!f..I..5....f..o.4y..._q...1k..q;&q...c.-..X..v........O.Fz.Q.;.l.T...5...8.~g.O..YJ.. ..&F..}..g.Q..0Y...rO..f3.U.n.KjdY..%.G ~.L...q.i~...G.H.#.A..;.1!....:...r.F..u1...+...@H.j...Z....b...E...jK.D.,/.X..%......\B$..}..t......qq....\|n@?..u59.#..pMM:DerivedFrom stRef:instanceID="xmp.iid:2B46F5F3E40D11EA8185BE8D2649EDC0" stRef:documentID="xmp.did:2B46F5F4E40D11EA8185BE8D2649EDC0"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.....................

C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCache\IE\OR0WKIO1\RE4ncJa[1].jpg.block (copy) Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	303034
Entropy (8bit):	7.928041935376861
Encrypted:	false
SSDEEP:	6144:v1+b8qAB82Xk5RAVXASfbH9GoDBK6RVK9akhHN/gpVkkcBF:vYgG20bUbMoDBtwnt/6OdBF
MD5:	6E8BA745F647980C591B466361331511
SHA1:	CE07092EFC2E19EB12507B5E18F5418A34C3075E
SHA-256:	9B0303AD04AD7061432B65FF7FB538E80E40A9FAE6F0E69F3E8D2442C9188A5F
SHA-512:	2E720B549B1E4B7ECDDBD9DC6C27FF2D5936B0C96B27932AC7B36999F8F736691D2585DAFC12F68A7747E9E3A51979E87F559C4C52568E5A4B0DAD5BD451BDC3
Malicious:	false
Preview:	.d.)t..X...f.Y..,6.N...8.a.....N^..:.RQ0D.v.il9.\.......E.u.\|..2.[* ...K.......o.k.c....o...,....Pj..0..dY.b.5.V.v.Y.q;..@..OEh..5.H..d,m..HS..Q.l....o.~B^g.9...M....o..."5.........>...T"....y..T7C..cm.&...v...:<.V....\6..x{...)<.X.+.VI...Bw9...H..,......hO.e.~B.....l..^..........u...o\=D7.r.L..G.i..P.tS...c~.P>{.F.>R.!&...:..'..%.#."...:.~..).g.{iu7...fi.G..2...3#.{......."...S..{.K?...7F.C?...k.6...k.?A..BC.L......6....+..........}.n.&..B.e........C/..V%.&.C....?.k..'.l..m...Cw}qkr..B.*..7.....rktP...fD@xA..%....~07.eG..i..... A...].:K`.......=~./.....b./.'=..1..0..b.>9.P.........R=S.L....,...[M:esy!.6,..X.i%.m.K16\b.G..{3.[X...?i.MO.p....SQ_....p.C.Iz+1.....B..E..#H..#.U./S?T@.k....[i4..[..q<..;.G..T..Z=..)P.i......,.r.e..documentID="D6D9EE93C73FE032909961A41E780051"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d...............................................................................................................

C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCache\IE\OR0WKIO1\RE4tD2S[1].jpg.block (copy) Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	217648
Entropy (8bit):	7.97738976730439
Encrypted:	false
SSDEEP:	6144:VVdriJHZXhRpdDs+k/XcT2TGvtZQZN2R0ObNT:VVtAZrDsJyyW3Q3u5bNT
MD5:	0B9489C0ECBA6120CE1286A00E1594F1
SHA1:	79F51F001056E80CD0D69C1E97639D77595FD0C5
SHA-256:	10C8740EB1568E053AF43B98CEF3706CCD44464D1492BC7319289634615F3CCE
SHA-512:	CF234E6D016E8F8D62ADFDCB6AE3B1ED91221BCD5B6022315A88555450DF63F350F51AB3DA7877E44A0E9C0A28E9D064966D6AB9D98F2CD87C6EB9726CB18E58
Malicious:	false
Preview:	J..3\`..3I...-/..x.(M'.p.....R]q#g.Q..n..}...!.\ ].....6..D{kv..H/.z..y....}b'N_5.....p$.J.qF~.a./....`.8.&.yN[..]...../5.4x...^......(Z,....O$.....3A.8A7,/.".!..o......-...(.H.nF<.!0.a......{........f.m......~..P..j.........y.F`..F5.f.w.!.e..{Q...g..~.....SG.3...O^L."'.dZ.i......).YP..t.f.s.]...S........k4.....4.C.I<..8$....;.Y.I.....5:....SV4... ..C...0.Ha......b....N.#3..,I...J.....C.#k...3e.........l....S*)'... -.c;.Y.}..5..^A.O........P...D...V.IP....0...].Y.U]p1..h..(....t..._......D5!k....e.a`..YVj...J.l....Q.y.qa...X.......M..>O~...O.....-`.......Lv+F.dvw..U....c.+..B...a.U6...Pv..+.'G^.`.5....R.Ea....y.HVx....^C..b...B...!.2.......KQM_.....wL.A.V.&.fl..q.-.._E..._.wQ.~O...A..}..&a.. _....v....A.......a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a

C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCache\IE\OR0WKIO1\RE4tG3O[1].jpg.block (copy) Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	13879
Entropy (8bit):	6.811975571988965
Encrypted:	false
SSDEEP:	384:yr1iogZ9YPY+BFGNvZg6GAsG111111111m+:Siou+6vqN+
MD5:	5991D72D657405D7A5BCB64B8501594F
SHA1:	72E7E35AECF2EBCAAFA9ACCA7B3C44C7B56BF5A1
SHA-256:	5D462903438AF9384E2D8CEBE05F58F6222C72435CF89F4283D17BAE9E9BB96C
SHA-512:	C3762C67748853C50A561ECB854D319694D8712FE621FEF70007FA34EF7DA91BBC6513356C194D9575E3BAB47C7CEADF82E3D4F608ABBD9360AB4BBF97543BB9
Malicious:	false
Preview:	.?K..`.sj.dO..CAD1..SE^.\|..,eh...}...m.`.n..>k.M..('...T..d.]WL.&E.......M...j.d.:..m..J.....!.Z....}\...]w..w.. S..>....n..Z..K.B........BQ.....N..\|..I.,.%...\|.. ?5.,.h.j".X.P..PJ.......?X..yD.a5'.n..r.*..`.........]f....fP).+gW.f........3N.UT...\|.U.{.Bd ..F.....P.C..........!...B.K<.T.a._..\H.....S....l.#..^.c...e......!....;.\.....K}P].......)0tI.Y.N-P...?...w.6E.+.p...l..O...%.......F..M...r...u.z... ..nv."]...uaU..&v-...5..t.]..Kq.........$b....X..U.a./F...-].9..6...y..T...N..~\|oQ.....UY........R...L....y...u.@.xk... .B.........X.D.E....v.3.X......!.&.?..>~..\|,.xmD.a..(......`....7..CR..}L<.t..Lw.taL../9]..a....X>.....8=.Q..BP..7.x[r.dk.N....j.^F.5...}..........q...:&.4....)v..FK.V..&...z}J....xZ.w..+.u.6......................................................................................................................................................................................................................................

C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCache\IE\OR0WKIO1\RE4tIoY[1].jpg.block (copy) Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	170749
Entropy (8bit):	7.972957708565767
Encrypted:	false
SSDEEP:	3072:Jb2nxDd5sjde9VHFREL+tvS1KsODqRoEg6i3/p4PdRcHfUUORRUbDF:ZcDtVH/EqtvkKsijDgRykRON
MD5:	B3ED6A37A8FE515EA7DB005B7184148C
SHA1:	9DF78EE5C443748CF2D5C9CAA60A95F85550F210
SHA-256:	48DCAC6EE0E8F47EB4E6393C1CCF9F3A775D3E43BB841F5DF88B5480A7E25927
SHA-512:	37EFA713178E1FFA82993F508C64E4577B9AED940D4C128426013CD64698AA1A591E835E8F8762FB2FBC50806026DF20E648BBE966BF1C70E9CA0EAE8CC62731
Malicious:	false
Preview:	.)Au.7..m.4.e{.X.Tb..T..Z>...[5..M..A.hT. ...V0.f..&.9..Lc)....!G<!.{U....5....nmQ........._./V..s.>....}59v@`n-......0.3.hv.2.$...pA}.c%.i.e.m...`...b...x.....O..}..7;..067..~j......B/.j.....\4...:+..I;.n1.j.t4...iH.T...=x.i.cc...y....?a.k>..p..{...B..q...E.id.p}.J..q....o..?....c-3..-..T.=.e..X..5(........Nd...%...N;=.7..[Z..%.".ODC).;...6@.p...&.F.^a..6.9.Z.X....!/J".^.%.V).q.zU.H).b."........'..>.x.\|....n..W..H..pC.P>..u.(d.....>1....A"`...[..O../.?q..&\|..fms....d.)..n.Kc.!..'.4.vi..9.?.={/.].......e...j..L../..<..oq...#Q... n....G<...@....^...T..P....ch.AP.\.....Dm.Z..0r...U...,@}...i..h....m.N..,............7..nNrk'...."T.rS<z.BX..{..1...$.4..S..P....Yd.....i.u.gx.IlciKbr..f\.r9S.........fw.........Fj.4Q.P...A..s.....@2h.M...4.&.d.....@2h.M...4.&.d.....@2h.M...4.&.d.....@2h.M...4.&.d.....@2h.M...4.&.d.....@2h.M...4.&.d.....@2h.M...4.&.d.....@2h.M...4.&.d.....@2h.M...4.&.d.....@2h.M.P.\|..Nh.M.B.)f8U..=..$...v.Di.c.Ub.*....7.....9

C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCache\IE\OR0WKIO1\RE4tKUA[1].jpg.block (copy) Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	106114
Entropy (8bit):	7.923253442658809
Encrypted:	false
SSDEEP:	1536:COqtPPKAdvi7hjJIwc86/nogKAXynAERZBlaKTjpmALGGAws93eFl59RjPb:CftPBvghVIfP/nkAuAE/N4Al+932Bt
MD5:	7AC9892F6972A52AFFD1A6F5A6D2D5B6
SHA1:	C20A6B0A3D667284FA90354208DA0ED09165A314
SHA-256:	4F1D682A8FC66E1544812452F94EAC86D4DA997E95F330CA3C9E171B29E312BC
SHA-512:	17BE67AEAC45FB986EEF1F2F8D812EDC376E1B65F986A6D020258FCEA0CDD849246E1A1D648845CD17B04DD1A579738134C64D124D36BC3AB145059D05DC50E3
Malicious:	false
Preview:	..U.4\|.......8..$Az.l....NI5........H.cv\.Un.#.n....4..N..}.H_._j.0........R_~qs...f{......0O.....czf[.s...1o..V.{Q,.........{v_.vo.~......+z..V.....1...Cg.~c.$..F._.p...."...x.Q...Fp .!e...V&..GD._. .wh&=b5.?..M..;..E+.s..I.og....p...U..'.w..RW.....HmN......H......k...G.I.>....3..D.x.Cb..M....4i.}...]^A.....~.5.!.^.....@.v....n..,.....>..K.&.'.....3w..hi\..2c.2...=;ebk..nB..\..4.MV..L.gs.H.....A.!e...OT...mOv7....w.}.+W.G.r.gA.-.W`.q8..^.1..p^...zx..O..=.........hr..D..\|...K.......;..@...)f..mL...s.......J..Q&..i..2...d...j......7:1q..[.Yt...@..{...c...8.#.....m...-Y..Z..n...,..4....7..x..Pd.E#......O.C...PS...0r.0.W...h..)....#..y..'..%+.q*h...m.K..c....EZ5:Ll~.../..D..Z }y........a..n.A:..RtzC..%...0s.UE..m.%L......].....................................................................................................M.....................................................................................................................................

C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCache\IE\OR0WKIO1\RE4tMOM[1].jpg.block (copy) Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	108801
Entropy (8bit):	7.804879223211447
Encrypted:	false
SSDEEP:	3072:DcB3vbKK9eMXMsM5cVf4FhtEsnKGTeQ0K:Y159FBiFhtEsn7t7
MD5:	FFB56689DECEF284E8AA4C9D9B9373E5
SHA1:	FFA1C884DEF36A640F99F6BAAB97C27731154289
SHA-256:	96FF068AAC2DEC5B6E8A1E546E6B9DBF5D09C9C240D05A2F8B69D27FF4A73F12
SHA-512:	E86F38856381B351536B776A0401FCFF505703987EE0EDA1B98D60993C68A132A17EA23CC22DE87F61142EF6EE8C28C0923F59FAF0C404DFA79AF8B8A42E0DE2
Malicious:	false
Preview:	w.!..-F.7]...<.9.$.~-..V.u#.....S...Z."v..l.aD lf.E.j..#w.m3...:.o.W.>7:S5.q`..Y1.@~...s..QV ~...45~.-m>cd>0.)....n.W......k.Y..NNN;.....[.;..F...k\?....{.R>.e$g1V...~.MZ.O...f....W....u.`5....w.;.x..t@.:....e.&..6:...Uz..A..$To.d.4W@..k...nn0E{XG..3..u....x...l}.#X.P.......[..h.O.}....#..IV.=e...@_\|.`.%...`.....jM..+.s..K...d.i...Ic.CuG.....g..0.......N52p.U.y).Q.9.E"....I.m=....'..k..42.jb3..E.......:.!..Y..D...e..@..i..RM.n..E.n....,..\|.p.h..]........v3..G....\|0.d..,d..4..C..#.f.%E.%.l9.z..L<.ti.}0.N.!.9..m.?..y.p2"f.!.tU.h.....C.E.&.o'.7....d... k.m.Ub.....S.fR._0.....~.@.G..X.Zf.wn[ \|xE>...t...5.....ac.E..&.......Wqx;%.....r.`.SY..@.%.B..v.OU88..7..0f...k....k.s..e-.3..Ek..../&..f.Ps..DT.....+%..i1..xQ.:.0/-.W1....0....V..r.e>...........M.........#.U...x......H.U{...$\|......>U^.w...x.;..W.`..G..0..#.U...x......H.U{...$\|......>U^.w...x.;..W.`..G..0..#.U...x......H.U{...$\|......>U^.w...x.;..W.`..G..0..#.U...x......H.U{...$\|.

C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCache\IE\OR0WKIO1\RE4tQVa[1].jpg.block (copy) Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	11084
Entropy (8bit):	6.4196195688618705
Encrypted:	false
SSDEEP:	192:smHeQ6gHlGDrjH188iSQxOsJQhYomvFgUADe:fHe+gptiJxOGaRkC6
MD5:	8074CBBA3372527148D53D8C2344EFE8
SHA1:	B3B22FF79BF55A81B4260F335AD228B087EFACA8
SHA-256:	E7D03869E24C34F637CA8F1875B6396673307108DA9E34D1E26F2D6849253B4F
SHA-512:	CA38A5BD8A2FA29194DE1A7EDBA8DA6332FA8E33DAA7C0253E20FB725C8E9BEE41F7C1DFEFB55EC1B1552919E535FE6BEB763B048AB9D4566D2BBC1D6820F604
Malicious:	false
Preview:	....D..(.![4.:......i...#P.#.s.....,9.lW`.g.<...)..ZRb..t.F...<..mj.>2I....7.k..4.9.b...o..7..`...ID'...<..@"....b:[. `.......'.#].Q]...5L....;4.....I....A..6..g...7.....a:....?.....I.F..LS...H..$$9.s..A...d ...:.. ...u.6."z.\|"...j.....q..\|.Wg[P?....e?."f.......F...u..:..e..<]Ud.nG...9"~.Z.D.e....C...6..9Dh.._@..5..]..w.... Y.....Dk;..%.Z.h..q.!..Au..EiF..q.....d..u...g..D..c...F.].M.DN.. t{u...W...f.C}{$ 8.-Y.Cp.2..QA-hP.8?.M.r.>{E..~....4..(A.A.O.7.M.2.Y..Z.I..`z.^M{._..M.....O.+{z.\.../.AO..... ....R.l.[1...#~2....R.Ik.K.uH'M..T..g.....p..N..5.0.mr..<.P.#.v...%z..6...W..I...M......l...P3..{0.2....Kx.-7.C6LNq\|...D..wUa.Gv.i..\7...~A.u...I...8.N.$B..v./..:.?..U4....Wr@......8f...\|.5...3..Zwk...+..n.z...@r.y.T..E.....................................................................................................................................................................................................................................

C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCache\IE\OR0WKIO1\RE4u1kF[1].jpg.block (copy) Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6757
Entropy (8bit):	7.966804322612872
Encrypted:	false
SSDEEP:	96:W1DuMlU96CwGeTa3llyAelV9nrqT7wHxxHpcMgQl00NxH5fGh4p8GMjCgKMzCg1y:ylHx4g5V1rqqpF53XGh4O9zjzCg1y
MD5:	F075E26359ACA84C73D85D3385A1BADF
SHA1:	2B9AE02233E105F6819D3F443A34A26A826CAE74
SHA-256:	E41AAD3BB8DC4DE1936F3F7D10E6BA8685F3EEB2D139821365C6DABFBF6EAF75
SHA-512:	8EA6F2C1929F7A81088997875C44D8030E1D8290EF2DED4E60BC0F33E5995135BBF617013D2EC4BDC8508B9EA81CBB6480BF58A49AA585866539F1521B87BD87
Malicious:	false
Preview:	....{tW9.L.9....3Cj&.....m..y"&5."..H.(.V.W....G..p.>y.C..v...puc...'.MK..G.1...O.(..0S9..)c..k#._.n.EY;D.d.HL..}vk....f...nK...9he"[..MR@Zq.&Q.......Me<B'....D.Zt.`.........~r[`...9D.`...R.!.m/..N%..W....x...u-+.4{... ...K...E)Xv..1?#c.[...M.@..LK.x...\...6...h.....H..8v.S^.QV....d... ..=.M5>...<...yN,.`...$..@Ehk.`......8.. ../.....{&....w..:..\.w.il...N.... ..N6...u.....Y....ZEj..\/\|i....SD.....L.....qp-;..OEI$Y...N1.+...k.g....@.,Q..43b.6_......\|....<[.g....hG.2.....;.Y...d.+kXf0)dXh....i?.D....w..}..i.;p._c....E=yQ..H.n..D...O....L.]yw..9...V..<&5..0.G-.......`..H...(.....d.......4.W.t.&...... K...(_w.(..8>aU?.[..9.-..`...4...Z......q...V.Xz.Hb......;...T2R.we..mlx.6..=.P....m..;.a....%Or.3'.....%.(R..F-._.Rz.... ..3...Q.\.d.......O\Zx..)...9.S..,F\|.H._,..n.;.[.....r.H...;.Q.v.;5..v.@."K!..i..0.DY.i.`.h.........5.........?...s......L..(....T.:..q...2m..<jh..\..J.G.:C......m.,.7..v.j..=.....,..S.IB.g...&i#`2...Z......{......K6..>?.

C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCache\IE\OR0WKIO1\RE4ubMD[1].jpg.block (copy) Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3767
Entropy (8bit):	7.92978734445756
Encrypted:	false
SSDEEP:	96:x6QmLucIJlKGSlFEbff+twNLHL+io6HzUI1wKn:x6Q71lfSlOjLpo+AIN
MD5:	E1D567B2CEE8D186B1A136FC9E8E8E44
SHA1:	42F1FE7EF86B00D37DD12B9B16B5286DE975D270
SHA-256:	CE6E23E0AAABBE61F09079D8753F0B8F36697CA9CA180AE28F261D199CF4738C
SHA-512:	24BFF6E3258C0A664D7029A6961730CE879D873FECC0C88D2DD62E228C3ED18A490517AC7598696C8C1E711EB7A638A11104E9BC873AD4F2E7D2BC44299A5A00
Malicious:	false
Preview:	H.BPF...Fy...:..S........k(.Sw..8=&..,.].<LK....M.&Kl...s."Y...9[.[Pr.t....jJ..n.^-?.p.Y.{D.#..5(.!..uV.........Y.'..<.g2....n%....X...\...h........F-.......C.....4{"...d..{...I.k....0...K..gj.0.[.....b..h.%.@.....bk]..`/2..Q....~..s..W...t1..^...UQ]i.E.>7...?......Q...1...(..H=...k...../n.s..........3.....ON.-.....r.>...v...y..N..:.....m....[.d..&.!..j+.._+..R.0..#.....[P.0...Ww{.RVdY.&\|.....$X~.F.T..j../@>.&.g.E.'...n..S.Q7L....C....2ZRw...Z.nDM.3...l.^.g...+h...l.....Q../...^.;.._f..L../.(.......{..Bo.^?..}..F.Y.k;=.VD.*P...@..bU8?{d,kXr1...qo.....$r.../.F........y......e2..=Wo.4.o.'..).&.;8....Ir....~.{.&\|D.+^....5...A.r.s..[.x.uGq...^,2N...t.7.o.....uQ.....z.(X.H. ....Q...i;.......Iz6.@R.@...@.mC...71~...%B...Ta....H=...!.1.....x}k........A..X.@..ND]DY."r~9ww..l..+.;..,.VOnR.....Q...Z)$.........s..7.._.u1N.y..r.8.c..C..........9..."..N.8D...N.8D...N.y........<..??...xE......gqqDS......{st.....Z.>: E".,.K[YQ.r..HX!......

C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCache\IE\OR0WKIO1\RE4wqj5[1].jpg.block (copy) Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	117633
Entropy (8bit):	7.982720011043676
Encrypted:	false
SSDEEP:	3072:glz/xSsXzOkyW8GCZO7HTGQDck3GMySdCbz0DFX3o:4/xK1xOHTGQDPzybz0R3o
MD5:	43EA430C0A748AC2ACBD8BD73CAB3EDD
SHA1:	16561E6F3F1BDDE100C5F730BC6A15B7E0B4C60E
SHA-256:	7DD955EF58B20CC28CF800893169BBB1C1B9F972C25A919F8942E54D7CCBD9A9
SHA-512:	E54550A3A2606403682832DB5F74F353A458B3A59729B1E708CEE4ECF1567DC48D16C8486CD8A7107DFBC545BEA4520FCD80C58F45EE7FA16F44302D0809488C
Malicious:	false
Preview:	q=....._6...s..2(f.lo......zW.1.g.u.~)%._.s........o......Z......O....0_.....y......Q..~...?...L..&.,.p0d^?/...........q.=..H.u9.....b.F.p/.7..yxE..h..u..~.(.c.Hn\|..,.......tZ.x.B..B..I.0. .]F.."!Gs...?.q.N.w.X.{...7..x.....f.Q3..<. .U}m...ir..."....d...M..b..i..o-&....:[F.@.=s...8.]D6`X/.. [9.......-..,.h.G..>.....A..6w..%......I.o......M,EMH....QgH..0a..Tq.y..f...x.....\|.3..pu..j..\|J....A<5C.."FF.Lr.N.K......[.fC.-..@..%..D.:..O9...U\.;..k;.YPk...D.v\|.[a....z..:7.T........u...\.i..c[..G.@..u..~_..x..".k...4.:#Q.y8..K..1g...n~.P......F.......GD.f.u..R.N...b]D.2<H.TU."..?...(_^....<..=.......\|.. ..8nXg..?.L....v...(......e9...J.$.....A.yP...C...;.$.xk.m....+>...b......5.T.b.ZU~G."=`...x..QF..>..W..V..].....g.".^....=..e..v&.s.s...c"]&.c.Y..Z<.ws...1.3C..w..c6.....E.-3.,...&8..R..\|.E...].p.........i..t=c..y...zL^.a..fCT.YE.!..G:k.>.P../.....k...8.'.\|...IL.......#\.i.. .hA1...2K...~.uB.a.:e...,.x...@.y7$k].&./.u.aG

C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCache\IE\OR0WKIO1\RE4zuiC[1].jpg.block (copy) Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	62651
Entropy (8bit):	7.952472775853044
Encrypted:	false
SSDEEP:	1536:EBeEV1UeB5KigIdgJ3uXWt7sUWdeNvB4Y+4:EdV1B5Ki9K+mRsf4Nve4
MD5:	89EEE45988897B530CF727098C9E758A
SHA1:	3229C4C29C84C8C4DA4F718B2E72AA351562221D
SHA-256:	68EF285DD8236419BE94159B4F90EF0AE6898684A75109F8C4519746679EE91D
SHA-512:	BB347F074E25D089C31D124F0F1C3D40BF8B47955F84B571941119DAC0FD3B3DE7125BAD75FFCB781F82856D62DA1DD34A067D1C19E46AFA4B99983F1EFB94A2
Malicious:	false
Preview:	.......%)0.KuOz.oWuu.....,.4...Bi...x.$<B..n...G`.....k.Fv.n.M..v..F..y....k...(..s1....S..zF..+X[..".k...)...F.....L.E......E46........L....Y.r....F.)2.^[U.5.x%.S.;..;.$~.b....7..zJ.?0........ .d....L..<...#..n.c.5R\|.6o(....QDr.....d]%/3.{...-...J..G56o...{..K..6....0OG...C.E.:......E...!.....O.....Z..E.....O#/.&+{..;c.I...YV....-.'.#..oi}.B..!.8.......c...O.V....[.......I%.n'.f...K.4<.......]a.f....w-#>..x.....;...45...... ..QZ.(...pJW..0.m.b.H(^......R}....0>.....&.Bj.&.SW..H.!U.0/a..1=~...D..x.?;...8.+.s..6{..n.N].....yA....@)=...Y.6.......L...........M...~.#......b....P...e.l......c...+.L4.....:..?g..M......J...j....X&.a..f......4.=.$....\...Y. ...#pH...."....W4JC....U...o=Q.7.K...L.....}.........&.d.W...............{6l.cY.j...0H.@.ZW...l.%..`.Z5]s.t.~..'}....\|C.C.y.....8T. ...,.M_...^......`.....8...q.F..#.x;d....>...k..s]..4\.......xVn....n......c...#.E......i.0.....1.....\|D....{.^.v.........~..........5....K.>?.....\|..

C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCache\IE\OR0WKIO1\icon-fb[1].jpg.block (copy) Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3306
Entropy (8bit):	4.791432632574388
Encrypted:	false
SSDEEP:	48:A8YFTJUG2BWu8zqCcXqJ5Xhw3WQGI5rnC6V:A/TJUG2I3qC1J5q3WQ9I6V
MD5:	6A4FEB552CD4B1C5362E443DC604C2DF
SHA1:	84BBF4869801576335509C9DEEE7F84F0CD433E3
SHA-256:	55ABEA06A82D0C8C4D0B51947E79719AC6F788B2D5D7BC0996707720D6FF67D8
SHA-512:	E250CE5243CD6B44F85013740680EE6A56ABBB9525B385AA1467E77DAD74EEA1B41EA8B9BAC8AA187DF66C54C40F41077FFA46834FA9F618FCB981DADE5B8978
Malicious:	false
Preview:	.P.`0r..vl.u.}..T....Q..1...lo#......@...=.P.A@[....k.D%..$...F...r...).<..w...I.......j.\Us...r.GX...@.,...74.w....t.:...4.$.x.<...v.....pD..nV......[....i...lAHW..N6....77.!...G......G......1...P..b.B..Q..s1.:Q.(...q..5......\|..i.7zg.k.L.a.\....~.r..._..^......h/...\|I...vJ..\.U....P..OB...Y?.B.m^...cL..?P.y...Z....s.L.X.0[..c.yC....O..\|..^..,#.B..)......M{%....[`..8..s...j(.T...C.nb.wym.Q...........B.PZ..s@W...r .....&...95.~.Mm..kpP!....)..f.....E<......H.0...3...>..:.j!..]."u...-....j3T..`+.zy...e......x.P..6...?....ag....JN....`G.B.N...0.{o>.6u.*..b=..U..:....?.jC56.o.s-.1..7.w.\.........M@c.....(1G. q._XQ......q.c.Q2..V.T....k}...L...I.b.L.`..q.D).....E;.,!..SR.^._h... ..}n.Z...Ct7.....D:.._....2.F^z.].T:..

C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCache\IE\OR0WKIO1\images[3].jpg.blockk (copy) Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2174
Entropy (8bit):	7.9177874306665155
Encrypted:	false
SSDEEP:	48:ouEfPrGbYjwKK9DPhRfEaKE2cSWnsTmaLiZCooBAtAH:ouEfnI/sascS82iZrtAH
MD5:	835B21BA5B0B8973010BB2DCD7C29F53
SHA1:	557933C3612B59E8EFAD2E059CCB35222D2E7037
SHA-256:	A50BF408F9FA2BD84CDC508D2A7DD2B7730E70DA75AF6B95A7388F7DCE7ADFF1
SHA-512:	4C0C05C0FD07C73E0ACA0C6F49E8552AB41704FEEDECD1FD2CD96AA7AADDD7DCD8FCAC4D6AFD4E612DFB15429ABAD19FF77CCA5A6DDBC79138E59F3EE9F475DA
Malicious:	false
Preview:	O...}.~.Z...jm...S.......R.....D.t.=m....o.=8....:..t+.xz...>....j3&..Q.nRp.....'_..............,..n.\.\|.x. M,..._....j......6.........+..o_T........E=.....g.Cz.....E/..;.@..J..[...X.~.q..f.....qF.....r.38Mg.,L..uG}K)4AJFN..[j.%&......2.dWgv..S. ...2.8..f{....N....r.....\|.1B[g.....5..Y....+=mCO<R._.,.a.3 vN5...s.....K.6..}........).@@.[..N.t..E.h.O.?. ...$U..b..A.!....F.K.;.u....P.....^....UK$.%.-]2.3...%W.bg}.8.T........k.V......2......?..;a.Y.Y.i.0.w...@.W...]lQ..$.\|....dN.....J......\c...x.L{tL.=..9.9.to.O.S..hI.S.N.9ez.^...^Xu....k.1.CT.C...D7.......N.@.xEL.'jU....<...#.A...."0.a..].i.3...3.M[.pm.DB.dj/.dbi.W...P.ce..3..].K.....N.tq...F...wi.,.i.\<..#;Z0G.O7Q3"9.....pB3...TsE.%.J............$K..x.A.YF....d.u..bv~....J........f.iK.e.HJUk6D...'-....^...g."{...L....N....Z..+...w.{...Lz.~.....o.t.t...T.L.............>....ug{....H..Ec.Y....!.V....1....K../E..gON..........R.#.6..".3.....z.X...M...r...I.!..`q$Fie....AM.".....7s.....ZQg

C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\{F98E098A-0ABF-4C65-BC96-7001FB4A77C0}.png.block. (copy) Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5829
Entropy (8bit):	7.915699076330811
Encrypted:	false
SSDEEP:	96:Cq2Fgt5oQ35jzrCArEPbFKy1S9Lcu1lzeqqIIg7hl90EDTGlDn+5nxQAa2p:CqYwfVrCfPbFL1SFlSl2hMpQ5xQAag
MD5:	CB9352BD7CE7B853B114FB008FD30A42
SHA1:	F672D4DA91B67239444BB61D0AE44E23912F3AED
SHA-256:	1E899DD5E6C31E06A54AF154CAFCC6C9748FB37551C0E8503C6C1192CA4C805C
SHA-512:	59FFB42EA8EF55F3FE6B07C91AC0BDEB74AB265321F31C086F837A065C265F25BA6DBED85B108AD9D011001A83D1E5514FB1F0D026948C995AD15210290D13E5
Malicious:	false
Preview:	Z_..:>nx...I.'R.3.:3=.I...1..e.......l@.m...N....#.2..4..Az".'a...JC/.M.s..-S..f.3...UI....3.P.....\.i......H ....+.Z.}...v...[e..T.c..%....bCi.,....DJ.9.].ng...\|d.G..&j......._@,.q/-Y..y......&t.*D.P..N.._......v.....d.?.V9...OeH...G..&.....\|Ru.5..G).C......;...7.M......QJ.....!.:j.5..V.........yM./.c#-.`....^..........1C..k...&.{.z..)I...g.s...1.....[...m........9...H...E..&....Y(o. .~f..uAV...3..)..6...?l.).k..j..'..C.o....6D...$3s.i..@.\|.#..$C..{.Y.i..b...t..C_o7E....;..... V.U.......`.....}./_E....7W..I6$sX....8...........3.N..u..6.k;.@.I..s&......]6.......7..1..M...lN..S..a.z@o.....A..h..T1G.9...G.Ek...~._\y.~G..j..u....t..L...o.....'...<..<.x.<V........{..X.yg4.s 2.._../.Dz...-.....N\|IZ5J+.<.i..[...0 p.S....C...6....B.w..n.I.h,.M.A..A.......X>.?..TU..~3..Zb.....0u.w.....Rh........Z"..yr....CK(b.XZ......hL...A6..GU`....`i..h'.q....w..A6kn....x.........;a.uh3D..[J.....4.....,W../........%.3@.M..F....d.e...v... k./...{..... ...

C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\IE\2WF3MMUU\BB19ylKx[1].jpg.blockck (copy) Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4105
Entropy (8bit):	7.9022341732078765
Encrypted:	false
SSDEEP:	96:qUSRgrYS1FJvIgl+9q3Rh6nUlc/JOmkvIgl+9q3Rh6B:2sYSXywmCXlc/J1wmCW
MD5:	D7465747AA1311D28BBC0A07D22D4CEF
SHA1:	4932F7F45E26D6205F3AC6FEEED8332B880986AF
SHA-256:	F2DBBA4042191C2A21B08615C8490F8541A0412C3E45BE71452DC6618F803809
SHA-512:	99FCD888DCABB3371C9756C33BCA56F5AF2113A58EAAB0DAD5CFE4198D49517FA6BD9CFA7525A026628C6FD54AFC473A0646A4080B88B2CF6D897B528CEB379D
Malicious:	false
Preview:	#b........9...C.T.P%.k..nD....0-q.<A.l...\|T.4xr.6...Ca...i.]-bk&..W.'5.@..-...zUL.. ...U.E..jY5R1..M. "...\....vkz.....?.gP..#....Y\|....[#vF..1....~.,L...4...a......i..F.......F.J..lL..O/......p...{2c.?K.. ..Ah.$...+.6\|J."@.m.....B....Q...c.6.iq.. .2........}..c.t.WH....:...."v.%r.T.wz......,.Ck...nQk...;.G.P.;..[...y.T....!$...;LF.p....t...`..>.8./.pu6..A?dk..v..L`b..Y3M_......O..V..5v@. ...M.R.f.e.Q.&..#..u=.m.{..j.P.~....k2i-4..N..Dx.~..B.G&...I........q\...=K0`..J@c..........1y.....M.'..S.....0..T....y~..gr.G.\| ..PB...3.b.k.f-...a..?\|L...3/<y..$J..3.`'.~.w..a.5.=.%.......O.VIN....8......Q.Fn{...^...uI1'd&2.....g..w]1c..VnE/...v..dOt.<.p..t5...h..N.$.n7.[.........(.H?.#......!......GEHY.....q`.L..-.5..L...P.IS.Ir./.i.`.v..r....\..=.P3%..gq..'=y.>Zc..A.0O..SU.s.~...%.V.R....-R.q...G...?.I.....i.$.....aEAGHV.G.y.......i...]gSg.Y.?>1G+..&.q..H..f....P...a.3.c..u?.[I..wR.W.1Q...+..f.LU..-.z..jj:.R.-.R*..I..t........`.L...@.B..q.Z..!.k..

C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\IE\2WF3MMUU\google-dev[1].png.block (copy) Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5673
Entropy (8bit):	7.942460167112004
Encrypted:	false
SSDEEP:	96:zgfLK4du61Djw7RMtsuYarp0Elvmw87rx/4Jg5AY1Djw7RMtsuYarp0Elvm8:zI9bRw7juY+O1/Mg5AYRw7juY+B
MD5:	3EC4B5293E60F5AC047AA7A39FA0A8F5
SHA1:	0803DCFE9E2EC8069464C1B46A581F5EEEE8D1FB
SHA-256:	36ED679F9424FB3272725E43D9EACAD58AF0DD5A385D333AF1F93498DF178CCB
SHA-512:	1034B7743E26525BAD39D399861277A4CDA4C3903D91E67073A0143808286EFEBE4CCBA116AD5873550A8EE6E35AE6EBB5771CF325C89D59B293B99B36F2F7D4
Malicious:	false
Preview:	=...=5B8CiRM.....[...v..f}K&..t.67D0...:.vM....o..Qq._S_s9.:.:...K..4.^.E.....j..7...V.Ck].C>..h>+.@.CR.T3G.....@&.J...-e=O.M...%.#....N...H.....n...9r`.%S2........").1V.(B.....v..C2&./p9p.C^N.S..S.n=.....JTZ..Y..v....a.....>D.M....v$K.g...5Y...C_.8F.......A.5...y..W(..<A..3.QY.@V.e-...a.h19.C=.-..#...'.5Y.U..../....r..p.U...5.?4.MX......\|[.`...s.....$cp.Zl.x.=.......U8.A"$.Q.....]<.l....k\|..{\.L=..>p.l..7....M;..d.-Q(}.....n.a./....]........1..3.f......u.[.....XP.~..xc.%P.1...B.......O5d\|kF...M..r/a..j..JB.@.D....>~...A.....9Uh..4..".V...`...;.y....g.o......s.TTs;..C..!;.^.q.J.....y.o\|.8..~IO...^w9..p7rZ......U...5....."&..b.....Q#E.h...dBR..1.;W.....9...a.........C..Y..*......d.,J.\|..s/...b..&.f..1..h...`.v.sd....=.....L....0.....ryX7\...W.uA.pbDW8Fv.sd..k..k.;..y...x.t...._.Wk.....`..5#.3.......K...Y.J.(.X..5.....SQU.D..M....gEG.Z..w.vB..P..#.6tB.f....u.:.ao.4.#..j../.....qT.....%}..`....D.K... g.4h...W..a...<.....y\|.H...8Q\|h.J7uE.

C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\IE\9026IKNJ\BB19xJbM[1].jpg.blockck (copy) Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5139
Entropy (8bit):	7.927930499162897
Encrypted:	false
SSDEEP:	96:CBdlfOS8J7yN0OXzMvBgVocffFkHap/KUn0lBuyN0OXzMvBgVocffFkHaE:CDlGrkNX0c3FkHaBTn0lPNX0c3FkHaE
MD5:	160EE0858F2F149D5C783561C873A91A
SHA1:	86CC3763BD54332DC250D6C04C9EA96A76637BD1
SHA-256:	011430CD77E2E96FBF353A13D316C4BBAC55B35405EEEC94415950821AA8011F
SHA-512:	121E3C90F927E05FD8F5ED781C4A2AF4E94DCDD819537C658C43C974DF1DDCD47B97F8D6642B9ABCB3ECF3CB8E8658B4EE1453EE696E2583B6C2B7C2CFC9C063
Malicious:	false
Preview:	.......\|.c..J..TX...._.N ..Vy.s..C.....Q.....RE.~.~.xxa.C....4..]Cx..'fw.....T...R[[a:.R.2..4... ..@...)MkR.+....m._..R..YD...s.....z7.R}.]@.2.T.d....B}.X..=0;..d..V5....J....\|sP.....<.'....KJ...........M@.o.....G..:#....g.z2Q)UKF"..K....5..E.....DD..EHT..w%..s.......[.Iy..,.....W.a u..a.....g..[..b+.Lv.R.-.......$.U..Aj.^.]..s.Rd.T..H.&._..Y..]Z+w...&.;m.Fyd...V_}.....6..wh[2}........q..J...,.h./..bo.X..A.7o../]...Q..........}.n2?....\|6...].....+.....8 ....F.R8.[.....P....m.... ..J..8g.C<..f.P%.L<..c.L.\.L.@...U.O...9{a...e,.Ja....!.:.@2..-.y..Ud..V..NY#.P....A.......B.Z&.s._>.+.i..c5.f.....i.'l .6L..M.,+3c..."..xD..:....M'.6.Om....%.a......Z...sd..Tl...0W;v`..U..p...e.'g/.Id..Q.."?!8.2...n`{N.>Gs^........x.p....mu...Y.....DQ....H.4..{+g1..c..tw..I!.D.;p.p..x6..u.....e.X.@.....l......c\|.g.\Z.[H.i.........n.n#..Qe.A.?.....jB.3.g..3....V.b[w..w.>a........c:.oR....?.....%YN.Fv.....`..\B....d.....5(.<.=.B......OU.+._....gh.......8..i...c....J.;

C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\IE\9026IKNJ\BB19yKf2[1].jpg.blockck (copy) Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	25905
Entropy (8bit):	7.966423875851623
Encrypted:	false
SSDEEP:	768:1naOV3hy3zikvZk//t7paOV3hy3zikvZk//t2:1neDp4tteDp4t2
MD5:	5B306639615FF64EE3BDBC4502462067
SHA1:	384ED4EB519E698302C3E6277C2371365C1ED63D
SHA-256:	14DAAA7A517E007D50ACBA62467C01F6BEEAC0FB8473CAFBA482161CA05383F7
SHA-512:	79B4668DCCDC3D101458C79A295A6C0D81D9F8AFE6AC386EC2B9AC676206046B71EF5962D92A5FFE2BC38E46A9F0062C1AC238D97D0F2D40945035562AF2A3AC
Malicious:	false
Preview:	......_e-J.(..y...u..?.z.......ov....o=..3....U.B..&.Pm(.B...e..S..m.\.......60...A#....@.E.......L.}..V<Eb.. ..H..n.${.R.......{@...-.B...".S.9MCa..5..6.+.n...F2v..4..u?w....&V..;.2e26.;.1nX<...\<....rw.....Wst...........%w.y.....2x7.,...jr=(.n..0..eo..&q..D...'....6c.y...p.v..+..F.....`....o...S_...1..st...t.{..#.....[..j......,6(.[.\|,Z..@p.iT..N.l.mP..Y...9.......z1...m..........&..x%.!...s.....CY.;....4...[....?;z........d...k.s.wg...mwI.T..".Z0.m9uf.<&.ey).r.[9......].z.../h.2>.. ....-..q....P.`.,.....Th......j.X1.D....K.h..)\|o&B.CO..<~.;Ed..Xao.=..].k^.9&>b..F..^...P>......GC)..d.?.2..z87..?o%..`U......S1c~'...6.................}...e....SIg.. ...u..OI..\|.a.o.au..(..BG.%.....#.o....x..I..:..[..l.x!-r7..V..~..F)...:........pO.HD6....1S.. LZly...1.=.7&.......HS0...;S....aU..;....i.,c..."...I$..q..qQ..{.7W....Ta.Vd...w.:.W.......u.$......7..2Q)ld.!.07n.O.V...8....f..t...h"T..3.......5b.r..@zu.\]y....n.!.I.j..h.wq2..Q...z..u;#`mdNc..#

C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\IE\9026IKNJ\BB19yuvA[1].jpg.blockck (copy) Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	25879
Entropy (8bit):	7.956207100411313
Encrypted:	false
SSDEEP:	768:/PrFUkW/7xLu114tTxrFUkW/7xLu114tTt:/WkWFLu11cTUkWFLu11cTt
MD5:	16FCAB68AFB5F671BEE3043EFAC74ADA
SHA1:	F07A2B59728FC3EF5DB208AAAE9D2BE7F41888D5
SHA-256:	8AB4DF7D28089AB80C3C6FC9D8C89D2AA824B6839E376A2E52D4F9A357C4AAE8
SHA-512:	15D084AD110840690158E4CA38BEE2C04ACAA4591623EA947994188ECD0561C04FE622ADB353130C314469CF5C35E7220A1DDDA6A7A7FFBE0D4EA05A40C778FB
Malicious:	false
Preview:	.XE..15 ........^....,h.>cq7...}........'9.a.Pi..S".N6Z}.bz..L..0.1..t..&.Ekv..".k.x....\.. ..M.{.88z..;..RX..I'..........~....x..@....F.!YK..:..y.Zj..d"j.t.....A.[.......B....v....e..k.v.T..!..(.Q....3%.u.......+.e...D....(.6vZ.p....&.Z.5.b..>... 9-O..yq.w.....}K(....K.\|.N..00....v..+{..,7P.S.^.Q.......H.>d../.....lm..A.\|:...i....9.+.l.8.v...Z......x..;3...~;....?..r...@..... .o/<1`...}..k....3...>i.rZf......&.X.6..~...9.W.....B..F..q.BV... .@..:.-}<.X......u%wd..M........s...6../..P.2?...9....[.b...\.H..gh..JO...?..A..]U.......1...\|g..../..P.....m.=/.ikw_ntM.=6....q...+....8.X.6<...=.Q.4%.....C.q....u.&.....bl..I.SC....j...Y..c.{Z..DT......;..'0#.....$...^.T..@.TG.I..........X.....y........o-b..O.....TM.E...\8..I.6.`#...6.......M...(.I.LP.x..&)6..x..&)6..#....Q`..(.I.1E.....v.@BzR.,Q..........(.R..W......m..Rb.-X....O.K....m.M..h...T.h.N.r=.m.v..\..f.!.T..N..T..<......Q............A...8..S.8<:K{ .F.m.k..H....F.`C...6.M...

C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\IE\9026IKNJ\BB19yxVU[1].jpg.blockck (copy) Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	15239
Entropy (8bit):	7.933300602104866
Encrypted:	false
SSDEEP:	384:et5irxAenBPYAQn5GztHgwbrxAenBPYAQn5GztH2:G5i9AeuAQn5KHr9AeuAQn5KH2
MD5:	6A5E7176C93314FDB7968FC3C0046137
SHA1:	854B0AE68B2486F71D52B780D0130385E7222DCC
SHA-256:	F81BE1CB8EADBDAF8DA71FEC62AF5A883163F90C871C645875D2ACD90C965723
SHA-512:	E6305E96FB93C55EC331C36ABEFFCDA8202FA5FEF87C682D17BA6D58DA9DBD4726B30575F2AEDCBA21751AC324BEF1092C00E6F9638EDB97AB3251514E7DF924
Malicious:	false
Preview:	..%osLp...B.r......Y.Q....p..T2...2E....@Xq\|0.....e.!,tQ..........Iy6s..L......Z..M.yT4..t.........3.\l....G?...J$.g.\~.$..`..D}1..3..1p.<.......9....1.n..!.b{..t5.....T.p...U_..k.B;~G8....h..;...w;^,\|..q.3..i......u7...e...y..a..5.:.JT.F~}n...K..R..r._........Y...r..E.R..-....kN..._k&..-V..p.OU.".e.q..h..<.ok.A.....?..U....P}..A...!8.QA....[7.J.%.8..\...K.M....-...;....-k...A2o s\|.D..#.Mz....M..(.7../......%.{..V..x..."..sZ.x........../..s.H.~-.b.6...I@.]jrF...I.....&.r~.....o4-.H.v..Z0.[.-TD-N..UO...........~}.4^}."g..7..._!"4>....W.#-.[.J...M.1.`......7s.Ym/=z.}...~...1..._%......1.?.P.;\|Y.......#...Y...&=aM..1g.5F'l.G...../.-5..,.s........./.c..Sqdae..!.+..........9.]..h......n.}..s9....`.sE?.....UD.EI..)C....G.09.B.........E.)..q.....5.g"..0..}.}EB....a.aR..r..r(.X....ue.....s......u `..BKi.....E.b..q2~".I.l.`}..RK....>.......S..#....2."e........C../ji.6.zS.G5 '.....E....m>.?J.......(.&...j?...U.......h.......w..?v..A$.

C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\IE\CS6IXJW6\BB17eTok[1].jpg.blockck (copy) Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4139
Entropy (8bit):	7.92324153429613
Encrypted:	false
SSDEEP:	96:DV0vaoR2gtZBtEp9REBRbwi4ARfHMPsbGvBcp9REBRbwi4AR5:2vNQEAp9RWqAlisbrp9RWqAL
MD5:	67B23D32C5FED4367C390B4CBB71CC4A
SHA1:	0EB1562A43E98F893621845E086ECC9E2082EB0B
SHA-256:	A9BF12107478E255AB05B92579D25DE4CB4B1E251E7E0B94A0CB5A52753061F6
SHA-512:	9E8410CCF837C1FBD7730D6996CF37F66C8ABF5C91A78F19B6A1D9215E9044F50BB2C8349C095A27C78E2F44E79ADC541A442F577CDF0B53F0A997D38CAD6372
Malicious:	false
Preview:	....3.HM.T..f\...Y..f'.e..:N..=KI_T.kv/-..j._G.M5.x..Ts.y..\..:.&f.W.....J"...:..E.}.}K4..M8..[.(JSS.0......e...4..K..m....jP=......C..j...J...k;.....,>......(t....C....9....d.NY. u.y....O...G..f.MX.!....)....i.Q...8Q...]..D.?..n..c.Hc.t..\j....^P.+`7(D.w.....l..i.I.~A..w..1.i(1M...F.G.F......]....!.$..N(........... .......xK."c........5...8.;j3.....^.^\|...:.v..'X/wX....._.mdO.._/..O...L.V....L.vg..6..TRo...nr_._q4.4I.:8.z...Z=.qdZA.j..@f_-`WS.3....+..n.V...1..Q.3.(.w~.1`.Ue..]h..8........V.jH...i)..r.~8.\qR.L.h..E.5.@.+.......;..gY..ci.ca.S.t..".....A6....w......kDR....c..m..D....A.kL.k.V7-.X.}.@..h.q...+_....aO..t..}....)eyp.d.=:....d\\....Na..\&...........r......}'R7.....v..0...C.>.4aQ./...UJ....?.w..o.h8i..E.<..P..\|..^<.... ..C^...}.9..r............s@Q...c.9.ZaW....L.7m......dG....uho$...M.~94PI..\S.K...c...,L-.'......[s.D$.....>c..q.Z..b]8.E..,..0.\|..POe.....L.!p...-.N`...L.5..4t.i..~.s.x%...o.?.i.0..8....=....T.,{.-.3...$..VG...llr

C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\IE\CS6IXJW6\BB19ywNG[1].jpg.blockck (copy) Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4295
Entropy (8bit):	7.925303484056644
Encrypted:	false
SSDEEP:	96:8GlwQa11YFJrxFWdR+XBRmtFc9A1YFJrxFWdd:Rlwp1YZFWLBtFcG1YZFWz
MD5:	824B1946F047A5977112193125103970
SHA1:	A13326A768397EC78865EA73DA701A2234654910
SHA-256:	5F47BAFDD0B263E93B89BC49BA4B4DCABA453067B8EFF553A126F6676BB340B3
SHA-512:	D999699222A2C7061144EA90B7D11B45F037E316DB24BD707DC76486E02F3E52837F08D45B19A822ED08FB03336374055A4548E122E7CE3A40F193194D811F03
Malicious:	false
Preview:	...Pq........7.A...............].U...$S.~....OOJ!......fP.y...v..:..............^...#].....\|JbS.F.w%.j...Q;...{hH....k../..t9.X...v.d........;@!..d..(.8.+..a..;...o...]...K.V.ZT....Y^&n.....z\|....c....~[....P....}%....@...-S...S...~.....`..ZP..&....(.4......I....K.H.#5.Aw..,.=.SW.o...j}57..nt......$/n....:.....]%!I.F.....7..wc(..,~.^.y~...............H../.4)..Z...."..lw...3.$.TE5....T9...D...W..z.[~l3..T...D...5u4..p.(.."..v2..~.$..a/&IBi.........5Kj)30Aq.!bYlH.te....u5..}A...e.w..6\|.N)..8.F?..c..cu.RO-=k.8.jj..h.L.V..U....4...-.....ko1K..{W....9.o<PV.........Q..E..#......C;YO{.jp..Y...w>l..j.G...0......8a8%...:.+\|..4......'..-..OA.F..C....5VW..O.O...h.c....... ....d. YE.>^7I..{MN....>X%!I.x..~...+SQ0....#&..X..W@".>..I.#c.:.+.......X..`:..Mo%.#.Fx.p.`.\.....3Kl..9..q..>wftbik....Xa.1a...\.h.....}3N....].X.n...p>0..\|.dx..F..w.^....C..F93.......Z.......F....3..JJ.l...s.ph.J..=wL..O.;?....o.......+a..dz.mCys.ks B.H.........../

C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\IE\CS6IXJW6\icon-help[1].jpg.blockk (copy) Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6673
Entropy (8bit):	4.846843251865339
Encrypted:	false
SSDEEP:	48:Dsqo4ncJAg2Z+r5Xhw3li+vx41+1p933/Qce6F23Srj5Xhw3li+vx41+1p933B:Dxc66r5q3lBOo3m6F23y5q3lBOo3B
MD5:	99990D0FC92CE1C9BAC6E6D16A3736C3
SHA1:	EDE56C08A016A6B01BDE16F13776D1E9D52B13E1
SHA-256:	7D76DA927EB420D864E946BD4A5A5160279347D9FAAB1512D512223833B174AB
SHA-512:	9F05F557C0BA66FEB24D54EE3D3F4D40209602A1F0829492177C6FAAB65A56279338A1553D6B26027039FF2F59A01686D87F575AFDA0277C167C5BEA1401E664
Malicious:	false
Preview:	.4.....H...t....9D....l.&.!.......Xk.y...b..`..............*.m.(....9...........brs..m.R3...D..q7..Z......Y7...U7.......2.j...E.....`...n..;...[..b.A.\c$.r.`......5g>.S...Ce..j....^4.X7.....j.......z..}/M2.^...<B.~..G........S._ .Y6.....H.2] .p.QbG13zj.........7..%vj..T.d...=[..N.."..\|.}{.DP..n.4BU.1G...\|...#...n.........dt......m....Zh."....z....A}.0}....../.=.8.......s.w..CY....V...%...B........=WTM4...f.>.....47.J.;...U...q\|.R....\|..8OM.......=.G"H-.h.W.@...L._....M......tS5..s..FC....5s.1.....tat.\..@..\.. 0.v,..~<....N..].\|{.p.D..>.)W.2\..+..c...}X.........W..{+.Z.?-..n.&(s..=.../........fc..dC.\.k..H.4h .A..L.?E)@w.v...1.tYUIW..a.o..D...'F.n~....9.j.w......NM.F..s..`x.f...^..zh..E..b.....d1c.....x....S.{..Ig....kaWji.

C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\IE\OR0WKIO1\BB18T33l[1].jpg.blockkk (copy) Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	17859
Entropy (8bit):	7.953511056609684
Encrypted:	false
SSDEEP:	384:M3MKYIhcEo/1/W5Tr7FsCCwDt8z1hINbmMKYIhcEo/1/W5Tr7FsCCwDt8z1hINh:OMKYco1/W5TX18HIBmMKYco1/W5TX18u
MD5:	8DEE138C99FBB1911EADCDF04D136FD3
SHA1:	667DEDE32609916449BD1269646A9D54363708F6
SHA-256:	A2FEE3C48851423A34A2B3E0DBDD6F2E32F5ACCDD47967FAC2F78AB1AC064180
SHA-512:	B371F3436E12B54E5B19A2AD4133611404905883417555CBF24DE67414A8176F390BC7F30691BB7CAAC1797F51A783363175CD2274237E8DDD37EA93C272C729
Malicious:	false
Preview:	..4./.......v(.....&P,.S..?I.....T..Lr....&G...v....nX...aF.e.;.+}....O.v..p6...%...s.v.2...z@.{.... .....@....r....=n.w.'.t..x.5.^02(84}.p..[.5.u.3.....N...+..7...........0GZ..@.^=.f...kK.}..NzJQ.\|Lb..........4.?o.Ar......\|%...'.z...A,t..t....y..F.........5..5........p..S!...D...#O....&36DU../!j.o....s}I..;;....e....`..FY@....]9...;y._..\oJ.(...A.C...S%......^G.)/d.........]s..xz.3.,..!,.r..x...y.........[....(,@B1. ....v~...i.s.).y..f...(#.i. .x.]...;aoCl@~'Y.-.."4.d;..4IH..z.q.&.\|...I..KE.a.~....H.pQ...P..o......5.4.[....V..1....vN%.@u/....\n....GV.t.....\|B.>.,.W..5.}e...\|f.... e31f[.V&..k..s.lu.A.......@ .2..p.<...+..w".T2..........gG&.Pc..D.r..._..".&.P.n...B.....D=.U....)V..#...!.[.vne..3..j.p..Y(K.X6.F.!.<{.R....J.........".E.P ..).R7.?JZF...S-.P...E.W.....(...(...(...(...(...(...(...(...(...(......$....d.i>Py.SN..op........t....rV..h..h.^D1.chU.]..#.l{/..d...jX..%...q.3...fP.8-.q.Cgkr.hEW<.>........Z.O.(n......Gu`.....p{

C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\IE\OR0WKIO1\BB19x3nX[1].jpg.blockkk (copy) Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	13997
Entropy (8bit):	7.950542067609158
Encrypted:	false
SSDEEP:	384:gpWM2PYFnKNQIf3CtIpWM2PYFnKNQIf3CY:Md2PYJKyXEd2PYJKyq
MD5:	83B01005923F2AA32A12B05F0A1973DC
SHA1:	20E5164F908408091B81F67C70A4020FDEB64637
SHA-256:	46AAF6C22EB797A24143E641D018AC5A8B45EE6151205221A514D50F594E5945
SHA-512:	D2573B679CDA1133A6701843FCABB987C203502512343E4E015B3A2B35D85231EBFE9CA7EBBA37BFC1B98BE641F236E551A779CBE611AC319EAE8D8BC7376E8E
Malicious:	false
Preview:	.6.}..P....7..2..`/..".4...\L.oL.,v...{..ZeU....E9....T....u?J.O.p.a/.(S..8r;S..Y....zJ.UW..]d...&.s.......r`+.wG....?=._.".h..2..\..$X.".....-.)fN;...,...k.-.....Q.t.k....q;....Z..<C...%}.w.....Hd$.:M..-.s...2....g..fz.z.+%4.^.mvF...Z.....^%..x.,G.+&.....P.:.V....5.oH..6....O.....n......\|R..28G...:....f#.)..2$bg..l....R:....A.[h..V..\|(..K...f..Y..'...z.YW6/,....TZ.VM.x......v1.Q.%f.."W.@...{$E.GuVo#B?......^..k.. ..C..C.X..K.../N...dl..=..."..e..?zNm.d3.2..7..I..aDZ......X....'`.....?.`....Wa..Qq....6...Kl. .S.._...K..Xb......{.........3..07.........r).=...;....b..........V....@j,%.,.%C.......E.z.el.....9m....f%T;4.V./f..U:3....x+.v...y.]......\|........lC.wLi..H....Z..b).a+F4..P..0..^w#4.7\-5...$..{./.....TT...........vH........8H.....F..@$..A.zgY.liQ.......P\|.CZ.aR6..#t...b..."#..z..9..`k.2Oc.Bt..:T.S=.]..U..,..}.p..8....s...j%-....r.sR.....da.k^<.MJ.....i..MH...T.....8.m..H...f..h...M..@.*..Y...A..!../\..b...7\z..<.E!.D...

C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\IE\OR0WKIO1\BB19xGDT[1].jpg.blockkk (copy) Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	27777
Entropy (8bit):	7.963528585005223
Encrypted:	false
SSDEEP:	768:+wEcuiytOmcpbbkO4nNwEcuiytOmcpbbkO4+:Tpnyopbr4nOpnyopbr4+
MD5:	79F00232E55EAFD4933ADA1F40B7513A
SHA1:	D40F5A12C80F7E63B48CF812362C5C05BBEE92EF
SHA-256:	92EBFE8C9E415DF9DFB177F7ABCE6D6222084B762659BA33AEA9515959D72DBA
SHA-512:	9CBD2FF872A07B2616025DFCF709AC9BE820753A7E1E2A60511B00EF8A4DF7E423BF1601953B2647EB1DD561E5FA6651D917FA50401BB6F1519E5A8F7A79A75C
Malicious:	false
Preview:	........ .8.. U.......LH.{"...(...W.X..a........b.~%.}.7.ir..6....v..h.k...4.Z+c.I..o...9?c..q......9N.Q.X.l B'... .2iR..R..y....T.D.3... v!}.....VB.{..&".2.H2.zG.3..Q.....c.....UL_ ..g.Ip.. .+z..2.L....C...6g0.9/c.W,zK.1.:,..(........%....u..?..f..A.im_....(Z.\\;.9.mm!..4XP.>5.j.%...d...yt.MM..y..VP..Q..eM......V+%&.=J.$..u.]+."...k...-W. ...H`d{[.,....\|-.bl.W....7d.}...lXp...n^^..6.P....=.>i.<i`(....w2..T.8...?:7Ft.V.X-.B.......9........ :D[..=5.E.9.o.../,v..0h..u\|...[Lh.AT...1...5.6[...d$....c...S.p.@74J.R.b......D...{=YU;.Aoq....W.j=..v..&......x..).-.'..a.{...IcK..F...L.(..kva..)..RY@..S..#../...O..:...RCxZ...nY...;. ...$...E........^ZTQ.b...`..u@..7s....mM%p8C_.Q....vD..7.@.....w....4.....x5+..j.r.x...IR.......Xr... -SL.J...qMI..\}jq@.\..}j.#\|.9.....F.p}..#...Z.xF..?.K/.7....=.).1...l.*.u.....6,...8.^.f....X..L@_P1.:f$...K..y.Y.Y.O..M.....kW../o.FP........Kw~.5;c..E..0=../:]..(z.5.<2....8....Fo5.<.y.EO..7/.+.....V.M.Vq-.2)%@......6

C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\IE\OR0WKIO1\BB19xaUu[1].jpg.blockkk (copy) Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	15417
Entropy (8bit):	7.9569441707839985
Encrypted:	false
SSDEEP:	384:Lm9aKQVwEHONIZdJJQBP8JKQVwEHONIZdJJQBPK:aARQBkRQBi
MD5:	72F9FB05DB32389D424CA6025531A908
SHA1:	49796C52EEF79C68271F5BA51F205A9EBF060FAA
SHA-256:	E23DE94062A4509BB032C368C2C11DCE1D2C80EAE602D3807ED79792B2BC6C4F
SHA-512:	C01055B6B52128376B8740192C593008C9F8F9ABB360286672B189AAB35D8435E7E8BA5EE1ECD42A3A907CE108CA0C6DC536C94625A9CF5C2483E18A1C5E3CAF
Malicious:	false
Preview:	.....B`.]G,.3..h.Y........._.M.n;v.g'..=....._.....aW,..Bs...8..2.............K%6.....}q.....T.X...n...jQ.._...L..:....j..[......f#.]%r.w...%.Ff......l.`.4tK...u.m.hV.yU..I...zW.5.?...-R.3.(..c..S.[..<-Y.H;....m]......D...g.R....k._.g.P..%.......(!.>9..-.8.....0K.......vD..f....^.w...F..n;v".....qP?.9A.......r ..3..._O.~ ..8Y...)DO.q.1.p.0.K..@7....kM.za..MA.^{.2..."$M...H......<..c...y..G..^&J.]... j./D.=.'..fSb.#.Fb0k%&3.V.t.....LN.A\|<..y..1..>.bA..w..$......$..@.D..i..,0....i..D.6zb.].Jm.$#..m.&u/t\|.#P..S.&.Q.....Nn..}.Z@.g.#r7Fyv.I^.f.^. .`.s...=../..\....}.x.,9.....t._...+c.Mz.TW..,..V:.I...O..~....e.AE9.....]...~53.....`..c....7.a.E&b..g..N..M..R.....1..7M.......E..n.........}r.slJ.l..$.8.6.[......$._`.AC!n=:.>.\....M2Q`.2,q."...)qU..B.X........K.KS3I....Rf..3H..4....i3IE..k+T.V.H'(9.A\...[.pC/.. ..8.oCZK[......P...y.f2......y...m.m....54W.H..,3..T.Y.4"..I.........X.-..i.d.ncn....J&F9q..c.XW.w..E...6C......_4....Hj.DW#;..g

C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\IE\OR0WKIO1\BB19yF6n[1].jpg.blockkk (copy) Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	28015
Entropy (8bit):	7.957903165252
Encrypted:	false
SSDEEP:	384:yDx5s6TdiZoam+VUFMEB1pg53dECAAXx5s6TdiZoam+VUFMEB1pg53dECAJ:y46TdcVUFMW25eYU6TdcVUFMW25eR
MD5:	A6F1A96A5B33EE194C843610758D407B
SHA1:	3CF95A8659C9B92598E3E547BB44A00B4A44DDE2
SHA-256:	B1922287E67B5AED55AA5C6FDFF369F20BFA3EF6776A917C16331099151197C6
SHA-512:	F25BFA73900240E2B385074F94AA04F966BE2F505CC9EC4F5D9AC9F9398E395948FDE148A23129401F6F1B311AE68BA46B094094FC40F2E96072453BE6A39D1B
Malicious:	false
Preview:	e'..'.8..........g..k[ ...Wq_ht.%v.u=.{FZ....m~....#..\|..&.8..dB..x.?...e.,T..a..%bc.u.r"h... -.3.%......o.`.~"....v..C...#..`=/=.G.\|.Aj.s..L..)...l.\.j...r.J.z+.Q6..g(........eG!.=.#.f..T...9.......f7..27.........._.:.F...8.iC.y)....#T.9d.. .:.r.io}...+..5o.-....(...6o{.(#.. Je^u..oV...Fo...z&mp..YsP.G..v;.Tv..\.2yZ..T...o#Ko.t^.b).um.....i..........?..hCqXJ...$....;<...L.W...X.[...T.^.C.<....j.i.;7.]".d...l...4%..Q...hc..:.d.qeA.^tI.u.@.?f.T..@.%&....?.1..9.c`...........1$..[.2X.O.k.fC./..n..\|.,.[.b.y.{h5.*.......)y..M.+\...0....G.\..q.Z...5......o...y..P=U..6......y....aa..-{.U....c..d...1..~..uj....s...K..A......f..G{...d..u...._.3.r.D>.h.3.Q"@s@.1\|\|`...!....X..(W..HN"l...v.h.e. W:\|...`.Or4.Q....f...b..k.)...}.,...ww.v.K..".S.E....M......2.8S...HC.(.!4.CL4.j3L..))i...).D]..........!.......p..L.....5$v..7,o..m.. EE9.....m....HM0.I.Bi)..)....XK.(..M..z.Y.@.8.%...8!Q.2>.e.k..W.)...\..BA...i..Y....o...O.S.V...b)9..s...r..6M.......$L\|....qH...)s.

C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-400.png.block\* (copy) Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6551
Entropy (8bit):	7.628420359502165
Encrypted:	false
SSDEEP:	192:Y5BjanaO5UHjEZEOV8tfA2xW8z/TRaO5UHjEZEOV8tfA20:qBuh5UHjXRp88DTRh5UHjXRp0
MD5:	D525184F6EDB7598F51B3491173976B2
SHA1:	7062CE7BEDC2B6C6B7D1DDEA8BF86C1CC690AE65
SHA-256:	500C2D4A570C7BF56B11A3B5FA87A95AF9FE9B7B44EC64ABAF93C5DC5BE16F20
SHA-512:	27992854C6232C5A161BC264DB6AF52CE5ADF385BED5C917B8D1AF54C01D86D0630BAAEA870B4B6CCD6BE413EDCF6E933A140139573CFBD15B9EF83F7D30B54F
Malicious:	false
Preview:	.o9t..H.i..p.....m.:xgV..;8j.. U.{.....^q.II`@k....p....S'].&q...I.Z......D.u?....j#.....-..f.Y.v7~.......&.gao.TQ.n{7....../.G..r6.<..f.g.{b+gZ.\|..0..G;.';c6_.U6q.Zi.......Sd.. ./.YW...IX?....`. j..e..9]..U5.......-f.4F.s...........m.M\|...>{..U...&.b['Jl.v.....wNN.s."a.W.;..@.(.........W..Y.?...W$.O..3.M.._.nj./......}.R..r.t....M...v..J<.;-..D..Yf}..`k..D.;.a.[.3....)R.@.<U.l?..B.Z...7_.`..."..c.Nc...J....J,.4dwJ\|4...E......./9.A.5.z}..j.5w.R.?.C...H..%d...?.s...0.-..J}...$R..........>".U.y..\V.....jN...Q..y.i}G..(...K.9iiU.si....,.....E?;.1.a..eQ.kE...k.....wH\.b....$..^.V4..'k..^].....ET.........c2..}..m..bxW].e..?KG.....8'..{P...G..0S...I.4.@.....(C..6...6i.>X.=.;...A....d:.>.$.$\G}..' ...........0.+.%m0(......E..U.....-....VV..+-...7.o.v.Q...,.X[....C.......oXg!X.q)x.....`1_.p...q.,\|..S.zc...`..r%Y..;.d.....[....%X.4WC.f.e.].......1D.x.5.6:....1ulq.~3../..h.....!....e.9.9l....TD=...h...-.:n~...VU....G..j..-.....ab.q.a.

C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCache\Content.IE5\2WF3MMUU\big_pixel_phone[1].png.block (copy) Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	61387
Entropy (8bit):	7.953807465439722
Encrypted:	false
SSDEEP:	1536:z/S0oVPkIKJQ7LzwyA/S0oVPkIKJQ7LzwY:zjShHBAjShHP
MD5:	2B7D6565B7CC4773F9553D086AFBABFE
SHA1:	1370E2E094E9B3AFA14BB40061D087280CEF0586
SHA-256:	BF7AC60EBA1CE08FC7814BF5F91C0543F03E3B8352F3F2D0B91F935D2906C0D7
SHA-512:	CE0C7C3ED711C5E39420ECA94EB04EDF4428407F85A9AF741B2DC80AE34AE3095FE5081C35E426F46D5C63AD13337138D89ACAC94DD2928FB9AE6796A267874C
Malicious:	false
Preview:	H.....\q.CH.y.Q........../X...J.3.].0.8Y..0.Y..=^-.w.f..2....,..r?.2.r.C$.H.y2..>@..#d..3.O?....F.i^(.=............e..?.t..1.37.'.H.....9n....u.k..E!T#.^....1.....S.Vw[.B...n.....}...}..^...fm..Q.C._..1...Q.%.x.RY.....'C'HN..O.....E5D..c.).._.,.Pq.....B..\|.m5.:...j...^./...[..F...Yz+.V\|...._.D.F.p.`.m...4...y1..4.....I.)....RP.C.1ET.&.v8><x..../..u..<..c....3.t..b.M8..>...b..wz..nD...BsVC.j`.......E....`$Fs..O..N:6Z....p%.K"...O..$..7W&......U^....?..BB]:.v."....a.z7..A.[XY........~$,..KI3!f..XN...tV...n..(W..".h.2.....)..K1......E..3G.....5.W....<....v...Y4....#....# AR.2.=....,AM.t..Y....j..:....x.}RW.T...k.3.0L..:f..N7.z.....(. !..Fo.}.W.S.S.Z'.0...3...&.lqD..b4..%..^.%..0.."'.K8..[...6...Bg..y(.B..'>}[...#..4.a..R.=:.JG.;,......k..D...fkTNn@7.t.YNK..+.......uy..A.,.o.,....i..3.......3tRNS.........[.#..../iL;~t.........n..T.......z.7...t0IDATx...n.@....N..pW..dL..J....o.=v.xG.6.U.(.:?g~vv.&$....c.g.f.J... .~m....k...\H

C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCache\Content.IE5\2WF3MMUU\google-canary[1].png.blockck (copy) Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7476
Entropy (8bit):	7.929553564084301
Encrypted:	false
SSDEEP:	192:bm+6kMey7G480h2TkMey7G48aaj9DYkMey7G480:bPyy480h2iyy48lxhyy480
MD5:	7C4439F0666187C9CE9F1BFF31918768
SHA1:	733FC2AD11960E883BB9C1B79C1BEE121165B8F8
SHA-256:	7627F504FA5C4FC12C0091A6C361485D37876F58B68FF032CACA7696B4552244
SHA-512:	068E2341975B1CC981DF494FF8A3C4E277DB7EBAA774C40BA7591049441DA884EEF04360664A0F82E287F0AE64C78E2991E14C22216F212564E5A24A032426E2
Malicious:	false
Preview:	U....s...4ct..>.H....(..4..pWX...\~..A.u...)...?.B.^..z....G.^..y..F(\|....M.m.&xZ...m.j......@...S.z....k....xEv........O..........x............{...A..hY@$.,.2..2....J.5....ac.s.....Rk[....i...t.+......jn(.-.,.P-k.Rc+q\S.C.3!.. ..$.2....r=;..,.........C..>....Oy.?:.....~..`.s.Xl../........2r..s..P..r..+..Vf}........m.._q".2.W.J.A..!)X-B.O.v.+..>.I..0!{...../.......7.O.4.."..[=.e7.V1.....>..rn.l........_......\|........H.{..K'_..P...1.6R..]...j..N.a..t........l{...B?.p&p.s.0E.g.3.t...R..(.Sx.A..e)6z....1.W6..,P.......c........ThjBT.....pi`.]....;8m....Nz...2....l..."..J..od.;...}.W?.....N..D...J.&I'.kb....v.wR}n......G0..#SW...N{c6oU.. .f.AKj{....#%p]..s"....J?.......&..%..6....#...[fR.U...'=..r.)3.......}.\|....g.{..{..".....X{7B.w!T.c.=.5....@..H.xG.q...^.(...........!..B......D..p...M.F\|.oaG..8......9..........x?..G....5..t.z.=s.Fh.../}...."..1$....@..'...../P>?Exj...[.....2....T.s.&#2...x.N......\....;.......{.C.~..E."..1

C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCache\Content.IE5\2WF3MMUU\icon-twitter[1].jpg.blockkc (copy) Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	9942
Entropy (8bit):	4.822029678759889
Encrypted:	false
SSDEEP:	96:Qt65ACnEOEtUH5q3MIykT4GNzHJ/4UD3Exb5q3MIykT4GNNvtTTMZejyj+6yT5qi:ySnSag8+VHJgUIhg8+zJTMQY+3Tg8+A
MD5:	2F89DC4EFA54EAA61D200633D5BFA0FD
SHA1:	EEF2BA2C56481B3FF68DA8790CE4B8949F9D7E0F
SHA-256:	14289E686A36376DF70D79729CD33E6BC99DC60A5D51AD8E08E76489381F98FA
SHA-512:	F1AC45971C0A1A7E8AD23C4A14EF9AF42264436FA3E01FE477B6EAC53FAD5AC7D3F1E0529057579711600E9A9D63BA7BE3ABAD2B7F51AAD58824FAE0D1BFB346
Malicious:	false
Preview:	...P4...l.'.".......n...FI...g,....w\...7r..../.c...Tq@...&......I0.V...i3....[+.Q.}..A.,.Lv2..\R.m(K.ai..5....,.,.(..w...-..c...=..(/?.......M^4/'.5...."..^.O.3..DKH.y.2lD.).g...D..F..Wd....\.a~.)P.1....U....+....l....AV..E....s;Li..s.?u.+$....7.n.....-.-.u8..R..Hy1...x.Ds........$(.6..U..7Dg..7C.^.t....o.8).%...I{.....FJ5]9?......].>]..{-k..N9..1......i..s......Y.m?....A.g.I..6.rp/.l..c....0......~P...A.2.....k..eB..a.7..w...WO..C...M.(..:%>..b..;....[_.....G.s...w.V0..D....W..[..5...R5.x..1-U.50......]....N..f....0.e....a..Ye.w_n....."..&G>.:.k....drk9e....p...*.......;.Y......=.V.].2.=.H.jm....G...P.gt.......D.uBkb........9n.LEU..A.:.M....b......~.p..M._..K....8...p.....g....."..})\|.`......^....

C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCache\Content.IE5\2WF3MMUU\pixel_tablet[1].png.blockkc (copy) Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	126207
Entropy (8bit):	7.955145358302313
Encrypted:	false
SSDEEP:	1536:M5Vb0/31NlUuCBQ7jVRuUpx5Vb0/31NlUuCBQ7jVRuUjn5Vb0/31NlUuCBQ7jVRi:Cl0PxCBQ7zBl0PxCBQ7zRl0PxCBQ7zi
MD5:	D6D114DA0B26EFF81EED75BFD2182479
SHA1:	5F1DEDBF10E5D80A2EFB2DAF3DCABFF0B3D42EC7
SHA-256:	B0F7FCD9EDDFF9724A94CE721565B092C942A8EEF30940084FCEF0960FF0BCD0
SHA-512:	4101DC40610372FBCFCD8D7300228BC003CC3ABEDBD7601BF6A5C0F0291D9A0529576C53B25C9C7B63A70D7480A189CD01E3386621BD1BDB3510089B82DB5455
Malicious:	false
Preview:	.\.\....."..rw.6>.V.&..Y9.T_...m...j#.G.$.}.........\.p...j._.w.e....t.[lq..."...A'...H&b..2..._...Iw.....L..Y........E.u..%y.<#<K%..u.C.5j...<....:.^x."..N.C...x..W3.8....:.=..<c...v-\...-....&....g...Yp..]yi.x...r...~..+9...GsX....e.;..#.b.X."....Ez....Z4.&.C=.VR+.7...X_...-}.v..?..B.?..z.Y!F. .k`s........rS2.........8....=r..P.x.d......0.7" .......r....[..b]{..D.C..R.%.....h..........0${...x..$[...!...h.:XZ\..........H0.H.oR.;....A...4.k#.f......6.. .......\......o.<........:G.qb&.n..... ......M...9.$B.#~.Z?...(u.....#7.]k..y...a....[..n}.........K... ..?.p..l?@D.V.c5ys.....j.-}.\|....y4.....9..........JQ....G.e...u-N..0F......sy.$."5..!...2T..`.)........t.x...e7.....m.s..#MN.e...G.StH.....$.....g.6...P...X..NB&..u......zil..qv.n.Ssw..(Zh@8.4K...\|&...o`..J...K.R[N.....tRNS.......(....B.l.[..~....IDATx..N.a...DV7(j....N..b\.!..V...X...Cal%.m.lAk.....gf...D...y.9.....g<w,&.W..M\h./?>..S.s.....?........b..^l.

C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCache\Content.IE5\9026IKNJ\20180416_102356[1].jpg.block (copy) Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	11495
Entropy (8bit):	7.950734478743823
Encrypted:	false
SSDEEP:	192:Hd5RL3oVO/wqIHnKJE5OwrlF9/VqOySVh0Cw8oVO/wqIHnKJE5OwrlF9/VqOySVW:95RL3JI9nKublF//yqh0AJI9nKublF/o
MD5:	73592A00D192C5976C52D79AEE703A3A
SHA1:	A20F29796187347F53A7263AC6A714E31170E289
SHA-256:	68EB4961A853D12B8933F6AC78F651C9B1B8FD49EDF7B2FC417D1EB33BB8133A
SHA-512:	BE06994ED528C72603892AB4FFDE74E891AFC9ED727C065F82ADBB912C2B0876FCAF5D615D3DD0005FFB2B0DA450C89E5C052D26B5D76EFD09D4760F410F928C
Malicious:	false
Preview:	h....f#.IPZ.SbB......q....lRc.>.O...V...!..~.s%.N..K9.c\|6...n...2e.....o.......^.5.4...%.7b.+>B../#.......y..........:{..,..KHR..M....0.u.u..d,V.a.}..D.~......3...Y..l,....B..Uc..ZD...(.^.H...`.../n.O...6O..'..4..I&.......E...!.....D$...<.<....ju..!.q..5V....q..,...ZySc.._0.;....h.....s.[!{^.Y..0hTY...b.[..8Wzj.#O..ZE..r.1.D...n.lZ....g0.H[..f.....K........[....{q....C.$;'4..x..).H....P.H..E4..+.K..j. .j....%..u.tE~.)....>..B.8.j..h...%.........8...T..A...j.~...-SZ.qy...8.h.7[.k......6s~@...?.a/..m...'.W[.....V..$.u.6u?2.R>.b)~.,.........O...-..<...r:.C..#E3".^.".).$.c.g$....AW..P..d..Q..6W..G.c.H../J.b...e....W.I..k....../..S...rX.u.$Zx............_.;.3h.P....;..<....>4.:...0./.e..K..?...-.yQ.Q....s.`..y....u.9,w.(??K..O...[...EN d..202.e^.Y..:..Y.[..$.."...Vb........\._...<...]D)1.9d....rH.......o7....,......x.%A.... }G.m.Z.....'....'m......Ko<{-2..-!.O4....@.;.K0G..$.s..( m..P..s.:*hT..'..\.'.4...=T.Y.N.:.U........8....[Zk.P.1

C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCache\Content.IE5\9026IKNJ\cursor-replay[1].bmp.blockck (copy) Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	13056
Entropy (8bit):	2.5499571280161426
Encrypted:	false
SSDEEP:	96:VMdKdj3XMoqk3olHWix5jvJLoqk3olHgSfEjLi3oqk3olHR:p38oolHBDDJLoolHgkWLi3oolHR
MD5:	594538432C2E7B0B6A71A41B7488AE20
SHA1:	8E0AEC2055CA0659D32218CF0038E712A4CA4C69
SHA-256:	D6951849ACD551CD25CE6AA9FDE663E0B9F9DCBF2D10902EC43F3A52CB0F124A
SHA-512:	46DCB96141145FF3ECF19310BD3E6489E293F4B05332D96C88B5C7A584546637992829ABB0F59586DFC8AFBB9BB56FBAB571635448903D0AB1BA3A537AD26B94
Malicious:	false
Preview:	M!O.-Y.b....'s.....!.!iiD_.w.^...n.~...JD..V........fk!.F....t.u/x.z.C.....U.^....YW?.>x..........5.X..%..a......f..y.....g.f....-.....`q.l.u...dbB>D..WEH\..%P[.yDp.b.9W...UP.u.S....c.O\..__.M..).J .+....0.`..k....u.."g...J...Y..N.....1.]di..(.....$.a.J...v.....AA..}.yA..}....>.......:.wl....7d.i.....ry.[..C.Mt.am.T.....P..23.t.&.....1..........4E.1..."Z.P.^OCU.....-S....?...O{.3D.95.o.Q.....Z.....T.s.%H..Z.[[....v.`.........>...{...;.0....f.!s.s.O.R5....!O0t..#5>..3..8...;.}BY.M2..?.1a......ser...ZL8.16"......a.$....GE"......n..E6.......:@6.F..B...G.....o...;.{.....W..`.:.r.v..{.P.1..#.`..u....,.G.t.d.......(...h.aW.s.o.n..m..=h.Q..f.9...........L..._..._...t..`..n..{`/&.W..zG......1....%.4;......\%.4.J[...`v.hGa..d........................................................................................................................................................................................................................................

C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCache\Content.IE5\9026IKNJ\laptop_desktop[1].png.blockk (copy) Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	27889
Entropy (8bit):	7.96294306070121
Encrypted:	false
SSDEEP:	768:2aPL0UOi/btsKr4/ZbVx5L0UOi/btsKr4/ZbVY:2a4UO+b7rmZxIUO+b7rmZxY
MD5:	66631BAFB5632FB25371F603DD3B4D4A
SHA1:	2314B290736D1018EDA96D31E56FE4B1CAFEE8FE
SHA-256:	933B554472421BB5D5F0082E2E3406844D8BDAF583E4583D537C5D1CDCC6AE5A
SHA-512:	F7AF379E017A0F5440E5427E321E69BC4B30A7719E330BDD5799704D2D2BBA46EC45F0E550DFCB17FCA7823AD5F9F4B25B65AD79A5C3FCAB68F8EE9032954D6B
Malicious:	false
Preview:	..nn..{+..C............wc....[.."..............D..,KJ..U....y...<x..sL'+.../..Y.>..D....0..m$..\.d. .....5.y.i.....;....P..(.5L...y.z.5..i<(.J..2.J!J_/....B.uoDQ.......Yb.{4..z..Zk........PE.P.K.Kw.+.0.G/...1\m.B..$9.p.O1($s...G.\|........(.`.2!U..za..:T...`..Y.......&T..y......\|.h>c..?..t`.....gw.:..rx..l.G..'....p2g..............5..p...?c..z.:..~.O...qm.d .t.{Jb.........)..f.^3sQ.>........).Pi.x.....l.j.."...... 1.T..7.b_.z.!....t..AS....Q.0et@H+N.....i.6..v.....>..!b.B.l..3..9q...l...XP..w..c.#a..#.B.x.O..`p:.H.}.n......>...\ZI..Q.6..N/..e.......i.d.j.Is4...%.8.0..43...#..C.$...4*T..7S..:.OLr....:.m....4.......^..o8.7....0[ta...-.\..V....J..lQ#....G.........U.ml....S.d...f.;y.c%..%..............R.iN\|.....m..j..#..J.j,.j.UI..F......r.b.z..F~F<.;......c.`./Y..SsVQ..E.).s..+....E.Udj....tRNS......=U2......)`...G..z..Bk.....s.h......:.^..2.IDATx...n.0...U.(+.K.E.H=".....R........{.\|... ..Il............(.i..$...$w.u.DC.......

C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCache\Content.IE5\9026IKNJ\nav_logo299[1].png.blockoc (copy) Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	24054
Entropy (8bit):	7.938880539369036
Encrypted:	false
SSDEEP:	384:u9P3dsaABjAzc1GbOhhQASgpdNdsaABjAzc1GbOhhQASgpdsUZdsaABjAzc1GbOu:uVLLm0OhjSYXLm0OhjSYCMLm0OhjSYe
MD5:	B7B1057D5614B4320702D9D9D5AADA50
SHA1:	649BBB77F28327826249CE50C7FD736CC1E2AE04
SHA-256:	2F973B6799085B504BB54A55093F57D05F271B4B0D103499415C708042CEF209
SHA-512:	09CF411F895D47A8DC1C6DE13416A850364980B65147E2274B1AD25E29A2B71FDC32A3D723295CE6E619777A347E349D1FD94207B9B1A9E5AF4BF60B70DFAE99
Malicious:	false
Preview:	..c.,a.Z.@.9.........z..$.......Tgx.4....5_.[..NA7..V.HFk...TvA.....[W.S.n\|.L..=..k;g.a.hD_L...7v.lxD.+!"..$.2..q~..-...@:...9.:j).Av.[...7.-..I:...=..J.;;T^8."....p..W..c.:8...~X.........G..gx.IB..%..N..j..7...>.P.......0.b......j.}....w..V.+~...P..Y.!.H..[.bS..=...GX[YT.=....&P..T.;^..z...Z.....n......Ot...m..L`#...X.X..3Q..Q\|.`r>..fx.c'N...(AX.....qw._.}..R......S._..._..V....d!..'...6y.[).H..q.q .....K....$.y. ...'.s.......[.O.d..W....\|...N.4[..;.......l.uSDM.N..r.(..&V`.h.n.ho.(.;.w..9.=G#ta.'.?..M...8.'+g"..D.t5:.........`...tD..F..-.%......Z@.#..]M.G...\|bu.......EU..H..D.fY.g...... 10m.;p.......5..$..;..C;x...(.%{x..+..8.......:...1..&.....JVn ..n0.8..y.X.(..\|I..F9...8..$J{/D\|.c...... .]..ZX.....5S<..n.W{-~C..,..P...........i......."..".D....{............i..w.s....@..8!..9,...c...h..w.R@..ZPa....3.f.q n.......(a .@....:<..H.H..t......Y.^..q......;..`...%...V...)Z.IS..:.M....H`..Bb'....~2... .@l.>.u..@,0........~.c.6..G..6G.....#...0

C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCache\Content.IE5\9026IKNJ\pixel_phone[1].png.blockoc (copy) Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	50784
Entropy (8bit):	7.9752496488078455
Encrypted:	false
SSDEEP:	768:Xj9QSRsYNxnEsN6uayzj9QSRsYNxnEsN6uahj9QSRsYNxnEsN6uaC:X5prNWu5prNWh5prNWC
MD5:	569B8981BD56E7D45EE290DF1F58310A
SHA1:	613F2C6F14445F4BFE546FEAE7CBCA54C2F42E29
SHA-256:	F363C4CA376BFB6C2EF362DF902D9228307D138796B48D4A2384E35DFCE35CCF
SHA-512:	9B20DD8D57A448FB9DC2CAD27A6233993AE152288376620AF589FF1F347B30D7FB0A665E540FFB84E7D942119366465EFF4C428C25CF235B83E93E172B0626DA
Malicious:	false
Preview:	...=...j....[o.e'.#t....{GP....'.a{..P.MC<.v........!.....p.C.W......MF..>.......<..CA......EEe='...t.%.......... \..z.o..lz..&;...@.9l'...........N..o .d.:P..eP[;G......=.j..{H...N.-O.........w6..m.p..+.CE6...'.s'l^.3.^B...%..<X7.N...].BO;iS\..A......AO..1Q.....f..?.I...7....K)t7.P....jU...... q.NJe..oi.0..b:.L..E.'g.....x..p.,L..i...,.....Yd.x.......B.4.Z.......=...4.y.P.....8..C%#]anE....z.f.S.Fs.:.w...z.A.U.@2O...T.....T.Y'=$..'q..n....y} ....N..Y......?:.P.%.$......joZs.?.0D.#.!...4<.j..W.V....p...^....\|rR..g........:.S...h.5'026O.(./..Q.`.5..&."..T...h...u.-...../.c..m/8eJ.h..(1pQ..Wa[o.......rGW.9....,...&..iOq..:P3]..ic}....j..M..O.x...Z8...:.K.......W.....Z.x)...N....h..O..D..~.._\|.xGd..&..%I...fZ..'a...\|w.........a..\|}v..l..Z...}.....{s../d..!!...q(..'...............tRNS..jZ.'...J..7l................/#...>qIDATx..M..0.........PU"..-%..ac..D......g..=..V.'iBx<.D....=..\|8...p.~.:.u.`4.9.:......OE..[..P.....9

C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCache\Content.IE5\CS6IXJW6\google-beta[1].png.blockoc (copy) Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8448
Entropy (8bit):	7.935415356326549
Encrypted:	false
SSDEEP:	192:GF2OL4BYdE5k2wRlTVD3vs/R1i4BYdE5k2wRlTO9mMga4BYdE5k2wRlTF:/ODR361y43F
MD5:	5B9AF4398479BD2B248AE3ED14034ECB
SHA1:	01A9242BE28538E0E74765A7B10B82696B7216D3
SHA-256:	CB8978F8AF9E537C5A602433ED860B1A1A21032027CF1FC802EC2941ECB03A32
SHA-512:	A3D3738E860022528B44A3593CAF8D7558425C5A65EDA8A2CB2BE85CD6B9571192F20C0CC4C7AE7B9D0C2CA3A76ED2B9390E4F247DEFB7EC5D08FCE82C1475FB
Malicious:	false
Preview:	._.#x.xDP.Vt.1!......J..].DDW..!6.qd.r.....9Mb.JfL..{V...Ppl9%....q...l... ...7...G"l.ER....Z.4.\|.d/...g..4.}.....C.A..A....."...@}.0.o..qi....7....-\UQ~Sf..N..........&.E!.w.\|..:.J ..=x..pm.@,W.J...\.h'.$..g_4=.]+.........Rt.g.(.~[..........2..f@.J,..^..]....Zb...~...G...F..~/....Eks..&.-........,.3@.qV....=....1....lB.&5.\|...'....L...s.c!L.v....'...`...j[Z.x&..e...!:..%p........3.{.1.CNQ.q.pf[..d..s..m...@..4.F.W.u.7.km...\|/.E.^p..$M9Wy....x/..:.....&.Z.;....w.d..C.T..m3xs..N...M"......w.4.g....=;..w}.fl-....&..a.y..M..[.$..?F..u...$...9..fm....z...gs.h.hH.7..W..#;...P.'.7v.....f.by.....a.LW. vh...>._.....f.3PqxK{c....X..{.....V.....9...'..J.....Y...Q..h.AC:&(..6.!......@.......Mp\U't...%?.....N#.s..i {.M.A[....b...i...i....U1..^H,r.i..j..r.K..[:.m5W._..C.}........i....g.V.....u......U.......F.....yC..^.D..z...x.........S...d<.....8k.OOEg.+lyD.rE..6..............8...b&.sE..\g.Acp..Z.L.^z.}.......\..S..s....nh.v.5g.

C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCache\Content.IE5\CS6IXJW6\i1_1967ca6a[1].png.blockoc (copy) Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	22173
Entropy (8bit):	7.936144922819014
Encrypted:	false
SSDEEP:	384:ZS/rQQ1BtCwPk8PK9tfO+21BtCwPk8PK9nOv1BtCwPk8PK9T:gQQtCP8PKDD2tCP8PKwtCP8PK5
MD5:	CDB20C264F871E218C72C72A08591224
SHA1:	3AFB46242F9209A1A341BBFDD214F7731B9CE385
SHA-256:	A2A2AD9989B3D12EC822393E4F1CC72E4401302B1549FD942F652AAC93DA775A
SHA-512:	2F6ECE8FCD49E4166B080C0BAC1937122410EB73DC62FA940DF55BC8419B9D94A089D93C0796F2498E59A36E6C1097CDC1535951C52BA5715F1771A46AD20078
Malicious:	false
Preview:	.i.H.Q.uE..N.g.....R.....N.L...kT.Jin.......7.E..D...z....Y...y~@...!m...Gm...Z..^.i.3.n{...S.60T..7....w.G...c.,.a....y.Q........Q...jC..iR.s......R...J.l...kQn}Sk0.B...a..(o.yk>J...u..J...L..0T..G.v...=Y.7.{....$....T4..5......E..9Dj......J#...'.A.Ksf4HlB.....$...D..L.{..5....B......Ai..H....2.fX.4..j..UDh)...a'f%r...k....B..'.c...sa.=...N.........k,.....i..Dx..!..O.UY)...36........}M:.8.z....a...8<..=.n..g=>1.m.b..=.LN^;R1\..zX/.>.{..}..t..}I}..,..[..+..e...]0)..,.[.fv....<..45.F$...v.5.J&......P.c.l>(.".2.\|}.J..b^..jx(....s...Ru....\|.5.V:Q.Ef...LF).J...'uo.#*/...'.U.-.s..P.@.."..k.K.4.M.f.YQ...,....X.>5T....B....D.s.3.&.....u.r....m=J#..9.D=.2b...Y.r.}.#...q8.p<..C..I).^5..]......Kgn.OiB...s.#M.!.c.....U"..5x.$V.,.o...}.....!A4~@..[$@@,,,.u...w.u....5....v}.....?K.>...y...Q..t.@H0.`........ME.>...d.<H(C.%3.[.....i....Cf......cf.}....l~.>......Y...X.Y....B..Oh....... .....O.K.....E....X..w~.w.$..+.J.^.Y._.;..APzq..0...+..C.....@...k....

C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCache\Content.IE5\OR0WKIO1\homepage_tools[1].png.blockk (copy) Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	38069
Entropy (8bit):	7.953791507107795
Encrypted:	false
SSDEEP:	768:5BSt8BpPXORFn58XaFvPzSt8BpPXORFn58XaFv3:3StQeR6snzStQeR6s/
MD5:	BEBC3BD32F85FB0D542657D46787FD8E
SHA1:	BA1C7A44F9A627CF2E5685E4F8B0F455A9A8F4FC
SHA-256:	9AF626E79A0DAA11F97C4FD7CF72C5CCAB61F646398E803442115167BD5FDE49
SHA-512:	0078BB3275D33EB5C8FA639EA5EAE93E0729C125B50A46D04D5F74BE95236A12871BE24165B696B97F86C3BC04D8087AA5270D2E1F7F42D49A4DA9C6E67E7222
Malicious:	false
Preview:	j.>.]?.-d..Z^...qt..(.;..<Cc.?.QD5.4s..8..v&X..>.s..b.P.`...M.....eu....M[.y..rZ.......uc..K..&z..F.k.\|....5...Q.z.Gl.T..`.h..Izj.....!..CQ.u.G.....j.N..Q.x.5..E..5.....d;C\.............8...!.q..Zm...npw......z.(....q.3c...jzR..0.k./8.1.9.kj..O[-..N.\T^..c......Y..ghw...V...$8..$O.v.W.L..d.o>...=!n...rG....?. ...`.].4...(..h.n..@.].H...2 Ok.v....s../O.]R.3Z#MG.}X,X..x......8...`.X'e,.......#U<p..5...1.".v.N..&j...0Z.vs.......!,V.h.l..l...(..+..x..t,..;..3.....Z.#g.z..oA6....?..=....L......... .Wv..?8....:.e..O.A.6.&..t.0.y?0.o{...W.).....^I).r....6... .V-.l..........Z){}R..Y.#4.Q../.....NH.;..D......%.. ....>B.....f22..7t1.+c..2..3...y k.n.].....s.k...s....-."....,.L......i-K....z..L\|.W..L..m4...^..S.....v4O.k.{.U...!w....CLY......}..p..^l....6..26?......16>............o.........RtRNS...... ... .<....2p&7@, ..` ..0........\|oS.y`P......aGDC.._..r.a0...X...h0.;.e....F.IDATx...Kn.P......l.......c..U.....Lut6..1)......8.hqinJ.!...

C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCache\Content.IE5\OR0WKIO1\icon-youtube[1].jpg.blockck (copy) Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	9588
Entropy (8bit):	4.650867521215546
Encrypted:	false
SSDEEP:	96:+M+IUKARi5q3jHMp6P5/MfTrui5q3jHMp3vizWIszvv6Fi5q3jHMpd:+OUKARigt5/Mf2igmizWIszvvYigq
MD5:	8CCA5F471141EBA76F2D4D2365676041
SHA1:	A069C8102ABD27183410133F362C57A1281447EE
SHA-256:	E65A0EC40BD1C9DA724EDE8EA10B5EAF7472CC1510441148C6F0798780C96C36
SHA-512:	654526D146530C5C70224C416F786E9ABE8B61864F8A85A98F7F799E83BABCBEEDA83DE49963CC37F03CC8C5E6DCFA0EAA09F543F8B5E2E9B7126380A4F5EFBA
Malicious:	false
Preview:	...i..uZ:..Yq>..0.D.J..n.}..f.Cuz....(v......#c]...7..#.........y\|.......G.C....@E:.:M.h..T....9........X..h.N..3U(...s#...y.P'..;....pR.v..o...i.7.F.za!R>...UOkU.;.Q..8.qx...DA..E..V.0...H..)e..p..p-d....09.1U)..XV...p.z.D.'X........0=...B.P:....ke.U..rrP..t....7I.+8r...UL...&......Q..n...........0.._]......M.8..E..o.^.d.....;4U9x...5f.v4........`.....^$i..h.C\..T..JU..[.&.rW..w..>.40$,_3....^..x. ....o.wW......J.:18..2g......q.W-....y....Yb.j"r.@.S"R.E....D7Q.>Y.V.....k.U._ry@-H)...I8N.]..;j.:v...W.3..vuH.U.H..*a`...<..Z........-..2u+.......\|..^..f.Q.b2./)<q.;..G.I%...'B..0....../.:6`...c...^..>.....33.i.%Ul8..{.I.s...uT.....1...x..{..5.....Zp..b..e.T....y.7.d.a..Qz...\Xc{.X.7Z....9.../X$..,.SA2.1f.A.C8y..t....+~.. d..

C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCache\IE\2WF3MMUU\google-chrome-logo[1].jpg.blockoc (copy) Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5589
Entropy (8bit):	7.897951766747541
Encrypted:	false
SSDEEP:	96:uD52tLrkQi7AbbNNbeVMBDdECzYlGRD1XYuZSyAbbNNbeVMBDdECzYlI:FBkD7ADeaBxEC8E5YuRADeaBxEC8u
MD5:	4A7A2CD7467092BB22FD292EA3E1D9AC
SHA1:	2E43E8B5650EE3562431EF184080FE3FAAAF92BE
SHA-256:	F2E24690DD3C5EC0ED647BA32442B14085CA82AD4E56171FCB90C899D11678FD
SHA-512:	E8C3CB3D735B594EC50A5B8F9C6EDB03D8B9BF8FD5BFEF8B90175310970529644967571A1472D68560D957887874FA25E4CC217ABE4C70B67AAF1F05EFAFE0F9
Malicious:	false
Preview:	..cd.s..nT?..s.l..H.....8y...../.a.....'..Z__:..7=s.~........u.u(.....Fs....%.....M...Ar.[...'...3;~......q(....}gA..)...)....H?q.i...?}8.j.V....,$[....c.d2t.. InO......6..1...T.z.H=L~....=...ao..Hk.(.2.Z..C@...o..p......$.`....M.$.KQ.mS..K......s......Ms...W.V.g...aU:.8......w.....5i...~...........!6.<L.Vn..3....(....I..5.....C....Q%.8.)3...{..]....a....j.../.WZ^...p..6..<M.31....Y.j..u{.v~..'".........].D...=.....r..nO)..z...s..hs?......O.M<.J.....)a..f63rKF.......@Jz..y..........]..Yt~..."..........a.d%H..-.]......c...L.hZ........`....:...T..o......n..H....X.]...lE.c...<"....NTV.By.....P...V... ......%....@..m.,.....S..Bz.Fa...H1.%..k......h:......NZ..j..E...=..............8.h..}.3.{.>.!.sD..&&P..g..Da_.p.ch...u....\|.G.1..2..a.d.Tf.._.'.?.._..+..:.f...+.#....LM-... ..\|.lo..Lt\|.J.4._....VzH.....g.....J.NH.....8!o.!.........*.&.C.~c+.p....5...GsA.5.%n.:}E...=...g1...}....:.P........f.b..r.X..;.P..].2.".t3D..h.8.:.....)3.I

C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCache\IE\2WF3MMUU\google-logo-one-color[1].jpg.blockck (copy) Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	10083
Entropy (8bit):	6.174961210849453
Encrypted:	false
SSDEEP:	96:RvkE5M8glIF5qyUuT60iCvPRm8WOTcDSD5fETM0XKa0jj5qyUuT60iCvPRm8WOTr:R8EkKgyTT6b8WXEcKJfgyTT6b8WXEx
MD5:	FA1481571F3707AC4A3B992430CEFF74
SHA1:	13FF3FD583B2A9AC9E6CA6554504625BA4405E74
SHA-256:	05A764E9D550D6A269C9AED0675059653E169279DA005CE4842E012B8D6B3766
SHA-512:	68EF54B65DE537ED2EE5366B40A09A6B6E3E56BC53EBBBFBDCE32B43D589DD3914FB184EF931DFED4BE02DBA5B28D0C4D35AD967CBD0B8011CA40DD43D365CC1
Malicious:	false
Preview:	%..o.IvV.;}...dF./8(>{A...8.@...C...6..>.lm.Mt...W8....].!...=\|^Z!Q..qV4...1...7.V...B....h.....?...A.8.O..N...J.=......A.c..{,.Q.Y2P...M.....X8W.....W.^........H..B.~I....Y.:........d.'\|"\|.w?...;o.M#...h]....>-..<y.3.zo7c.4......0..F...I..T{...5S.&...n.kt...0.>......ee. +=Y....V...j..#Hc..S..iS.$ZR<.A9..+8....JU.Z...8"9K.$.........rl>.U.(.6.{.Cm},.~o".F+)...N.....-.E.M.T..l.\...b.."O..M.].H..{....:c[.<.2R.....@.../.............{)=.(.l.9..A.?;....,.c..\..V.L...N.).$.U.c......G. Q...\|..Sq...f...D.....`...._..,..jJ...-......`2...^O..p..$.......G.w.B.......L......X......!...C.9.N.....^.S..KC[...U}..%A....J!...D......y..[.hI._........1.......S..K%.L..M\|..Lq.w3...Kog...5.r...04....Sd......\../I.9..W.r.E....p.&....Y6. ..J.

C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCache\IE\2WF3MMUU\googlelogo_color_92x36dp[1].png.block (copy) Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2101
Entropy (8bit):	7.90064247792031
Encrypted:	false
SSDEEP:	48:QPdZp2ZZmbk0DnbhZOPaPWddUVVWmMDPCaqJc:QPd6ZMbk0DnuagdsWmADR
MD5:	7DFB0DC8F71A87DA8735E2FE60C684D3
SHA1:	FFF7C5E02AD49EEBD4CA5DD4073DA01D6EB9F15A
SHA-256:	F977096CA33FA18837237D4C0143351CB92EBF669BE86D077FF91EA631E788DF
SHA-512:	7235651023EBD1F0B7F6A4F19520308D8CEE4A9C7E6A3DD34A4D2D4FA0164CD05A5BBDA32789374550E28A27E6EFC2966A31BE0E2B3C7292C16D81058F3149CC
Malicious:	false
Preview:	R..5.'a.e:).\|.=4{..Lv..{. .7G.s.h....f@....(T..g..r.(c.cD...4M&.Q.E.....n.....8z).B{$......^.}..Ex8.....n..]......n.......z8..R.N."......Z....)}j..e..?.z..6L....iU.x...R.....M.&..........r.......B\..Cl.7..7.V..2Y@...1..r....$....Q....A\6Uo....By.H.,....Q#..l.Gc..,..@...c.s..I.......N.;)...3...!.....Cs.......f..NU.KPx.{....JJ..4\|...G.m.A/....oOn..f/x,.....s...{.i.&_J.....O.....{}.K^....VH4i......7..Q]Qf....X.Kec.......h..........E......K..^R.....WH~...&....8..............A.4........a.\...4..3.9.......S.G.R&x..2.XH.n...\.O....9..?...j...i\..@..r...}.M.....n....vmhd.1..1.....H.V.`...x=5.A.=..d.2x......nC.p..B.9....}`...........Y.q...1..m....3!...]Q.._?c..#..cs..1..`-<..([.e%....<wft8iQ...y.!.7..z...V.&(..&p.8..J,.[....$F.J5......>..[......(..-.z.B.........G..I?...p.=.^.\(...#.w.-.... 7...`.Ny.k4..@...iG...K.o*.;.......B...gu.m.j....F..Tj...3...~&...`>...e8..x...pnS..5.....VQ.@O...x...2.l.Z.4".u....u.y.,#.b..).c..G.... -q.(..J.O..h...

C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCache\IE\9026IKNJ\1599143076228-3140[1].jpg.block.b (copy) Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	262313
Entropy (8bit):	7.979054409384697
Encrypted:	false
SSDEEP:	6144:GzzECR2bC0AVo2ivTRI81eNozzECR2bC0AVo2ivTRI81eN8:GH7QC1XibRPEoH7QC1XibRPE8
MD5:	88A9BD9D2D9C98715788133629E0FE9B
SHA1:	6480F901E8AACA88B1021E247EFC4A228D886FC5
SHA-256:	A73738EA245A8778768CDE7D0C3B39DA3844BF80F7834AB9F6165EDC71BB40DD
SHA-512:	AF6FC5B07E9D76222BC9CD3C982CF5F3B3687ED70B08B74F919F217E4DAAC0418C16163B35B475BE7A89BDE3269194B60CC0A4B4F4F2C77D70C6D3C0ECDDDC8F
Malicious:	false
Preview:	L.J".R..U.F..$...k...n.nc:.x.bFV.....,\|_...W6.../cg..f......@6....S....bj.a?.....wB..)B.z..1.x.NwC...`7.....> .e.....4.].or...\|.T.(.....~.mm.0+.G~.....d..Z.b.H.X..\.....tp........gF..o...@P.k.,.#.w..S..... t0.8.....E=....:...c....r..C..k....<1...a<....t-f8.....23Gc..V..]...............x.o.6...@.b....b.?..l.TqA.A.W...x.........cknO..".fj....9...b,\|z$..O..w.B.d...O....'...N.,.^7..=8......k.<.]..5...RR..q. .x.\|]...G...HZ4k..$m.J........u......$"...R.....6..D...$..6.[...k....e.x.G.........I&.q.1.L5.J....0..uo...`.8e7......c.K.".....\...........\.nU..VO.oh...6t..U..n.....>-..p......t...5...5...V....C.:..4y[...c..I....=7g......7?{...'.d.H4...yTK.L..d.H";..\..8,sA.$#....ES...w..O87.D...M.@b..?..J....\........oam7...4OK..w!.......6.H..E.~.\|.r.R.......$..F)I..Z./.c.q[w.....E...4l.*..;Wn4W.D~...A.....HX............Z. .b..A..F3....Bn...x.^.0#...;.6h^.........>.n2,f..A....x.x..}..V.\|............e=B....b.......o..+.a.h..V..0.k..r=G.q...`.

C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCache\IE\9026IKNJ\google-play-download[1].png.blocklo (copy) Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5369
Entropy (8bit):	7.913538139688611
Encrypted:	false
SSDEEP:	96:nuEUGPoYKpuef9XcAGMrO4fqvZ8Z6KK2wFD+HZ8HGPoYKpuef9XcAGMrO4fqvZ8F:nuXftcAGMrtyv4lIFDqMftcAGMrtyv4j
MD5:	D434736146B39125957A0027F064B514
SHA1:	D80E629E5FFB80374B6B613D268CDC0194425496
SHA-256:	90522A6FBFD793395A559A25E5ABDF6561A510E58EE2A680A62F19A58DF07912
SHA-512:	A64E35E92F418EBC0540A62E93BB6E711FB776007E6AE57ED7753FCC16FD39C0FE9BECFE059460AED1AFA22089FFE1E5F8DB8074C1DF71328CB94177D8E1348B
Malicious:	false
Preview:	........g,;T...&.^.;"........+....m.@..2...N..4...hB.!.70.^R.a..z.HM8.[.H.^..#.@......u.r..M_......%0...K.3(.w..cC....c.OO8..?./@......T. ....q.JT3%...G...E.....d;r\.....bX].q..x......7\e..-.u..O......{t..(#(.;,R.......1....^..5...Z...u.../&..B.j.......s6.}.?..J.5..$%..T.9...).d&...H(..h..[...7......K.+Do[7^..D.9..l...."...2....E....s.j.1.'.......K..x...{..%...m..B...T...B...66.[.3)_I. C.W...,.....M.J.U.....=/...u2....Q}E.4...W..Rt\|/....l.ET.N.x..... .y=...? ....i...}........t.7.....z0....YD..B+.&>4.....vZ..".Y...F......z6&h.U.W"P..W.r...v-l...ay.....X.........YNw.._.............q..;y..$$O.##.x\|XDJ.+.....C.r...9...;..T^..YP.......JZ.......>.......(.........}..?...c.........]...E...j.K.E....../.8I..U.g9.A.=..S.d..;\.....F.....9....]U....?:.....{.+...i...................~..r.tm.UI.:0...Ak....tRNS...o...../..$g....IDATX..u..A.......b.6b+vwwwwwwwwwwwwwww=g....y...........;.B.d"...6D..6D.H.M.F..3w.#w.P....m.QP.7M.!..MA.0,.*:.-.B.`L.b..`N

C:\ProgramData\Adobe\ARM\Reader_19.012.20034\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUc:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgic
MD5:	2DD89CA2D644D9414D300A8AF16335CA
SHA1:	669A89206DBF779310703AEE89FAF02E45F4BD8F
SHA-256:	96050B4208C71F273887FDD4DC7CE3D2AE8B557916F9B131DD33863B0D59AED9
SHA-512:	9847E81AD1CF2B6C34CF1FA713D3E24F49D3E92E9DABD2CD356CFC574A76155FA3E866D43C2144AAE388E10D326C0682B48187CC0B52D7DF7CB6F3561262E65C
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Adobe\ARM\Reader_19.012.20035\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUc:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgic
MD5:	2DD89CA2D644D9414D300A8AF16335CA
SHA1:	669A89206DBF779310703AEE89FAF02E45F4BD8F
SHA-256:	96050B4208C71F273887FDD4DC7CE3D2AE8B557916F9B131DD33863B0D59AED9
SHA-512:	9847E81AD1CF2B6C34CF1FA713D3E24F49D3E92E9DABD2CD356CFC574A76155FA3E866D43C2144AAE388E10D326C0682B48187CC0B52D7DF7CB6F3561262E65C
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Adobe\ARM\S\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2988
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUZ:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiZ
MD5:	1EAFD54AB2EF966BEFDDBC81523CC9A3
SHA1:	B88BAF7E2AEF9583E5D9166BE4FA708D2F90AE62
SHA-256:	525754A2BF80387C752C0B58D1B8E5A42C306B7BB9996EE502E0A51383D6740D
SHA-512:	83731C664680216E99447D813AA39FFDB04899E049067DECD24FD7BE5F33338952EA2258EE91C6ACE643B107E111478ACC096790082B3082998D28EFEBD6279A
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Adobe\ARM\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2988
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUZ:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiZ
MD5:	1EAFD54AB2EF966BEFDDBC81523CC9A3
SHA1:	B88BAF7E2AEF9583E5D9166BE4FA708D2F90AE62
SHA-256:	525754A2BF80387C752C0B58D1B8E5A42C306B7BB9996EE502E0A51383D6740D
SHA-512:	83731C664680216E99447D813AA39FFDB04899E049067DECD24FD7BE5F33338952EA2258EE91C6ACE643B107E111478ACC096790082B3082998D28EFEBD6279A
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2490
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E55D921118396C9F31A5B2E173A938A0
SHA1:	210E5A9952B8C75E7BCA0937AA817DBD563F76B5
SHA-256:	C0E93AADBABC947992A361C545E9E41CBBB9E2864AD893A1A6727A9B145D1D52
SHA-512:	C664CDC8CAC9595494C389860AD44F19EB9150F536A6CF8EB62B312CADFE60D47D5A8CCDED5FBDEE7B7EA099D8A85BB76F55C6E94FE502A05AFFFE36B7AA9ECC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Adobe\Setup\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2988
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUZ:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiZ
MD5:	1EAFD54AB2EF966BEFDDBC81523CC9A3
SHA1:	B88BAF7E2AEF9583E5D9166BE4FA708D2F90AE62
SHA-256:	525754A2BF80387C752C0B58D1B8E5A42C306B7BB9996EE502E0A51383D6740D
SHA-512:	83731C664680216E99447D813AA39FFDB04899E049067DECD24FD7BE5F33338952EA2258EE91C6ACE643B107E111478ACC096790082B3082998D28EFEBD6279A
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2490
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E55D921118396C9F31A5B2E173A938A0
SHA1:	210E5A9952B8C75E7BCA0937AA817DBD563F76B5
SHA-256:	C0E93AADBABC947992A361C545E9E41CBBB9E2864AD893A1A6727A9B145D1D52
SHA-512:	C664CDC8CAC9595494C389860AD44F19EB9150F536A6CF8EB62B312CADFE60D47D5A8CCDED5FBDEE7B7EA099D8A85BB76F55C6E94FE502A05AFFFE36B7AA9ECC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Adobe\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3237
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	96:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgs:TWWWWWWWWWWWWs
MD5:	8F4FD7A4A181DFD54758C84AFBB20C6E
SHA1:	64952B85F3DD2099A989009C85A61A3344C64C17
SHA-256:	7635398CCC959633D8F75F7CCEB4FC8F3CFC8A8D910315A6B9A8A105A165BF12
SHA-512:	8D20EFE7B1F047D28D3BFE7B8D9DBB27819A23D23AD224739814D9452AC93EB790299AC804F8C3E64681A49C121FCDD349C93DF35029E0BA994E23B779E28714
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft Help\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2988
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUZ:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiZ
MD5:	1EAFD54AB2EF966BEFDDBC81523CC9A3
SHA1:	B88BAF7E2AEF9583E5D9166BE4FA708D2F90AE62
SHA-256:	525754A2BF80387C752C0B58D1B8E5A42C306B7BB9996EE502E0A51383D6740D
SHA-512:	83731C664680216E99447D813AA39FFDB04899E049067DECD24FD7BE5F33338952EA2258EE91C6ACE643B107E111478ACC096790082B3082998D28EFEBD6279A
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft OneDrive\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2988
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUZ:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiZ
MD5:	1EAFD54AB2EF966BEFDDBC81523CC9A3
SHA1:	B88BAF7E2AEF9583E5D9166BE4FA708D2F90AE62
SHA-256:	525754A2BF80387C752C0B58D1B8E5A42C306B7BB9996EE502E0A51383D6740D
SHA-512:	83731C664680216E99447D813AA39FFDB04899E049067DECD24FD7BE5F33338952EA2258EE91C6ACE643B107E111478ACC096790082B3082998D28EFEBD6279A
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft OneDrive\setup\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2988
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUZ:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiZ
MD5:	1EAFD54AB2EF966BEFDDBC81523CC9A3
SHA1:	B88BAF7E2AEF9583E5D9166BE4FA708D2F90AE62
SHA-256:	525754A2BF80387C752C0B58D1B8E5A42C306B7BB9996EE502E0A51383D6740D
SHA-512:	83731C664680216E99447D813AA39FFDB04899E049067DECD24FD7BE5F33338952EA2258EE91C6ACE643B107E111478ACC096790082B3082998D28EFEBD6279A
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\AppV\Setup\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2988
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUZ:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiZ
MD5:	1EAFD54AB2EF966BEFDDBC81523CC9A3
SHA1:	B88BAF7E2AEF9583E5D9166BE4FA708D2F90AE62
SHA-256:	525754A2BF80387C752C0B58D1B8E5A42C306B7BB9996EE502E0A51383D6740D
SHA-512:	83731C664680216E99447D813AA39FFDB04899E049067DECD24FD7BE5F33338952EA2258EE91C6ACE643B107E111478ACC096790082B3082998D28EFEBD6279A
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\AppV\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2988
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUZ:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiZ
MD5:	1EAFD54AB2EF966BEFDDBC81523CC9A3
SHA1:	B88BAF7E2AEF9583E5D9166BE4FA708D2F90AE62
SHA-256:	525754A2BF80387C752C0B58D1B8E5A42C306B7BB9996EE502E0A51383D6740D
SHA-512:	83731C664680216E99447D813AA39FFDB04899E049067DECD24FD7BE5F33338952EA2258EE91C6ACE643B107E111478ACC096790082B3082998D28EFEBD6279A
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Crypto\DSS\MachineKeys\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUc:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgic
MD5:	2DD89CA2D644D9414D300A8AF16335CA
SHA1:	669A89206DBF779310703AEE89FAF02E45F4BD8F
SHA-256:	96050B4208C71F273887FDD4DC7CE3D2AE8B557916F9B131DD33863B0D59AED9
SHA-512:	9847E81AD1CF2B6C34CF1FA713D3E24F49D3E92E9DABD2CD356CFC574A76155FA3E866D43C2144AAE388E10D326C0682B48187CC0B52D7DF7CB6F3561262E65C
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Crypto\DSS\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2988
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUZ:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiZ
MD5:	1EAFD54AB2EF966BEFDDBC81523CC9A3
SHA1:	B88BAF7E2AEF9583E5D9166BE4FA708D2F90AE62
SHA-256:	525754A2BF80387C752C0B58D1B8E5A42C306B7BB9996EE502E0A51383D6740D
SHA-512:	83731C664680216E99447D813AA39FFDB04899E049067DECD24FD7BE5F33338952EA2258EE91C6ACE643B107E111478ACC096790082B3082998D28EFEBD6279A
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Crypto\Keys\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2988
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUZ:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiZ
MD5:	1EAFD54AB2EF966BEFDDBC81523CC9A3
SHA1:	B88BAF7E2AEF9583E5D9166BE4FA708D2F90AE62
SHA-256:	525754A2BF80387C752C0B58D1B8E5A42C306B7BB9996EE502E0A51383D6740D
SHA-512:	83731C664680216E99447D813AA39FFDB04899E049067DECD24FD7BE5F33338952EA2258EE91C6ACE643B107E111478ACC096790082B3082998D28EFEBD6279A
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Crypto\PCPKSP\WindowsAIK\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUc:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgic
MD5:	2DD89CA2D644D9414D300A8AF16335CA
SHA1:	669A89206DBF779310703AEE89FAF02E45F4BD8F
SHA-256:	96050B4208C71F273887FDD4DC7CE3D2AE8B557916F9B131DD33863B0D59AED9
SHA-512:	9847E81AD1CF2B6C34CF1FA713D3E24F49D3E92E9DABD2CD356CFC574A76155FA3E866D43C2144AAE388E10D326C0682B48187CC0B52D7DF7CB6F3561262E65C
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Crypto\PCPKSP\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2988
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUZ:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiZ
MD5:	1EAFD54AB2EF966BEFDDBC81523CC9A3
SHA1:	B88BAF7E2AEF9583E5D9166BE4FA708D2F90AE62
SHA-256:	525754A2BF80387C752C0B58D1B8E5A42C306B7BB9996EE502E0A51383D6740D
SHA-512:	83731C664680216E99447D813AA39FFDB04899E049067DECD24FD7BE5F33338952EA2258EE91C6ACE643B107E111478ACC096790082B3082998D28EFEBD6279A
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUc:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgic
MD5:	2DD89CA2D644D9414D300A8AF16335CA
SHA1:	669A89206DBF779310703AEE89FAF02E45F4BD8F
SHA-256:	96050B4208C71F273887FDD4DC7CE3D2AE8B557916F9B131DD33863B0D59AED9
SHA-512:	9847E81AD1CF2B6C34CF1FA713D3E24F49D3E92E9DABD2CD356CFC574A76155FA3E866D43C2144AAE388E10D326C0682B48187CC0B52D7DF7CB6F3561262E65C
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Crypto\RSA\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2988
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUZ:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiZ
MD5:	1EAFD54AB2EF966BEFDDBC81523CC9A3
SHA1:	B88BAF7E2AEF9583E5D9166BE4FA708D2F90AE62
SHA-256:	525754A2BF80387C752C0B58D1B8E5A42C306B7BB9996EE502E0A51383D6740D
SHA-512:	83731C664680216E99447D813AA39FFDB04899E049067DECD24FD7BE5F33338952EA2258EE91C6ACE643B107E111478ACC096790082B3082998D28EFEBD6279A
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Crypto\SystemKeys\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUc:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgic
MD5:	2DD89CA2D644D9414D300A8AF16335CA
SHA1:	669A89206DBF779310703AEE89FAF02E45F4BD8F
SHA-256:	96050B4208C71F273887FDD4DC7CE3D2AE8B557916F9B131DD33863B0D59AED9
SHA-512:	9847E81AD1CF2B6C34CF1FA713D3E24F49D3E92E9DABD2CD356CFC574A76155FA3E866D43C2144AAE388E10D326C0682B48187CC0B52D7DF7CB6F3561262E65C
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Crypto\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2988
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUZ:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiZ
MD5:	1EAFD54AB2EF966BEFDDBC81523CC9A3
SHA1:	B88BAF7E2AEF9583E5D9166BE4FA708D2F90AE62
SHA-256:	525754A2BF80387C752C0B58D1B8E5A42C306B7BB9996EE502E0A51383D6740D
SHA-512:	83731C664680216E99447D813AA39FFDB04899E049067DECD24FD7BE5F33338952EA2258EE91C6ACE643B107E111478ACC096790082B3082998D28EFEBD6279A
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\DRM\Server\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2988
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUZ:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiZ
MD5:	1EAFD54AB2EF966BEFDDBC81523CC9A3
SHA1:	B88BAF7E2AEF9583E5D9166BE4FA708D2F90AE62
SHA-256:	525754A2BF80387C752C0B58D1B8E5A42C306B7BB9996EE502E0A51383D6740D
SHA-512:	83731C664680216E99447D813AA39FFDB04899E049067DECD24FD7BE5F33338952EA2258EE91C6ACE643B107E111478ACC096790082B3082998D28EFEBD6279A
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\DRM\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2988
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUZ:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiZ
MD5:	1EAFD54AB2EF966BEFDDBC81523CC9A3
SHA1:	B88BAF7E2AEF9583E5D9166BE4FA708D2F90AE62
SHA-256:	525754A2BF80387C752C0B58D1B8E5A42C306B7BB9996EE502E0A51383D6740D
SHA-512:	83731C664680216E99447D813AA39FFDB04899E049067DECD24FD7BE5F33338952EA2258EE91C6ACE643B107E111478ACC096790082B3082998D28EFEBD6279A
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Device Stage\Device\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUc:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgic
MD5:	2DD89CA2D644D9414D300A8AF16335CA
SHA1:	669A89206DBF779310703AEE89FAF02E45F4BD8F
SHA-256:	96050B4208C71F273887FDD4DC7CE3D2AE8B557916F9B131DD33863B0D59AED9
SHA-512:	9847E81AD1CF2B6C34CF1FA713D3E24F49D3E92E9DABD2CD356CFC574A76155FA3E866D43C2144AAE388E10D326C0682B48187CC0B52D7DF7CB6F3561262E65C
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Device Stage\Task\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUc:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgic
MD5:	2DD89CA2D644D9414D300A8AF16335CA
SHA1:	669A89206DBF779310703AEE89FAF02E45F4BD8F
SHA-256:	96050B4208C71F273887FDD4DC7CE3D2AE8B557916F9B131DD33863B0D59AED9
SHA-512:	9847E81AD1CF2B6C34CF1FA713D3E24F49D3E92E9DABD2CD356CFC574A76155FA3E866D43C2144AAE388E10D326C0682B48187CC0B52D7DF7CB6F3561262E65C
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-US\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Device Stage\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2988
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUZ:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiZ
MD5:	1EAFD54AB2EF966BEFDDBC81523CC9A3
SHA1:	B88BAF7E2AEF9583E5D9166BE4FA708D2F90AE62
SHA-256:	525754A2BF80387C752C0B58D1B8E5A42C306B7BB9996EE502E0A51383D6740D
SHA-512:	83731C664680216E99447D813AA39FFDB04899E049067DECD24FD7BE5F33338952EA2258EE91C6ACE643B107E111478ACC096790082B3082998D28EFEBD6279A
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\DeviceSync\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2988
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUZ:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiZ
MD5:	1EAFD54AB2EF966BEFDDBC81523CC9A3
SHA1:	B88BAF7E2AEF9583E5D9166BE4FA708D2F90AE62
SHA-256:	525754A2BF80387C752C0B58D1B8E5A42C306B7BB9996EE502E0A51383D6740D
SHA-512:	83731C664680216E99447D813AA39FFDB04899E049067DECD24FD7BE5F33338952EA2258EE91C6ACE643B107E111478ACC096790082B3082998D28EFEBD6279A
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Diagnosis\AsimovUploader\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUc:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgic
MD5:	2DD89CA2D644D9414D300A8AF16335CA
SHA1:	669A89206DBF779310703AEE89FAF02E45F4BD8F
SHA-256:	96050B4208C71F273887FDD4DC7CE3D2AE8B557916F9B131DD33863B0D59AED9
SHA-512:	9847E81AD1CF2B6C34CF1FA713D3E24F49D3E92E9DABD2CD356CFC574A76155FA3E866D43C2144AAE388E10D326C0682B48187CC0B52D7DF7CB6F3561262E65C
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Diagnosis\CustomTraceProfiles\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUc:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgic
MD5:	2DD89CA2D644D9414D300A8AF16335CA
SHA1:	669A89206DBF779310703AEE89FAF02E45F4BD8F
SHA-256:	96050B4208C71F273887FDD4DC7CE3D2AE8B557916F9B131DD33863B0D59AED9
SHA-512:	9847E81AD1CF2B6C34CF1FA713D3E24F49D3E92E9DABD2CD356CFC574A76155FA3E866D43C2144AAE388E10D326C0682B48187CC0B52D7DF7CB6F3561262E65C
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Diagnosis\DownloadedScenarios\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUc:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgic
MD5:	2DD89CA2D644D9414D300A8AF16335CA
SHA1:	669A89206DBF779310703AEE89FAF02E45F4BD8F
SHA-256:	96050B4208C71F273887FDD4DC7CE3D2AE8B557916F9B131DD33863B0D59AED9
SHA-512:	9847E81AD1CF2B6C34CF1FA713D3E24F49D3E92E9DABD2CD356CFC574A76155FA3E866D43C2144AAE388E10D326C0682B48187CC0B52D7DF7CB6F3561262E65C
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUc:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgic
MD5:	2DD89CA2D644D9414D300A8AF16335CA
SHA1:	669A89206DBF779310703AEE89FAF02E45F4BD8F
SHA-256:	96050B4208C71F273887FDD4DC7CE3D2AE8B557916F9B131DD33863B0D59AED9
SHA-512:	9847E81AD1CF2B6C34CF1FA713D3E24F49D3E92E9DABD2CD356CFC574A76155FA3E866D43C2144AAE388E10D326C0682B48187CC0B52D7DF7CB6F3561262E65C
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Diagnosis\ETLLogs\AutoLogger\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUc:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgic
MD5:	2DD89CA2D644D9414D300A8AF16335CA
SHA1:	669A89206DBF779310703AEE89FAF02E45F4BD8F
SHA-256:	96050B4208C71F273887FDD4DC7CE3D2AE8B557916F9B131DD33863B0D59AED9
SHA-512:	9847E81AD1CF2B6C34CF1FA713D3E24F49D3E92E9DABD2CD356CFC574A76155FA3E866D43C2144AAE388E10D326C0682B48187CC0B52D7DF7CB6F3561262E65C
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Diagnosis\ETLLogs\ScenarioShutdownLogger\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2490
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E55D921118396C9F31A5B2E173A938A0
SHA1:	210E5A9952B8C75E7BCA0937AA817DBD563F76B5
SHA-256:	C0E93AADBABC947992A361C545E9E41CBBB9E2864AD893A1A6727A9B145D1D52
SHA-512:	C664CDC8CAC9595494C389860AD44F19EB9150F536A6CF8EB62B312CADFE60D47D5A8CCDED5FBDEE7B7EA099D8A85BB76F55C6E94FE502A05AFFFE36B7AA9ECC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Diagnosis\ETLLogs\ShutdownLogger\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2490
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E55D921118396C9F31A5B2E173A938A0
SHA1:	210E5A9952B8C75E7BCA0937AA817DBD563F76B5
SHA-256:	C0E93AADBABC947992A361C545E9E41CBBB9E2864AD893A1A6727A9B145D1D52
SHA-512:	C664CDC8CAC9595494C389860AD44F19EB9150F536A6CF8EB62B312CADFE60D47D5A8CCDED5FBDEE7B7EA099D8A85BB76F55C6E94FE502A05AFFFE36B7AA9ECC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Diagnosis\ETLLogs\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUc:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgic
MD5:	2DD89CA2D644D9414D300A8AF16335CA
SHA1:	669A89206DBF779310703AEE89FAF02E45F4BD8F
SHA-256:	96050B4208C71F273887FDD4DC7CE3D2AE8B557916F9B131DD33863B0D59AED9
SHA-512:	9847E81AD1CF2B6C34CF1FA713D3E24F49D3E92E9DABD2CD356CFC574A76155FA3E866D43C2144AAE388E10D326C0682B48187CC0B52D7DF7CB6F3561262E65C
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Diagnosis\EventTranscript\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUc:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgic
MD5:	2DD89CA2D644D9414D300A8AF16335CA
SHA1:	669A89206DBF779310703AEE89FAF02E45F4BD8F
SHA-256:	96050B4208C71F273887FDD4DC7CE3D2AE8B557916F9B131DD33863B0D59AED9
SHA-512:	9847E81AD1CF2B6C34CF1FA713D3E24F49D3E92E9DABD2CD356CFC574A76155FA3E866D43C2144AAE388E10D326C0682B48187CC0B52D7DF7CB6F3561262E65C
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Diagnosis\LocalTraceStore\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUc:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgic
MD5:	2DD89CA2D644D9414D300A8AF16335CA
SHA1:	669A89206DBF779310703AEE89FAF02E45F4BD8F
SHA-256:	96050B4208C71F273887FDD4DC7CE3D2AE8B557916F9B131DD33863B0D59AED9
SHA-512:	9847E81AD1CF2B6C34CF1FA713D3E24F49D3E92E9DABD2CD356CFC574A76155FA3E866D43C2144AAE388E10D326C0682B48187CC0B52D7DF7CB6F3561262E65C
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Diagnosis\OfflineSettings\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUc:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgic
MD5:	2DD89CA2D644D9414D300A8AF16335CA
SHA1:	669A89206DBF779310703AEE89FAF02E45F4BD8F
SHA-256:	96050B4208C71F273887FDD4DC7CE3D2AE8B557916F9B131DD33863B0D59AED9
SHA-512:	9847E81AD1CF2B6C34CF1FA713D3E24F49D3E92E9DABD2CD356CFC574A76155FA3E866D43C2144AAE388E10D326C0682B48187CC0B52D7DF7CB6F3561262E65C
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Diagnosis\Scripts\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUc:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgic
MD5:	2DD89CA2D644D9414D300A8AF16335CA
SHA1:	669A89206DBF779310703AEE89FAF02E45F4BD8F
SHA-256:	96050B4208C71F273887FDD4DC7CE3D2AE8B557916F9B131DD33863B0D59AED9
SHA-512:	9847E81AD1CF2B6C34CF1FA713D3E24F49D3E92E9DABD2CD356CFC574A76155FA3E866D43C2144AAE388E10D326C0682B48187CC0B52D7DF7CB6F3561262E65C
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Diagnosis\Sideload\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUc:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgic
MD5:	2DD89CA2D644D9414D300A8AF16335CA
SHA1:	669A89206DBF779310703AEE89FAF02E45F4BD8F
SHA-256:	96050B4208C71F273887FDD4DC7CE3D2AE8B557916F9B131DD33863B0D59AED9
SHA-512:	9847E81AD1CF2B6C34CF1FA713D3E24F49D3E92E9DABD2CD356CFC574A76155FA3E866D43C2144AAE388E10D326C0682B48187CC0B52D7DF7CB6F3561262E65C
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Diagnosis\Siufloc\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUc:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgic
MD5:	2DD89CA2D644D9414D300A8AF16335CA
SHA1:	669A89206DBF779310703AEE89FAF02E45F4BD8F
SHA-256:	96050B4208C71F273887FDD4DC7CE3D2AE8B557916F9B131DD33863B0D59AED9
SHA-512:	9847E81AD1CF2B6C34CF1FA713D3E24F49D3E92E9DABD2CD356CFC574A76155FA3E866D43C2144AAE388E10D326C0682B48187CC0B52D7DF7CB6F3561262E65C
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Diagnosis\SoftLandingStage\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUc:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgic
MD5:	2DD89CA2D644D9414D300A8AF16335CA
SHA1:	669A89206DBF779310703AEE89FAF02E45F4BD8F
SHA-256:	96050B4208C71F273887FDD4DC7CE3D2AE8B557916F9B131DD33863B0D59AED9
SHA-512:	9847E81AD1CF2B6C34CF1FA713D3E24F49D3E92E9DABD2CD356CFC574A76155FA3E866D43C2144AAE388E10D326C0682B48187CC0B52D7DF7CB6F3561262E65C
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Diagnosis\SoftLanding\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUc:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgic
MD5:	2DD89CA2D644D9414D300A8AF16335CA
SHA1:	669A89206DBF779310703AEE89FAF02E45F4BD8F
SHA-256:	96050B4208C71F273887FDD4DC7CE3D2AE8B557916F9B131DD33863B0D59AED9
SHA-512:	9847E81AD1CF2B6C34CF1FA713D3E24F49D3E92E9DABD2CD356CFC574A76155FA3E866D43C2144AAE388E10D326C0682B48187CC0B52D7DF7CB6F3561262E65C
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Diagnosis\TenantStorage\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUc:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgic
MD5:	2DD89CA2D644D9414D300A8AF16335CA
SHA1:	669A89206DBF779310703AEE89FAF02E45F4BD8F
SHA-256:	96050B4208C71F273887FDD4DC7CE3D2AE8B557916F9B131DD33863B0D59AED9
SHA-512:	9847E81AD1CF2B6C34CF1FA713D3E24F49D3E92E9DABD2CD356CFC574A76155FA3E866D43C2144AAE388E10D326C0682B48187CC0B52D7DF7CB6F3561262E65C
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Diagnosis\WindowsAnalytics\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUc:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgic
MD5:	2DD89CA2D644D9414D300A8AF16335CA
SHA1:	669A89206DBF779310703AEE89FAF02E45F4BD8F
SHA-256:	96050B4208C71F273887FDD4DC7CE3D2AE8B557916F9B131DD33863B0D59AED9
SHA-512:	9847E81AD1CF2B6C34CF1FA713D3E24F49D3E92E9DABD2CD356CFC574A76155FA3E866D43C2144AAE388E10D326C0682B48187CC0B52D7DF7CB6F3561262E65C
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Diagnosis\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2988
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUZ:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiZ
MD5:	1EAFD54AB2EF966BEFDDBC81523CC9A3
SHA1:	B88BAF7E2AEF9583E5D9166BE4FA708D2F90AE62
SHA-256:	525754A2BF80387C752C0B58D1B8E5A42C306B7BB9996EE502E0A51383D6740D
SHA-512:	83731C664680216E99447D813AA39FFDB04899E049067DECD24FD7BE5F33338952EA2258EE91C6ACE643B107E111478ACC096790082B3082998D28EFEBD6279A
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\IdentityCRL\INT\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUc:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgic
MD5:	2DD89CA2D644D9414D300A8AF16335CA
SHA1:	669A89206DBF779310703AEE89FAF02E45F4BD8F
SHA-256:	96050B4208C71F273887FDD4DC7CE3D2AE8B557916F9B131DD33863B0D59AED9
SHA-512:	9847E81AD1CF2B6C34CF1FA713D3E24F49D3E92E9DABD2CD356CFC574A76155FA3E866D43C2144AAE388E10D326C0682B48187CC0B52D7DF7CB6F3561262E65C
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\IdentityCRL\production\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUc:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgic
MD5:	2DD89CA2D644D9414D300A8AF16335CA
SHA1:	669A89206DBF779310703AEE89FAF02E45F4BD8F
SHA-256:	96050B4208C71F273887FDD4DC7CE3D2AE8B557916F9B131DD33863B0D59AED9
SHA-512:	9847E81AD1CF2B6C34CF1FA713D3E24F49D3E92E9DABD2CD356CFC574A76155FA3E866D43C2144AAE388E10D326C0682B48187CC0B52D7DF7CB6F3561262E65C
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\IdentityCRL\production\temp\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUc:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgic
MD5:	2DD89CA2D644D9414D300A8AF16335CA
SHA1:	669A89206DBF779310703AEE89FAF02E45F4BD8F
SHA-256:	96050B4208C71F273887FDD4DC7CE3D2AE8B557916F9B131DD33863B0D59AED9
SHA-512:	9847E81AD1CF2B6C34CF1FA713D3E24F49D3E92E9DABD2CD356CFC574A76155FA3E866D43C2144AAE388E10D326C0682B48187CC0B52D7DF7CB6F3561262E65C
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\IdentityCRL\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2988
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUZ:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiZ
MD5:	1EAFD54AB2EF966BEFDDBC81523CC9A3
SHA1:	B88BAF7E2AEF9583E5D9166BE4FA708D2F90AE62
SHA-256:	525754A2BF80387C752C0B58D1B8E5A42C306B7BB9996EE502E0A51383D6740D
SHA-512:	83731C664680216E99447D813AA39FFDB04899E049067DECD24FD7BE5F33338952EA2258EE91C6ACE643B107E111478ACC096790082B3082998D28EFEBD6279A
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\MF\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2988
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUZ:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiZ
MD5:	1EAFD54AB2EF966BEFDDBC81523CC9A3
SHA1:	B88BAF7E2AEF9583E5D9166BE4FA708D2F90AE62
SHA-256:	525754A2BF80387C752C0B58D1B8E5A42C306B7BB9996EE502E0A51383D6740D
SHA-512:	83731C664680216E99447D813AA39FFDB04899E049067DECD24FD7BE5F33338952EA2258EE91C6ACE643B107E111478ACC096790082B3082998D28EFEBD6279A
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\MapData\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2988
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUZ:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiZ
MD5:	1EAFD54AB2EF966BEFDDBC81523CC9A3
SHA1:	B88BAF7E2AEF9583E5D9166BE4FA708D2F90AE62
SHA-256:	525754A2BF80387C752C0B58D1B8E5A42C306B7BB9996EE502E0A51383D6740D
SHA-512:	83731C664680216E99447D813AA39FFDB04899E049067DECD24FD7BE5F33338952EA2258EE91C6ACE643B107E111478ACC096790082B3082998D28EFEBD6279A
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUc:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgic
MD5:	2DD89CA2D644D9414D300A8AF16335CA
SHA1:	669A89206DBF779310703AEE89FAF02E45F4BD8F
SHA-256:	96050B4208C71F273887FDD4DC7CE3D2AE8B557916F9B131DD33863B0D59AED9
SHA-512:	9847E81AD1CF2B6C34CF1FA713D3E24F49D3E92E9DABD2CD356CFC574A76155FA3E866D43C2144AAE388E10D326C0682B48187CC0B52D7DF7CB6F3561262E65C
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\NetFramework\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2988
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUZ:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiZ
MD5:	1EAFD54AB2EF966BEFDDBC81523CC9A3
SHA1:	B88BAF7E2AEF9583E5D9166BE4FA708D2F90AE62
SHA-256:	525754A2BF80387C752C0B58D1B8E5A42C306B7BB9996EE502E0A51383D6740D
SHA-512:	83731C664680216E99447D813AA39FFDB04899E049067DECD24FD7BE5F33338952EA2258EE91C6ACE643B107E111478ACC096790082B3082998D28EFEBD6279A
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Network\Connections\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUc:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgic
MD5:	2DD89CA2D644D9414D300A8AF16335CA
SHA1:	669A89206DBF779310703AEE89FAF02E45F4BD8F
SHA-256:	96050B4208C71F273887FDD4DC7CE3D2AE8B557916F9B131DD33863B0D59AED9
SHA-512:	9847E81AD1CF2B6C34CF1FA713D3E24F49D3E92E9DABD2CD356CFC574A76155FA3E866D43C2144AAE388E10D326C0682B48187CC0B52D7DF7CB6F3561262E65C
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Network\Downloader\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUc:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgic
MD5:	2DD89CA2D644D9414D300A8AF16335CA
SHA1:	669A89206DBF779310703AEE89FAF02E45F4BD8F
SHA-256:	96050B4208C71F273887FDD4DC7CE3D2AE8B557916F9B131DD33863B0D59AED9
SHA-512:	9847E81AD1CF2B6C34CF1FA713D3E24F49D3E92E9DABD2CD356CFC574A76155FA3E866D43C2144AAE388E10D326C0682B48187CC0B52D7DF7CB6F3561262E65C
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Network\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2988
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUZ:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiZ
MD5:	1EAFD54AB2EF966BEFDDBC81523CC9A3
SHA1:	B88BAF7E2AEF9583E5D9166BE4FA708D2F90AE62
SHA-256:	525754A2BF80387C752C0B58D1B8E5A42C306B7BB9996EE502E0A51383D6740D
SHA-512:	83731C664680216E99447D813AA39FFDB04899E049067DECD24FD7BE5F33338952EA2258EE91C6ACE643B107E111478ACC096790082B3082998D28EFEBD6279A
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\OFFICE\Heartbeat\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUc:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgic
MD5:	2DD89CA2D644D9414D300A8AF16335CA
SHA1:	669A89206DBF779310703AEE89FAF02E45F4BD8F
SHA-256:	96050B4208C71F273887FDD4DC7CE3D2AE8B557916F9B131DD33863B0D59AED9
SHA-512:	9847E81AD1CF2B6C34CF1FA713D3E24F49D3E92E9DABD2CD356CFC574A76155FA3E866D43C2144AAE388E10D326C0682B48187CC0B52D7DF7CB6F3561262E65C
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\OFFICE\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2988
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUZ:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiZ
MD5:	1EAFD54AB2EF966BEFDDBC81523CC9A3
SHA1:	B88BAF7E2AEF9583E5D9166BE4FA708D2F90AE62
SHA-256:	525754A2BF80387C752C0B58D1B8E5A42C306B7BB9996EE502E0A51383D6740D
SHA-512:	83731C664680216E99447D813AA39FFDB04899E049067DECD24FD7BE5F33338952EA2258EE91C6ACE643B107E111478ACC096790082B3082998D28EFEBD6279A
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Provisioning\AssetCache\CellularUx\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2490
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E55D921118396C9F31A5B2E173A938A0
SHA1:	210E5A9952B8C75E7BCA0937AA817DBD563F76B5
SHA-256:	C0E93AADBABC947992A361C545E9E41CBBB9E2864AD893A1A6727A9B145D1D52
SHA-512:	C664CDC8CAC9595494C389860AD44F19EB9150F536A6CF8EB62B312CADFE60D47D5A8CCDED5FBDEE7B7EA099D8A85BB76F55C6E94FE502A05AFFFE36B7AA9ECC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Provisioning\AssetCache\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUc:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgic
MD5:	2DD89CA2D644D9414D300A8AF16335CA
SHA1:	669A89206DBF779310703AEE89FAF02E45F4BD8F
SHA-256:	96050B4208C71F273887FDD4DC7CE3D2AE8B557916F9B131DD33863B0D59AED9
SHA-512:	9847E81AD1CF2B6C34CF1FA713D3E24F49D3E92E9DABD2CD356CFC574A76155FA3E866D43C2144AAE388E10D326C0682B48187CC0B52D7DF7CB6F3561262E65C
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Provisioning\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2988
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUZ:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiZ
MD5:	1EAFD54AB2EF966BEFDDBC81523CC9A3
SHA1:	B88BAF7E2AEF9583E5D9166BE4FA708D2F90AE62
SHA-256:	525754A2BF80387C752C0B58D1B8E5A42C306B7BB9996EE502E0A51383D6740D
SHA-512:	83731C664680216E99447D813AA39FFDB04899E049067DECD24FD7BE5F33338952EA2258EE91C6ACE643B107E111478ACC096790082B3082998D28EFEBD6279A
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Provisioning\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\Prov\RunTime\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Provisioning\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\Prov\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Provisioning\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Provisioning\{1e05dd5d-a022-46c5-963c-b20de341170f}\Prov\RunTime\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Provisioning\{1e05dd5d-a022-46c5-963c-b20de341170f}\Prov\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Provisioning\{1e05dd5d-a022-46c5-963c-b20de341170f}\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Provisioning\{23cb517f-5073-4e96-a202-7fe6122a2271}\Prov\RunTime\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Provisioning\{23cb517f-5073-4e96-a202-7fe6122a2271}\Prov\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Provisioning\{23cb517f-5073-4e96-a202-7fe6122a2271}\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Provisioning\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\Prov\RunTime\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Provisioning\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\Prov\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Provisioning\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Provisioning\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\Prov\RunTime\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Provisioning\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\Prov\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Provisioning\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Provisioning\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\Prov\RunTime\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Provisioning\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\Prov\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Provisioning\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Provisioning\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\Prov\RunTime\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Provisioning\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\Prov\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Provisioning\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Provisioning\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\Prov\RunTime\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Provisioning\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\Prov\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Provisioning\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Provisioning\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\Prov\RunTime\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Provisioning\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\Prov\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Provisioning\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Provisioning\{99b095d8-5959-4820-bea7-7448c8427b4e}\Prov\RunTime\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Provisioning\{99b095d8-5959-4820-bea7-7448c8427b4e}\Prov\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Provisioning\{99b095d8-5959-4820-bea7-7448c8427b4e}\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Provisioning\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\Prov\RunTime\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Provisioning\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\Prov\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Provisioning\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Provisioning\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\Prov\RunTime\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Provisioning\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\Prov\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Provisioning\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Provisioning\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\Prov\RunTime\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Provisioning\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\Prov\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Provisioning\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Provisioning\{bf56ce5a-946b-45b5-858a-1794eb0125e2}\Prov\RunTime\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Provisioning\{bf56ce5a-946b-45b5-858a-1794eb0125e2}\Prov\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Provisioning\{bf56ce5a-946b-45b5-858a-1794eb0125e2}\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Provisioning\{c5dc3753-b6c8-4057-b396-bf13d769311c}\Prov\RunTime\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Provisioning\{c5dc3753-b6c8-4057-b396-bf13d769311c}\Prov\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Provisioning\{c5dc3753-b6c8-4057-b396-bf13d769311c}\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Provisioning\{c8a326e4-f518-4f14-b543-97a57e1a975e}\Prov\RunTime\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Provisioning\{c8a326e4-f518-4f14-b543-97a57e1a975e}\Prov\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Provisioning\{c8a326e4-f518-4f14-b543-97a57e1a975e}\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Provisioning\{ee4aac98-c174-4941-82b1-d121e493e4fb}\Prov\RunTime\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Provisioning\{ee4aac98-c174-4941-82b1-d121e493e4fb}\Prov\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Provisioning\{ee4aac98-c174-4941-82b1-d121e493e4fb}\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Provisioning\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\Prov\RunTime\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Provisioning\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\Prov\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Provisioning\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Provisioning\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\Prov\RunTime\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Provisioning\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\Prov\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Provisioning\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Config\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2490
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E55D921118396C9F31A5B2E173A938A0
SHA1:	210E5A9952B8C75E7BCA0937AA817DBD563F76B5
SHA-256:	C0E93AADBABC947992A361C545E9E41CBBB9E2864AD893A1A6727A9B145D1D52
SHA-512:	C664CDC8CAC9595494C389860AD44F19EB9150F536A6CF8EB62B312CADFE60D47D5A8CCDED5FBDEE7B7EA099D8A85BB76F55C6E94FE502A05AFFFE36B7AA9ECC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Search\Data\Applications\Windows\GatherLogs\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2490
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E55D921118396C9F31A5B2E173A938A0
SHA1:	210E5A9952B8C75E7BCA0937AA817DBD563F76B5
SHA-256:	C0E93AADBABC947992A361C545E9E41CBBB9E2864AD893A1A6727A9B145D1D52
SHA-512:	C664CDC8CAC9595494C389860AD44F19EB9150F536A6CF8EB62B312CADFE60D47D5A8CCDED5FBDEE7B7EA099D8A85BB76F55C6E94FE502A05AFFFE36B7AA9ECC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SecStore\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2490
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E55D921118396C9F31A5B2E173A938A0
SHA1:	210E5A9952B8C75E7BCA0937AA817DBD563F76B5
SHA-256:	C0E93AADBABC947992A361C545E9E41CBBB9E2864AD893A1A6727A9B145D1D52
SHA-512:	C664CDC8CAC9595494C389860AD44F19EB9150F536A6CF8EB62B312CADFE60D47D5A8CCDED5FBDEE7B7EA099D8A85BB76F55C6E94FE502A05AFFFE36B7AA9ECC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Search\Data\Applications\Windows\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2490
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E55D921118396C9F31A5B2E173A938A0
SHA1:	210E5A9952B8C75E7BCA0937AA817DBD563F76B5
SHA-256:	C0E93AADBABC947992A361C545E9E41CBBB9E2864AD893A1A6727A9B145D1D52
SHA-512:	C664CDC8CAC9595494C389860AD44F19EB9150F536A6CF8EB62B312CADFE60D47D5A8CCDED5FBDEE7B7EA099D8A85BB76F55C6E94FE502A05AFFFE36B7AA9ECC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Search\Data\Applications\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUc:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgic
MD5:	2DD89CA2D644D9414D300A8AF16335CA
SHA1:	669A89206DBF779310703AEE89FAF02E45F4BD8F
SHA-256:	96050B4208C71F273887FDD4DC7CE3D2AE8B557916F9B131DD33863B0D59AED9
SHA-512:	9847E81AD1CF2B6C34CF1FA713D3E24F49D3E92E9DABD2CD356CFC574A76155FA3E866D43C2144AAE388E10D326C0682B48187CC0B52D7DF7CB6F3561262E65C
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Search\Data\Temp\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUc:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgic
MD5:	2DD89CA2D644D9414D300A8AF16335CA
SHA1:	669A89206DBF779310703AEE89FAF02E45F4BD8F
SHA-256:	96050B4208C71F273887FDD4DC7CE3D2AE8B557916F9B131DD33863B0D59AED9
SHA-512:	9847E81AD1CF2B6C34CF1FA713D3E24F49D3E92E9DABD2CD356CFC574A76155FA3E866D43C2144AAE388E10D326C0682B48187CC0B52D7DF7CB6F3561262E65C
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUc:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgic
MD5:	2DD89CA2D644D9414D300A8AF16335CA
SHA1:	669A89206DBF779310703AEE89FAF02E45F4BD8F
SHA-256:	96050B4208C71F273887FDD4DC7CE3D2AE8B557916F9B131DD33863B0D59AED9
SHA-512:	9847E81AD1CF2B6C34CF1FA713D3E24F49D3E92E9DABD2CD356CFC574A76155FA3E866D43C2144AAE388E10D326C0682B48187CC0B52D7DF7CB6F3561262E65C
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Search\Data\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2988
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUZ:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiZ
MD5:	1EAFD54AB2EF966BEFDDBC81523CC9A3
SHA1:	B88BAF7E2AEF9583E5D9166BE4FA708D2F90AE62
SHA-256:	525754A2BF80387C752C0B58D1B8E5A42C306B7BB9996EE502E0A51383D6740D
SHA-512:	83731C664680216E99447D813AA39FFDB04899E049067DECD24FD7BE5F33338952EA2258EE91C6ACE643B107E111478ACC096790082B3082998D28EFEBD6279A
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Search\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2988
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUZ:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiZ
MD5:	1EAFD54AB2EF966BEFDDBC81523CC9A3
SHA1:	B88BAF7E2AEF9583E5D9166BE4FA708D2F90AE62
SHA-256:	525754A2BF80387C752C0B58D1B8E5A42C306B7BB9996EE502E0A51383D6740D
SHA-512:	83731C664680216E99447D813AA39FFDB04899E049067DECD24FD7BE5F33338952EA2258EE91C6ACE643B107E111478ACC096790082B3082998D28EFEBD6279A
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Settings\Accounts\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUc:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgic
MD5:	2DD89CA2D644D9414D300A8AF16335CA
SHA1:	669A89206DBF779310703AEE89FAF02E45F4BD8F
SHA-256:	96050B4208C71F273887FDD4DC7CE3D2AE8B557916F9B131DD33863B0D59AED9
SHA-512:	9847E81AD1CF2B6C34CF1FA713D3E24F49D3E92E9DABD2CD356CFC574A76155FA3E866D43C2144AAE388E10D326C0682B48187CC0B52D7DF7CB6F3561262E65C
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Settings\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2988
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUZ:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiZ
MD5:	1EAFD54AB2EF966BEFDDBC81523CC9A3
SHA1:	B88BAF7E2AEF9583E5D9166BE4FA708D2F90AE62
SHA-256:	525754A2BF80387C752C0B58D1B8E5A42C306B7BB9996EE502E0A51383D6740D
SHA-512:	83731C664680216E99447D813AA39FFDB04899E049067DECD24FD7BE5F33338952EA2258EE91C6ACE643B107E111478ACC096790082B3082998D28EFEBD6279A
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\SmsRouter\MessageStore\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUc:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgic
MD5:	2DD89CA2D644D9414D300A8AF16335CA
SHA1:	669A89206DBF779310703AEE89FAF02E45F4BD8F
SHA-256:	96050B4208C71F273887FDD4DC7CE3D2AE8B557916F9B131DD33863B0D59AED9
SHA-512:	9847E81AD1CF2B6C34CF1FA713D3E24F49D3E92E9DABD2CD356CFC574A76155FA3E866D43C2144AAE388E10D326C0682B48187CC0B52D7DF7CB6F3561262E65C
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\SmsRouter\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2988
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUZ:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiZ
MD5:	1EAFD54AB2EF966BEFDDBC81523CC9A3
SHA1:	B88BAF7E2AEF9583E5D9166BE4FA708D2F90AE62
SHA-256:	525754A2BF80387C752C0B58D1B8E5A42C306B7BB9996EE502E0A51383D6740D
SHA-512:	83731C664680216E99447D813AA39FFDB04899E049067DECD24FD7BE5F33338952EA2258EE91C6ACE643B107E111478ACC096790082B3082998D28EFEBD6279A
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Spectrum\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2988
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUZ:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiZ
MD5:	1EAFD54AB2EF966BEFDDBC81523CC9A3
SHA1:	B88BAF7E2AEF9583E5D9166BE4FA708D2F90AE62
SHA-256:	525754A2BF80387C752C0B58D1B8E5A42C306B7BB9996EE502E0A51383D6740D
SHA-512:	83731C664680216E99447D813AA39FFDB04899E049067DECD24FD7BE5F33338952EA2258EE91C6ACE643B107E111478ACC096790082B3082998D28EFEBD6279A
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Speech_OneCore\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2988
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUZ:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiZ
MD5:	1EAFD54AB2EF966BEFDDBC81523CC9A3
SHA1:	B88BAF7E2AEF9583E5D9166BE4FA708D2F90AE62
SHA-256:	525754A2BF80387C752C0B58D1B8E5A42C306B7BB9996EE502E0A51383D6740D
SHA-512:	83731C664680216E99447D813AA39FFDB04899E049067DECD24FD7BE5F33338952EA2258EE91C6ACE643B107E111478ACC096790082B3082998D28EFEBD6279A
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Storage Health\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2988
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUZ:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiZ
MD5:	1EAFD54AB2EF966BEFDDBC81523CC9A3
SHA1:	B88BAF7E2AEF9583E5D9166BE4FA708D2F90AE62
SHA-256:	525754A2BF80387C752C0B58D1B8E5A42C306B7BB9996EE502E0A51383D6740D
SHA-512:	83731C664680216E99447D813AA39FFDB04899E049067DECD24FD7BE5F33338952EA2258EE91C6ACE643B107E111478ACC096790082B3082998D28EFEBD6279A
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\UEV\InboxTemplates\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUc:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgic
MD5:	2DD89CA2D644D9414D300A8AF16335CA
SHA1:	669A89206DBF779310703AEE89FAF02E45F4BD8F
SHA-256:	96050B4208C71F273887FDD4DC7CE3D2AE8B557916F9B131DD33863B0D59AED9
SHA-512:	9847E81AD1CF2B6C34CF1FA713D3E24F49D3E92E9DABD2CD356CFC574A76155FA3E866D43C2144AAE388E10D326C0682B48187CC0B52D7DF7CB6F3561262E65C
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\UEV\Scripts\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2988
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUZ:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiZ
MD5:	1EAFD54AB2EF966BEFDDBC81523CC9A3
SHA1:	B88BAF7E2AEF9583E5D9166BE4FA708D2F90AE62
SHA-256:	525754A2BF80387C752C0B58D1B8E5A42C306B7BB9996EE502E0A51383D6740D
SHA-512:	83731C664680216E99447D813AA39FFDB04899E049067DECD24FD7BE5F33338952EA2258EE91C6ACE643B107E111478ACC096790082B3082998D28EFEBD6279A
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\UEV\Templates\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2988
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUZ:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiZ
MD5:	1EAFD54AB2EF966BEFDDBC81523CC9A3
SHA1:	B88BAF7E2AEF9583E5D9166BE4FA708D2F90AE62
SHA-256:	525754A2BF80387C752C0B58D1B8E5A42C306B7BB9996EE502E0A51383D6740D
SHA-512:	83731C664680216E99447D813AA39FFDB04899E049067DECD24FD7BE5F33338952EA2258EE91C6ACE643B107E111478ACC096790082B3082998D28EFEBD6279A
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\UEV\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2988
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUZ:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiZ
MD5:	1EAFD54AB2EF966BEFDDBC81523CC9A3
SHA1:	B88BAF7E2AEF9583E5D9166BE4FA708D2F90AE62
SHA-256:	525754A2BF80387C752C0B58D1B8E5A42C306B7BB9996EE502E0A51383D6740D
SHA-512:	83731C664680216E99447D813AA39FFDB04899E049067DECD24FD7BE5F33338952EA2258EE91C6ACE643B107E111478ACC096790082B3082998D28EFEBD6279A
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\User Account Pictures\guest.bmp Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	602201
Entropy (8bit):	0.28134963826761367
Encrypted:	false
SSDEEP:	48:Y0cy7gzQ65rJwzXfv+iwkeaG/Ni6B4vtctwsNW6B4RU4SQB5pmyhbvNSFfCXDvSo:Y0cy7k52sNW6BRg
MD5:	186AE1D82746352ACE2E04F4728B234B
SHA1:	0707595FAC257D9AF61DB793BD08CEE66385BA4A
SHA-256:	8AEE1C153C90870DDAFA279E185D1CFC3589AB2603AD5AD9904C36AA0CF54ACA
SHA-512:	314E2C98F38D9D3868C93DDCDABFA2495993E011D81924301C2667E82264F6448976B6DE3BF87AC5CBEC203B7E0901885D4EDBE03B9462390BBE054FF783CADA
Malicious:	false
Preview:	./6..1nI.N..m.1.&...A..o.......`n..$./....f.[..."t.0..-!......J.u..eY...:..../.....^...c'.=.tm....u.Vm....I.n.. .-."Z..I,.x."...#..~.e.Z.e.b....I.<..V{...s30.......MR....XV>H.A..(....ICn.Q....J.bt.c....sF..r.k...-..k...2>........e.o....{O)..$$=.......c....m..x.?.N3......0.f....rw. . ..pv.^[..>.....[..d.A....+....x.-....&..."..=.....3.@H..xQ.... ....%............a(Y.....f.i:N..RF.8Y..Y...........[.\|......a."]hA.J...9..W:....).W.#HI..Loq...@.p.....\|/;.;o.yXm%....J4..#.......>..'=.a..y=S9k.Z(...\4...(....!.1....*=x!.O........q.j ..#h.(...c........&..Tvs....(....F..^...t...(...,n.A.......m...tl.~........../.......v.f8)..z.......M8..{...ih..s.i=..I.Z.d.......?..0..zD.'"@..0>../....f.1.T...;...i...L#....A....a..]...heV.e.'.aF W2ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff

C:\ProgramData\Microsoft\User Account Pictures\guest.png Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5433
Entropy (8bit):	7.845628794619717
Encrypted:	false
SSDEEP:	96:yqXnx9hcm75SM7+3r0dbrNpnGGOL79Xot5ytNT3G+MHBTLrK4ioG5K:zx9+m9Z+4VrnGGSbTW+MHBTvKTK
MD5:	9A6FA42AD336844FCB8AC4461F2720DB
SHA1:	5C4043DA4CA543B0DA9D7023B54A115A4A2F3A40
SHA-256:	8598682D334D237BA7D2C078492E8CC990269B2B5B4650DE24043CD7E6CBEE14
SHA-512:	471C5D66AD4AEEBDCCB2650B2D93842AFEDAE6EFC212FC432D3E4ED96B092BA7A756B0A1C45CCFA35D239E8F101DB0B354A30FE51A36F37C99244C58CE53FBA6
Malicious:	false
Preview:	...?Q<.^H.J....r..XX{$..K.{v.."@.!...~....I2.i.ha....[3.[}d....qQ..rqn.+N}/..#$a......}.+.s....$.....,.4n.!..:..T...<...s..kP.-..w....i.$.!.?<......3/:..>.1w..<...s........H...\"...E..'.h{...,I@...........iW....&c...i....._=[....:Q.A[,...{....\|....?M..^d`....'..U.U.N.I.$.6....c....u....@\.mV..X..k..gN)1..9R..>..U4........Us1.......\|I1...X.~(..,.N.#C...7..%I...3.7.Q...0M..y.=goNW..s......8.8..`..Jx.....IU.G....Y..@.?...\|].....[.D..l......[.x+.....,.cg.....2.T.2T.eO."....D{dd.".....+T..sZ..X.A~..1...I.....nVA........@..".?\..v.^..p/v.>....... ..Df..Q...F"...U.z%V.....Y.....b....T.n.jG.oR)...Z`.P+...d..&H...q..%W.....tJ\2j[....x.HEnGlid..9.n...o..z.....z.6H.. .d.).....c.....1.lZQ...la'<^.......f..R.".NNo..A.t.f.9...x.@..~...N.....!"......w....../..NMM9...2R.J../....}C.....\|.....c?V..3....x^.t.....r...X.GF.p..iLdP..WWW.~vg,.{W...r.].....T*....]A?..VVVj......I.(<...Q.\S..\|u......^]Y...?.n.....%..NI.{...Tt..........&...5..e8...g.}6."..l....x.......

C:\ProgramData\Microsoft\User Account Pictures\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUc:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgic
MD5:	2DD89CA2D644D9414D300A8AF16335CA
SHA1:	669A89206DBF779310703AEE89FAF02E45F4BD8F
SHA-256:	96050B4208C71F273887FDD4DC7CE3D2AE8B557916F9B131DD33863B0D59AED9
SHA-512:	9847E81AD1CF2B6C34CF1FA713D3E24F49D3E92E9DABD2CD356CFC574A76155FA3E866D43C2144AAE388E10D326C0682B48187CC0B52D7DF7CB6F3561262E65C
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\User Account Pictures\user-192.png Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2440
Entropy (8bit):	7.832447597344405
Encrypted:	false
SSDEEP:	48:KcvTFi/E48kl36lZeTyUYw5BZ8JtDjnQ+lUC63:zTFi/C9zQ5Du96z3
MD5:	64F635A17E92CEBF2F2B76E4A53D9F37
SHA1:	F3DF3D7D6DEA0F890F8997BA04D9172A6364A3B1
SHA-256:	10158017F6B7E862CD8A6CE4005EBC5C8F9208ED9EF48E7337A92B3E045EEC7B
SHA-512:	175DDF3A7D26B54905B06175D5884C111C5A8737A459386A8F645054A07881B45579209B461C77F0089F61D8F108ADEFF8132D7BC22DE238DD90F59088243691
Malicious:	false
Preview:	)...2G9.h....X...7._4{.Z$>)......c"...y.Z_.D.}P/..t...@.A,.....u.ij..+..A.kK..h..?.7..Z.@.....eI-9........L`.``..{ 0O....w..4.^-.)....Y...V.D.lC.Q.0"..+..ar.....>...T..62..\....8.G'%..s..!<...&2...h1......%>.B..ng..zg.b..y.lV...N..X.`D..2.E.a .....o.:.ZL....i5.........=.wIr..Q..r...g..lv...c.....".Eq..+df.....;W..%Wu:8....q...(@H.0P#..`.V.T..s.p1.8\|.$.d3.7.6U)I..#G.\|.m..m]....s#..j..$..s........3Z..&v........]B..^wR..T..\|/.a.A.}.ix.........Yzl...~....A...x........w.....L...z.[....D./..A.g ki..am..zT.+..9..;."=.. .i.Ac}.Z.yD@mr7.Y....?P0A..;.m4m/..v..o"....t.~...}..#...F.:.l.....,l.C&.VU.9..d.E..x... Dw.....\...)..n.....[r...V0..p......os..8.L.U.J.O..--i }...\..X;C...p..h(.............D.W.lh.X..`.p..k/...s.S.;;ml.\|\m.GV..xha.7ct:g.s6...B.T.yF......Iuj......R...#.}..FR...y.H.JK.e....S... .F.T..#..O.G].J..A(.T:..lnqtt...L5..S.)..D......+..3..jj.C".h,l.seDX.D.m0.%.}..H.>...........nz.gc!.....+%.. ....E.TD.T...!......@......4.........BJ..@...\.

C:\ProgramData\Microsoft\User Account Pictures\user.bmp Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	602201
Entropy (8bit):	0.28154964106722064
Encrypted:	false
SSDEEP:	48:olej5san7urhZICXfv+iwkeaG/Ni6B4vtctwsNW6B4RU4SQB5pmyhbvNSFfCXDvR:osjOkiAisNW6BRg
MD5:	A2439515219F28CDCC3A75FAC0B32683
SHA1:	E7C30218E7A690400E6EFC0117DEDF00CADA51BC
SHA-256:	5B9A081CB3133FEF85A5B8D9088CC0177A9F005953893E5C529A9FE5E2F85C45
SHA-512:	DA460157376F5FAAC9E74330A862FA795E66A6E56729ECF4B6743BED7E5F7F2DC9BB7FB66798055F7550FA32956F0AB4081377A3FACD1BD3C8EF2AC2AA663910
Malicious:	false
Preview:	O..G.....e`.=U.D}..A.D....[......;..'.8....l..J&p....t..C..'Z4X;Q7Q,.6....]..!.>...<v{$..4.s..5...e.....s3.R....`......l..wz..M.........1.\..t.(z.c.8..lRm..z?..)N..v<....].O..%.e.%.M.Y..D"q.B..D O,JhF..._..M%....k.....=.Q.....Ew..z...?.F.P....hNe..Q..>J0.I.f.g?..g......!..5WV..h.,....`..........n..Y..........!u.E}.\.x...8...<...0...dF...6../x%;Jg.h....d.....'...(.).Kc.aqO.....:.o...D...>...)#....7.O.Nx...U.."..9@?.7...XW...,.q..5..id.U.N...)..}F...........&....K^...H....3u/..x.hi...!.#N.F_9.o....z.u..\|..s(uG...8.b.....?. P;Pw..*...fy.....T1....{....5.....l...[jA3Y..Y.7r..<.x.n6.mX.~..@..l.X.....N.j.E.X.M.......E..+tAo.0K..s7Z.F"..E.....;_........8..LX.Ur.Q=.B.k..Q. ...;Z.2..S.-.c...k..wI...K...B..:..s#.w\..g.N..j.z.?..Lffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff

C:\ProgramData\Microsoft\User Account Pictures\user.png Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5433
Entropy (8bit):	7.852556747354003
Encrypted:	false
SSDEEP:	96:4HVYt8ufk7+3r0dbrNpnGGOL79Xot5ytNT3G+MHBTLrK4ioG5K:41TufS+4VrnGGSbTW+MHBTvKTK
MD5:	E50431E9EEFC432D83F7197FA3533750
SHA1:	47870B1F874CCBC4A51859820E7882F42F6DBC1B
SHA-256:	AF3064C19E688F8E3D3571F92CE0FF4EC9DA1D07C63171A595FCCBE84332E1BA
SHA-512:	D69E760AD5D733A2909B5C543FC1427A8AB5CC1B85947EAB2CDDC8C9F72A88FDA882094A8AB1C844F71EAE0BC81F59EA4D580FF6D39798DF740DA01F4CFB1194
Malicious:	false
Preview:	...4.a.k..XKl.Y.."\|p_.\|...z..F'f..g.n3M..-r....'...h...eM.........D.j.$..%I.px..:.3...Q...1.....MJ...q..St..0..}~...V..U..G.8UX\..C)~....7.b..Z.....32....)..~...1....c..].....e..K..#....9..tf4....gh..E.S.M....8.].2H.pI....s"..."...l..<F....".).4.XC.wr...I0..._,...5....S.......9.4..o.E.9.O. /.i.I.X.q.a..d.o#.4/D@.1xHmB.(r......_^.....:F.l....C.....UA..$.M.O....V.....pi.y.].r..S.!......:.j..............k...!..;n.f....y0......lv....@.k..*L.3M....J...1i.....in.\...:.?0.G.].q......Nm....5?&...Pl....5\s.9>.Q8....:..m.K....;..E`....U...mHQ..8.....8..^.....w].#..8.h.v.g..j<j.N8}dn.........._/...R{..; \|.......KO..l>...b..J".....v.A..C....e.hT.c...6..n...N...Y...ZS..2..U4.....rZ..X.8.7.1...X$..F\|/..q.../.N\|.^f.h..Md.=.a...!"......w....../..NMM9...2R.J../....}C.....\|.....c?V..3....x^.t.....r...X.GF.p..iLdP..WWW.~vg,.{W...r.].....T*....]A?..VVVj......I.(<...Q.\S..\|u......^]Y...?.n.....%..NI.{...Tt..........&...5..e8...g.}6."..l....x.......

C:\ProgramData\Microsoft\Vault\AC658CB4-9126-49BD-B877-31EEDAB3F204\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2490
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E55D921118396C9F31A5B2E173A938A0
SHA1:	210E5A9952B8C75E7BCA0937AA817DBD563F76B5
SHA-256:	C0E93AADBABC947992A361C545E9E41CBBB9E2864AD893A1A6727A9B145D1D52
SHA-512:	C664CDC8CAC9595494C389860AD44F19EB9150F536A6CF8EB62B312CADFE60D47D5A8CCDED5FBDEE7B7EA099D8A85BB76F55C6E94FE502A05AFFFE36B7AA9ECC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Vault\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2988
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUZ:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiZ
MD5:	1EAFD54AB2EF966BEFDDBC81523CC9A3
SHA1:	B88BAF7E2AEF9583E5D9166BE4FA708D2F90AE62
SHA-256:	525754A2BF80387C752C0B58D1B8E5A42C306B7BB9996EE502E0A51383D6740D
SHA-512:	83731C664680216E99447D813AA39FFDB04899E049067DECD24FD7BE5F33338952EA2258EE91C6ACE643B107E111478ACC096790082B3082998D28EFEBD6279A
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\WDF\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2988
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUZ:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiZ
MD5:	1EAFD54AB2EF966BEFDDBC81523CC9A3
SHA1:	B88BAF7E2AEF9583E5D9166BE4FA708D2F90AE62
SHA-256:	525754A2BF80387C752C0B58D1B8E5A42C306B7BB9996EE502E0A51383D6740D
SHA-512:	83731C664680216E99447D813AA39FFDB04899E049067DECD24FD7BE5F33338952EA2258EE91C6ACE643B107E111478ACC096790082B3082998D28EFEBD6279A
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\WinMSIPC\Server\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2490
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E55D921118396C9F31A5B2E173A938A0
SHA1:	210E5A9952B8C75E7BCA0937AA817DBD563F76B5
SHA-256:	C0E93AADBABC947992A361C545E9E41CBBB9E2864AD893A1A6727A9B145D1D52
SHA-512:	C664CDC8CAC9595494C389860AD44F19EB9150F536A6CF8EB62B312CADFE60D47D5A8CCDED5FBDEE7B7EA099D8A85BB76F55C6E94FE502A05AFFFE36B7AA9ECC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\WinMSIPC\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2490
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E55D921118396C9F31A5B2E173A938A0
SHA1:	210E5A9952B8C75E7BCA0937AA817DBD563F76B5
SHA-256:	C0E93AADBABC947992A361C545E9E41CBBB9E2864AD893A1A6727A9B145D1D52
SHA-512:	C664CDC8CAC9595494C389860AD44F19EB9150F536A6CF8EB62B312CADFE60D47D5A8CCDED5FBDEE7B7EA099D8A85BB76F55C6E94FE502A05AFFFE36B7AA9ECC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Temp\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2490
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E55D921118396C9F31A5B2E173A938A0
SHA1:	210E5A9952B8C75E7BCA0937AA817DBD563F76B5
SHA-256:	C0E93AADBABC947992A361C545E9E41CBBB9E2864AD893A1A6727A9B145D1D52
SHA-512:	C664CDC8CAC9595494C389860AD44F19EB9150F536A6CF8EB62B312CADFE60D47D5A8CCDED5FBDEE7B7EA099D8A85BB76F55C6E94FE502A05AFFFE36B7AA9ECC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2490
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E55D921118396C9F31A5B2E173A938A0
SHA1:	210E5A9952B8C75E7BCA0937AA817DBD563F76B5
SHA-256:	C0E93AADBABC947992A361C545E9E41CBBB9E2864AD893A1A6727A9B145D1D52
SHA-512:	C664CDC8CAC9595494C389860AD44F19EB9150F536A6CF8EB62B312CADFE60D47D5A8CCDED5FBDEE7B7EA099D8A85BB76F55C6E94FE502A05AFFFE36B7AA9ECC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows Defender\Clean Store\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUc:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgic
MD5:	2DD89CA2D644D9414D300A8AF16335CA
SHA1:	669A89206DBF779310703AEE89FAF02E45F4BD8F
SHA-256:	96050B4208C71F273887FDD4DC7CE3D2AE8B557916F9B131DD33863B0D59AED9
SHA-512:	9847E81AD1CF2B6C34CF1FA713D3E24F49D3E92E9DABD2CD356CFC574A76155FA3E866D43C2144AAE388E10D326C0682B48187CC0B52D7DF7CB6F3561262E65C
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2490
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E55D921118396C9F31A5B2E173A938A0
SHA1:	210E5A9952B8C75E7BCA0937AA817DBD563F76B5
SHA-256:	C0E93AADBABC947992A361C545E9E41CBBB9E2864AD893A1A6727A9B145D1D52
SHA-512:	C664CDC8CAC9595494C389860AD44F19EB9150F536A6CF8EB62B312CADFE60D47D5A8CCDED5FBDEE7B7EA099D8A85BB76F55C6E94FE502A05AFFFE36B7AA9ECC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Default\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2490
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E55D921118396C9F31A5B2E173A938A0
SHA1:	210E5A9952B8C75E7BCA0937AA817DBD563F76B5
SHA-256:	C0E93AADBABC947992A361C545E9E41CBBB9E2864AD893A1A6727A9B145D1D52
SHA-512:	C664CDC8CAC9595494C389860AD44F19EB9150F536A6CF8EB62B312CADFE60D47D5A8CCDED5FBDEE7B7EA099D8A85BB76F55C6E94FE502A05AFFFE36B7AA9ECC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows Defender\Definition Updates\NisBackup\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2490
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E55D921118396C9F31A5B2E173A938A0
SHA1:	210E5A9952B8C75E7BCA0937AA817DBD563F76B5
SHA-256:	C0E93AADBABC947992A361C545E9E41CBBB9E2864AD893A1A6727A9B145D1D52
SHA-512:	C664CDC8CAC9595494C389860AD44F19EB9150F536A6CF8EB62B312CADFE60D47D5A8CCDED5FBDEE7B7EA099D8A85BB76F55C6E94FE502A05AFFFE36B7AA9ECC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Updates\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2490
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E55D921118396C9F31A5B2E173A938A0
SHA1:	210E5A9952B8C75E7BCA0937AA817DBD563F76B5
SHA-256:	C0E93AADBABC947992A361C545E9E41CBBB9E2864AD893A1A6727A9B145D1D52
SHA-512:	C664CDC8CAC9595494C389860AD44F19EB9150F536A6CF8EB62B312CADFE60D47D5A8CCDED5FBDEE7B7EA099D8A85BB76F55C6E94FE502A05AFFFE36B7AA9ECC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows Defender\Definition Updates\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2490
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E55D921118396C9F31A5B2E173A938A0
SHA1:	210E5A9952B8C75E7BCA0937AA817DBD563F76B5
SHA-256:	C0E93AADBABC947992A361C545E9E41CBBB9E2864AD893A1A6727A9B145D1D52
SHA-512:	C664CDC8CAC9595494C389860AD44F19EB9150F536A6CF8EB62B312CADFE60D47D5A8CCDED5FBDEE7B7EA099D8A85BB76F55C6E94FE502A05AFFFE36B7AA9ECC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{186FBBD0-81E5-4485-9A0B-058B395708F3}\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1992
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	2D707791A014BFEB049FBD7D87170190
SHA1:	87AF3841A3259CB1016FC2D7F4482BA8F1EFD3A4
SHA-256:	1077033D0E9374BDB9DDCE254EC1D80AC2B02A10EEFC5DEB9A4F59BB6C31791B
SHA-512:	91EB7F9B388ECAC04D9FE2F604F265251A484C8AC10486DD80E44E39B62DEE1C00DBC3DC54E4D6B277A96E5F5E06D2CDB2C95B0EBD21BCAEF6391CC9AE770510
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows Defender\Features\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUc:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgic
MD5:	2DD89CA2D644D9414D300A8AF16335CA
SHA1:	669A89206DBF779310703AEE89FAF02E45F4BD8F
SHA-256:	96050B4208C71F273887FDD4DC7CE3D2AE8B557916F9B131DD33863B0D59AED9
SHA-512:	9847E81AD1CF2B6C34CF1FA713D3E24F49D3E92E9DABD2CD356CFC574A76155FA3E866D43C2144AAE388E10D326C0682B48187CC0B52D7DF7CB6F3561262E65C
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows Defender\LocalCopy\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUc:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgic
MD5:	2DD89CA2D644D9414D300A8AF16335CA
SHA1:	669A89206DBF779310703AEE89FAF02E45F4BD8F
SHA-256:	96050B4208C71F273887FDD4DC7CE3D2AE8B557916F9B131DD33863B0D59AED9
SHA-512:	9847E81AD1CF2B6C34CF1FA713D3E24F49D3E92E9DABD2CD356CFC574A76155FA3E866D43C2144AAE388E10D326C0682B48187CC0B52D7DF7CB6F3561262E65C
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows Defender\Network Inspection System\Support\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows Defender\Network Inspection System\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2490
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E55D921118396C9F31A5B2E173A938A0
SHA1:	210E5A9952B8C75E7BCA0937AA817DBD563F76B5
SHA-256:	C0E93AADBABC947992A361C545E9E41CBBB9E2864AD893A1A6727A9B145D1D52
SHA-512:	C664CDC8CAC9595494C389860AD44F19EB9150F536A6CF8EB62B312CADFE60D47D5A8CCDED5FBDEE7B7EA099D8A85BB76F55C6E94FE502A05AFFFE36B7AA9ECC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows Defender\Platform\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2490
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E55D921118396C9F31A5B2E173A938A0
SHA1:	210E5A9952B8C75E7BCA0937AA817DBD563F76B5
SHA-256:	C0E93AADBABC947992A361C545E9E41CBBB9E2864AD893A1A6727A9B145D1D52
SHA-512:	C664CDC8CAC9595494C389860AD44F19EB9150F536A6CF8EB62B312CADFE60D47D5A8CCDED5FBDEE7B7EA099D8A85BB76F55C6E94FE502A05AFFFE36B7AA9ECC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows Defender\Quarantine\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2490
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E55D921118396C9F31A5B2E173A938A0
SHA1:	210E5A9952B8C75E7BCA0937AA817DBD563F76B5
SHA-256:	C0E93AADBABC947992A361C545E9E41CBBB9E2864AD893A1A6727A9B145D1D52
SHA-512:	C664CDC8CAC9595494C389860AD44F19EB9150F536A6CF8EB62B312CADFE60D47D5A8CCDED5FBDEE7B7EA099D8A85BB76F55C6E94FE502A05AFFFE36B7AA9ECC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows Defender\Scans\BackupStore\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2490
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E55D921118396C9F31A5B2E173A938A0
SHA1:	210E5A9952B8C75E7BCA0937AA817DBD563F76B5
SHA-256:	C0E93AADBABC947992A361C545E9E41CBBB9E2864AD893A1A6727A9B145D1D52
SHA-512:	C664CDC8CAC9595494C389860AD44F19EB9150F536A6CF8EB62B312CADFE60D47D5A8CCDED5FBDEE7B7EA099D8A85BB76F55C6E94FE502A05AFFFE36B7AA9ECC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows Defender\Scans\History\CacheManager\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2490
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E55D921118396C9F31A5B2E173A938A0
SHA1:	210E5A9952B8C75E7BCA0937AA817DBD563F76B5
SHA-256:	C0E93AADBABC947992A361C545E9E41CBBB9E2864AD893A1A6727A9B145D1D52
SHA-512:	C664CDC8CAC9595494C389860AD44F19EB9150F536A6CF8EB62B312CADFE60D47D5A8CCDED5FBDEE7B7EA099D8A85BB76F55C6E94FE502A05AFFFE36B7AA9ECC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows Defender\Scans\History\ReportLatency\Latency\19\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows Defender\Scans\History\ReportLatency\Latency\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows Defender\Scans\History\ReportLatency\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2490
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E55D921118396C9F31A5B2E173A938A0
SHA1:	210E5A9952B8C75E7BCA0937AA817DBD563F76B5
SHA-256:	C0E93AADBABC947992A361C545E9E41CBBB9E2864AD893A1A6727A9B145D1D52
SHA-512:	C664CDC8CAC9595494C389860AD44F19EB9150F536A6CF8EB62B312CADFE60D47D5A8CCDED5FBDEE7B7EA099D8A85BB76F55C6E94FE502A05AFFFE36B7AA9ECC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Resource\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2490
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E55D921118396C9F31A5B2E173A938A0
SHA1:	210E5A9952B8C75E7BCA0937AA817DBD563F76B5
SHA-256:	C0E93AADBABC947992A361C545E9E41CBBB9E2864AD893A1A6727A9B145D1D52
SHA-512:	C664CDC8CAC9595494C389860AD44F19EB9150F536A6CF8EB62B312CADFE60D47D5A8CCDED5FBDEE7B7EA099D8A85BB76F55C6E94FE502A05AFFFE36B7AA9ECC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2490
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E55D921118396C9F31A5B2E173A938A0
SHA1:	210E5A9952B8C75E7BCA0937AA817DBD563F76B5
SHA-256:	C0E93AADBABC947992A361C545E9E41CBBB9E2864AD893A1A6727A9B145D1D52
SHA-512:	C664CDC8CAC9595494C389860AD44F19EB9150F536A6CF8EB62B312CADFE60D47D5A8CCDED5FBDEE7B7EA099D8A85BB76F55C6E94FE502A05AFFFE36B7AA9ECC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2490
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E55D921118396C9F31A5B2E173A938A0
SHA1:	210E5A9952B8C75E7BCA0937AA817DBD563F76B5
SHA-256:	C0E93AADBABC947992A361C545E9E41CBBB9E2864AD893A1A6727A9B145D1D52
SHA-512:	C664CDC8CAC9595494C389860AD44F19EB9150F536A6CF8EB62B312CADFE60D47D5A8CCDED5FBDEE7B7EA099D8A85BB76F55C6E94FE502A05AFFFE36B7AA9ECC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows Defender\Scans\History\Store\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2490
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E55D921118396C9F31A5B2E173A938A0
SHA1:	210E5A9952B8C75E7BCA0937AA817DBD563F76B5
SHA-256:	C0E93AADBABC947992A361C545E9E41CBBB9E2864AD893A1A6727A9B145D1D52
SHA-512:	C664CDC8CAC9595494C389860AD44F19EB9150F536A6CF8EB62B312CADFE60D47D5A8CCDED5FBDEE7B7EA099D8A85BB76F55C6E94FE502A05AFFFE36B7AA9ECC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows Defender\Scans\History\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2490
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E55D921118396C9F31A5B2E173A938A0
SHA1:	210E5A9952B8C75E7BCA0937AA817DBD563F76B5
SHA-256:	C0E93AADBABC947992A361C545E9E41CBBB9E2864AD893A1A6727A9B145D1D52
SHA-512:	C664CDC8CAC9595494C389860AD44F19EB9150F536A6CF8EB62B312CADFE60D47D5A8CCDED5FBDEE7B7EA099D8A85BB76F55C6E94FE502A05AFFFE36B7AA9ECC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows Defender\Scans\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2490
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E55D921118396C9F31A5B2E173A938A0
SHA1:	210E5A9952B8C75E7BCA0937AA817DBD563F76B5
SHA-256:	C0E93AADBABC947992A361C545E9E41CBBB9E2864AD893A1A6727A9B145D1D52
SHA-512:	C664CDC8CAC9595494C389860AD44F19EB9150F536A6CF8EB62B312CADFE60D47D5A8CCDED5FBDEE7B7EA099D8A85BB76F55C6E94FE502A05AFFFE36B7AA9ECC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows Defender\Support\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2490
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E55D921118396C9F31A5B2E173A938A0
SHA1:	210E5A9952B8C75E7BCA0937AA817DBD563F76B5
SHA-256:	C0E93AADBABC947992A361C545E9E41CBBB9E2864AD893A1A6727A9B145D1D52
SHA-512:	C664CDC8CAC9595494C389860AD44F19EB9150F536A6CF8EB62B312CADFE60D47D5A8CCDED5FBDEE7B7EA099D8A85BB76F55C6E94FE502A05AFFFE36B7AA9ECC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows Defender\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUc:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgic
MD5:	2DD89CA2D644D9414D300A8AF16335CA
SHA1:	669A89206DBF779310703AEE89FAF02E45F4BD8F
SHA-256:	96050B4208C71F273887FDD4DC7CE3D2AE8B557916F9B131DD33863B0D59AED9
SHA-512:	9847E81AD1CF2B6C34CF1FA713D3E24F49D3E92E9DABD2CD356CFC574A76155FA3E866D43C2144AAE388E10D326C0682B48187CC0B52D7DF7CB6F3561262E65C
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows NT\MSFax\ActivityLog\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2490
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E55D921118396C9F31A5B2E173A938A0
SHA1:	210E5A9952B8C75E7BCA0937AA817DBD563F76B5
SHA-256:	C0E93AADBABC947992A361C545E9E41CBBB9E2864AD893A1A6727A9B145D1D52
SHA-512:	C664CDC8CAC9595494C389860AD44F19EB9150F536A6CF8EB62B312CADFE60D47D5A8CCDED5FBDEE7B7EA099D8A85BB76F55C6E94FE502A05AFFFE36B7AA9ECC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows NT\MSFax\Common Coverpages\en-US\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2490
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E55D921118396C9F31A5B2E173A938A0
SHA1:	210E5A9952B8C75E7BCA0937AA817DBD563F76B5
SHA-256:	C0E93AADBABC947992A361C545E9E41CBBB9E2864AD893A1A6727A9B145D1D52
SHA-512:	C664CDC8CAC9595494C389860AD44F19EB9150F536A6CF8EB62B312CADFE60D47D5A8CCDED5FBDEE7B7EA099D8A85BB76F55C6E94FE502A05AFFFE36B7AA9ECC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows NT\MSFax\Common Coverpages\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2490
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E55D921118396C9F31A5B2E173A938A0
SHA1:	210E5A9952B8C75E7BCA0937AA817DBD563F76B5
SHA-256:	C0E93AADBABC947992A361C545E9E41CBBB9E2864AD893A1A6727A9B145D1D52
SHA-512:	C664CDC8CAC9595494C389860AD44F19EB9150F536A6CF8EB62B312CADFE60D47D5A8CCDED5FBDEE7B7EA099D8A85BB76F55C6E94FE502A05AFFFE36B7AA9ECC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows NT\MSFax\Inbox\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2490
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E55D921118396C9F31A5B2E173A938A0
SHA1:	210E5A9952B8C75E7BCA0937AA817DBD563F76B5
SHA-256:	C0E93AADBABC947992A361C545E9E41CBBB9E2864AD893A1A6727A9B145D1D52
SHA-512:	C664CDC8CAC9595494C389860AD44F19EB9150F536A6CF8EB62B312CADFE60D47D5A8CCDED5FBDEE7B7EA099D8A85BB76F55C6E94FE502A05AFFFE36B7AA9ECC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows NT\MSFax\Queue\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2490
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E55D921118396C9F31A5B2E173A938A0
SHA1:	210E5A9952B8C75E7BCA0937AA817DBD563F76B5
SHA-256:	C0E93AADBABC947992A361C545E9E41CBBB9E2864AD893A1A6727A9B145D1D52
SHA-512:	C664CDC8CAC9595494C389860AD44F19EB9150F536A6CF8EB62B312CADFE60D47D5A8CCDED5FBDEE7B7EA099D8A85BB76F55C6E94FE502A05AFFFE36B7AA9ECC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows NT\MSFax\SentItems\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2490
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E55D921118396C9F31A5B2E173A938A0
SHA1:	210E5A9952B8C75E7BCA0937AA817DBD563F76B5
SHA-256:	C0E93AADBABC947992A361C545E9E41CBBB9E2864AD893A1A6727A9B145D1D52
SHA-512:	C664CDC8CAC9595494C389860AD44F19EB9150F536A6CF8EB62B312CADFE60D47D5A8CCDED5FBDEE7B7EA099D8A85BB76F55C6E94FE502A05AFFFE36B7AA9ECC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows NT\MSFax\VirtualInbox\en-US\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2490
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E55D921118396C9F31A5B2E173A938A0
SHA1:	210E5A9952B8C75E7BCA0937AA817DBD563F76B5
SHA-256:	C0E93AADBABC947992A361C545E9E41CBBB9E2864AD893A1A6727A9B145D1D52
SHA-512:	C664CDC8CAC9595494C389860AD44F19EB9150F536A6CF8EB62B312CADFE60D47D5A8CCDED5FBDEE7B7EA099D8A85BB76F55C6E94FE502A05AFFFE36B7AA9ECC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows NT\MSFax\VirtualInbox\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2490
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E55D921118396C9F31A5B2E173A938A0
SHA1:	210E5A9952B8C75E7BCA0937AA817DBD563F76B5
SHA-256:	C0E93AADBABC947992A361C545E9E41CBBB9E2864AD893A1A6727A9B145D1D52
SHA-512:	C664CDC8CAC9595494C389860AD44F19EB9150F536A6CF8EB62B312CADFE60D47D5A8CCDED5FBDEE7B7EA099D8A85BB76F55C6E94FE502A05AFFFE36B7AA9ECC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows NT\MSFax\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2490
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E55D921118396C9F31A5B2E173A938A0
SHA1:	210E5A9952B8C75E7BCA0937AA817DBD563F76B5
SHA-256:	C0E93AADBABC947992A361C545E9E41CBBB9E2864AD893A1A6727A9B145D1D52
SHA-512:	C664CDC8CAC9595494C389860AD44F19EB9150F536A6CF8EB62B312CADFE60D47D5A8CCDED5FBDEE7B7EA099D8A85BB76F55C6E94FE502A05AFFFE36B7AA9ECC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows NT\MSScan\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2490
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E55D921118396C9F31A5B2E173A938A0
SHA1:	210E5A9952B8C75E7BCA0937AA817DBD563F76B5
SHA-256:	C0E93AADBABC947992A361C545E9E41CBBB9E2864AD893A1A6727A9B145D1D52
SHA-512:	C664CDC8CAC9595494C389860AD44F19EB9150F536A6CF8EB62B312CADFE60D47D5A8CCDED5FBDEE7B7EA099D8A85BB76F55C6E94FE502A05AFFFE36B7AA9ECC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows NT\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2490
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E55D921118396C9F31A5B2E173A938A0
SHA1:	210E5A9952B8C75E7BCA0937AA817DBD563F76B5
SHA-256:	C0E93AADBABC947992A361C545E9E41CBBB9E2864AD893A1A6727A9B145D1D52
SHA-512:	C664CDC8CAC9595494C389860AD44F19EB9150F536A6CF8EB62B312CADFE60D47D5A8CCDED5FBDEE7B7EA099D8A85BB76F55C6E94FE502A05AFFFE36B7AA9ECC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows Security Health\Logs\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2490
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E55D921118396C9F31A5B2E173A938A0
SHA1:	210E5A9952B8C75E7BCA0937AA817DBD563F76B5
SHA-256:	C0E93AADBABC947992A361C545E9E41CBBB9E2864AD893A1A6727A9B145D1D52
SHA-512:	C664CDC8CAC9595494C389860AD44F19EB9150F536A6CF8EB62B312CADFE60D47D5A8CCDED5FBDEE7B7EA099D8A85BB76F55C6E94FE502A05AFFFE36B7AA9ECC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows Security Health\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2490
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E55D921118396C9F31A5B2E173A938A0
SHA1:	210E5A9952B8C75E7BCA0937AA817DBD563F76B5
SHA-256:	C0E93AADBABC947992A361C545E9E41CBBB9E2864AD893A1A6727A9B145D1D52
SHA-512:	C664CDC8CAC9595494C389860AD44F19EB9150F536A6CF8EB62B312CADFE60D47D5A8CCDED5FBDEE7B7EA099D8A85BB76F55C6E94FE502A05AFFFE36B7AA9ECC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows\Caches\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2988
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUZ:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiZ
MD5:	1EAFD54AB2EF966BEFDDBC81523CC9A3
SHA1:	B88BAF7E2AEF9583E5D9166BE4FA708D2F90AE62
SHA-256:	525754A2BF80387C752C0B58D1B8E5A42C306B7BB9996EE502E0A51383D6740D
SHA-512:	83731C664680216E99447D813AA39FFDB04899E049067DECD24FD7BE5F33338952EA2258EE91C6ACE643B107E111478ACC096790082B3082998D28EFEBD6279A
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUc:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgic
MD5:	2DD89CA2D644D9414D300A8AF16335CA
SHA1:	669A89206DBF779310703AEE89FAF02E45F4BD8F
SHA-256:	96050B4208C71F273887FDD4DC7CE3D2AE8B557916F9B131DD33863B0D59AED9
SHA-512:	9847E81AD1CF2B6C34CF1FA713D3E24F49D3E92E9DABD2CD356CFC574A76155FA3E866D43C2144AAE388E10D326C0682B48187CC0B52D7DF7CB6F3561262E65C
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\KeyHolder\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2490
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E55D921118396C9F31A5B2E173A938A0
SHA1:	210E5A9952B8C75E7BCA0937AA817DBD563F76B5
SHA-256:	C0E93AADBABC947992A361C545E9E41CBBB9E2864AD893A1A6727A9B145D1D52
SHA-512:	C664CDC8CAC9595494C389860AD44F19EB9150F536A6CF8EB62B312CADFE60D47D5A8CCDED5FBDEE7B7EA099D8A85BB76F55C6E94FE502A05AFFFE36B7AA9ECC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUc:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgic
MD5:	2DD89CA2D644D9414D300A8AF16335CA
SHA1:	669A89206DBF779310703AEE89FAF02E45F4BD8F
SHA-256:	96050B4208C71F273887FDD4DC7CE3D2AE8B557916F9B131DD33863B0D59AED9
SHA-512:	9847E81AD1CF2B6C34CF1FA713D3E24F49D3E92E9DABD2CD356CFC574A76155FA3E866D43C2144AAE388E10D326C0682B48187CC0B52D7DF7CB6F3561262E65C
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows\ClipSVC\GenuineTicket\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUc:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgic
MD5:	2DD89CA2D644D9414D300A8AF16335CA
SHA1:	669A89206DBF779310703AEE89FAF02E45F4BD8F
SHA-256:	96050B4208C71F273887FDD4DC7CE3D2AE8B557916F9B131DD33863B0D59AED9
SHA-512:	9847E81AD1CF2B6C34CF1FA713D3E24F49D3E92E9DABD2CD356CFC574A76155FA3E866D43C2144AAE388E10D326C0682B48187CC0B52D7DF7CB6F3561262E65C
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows\ClipSVC\Import\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUc:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgic
MD5:	2DD89CA2D644D9414D300A8AF16335CA
SHA1:	669A89206DBF779310703AEE89FAF02E45F4BD8F
SHA-256:	96050B4208C71F273887FDD4DC7CE3D2AE8B557916F9B131DD33863B0D59AED9
SHA-512:	9847E81AD1CF2B6C34CF1FA713D3E24F49D3E92E9DABD2CD356CFC574A76155FA3E866D43C2144AAE388E10D326C0682B48187CC0B52D7DF7CB6F3561262E65C
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows\ClipSVC\Install\Apps\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUc:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgic
MD5:	2DD89CA2D644D9414D300A8AF16335CA
SHA1:	669A89206DBF779310703AEE89FAF02E45F4BD8F
SHA-256:	96050B4208C71F273887FDD4DC7CE3D2AE8B557916F9B131DD33863B0D59AED9
SHA-512:	9847E81AD1CF2B6C34CF1FA713D3E24F49D3E92E9DABD2CD356CFC574A76155FA3E866D43C2144AAE388E10D326C0682B48187CC0B52D7DF7CB6F3561262E65C
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows\ClipSVC\Install\Migration\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2490
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E55D921118396C9F31A5B2E173A938A0
SHA1:	210E5A9952B8C75E7BCA0937AA817DBD563F76B5
SHA-256:	C0E93AADBABC947992A361C545E9E41CBBB9E2864AD893A1A6727A9B145D1D52
SHA-512:	C664CDC8CAC9595494C389860AD44F19EB9150F536A6CF8EB62B312CADFE60D47D5A8CCDED5FBDEE7B7EA099D8A85BB76F55C6E94FE502A05AFFFE36B7AA9ECC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows\ClipSVC\Install\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUc:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgic
MD5:	2DD89CA2D644D9414D300A8AF16335CA
SHA1:	669A89206DBF779310703AEE89FAF02E45F4BD8F
SHA-256:	96050B4208C71F273887FDD4DC7CE3D2AE8B557916F9B131DD33863B0D59AED9
SHA-512:	9847E81AD1CF2B6C34CF1FA713D3E24F49D3E92E9DABD2CD356CFC574A76155FA3E866D43C2144AAE388E10D326C0682B48187CC0B52D7DF7CB6F3561262E65C
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows\ClipSVC\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUc:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgic
MD5:	2DD89CA2D644D9414D300A8AF16335CA
SHA1:	669A89206DBF779310703AEE89FAF02E45F4BD8F
SHA-256:	96050B4208C71F273887FDD4DC7CE3D2AE8B557916F9B131DD33863B0D59AED9
SHA-512:	9847E81AD1CF2B6C34CF1FA713D3E24F49D3E92E9DABD2CD356CFC574A76155FA3E866D43C2144AAE388E10D326C0682B48187CC0B52D7DF7CB6F3561262E65C
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows\DeviceMetadataCache\dmrccache\downloads\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2490
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E55D921118396C9F31A5B2E173A938A0
SHA1:	210E5A9952B8C75E7BCA0937AA817DBD563F76B5
SHA-256:	C0E93AADBABC947992A361C545E9E41CBBB9E2864AD893A1A6727A9B145D1D52
SHA-512:	C664CDC8CAC9595494C389860AD44F19EB9150F536A6CF8EB62B312CADFE60D47D5A8CCDED5FBDEE7B7EA099D8A85BB76F55C6E94FE502A05AFFFE36B7AA9ECC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows\DeviceMetadataCache\dmrccache\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2490
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E55D921118396C9F31A5B2E173A938A0
SHA1:	210E5A9952B8C75E7BCA0937AA817DBD563F76B5
SHA-256:	C0E93AADBABC947992A361C545E9E41CBBB9E2864AD893A1A6727A9B145D1D52
SHA-512:	C664CDC8CAC9595494C389860AD44F19EB9150F536A6CF8EB62B312CADFE60D47D5A8CCDED5FBDEE7B7EA099D8A85BB76F55C6E94FE502A05AFFFE36B7AA9ECC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows\DeviceMetadataCache\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUc:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgic
MD5:	2DD89CA2D644D9414D300A8AF16335CA
SHA1:	669A89206DBF779310703AEE89FAF02E45F4BD8F
SHA-256:	96050B4208C71F273887FDD4DC7CE3D2AE8B557916F9B131DD33863B0D59AED9
SHA-512:	9847E81AD1CF2B6C34CF1FA713D3E24F49D3E92E9DABD2CD356CFC574A76155FA3E866D43C2144AAE388E10D326C0682B48187CC0B52D7DF7CB6F3561262E65C
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows\DeviceMetadataStore\en-US\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2490
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E55D921118396C9F31A5B2E173A938A0
SHA1:	210E5A9952B8C75E7BCA0937AA817DBD563F76B5
SHA-256:	C0E93AADBABC947992A361C545E9E41CBBB9E2864AD893A1A6727A9B145D1D52
SHA-512:	C664CDC8CAC9595494C389860AD44F19EB9150F536A6CF8EB62B312CADFE60D47D5A8CCDED5FBDEE7B7EA099D8A85BB76F55C6E94FE502A05AFFFE36B7AA9ECC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows\DeviceMetadataStore\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUc:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgic
MD5:	2DD89CA2D644D9414D300A8AF16335CA
SHA1:	669A89206DBF779310703AEE89FAF02E45F4BD8F
SHA-256:	96050B4208C71F273887FDD4DC7CE3D2AE8B557916F9B131DD33863B0D59AED9
SHA-512:	9847E81AD1CF2B6C34CF1FA713D3E24F49D3E92E9DABD2CD356CFC574A76155FA3E866D43C2144AAE388E10D326C0682B48187CC0B52D7DF7CB6F3561262E65C
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows\GameExplorer\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUc:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgic
MD5:	2DD89CA2D644D9414D300A8AF16335CA
SHA1:	669A89206DBF779310703AEE89FAF02E45F4BD8F
SHA-256:	96050B4208C71F273887FDD4DC7CE3D2AE8B557916F9B131DD33863B0D59AED9
SHA-512:	9847E81AD1CF2B6C34CF1FA713D3E24F49D3E92E9DABD2CD356CFC574A76155FA3E866D43C2144AAE388E10D326C0682B48187CC0B52D7DF7CB6F3561262E65C
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows\LfSvc\Cache\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUc:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgic
MD5:	2DD89CA2D644D9414D300A8AF16335CA
SHA1:	669A89206DBF779310703AEE89FAF02E45F4BD8F
SHA-256:	96050B4208C71F273887FDD4DC7CE3D2AE8B557916F9B131DD33863B0D59AED9
SHA-512:	9847E81AD1CF2B6C34CF1FA713D3E24F49D3E92E9DABD2CD356CFC574A76155FA3E866D43C2144AAE388E10D326C0682B48187CC0B52D7DF7CB6F3561262E65C
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows\LfSvc\Geofence\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUc:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgic
MD5:	2DD89CA2D644D9414D300A8AF16335CA
SHA1:	669A89206DBF779310703AEE89FAF02E45F4BD8F
SHA-256:	96050B4208C71F273887FDD4DC7CE3D2AE8B557916F9B131DD33863B0D59AED9
SHA-512:	9847E81AD1CF2B6C34CF1FA713D3E24F49D3E92E9DABD2CD356CFC574A76155FA3E866D43C2144AAE388E10D326C0682B48187CC0B52D7DF7CB6F3561262E65C
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows\LfSvc\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUc:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgic
MD5:	2DD89CA2D644D9414D300A8AF16335CA
SHA1:	669A89206DBF779310703AEE89FAF02E45F4BD8F
SHA-256:	96050B4208C71F273887FDD4DC7CE3D2AE8B557916F9B131DD33863B0D59AED9
SHA-512:	9847E81AD1CF2B6C34CF1FA713D3E24F49D3E92E9DABD2CD356CFC574A76155FA3E866D43C2144AAE388E10D326C0682B48187CC0B52D7DF7CB6F3561262E65C
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows\Parental Controls\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUc:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgic
MD5:	2DD89CA2D644D9414D300A8AF16335CA
SHA1:	669A89206DBF779310703AEE89FAF02E45F4BD8F
SHA-256:	96050B4208C71F273887FDD4DC7CE3D2AE8B557916F9B131DD33863B0D59AED9
SHA-512:	9847E81AD1CF2B6C34CF1FA713D3E24F49D3E92E9DABD2CD356CFC574A76155FA3E866D43C2144AAE388E10D326C0682B48187CC0B52D7DF7CB6F3561262E65C
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows\Parental Controls\settings\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2490
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E55D921118396C9F31A5B2E173A938A0
SHA1:	210E5A9952B8C75E7BCA0937AA817DBD563F76B5
SHA-256:	C0E93AADBABC947992A361C545E9E41CBBB9E2864AD893A1A6727A9B145D1D52
SHA-512:	C664CDC8CAC9595494C389860AD44F19EB9150F536A6CF8EB62B312CADFE60D47D5A8CCDED5FBDEE7B7EA099D8A85BB76F55C6E94FE502A05AFFFE36B7AA9ECC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows\Power Efficiency Diagnostics\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2490
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E55D921118396C9F31A5B2E173A938A0
SHA1:	210E5A9952B8C75E7BCA0937AA817DBD563F76B5
SHA-256:	C0E93AADBABC947992A361C545E9E41CBBB9E2864AD893A1A6727A9B145D1D52
SHA-512:	C664CDC8CAC9595494C389860AD44F19EB9150F536A6CF8EB62B312CADFE60D47D5A8CCDED5FBDEE7B7EA099D8A85BB76F55C6E94FE502A05AFFFE36B7AA9ECC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows\Ringtones\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUc:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgic
MD5:	2DD89CA2D644D9414D300A8AF16335CA
SHA1:	669A89206DBF779310703AEE89FAF02E45F4BD8F
SHA-256:	96050B4208C71F273887FDD4DC7CE3D2AE8B557916F9B131DD33863B0D59AED9
SHA-512:	9847E81AD1CF2B6C34CF1FA713D3E24F49D3E92E9DABD2CD356CFC574A76155FA3E866D43C2144AAE388E10D326C0682B48187CC0B52D7DF7CB6F3561262E65C
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows\Sqm\Manifest\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUc:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgic
MD5:	2DD89CA2D644D9414D300A8AF16335CA
SHA1:	669A89206DBF779310703AEE89FAF02E45F4BD8F
SHA-256:	96050B4208C71F273887FDD4DC7CE3D2AE8B557916F9B131DD33863B0D59AED9
SHA-512:	9847E81AD1CF2B6C34CF1FA713D3E24F49D3E92E9DABD2CD356CFC574A76155FA3E866D43C2144AAE388E10D326C0682B48187CC0B52D7DF7CB6F3561262E65C
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows\Sqm\Sessions\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUc:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgic
MD5:	2DD89CA2D644D9414D300A8AF16335CA
SHA1:	669A89206DBF779310703AEE89FAF02E45F4BD8F
SHA-256:	96050B4208C71F273887FDD4DC7CE3D2AE8B557916F9B131DD33863B0D59AED9
SHA-512:	9847E81AD1CF2B6C34CF1FA713D3E24F49D3E92E9DABD2CD356CFC574A76155FA3E866D43C2144AAE388E10D326C0682B48187CC0B52D7DF7CB6F3561262E65C
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows\Sqm\Upload\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUc:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgic
MD5:	2DD89CA2D644D9414D300A8AF16335CA
SHA1:	669A89206DBF779310703AEE89FAF02E45F4BD8F
SHA-256:	96050B4208C71F273887FDD4DC7CE3D2AE8B557916F9B131DD33863B0D59AED9
SHA-512:	9847E81AD1CF2B6C34CF1FA713D3E24F49D3E92E9DABD2CD356CFC574A76155FA3E866D43C2144AAE388E10D326C0682B48187CC0B52D7DF7CB6F3561262E65C
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows\Sqm\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUc:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgic
MD5:	2DD89CA2D644D9414D300A8AF16335CA
SHA1:	669A89206DBF779310703AEE89FAF02E45F4BD8F
SHA-256:	96050B4208C71F273887FDD4DC7CE3D2AE8B557916F9B131DD33863B0D59AED9
SHA-512:	9847E81AD1CF2B6C34CF1FA713D3E24F49D3E92E9DABD2CD356CFC574A76155FA3E866D43C2144AAE388E10D326C0682B48187CC0B52D7DF7CB6F3561262E65C
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows\Start Menu Places\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUc:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgic
MD5:	2DD89CA2D644D9414D300A8AF16335CA
SHA1:	669A89206DBF779310703AEE89FAF02E45F4BD8F
SHA-256:	96050B4208C71F273887FDD4DC7CE3D2AE8B557916F9B131DD33863B0D59AED9
SHA-512:	9847E81AD1CF2B6C34CF1FA713D3E24F49D3E92E9DABD2CD356CFC574A76155FA3E866D43C2144AAE388E10D326C0682B48187CC0B52D7DF7CB6F3561262E65C
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5229
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	96:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgs:TWWWWWWWWWWWWWWWWWWWWs
MD5:	CF8F47C4D37B6055ACEDE03F23AFDAC2
SHA1:	F14EB06B503F31643A49925ACEC151109655DBF8
SHA-256:	DE1A38126E24D66B08FCC4F71A4C6DB22B388EF117B61E40EF60F854D72E0BE7
SHA-512:	CBDF75780E91B931E9C0561CB6DF1E261ACC28ED268871F148A5737916EFF178F181A7DB6509388DCF1442035FBE689851BDA4CF0304B42DB26C3A63476B643F
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4731
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	96:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgs:TWWWWWWWWWWWWWWWWWWs
MD5:	A3C577C99063967E46ED12D528B16755
SHA1:	76F8872EB0D4BD7E508B4025818373036783497E
SHA-256:	7DA19038679799C8FD8B1F72DFA2644C6FA8BBE6F2A74ADAF03F7F756F8B82AB
SHA-512:	20B33BEF452549D8090396857ED97B9DE48509396A07B2DCF34973CBA5F56FBB1E07047438A58A45EFC82B530728388EA1F6353FA7F61D49BDE02D44C9FB75B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5229
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	96:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgs:TWWWWWWWWWWWWWWWWWWWWs
MD5:	CF8F47C4D37B6055ACEDE03F23AFDAC2
SHA1:	F14EB06B503F31643A49925ACEC151109655DBF8
SHA-256:	DE1A38126E24D66B08FCC4F71A4C6DB22B388EF117B61E40EF60F854D72E0BE7
SHA-512:	CBDF75780E91B931E9C0561CB6DF1E261ACC28ED268871F148A5737916EFF178F181A7DB6509388DCF1442035FBE689851BDA4CF0304B42DB26C3A63476B643F
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5229
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	96:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgs:TWWWWWWWWWWWWWWWWWWWWs
MD5:	CF8F47C4D37B6055ACEDE03F23AFDAC2
SHA1:	F14EB06B503F31643A49925ACEC151109655DBF8
SHA-256:	DE1A38126E24D66B08FCC4F71A4C6DB22B388EF117B61E40EF60F854D72E0BE7
SHA-512:	CBDF75780E91B931E9C0561CB6DF1E261ACC28ED268871F148A5737916EFF178F181A7DB6509388DCF1442035FBE689851BDA4CF0304B42DB26C3A63476B643F
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Extras\AutoItX\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4731
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	96:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgs:TWWWWWWWWWWWWWWWWWWs
MD5:	A3C577C99063967E46ED12D528B16755
SHA1:	76F8872EB0D4BD7E508B4025818373036783497E
SHA-256:	7DA19038679799C8FD8B1F72DFA2644C6FA8BBE6F2A74ADAF03F7F756F8B82AB
SHA-512:	20B33BEF452549D8090396857ED97B9DE48509396A07B2DCF34973CBA5F56FBB1E07047438A58A45EFC82B530728388EA1F6353FA7F61D49BDE02D44C9FB75B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Extras\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5229
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	96:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgs:TWWWWWWWWWWWWWWWWWWWWs
MD5:	CF8F47C4D37B6055ACEDE03F23AFDAC2
SHA1:	F14EB06B503F31643A49925ACEC151109655DBF8
SHA-256:	DE1A38126E24D66B08FCC4F71A4C6DB22B388EF117B61E40EF60F854D72E0BE7
SHA-512:	CBDF75780E91B931E9C0561CB6DF1E261ACC28ED268871F148A5737916EFF178F181A7DB6509388DCF1442035FBE689851BDA4CF0304B42DB26C3A63476B643F
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5229
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	96:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgs:TWWWWWWWWWWWWWWWWWWWWs
MD5:	CF8F47C4D37B6055ACEDE03F23AFDAC2
SHA1:	F14EB06B503F31643A49925ACEC151109655DBF8
SHA-256:	DE1A38126E24D66B08FCC4F71A4C6DB22B388EF117B61E40EF60F854D72E0BE7
SHA-512:	CBDF75780E91B931E9C0561CB6DF1E261ACC28ED268871F148A5737916EFF178F181A7DB6509388DCF1442035FBE689851BDA4CF0304B42DB26C3A63476B643F
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5229
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	96:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgs:TWWWWWWWWWWWWWWWWWWWWs
MD5:	CF8F47C4D37B6055ACEDE03F23AFDAC2
SHA1:	F14EB06B503F31643A49925ACEC151109655DBF8
SHA-256:	DE1A38126E24D66B08FCC4F71A4C6DB22B388EF117B61E40EF60F854D72E0BE7
SHA-512:	CBDF75780E91B931E9C0561CB6DF1E261ACC28ED268871F148A5737916EFF178F181A7DB6509388DCF1442035FBE689851BDA4CF0304B42DB26C3A63476B643F
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5229
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	96:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgs:TWWWWWWWWWWWWWWWWWWWWs
MD5:	CF8F47C4D37B6055ACEDE03F23AFDAC2
SHA1:	F14EB06B503F31643A49925ACEC151109655DBF8
SHA-256:	DE1A38126E24D66B08FCC4F71A4C6DB22B388EF117B61E40EF60F854D72E0BE7
SHA-512:	CBDF75780E91B931E9C0561CB6DF1E261ACC28ED268871F148A5737916EFF178F181A7DB6509388DCF1442035FBE689851BDA4CF0304B42DB26C3A63476B643F
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2016 Tools\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4731
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	96:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgs:TWWWWWWWWWWWWWWWWWWs
MD5:	A3C577C99063967E46ED12D528B16755
SHA1:	76F8872EB0D4BD7E508B4025818373036783497E
SHA-256:	7DA19038679799C8FD8B1F72DFA2644C6FA8BBE6F2A74ADAF03F7F756F8B82AB
SHA-512:	20B33BEF452549D8090396857ED97B9DE48509396A07B2DCF34973CBA5F56FBB1E07047438A58A45EFC82B530728388EA1F6353FA7F61D49BDE02D44C9FB75B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5229
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	96:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgs:TWWWWWWWWWWWWWWWWWWWWs
MD5:	CF8F47C4D37B6055ACEDE03F23AFDAC2
SHA1:	F14EB06B503F31643A49925ACEC151109655DBF8
SHA-256:	DE1A38126E24D66B08FCC4F71A4C6DB22B388EF117B61E40EF60F854D72E0BE7
SHA-512:	CBDF75780E91B931E9C0561CB6DF1E261ACC28ED268871F148A5737916EFF178F181A7DB6509388DCF1442035FBE689851BDA4CF0304B42DB26C3A63476B643F
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5229
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	96:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgs:TWWWWWWWWWWWWWWWWWWWWs
MD5:	CF8F47C4D37B6055ACEDE03F23AFDAC2
SHA1:	F14EB06B503F31643A49925ACEC151109655DBF8
SHA-256:	DE1A38126E24D66B08FCC4F71A4C6DB22B388EF117B61E40EF60F854D72E0BE7
SHA-512:	CBDF75780E91B931E9C0561CB6DF1E261ACC28ED268871F148A5737916EFF178F181A7DB6509388DCF1442035FBE689851BDA4CF0304B42DB26C3A63476B643F
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5727
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	96:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYge:TWWWWWWWWWWWWWWWWWWWWWWs
MD5:	EAC959EC571781A9E3EE95C7454AFB76
SHA1:	60B54AC0DF1678C3AA3FF904433E92711FB2C482
SHA-256:	88636BB93D604F47AB7748487994009B4769E8CDDF0EA14E04B7C7D190656DA4
SHA-512:	47A394DFDF236DA5B2962A0A4ED0AFCAA834D3CC0A95645B1E54009D83C39D0F887804CB58437598515C219FA3B6C70458802A1BC3A69A3FEF5939541C94BC82
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows\Start Menu\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5727
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	96:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYge:TWWWWWWWWWWWWWWWWWWWWWWs
MD5:	EAC959EC571781A9E3EE95C7454AFB76
SHA1:	60B54AC0DF1678C3AA3FF904433E92711FB2C482
SHA-256:	88636BB93D604F47AB7748487994009B4769E8CDDF0EA14E04B7C7D190656DA4
SHA-512:	47A394DFDF236DA5B2962A0A4ED0AFCAA834D3CC0A95645B1E54009D83C39D0F887804CB58437598515C219FA3B6C70458802A1BC3A69A3FEF5939541C94BC82
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows\Templates\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5727
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	96:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYge:TWWWWWWWWWWWWWWWWWWWWWWs
MD5:	EAC959EC571781A9E3EE95C7454AFB76
SHA1:	60B54AC0DF1678C3AA3FF904433E92711FB2C482
SHA-256:	88636BB93D604F47AB7748487994009B4769E8CDDF0EA14E04B7C7D190656DA4
SHA-512:	47A394DFDF236DA5B2962A0A4ED0AFCAA834D3CC0A95645B1E54009D83C39D0F887804CB58437598515C219FA3B6C70458802A1BC3A69A3FEF5939541C94BC82
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows\WER\ReportArchive\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUc:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgic
MD5:	2DD89CA2D644D9414D300A8AF16335CA
SHA1:	669A89206DBF779310703AEE89FAF02E45F4BD8F
SHA-256:	96050B4208C71F273887FDD4DC7CE3D2AE8B557916F9B131DD33863B0D59AED9
SHA-512:	9847E81AD1CF2B6C34CF1FA713D3E24F49D3E92E9DABD2CD356CFC574A76155FA3E866D43C2144AAE388E10D326C0682B48187CC0B52D7DF7CB6F3561262E65C
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_b187e4484c4831a1fe7677975c9505e17d6a36e_76d002fb_06ec5ec9\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1494
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	24:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoM/:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxp
MD5:	7CE6ACB9853F7FABB46F44230D475782
SHA1:	64E98068AC3A0BA9F3184C19D6B0047262789C71
SHA-256:	F4328C73B5C76759B21F35CE313C46F56911E676468BFF73A5D01377726A8DCF
SHA-512:	33C2E7F737238E89587A4674AD06BCEC54B49680125A7A3219F95911780BEE217C4FDE84517326073D15858EC7121788DD018F461FE546F7533E8E209B792054
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_b187e4484c4831a1fe7677975c9505e17d6a36e_76d002fb_08c03c3d\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1494
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	24:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoM/:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxp
MD5:	7CE6ACB9853F7FABB46F44230D475782
SHA1:	64E98068AC3A0BA9F3184C19D6B0047262789C71
SHA-256:	F4328C73B5C76759B21F35CE313C46F56911E676468BFF73A5D01377726A8DCF
SHA-512:	33C2E7F737238E89587A4674AD06BCEC54B49680125A7A3219F95911780BEE217C4FDE84517326073D15858EC7121788DD018F461FE546F7533E8E209B792054
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_b187e4484c4831a1fe7677975c9505e17d6a36e_76d002fb_09a460dc\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1494
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	24:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoM/:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxp
MD5:	7CE6ACB9853F7FABB46F44230D475782
SHA1:	64E98068AC3A0BA9F3184C19D6B0047262789C71
SHA-256:	F4328C73B5C76759B21F35CE313C46F56911E676468BFF73A5D01377726A8DCF
SHA-512:	33C2E7F737238E89587A4674AD06BCEC54B49680125A7A3219F95911780BEE217C4FDE84517326073D15858EC7121788DD018F461FE546F7533E8E209B792054
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_b187e4484c4831a1fe7677975c9505e17d6a36e_76d002fb_0a8180d0\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1494
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	24:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoM/:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxp
MD5:	7CE6ACB9853F7FABB46F44230D475782
SHA1:	64E98068AC3A0BA9F3184C19D6B0047262789C71
SHA-256:	F4328C73B5C76759B21F35CE313C46F56911E676468BFF73A5D01377726A8DCF
SHA-512:	33C2E7F737238E89587A4674AD06BCEC54B49680125A7A3219F95911780BEE217C4FDE84517326073D15858EC7121788DD018F461FE546F7533E8E209B792054
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_b187e4484c4831a1fe7677975c9505e17d6a36e_76d002fb_0b6c517b\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1494
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	24:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoM/:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxp
MD5:	7CE6ACB9853F7FABB46F44230D475782
SHA1:	64E98068AC3A0BA9F3184C19D6B0047262789C71
SHA-256:	F4328C73B5C76759B21F35CE313C46F56911E676468BFF73A5D01377726A8DCF
SHA-512:	33C2E7F737238E89587A4674AD06BCEC54B49680125A7A3219F95911780BEE217C4FDE84517326073D15858EC7121788DD018F461FE546F7533E8E209B792054
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_b187e4484c4831a1fe7677975c9505e17d6a36e_76d002fb_0b8c4c0c\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1494
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	24:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoM/:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxp
MD5:	7CE6ACB9853F7FABB46F44230D475782
SHA1:	64E98068AC3A0BA9F3184C19D6B0047262789C71
SHA-256:	F4328C73B5C76759B21F35CE313C46F56911E676468BFF73A5D01377726A8DCF
SHA-512:	33C2E7F737238E89587A4674AD06BCEC54B49680125A7A3219F95911780BEE217C4FDE84517326073D15858EC7121788DD018F461FE546F7533E8E209B792054
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_b187e4484c4831a1fe7677975c9505e17d6a36e_76d002fb_0f4939b5\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1494
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	24:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoM/:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxp
MD5:	7CE6ACB9853F7FABB46F44230D475782
SHA1:	64E98068AC3A0BA9F3184C19D6B0047262789C71
SHA-256:	F4328C73B5C76759B21F35CE313C46F56911E676468BFF73A5D01377726A8DCF
SHA-512:	33C2E7F737238E89587A4674AD06BCEC54B49680125A7A3219F95911780BEE217C4FDE84517326073D15858EC7121788DD018F461FE546F7533E8E209B792054
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_b187e4484c4831a1fe7677975c9505e17d6a36e_76d002fb_12643e03\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1494
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	24:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoM/:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxp
MD5:	7CE6ACB9853F7FABB46F44230D475782
SHA1:	64E98068AC3A0BA9F3184C19D6B0047262789C71
SHA-256:	F4328C73B5C76759B21F35CE313C46F56911E676468BFF73A5D01377726A8DCF
SHA-512:	33C2E7F737238E89587A4674AD06BCEC54B49680125A7A3219F95911780BEE217C4FDE84517326073D15858EC7121788DD018F461FE546F7533E8E209B792054
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_b187e4484c4831a1fe7677975c9505e17d6a36e_76d002fb_128043b0\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1494
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	24:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoM/:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxp
MD5:	7CE6ACB9853F7FABB46F44230D475782
SHA1:	64E98068AC3A0BA9F3184C19D6B0047262789C71
SHA-256:	F4328C73B5C76759B21F35CE313C46F56911E676468BFF73A5D01377726A8DCF
SHA-512:	33C2E7F737238E89587A4674AD06BCEC54B49680125A7A3219F95911780BEE217C4FDE84517326073D15858EC7121788DD018F461FE546F7533E8E209B792054
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_b187e4484c4831a1fe7677975c9505e17d6a36e_76d002fb_13494425\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1494
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	24:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoM/:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxp
MD5:	7CE6ACB9853F7FABB46F44230D475782
SHA1:	64E98068AC3A0BA9F3184C19D6B0047262789C71
SHA-256:	F4328C73B5C76759B21F35CE313C46F56911E676468BFF73A5D01377726A8DCF
SHA-512:	33C2E7F737238E89587A4674AD06BCEC54B49680125A7A3219F95911780BEE217C4FDE84517326073D15858EC7121788DD018F461FE546F7533E8E209B792054
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_b187e4484c4831a1fe7677975c9505e17d6a36e_76d002fb_13748f6e\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1494
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	24:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoM/:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxp
MD5:	7CE6ACB9853F7FABB46F44230D475782
SHA1:	64E98068AC3A0BA9F3184C19D6B0047262789C71
SHA-256:	F4328C73B5C76759B21F35CE313C46F56911E676468BFF73A5D01377726A8DCF
SHA-512:	33C2E7F737238E89587A4674AD06BCEC54B49680125A7A3219F95911780BEE217C4FDE84517326073D15858EC7121788DD018F461FE546F7533E8E209B792054
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_b187e4484c4831a1fe7677975c9505e17d6a36e_76d002fb_138c4769\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1494
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	24:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoM/:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxp
MD5:	7CE6ACB9853F7FABB46F44230D475782
SHA1:	64E98068AC3A0BA9F3184C19D6B0047262789C71
SHA-256:	F4328C73B5C76759B21F35CE313C46F56911E676468BFF73A5D01377726A8DCF
SHA-512:	33C2E7F737238E89587A4674AD06BCEC54B49680125A7A3219F95911780BEE217C4FDE84517326073D15858EC7121788DD018F461FE546F7533E8E209B792054
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_b187e4484c4831a1fe7677975c9505e17d6a36e_76d002fb_13cc4a57\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1494
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	24:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoM/:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxp
MD5:	7CE6ACB9853F7FABB46F44230D475782
SHA1:	64E98068AC3A0BA9F3184C19D6B0047262789C71
SHA-256:	F4328C73B5C76759B21F35CE313C46F56911E676468BFF73A5D01377726A8DCF
SHA-512:	33C2E7F737238E89587A4674AD06BCEC54B49680125A7A3219F95911780BEE217C4FDE84517326073D15858EC7121788DD018F461FE546F7533E8E209B792054
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_b187e4484c4831a1fe7677975c9505e17d6a36e_76d002fb_15887bb7\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1494
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	24:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoM/:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxp
MD5:	7CE6ACB9853F7FABB46F44230D475782
SHA1:	64E98068AC3A0BA9F3184C19D6B0047262789C71
SHA-256:	F4328C73B5C76759B21F35CE313C46F56911E676468BFF73A5D01377726A8DCF
SHA-512:	33C2E7F737238E89587A4674AD06BCEC54B49680125A7A3219F95911780BEE217C4FDE84517326073D15858EC7121788DD018F461FE546F7533E8E209B792054
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_b187e4484c4831a1fe7677975c9505e17d6a36e_76d002fb_15f6da80\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1494
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	24:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoM/:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxp
MD5:	7CE6ACB9853F7FABB46F44230D475782
SHA1:	64E98068AC3A0BA9F3184C19D6B0047262789C71
SHA-256:	F4328C73B5C76759B21F35CE313C46F56911E676468BFF73A5D01377726A8DCF
SHA-512:	33C2E7F737238E89587A4674AD06BCEC54B49680125A7A3219F95911780BEE217C4FDE84517326073D15858EC7121788DD018F461FE546F7533E8E209B792054
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_b187e4484c4831a1fe7677975c9505e17d6a36e_76d002fb_169039cc\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1494
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	24:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoM/:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxp
MD5:	7CE6ACB9853F7FABB46F44230D475782
SHA1:	64E98068AC3A0BA9F3184C19D6B0047262789C71
SHA-256:	F4328C73B5C76759B21F35CE313C46F56911E676468BFF73A5D01377726A8DCF
SHA-512:	33C2E7F737238E89587A4674AD06BCEC54B49680125A7A3219F95911780BEE217C4FDE84517326073D15858EC7121788DD018F461FE546F7533E8E209B792054
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_b187e4484c4831a1fe7677975c9505e17d6a36e_76d002fb_18713e87\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1494
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	24:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoM/:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxp
MD5:	7CE6ACB9853F7FABB46F44230D475782
SHA1:	64E98068AC3A0BA9F3184C19D6B0047262789C71
SHA-256:	F4328C73B5C76759B21F35CE313C46F56911E676468BFF73A5D01377726A8DCF
SHA-512:	33C2E7F737238E89587A4674AD06BCEC54B49680125A7A3219F95911780BEE217C4FDE84517326073D15858EC7121788DD018F461FE546F7533E8E209B792054
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_10.0.17134.1_3b14d13aed986ad7ce8ed84862a7c39c2972e_00000000_0f243638\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1494
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	24:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoM/:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxp
MD5:	7CE6ACB9853F7FABB46F44230D475782
SHA1:	64E98068AC3A0BA9F3184C19D6B0047262789C71
SHA-256:	F4328C73B5C76759B21F35CE313C46F56911E676468BFF73A5D01377726A8DCF
SHA-512:	33C2E7F737238E89587A4674AD06BCEC54B49680125A7A3219F95911780BEE217C4FDE84517326073D15858EC7121788DD018F461FE546F7533E8E209B792054
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_10.0.17134.1_59c14d4512be5b58e3be16cb2633ba5cb7a7ee0_00000000_056041eb\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1494
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	24:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoM/:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxp
MD5:	7CE6ACB9853F7FABB46F44230D475782
SHA1:	64E98068AC3A0BA9F3184C19D6B0047262789C71
SHA-256:	F4328C73B5C76759B21F35CE313C46F56911E676468BFF73A5D01377726A8DCF
SHA-512:	33C2E7F737238E89587A4674AD06BCEC54B49680125A7A3219F95911780BEE217C4FDE84517326073D15858EC7121788DD018F461FE546F7533E8E209B792054
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_10.0.17134.1_59c14d4512be5b58e3be16cb2633ba5cb7a7ee0_00000000_05f85294\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1494
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	24:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoM/:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxp
MD5:	7CE6ACB9853F7FABB46F44230D475782
SHA1:	64E98068AC3A0BA9F3184C19D6B0047262789C71
SHA-256:	F4328C73B5C76759B21F35CE313C46F56911E676468BFF73A5D01377726A8DCF
SHA-512:	33C2E7F737238E89587A4674AD06BCEC54B49680125A7A3219F95911780BEE217C4FDE84517326073D15858EC7121788DD018F461FE546F7533E8E209B792054
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_10.0.17134.1_9c1477dd5bdcc59dfc815b2942263c50f1622656_00000000_0eef26d2\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1494
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	24:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoM/:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxp
MD5:	7CE6ACB9853F7FABB46F44230D475782
SHA1:	64E98068AC3A0BA9F3184C19D6B0047262789C71
SHA-256:	F4328C73B5C76759B21F35CE313C46F56911E676468BFF73A5D01377726A8DCF
SHA-512:	33C2E7F737238E89587A4674AD06BCEC54B49680125A7A3219F95911780BEE217C4FDE84517326073D15858EC7121788DD018F461FE546F7533E8E209B792054
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUc:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgic
MD5:	2DD89CA2D644D9414D300A8AF16335CA
SHA1:	669A89206DBF779310703AEE89FAF02E45F4BD8F
SHA-256:	96050B4208C71F273887FDD4DC7CE3D2AE8B557916F9B131DD33863B0D59AED9
SHA-512:	9847E81AD1CF2B6C34CF1FA713D3E24F49D3E92E9DABD2CD356CFC574A76155FA3E866D43C2144AAE388E10D326C0682B48187CC0B52D7DF7CB6F3561262E65C
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows\WER\Temp\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUc:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgic
MD5:	2DD89CA2D644D9414D300A8AF16335CA
SHA1:	669A89206DBF779310703AEE89FAF02E45F4BD8F
SHA-256:	96050B4208C71F273887FDD4DC7CE3D2AE8B557916F9B131DD33863B0D59AED9
SHA-512:	9847E81AD1CF2B6C34CF1FA713D3E24F49D3E92E9DABD2CD356CFC574A76155FA3E866D43C2144AAE388E10D326C0682B48187CC0B52D7DF7CB6F3561262E65C
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows\WER\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUc:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgic
MD5:	2DD89CA2D644D9414D300A8AF16335CA
SHA1:	669A89206DBF779310703AEE89FAF02E45F4BD8F
SHA-256:	96050B4208C71F273887FDD4DC7CE3D2AE8B557916F9B131DD33863B0D59AED9
SHA-512:	9847E81AD1CF2B6C34CF1FA713D3E24F49D3E92E9DABD2CD356CFC574A76155FA3E866D43C2144AAE388E10D326C0682B48187CC0B52D7DF7CB6F3561262E65C
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2988
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUZ:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiZ
MD5:	1EAFD54AB2EF966BEFDDBC81523CC9A3
SHA1:	B88BAF7E2AEF9583E5D9166BE4FA708D2F90AE62
SHA-256:	525754A2BF80387C752C0B58D1B8E5A42C306B7BB9996EE502E0A51383D6740D
SHA-512:	83731C664680216E99447D813AA39FFDB04899E049067DECD24FD7BE5F33338952EA2258EE91C6ACE643B107E111478ACC096790082B3082998D28EFEBD6279A
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\Windows\wfp\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUc:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgic
MD5:	2DD89CA2D644D9414D300A8AF16335CA
SHA1:	669A89206DBF779310703AEE89FAF02E45F4BD8F
SHA-256:	96050B4208C71F273887FDD4DC7CE3D2AE8B557916F9B131DD33863B0D59AED9
SHA-512:	9847E81AD1CF2B6C34CF1FA713D3E24F49D3E92E9DABD2CD356CFC574A76155FA3E866D43C2144AAE388E10D326C0682B48187CC0B52D7DF7CB6F3561262E65C
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\WwanSvc\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2490
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E55D921118396C9F31A5B2E173A938A0
SHA1:	210E5A9952B8C75E7BCA0937AA817DBD563F76B5
SHA-256:	C0E93AADBABC947992A361C545E9E41CBBB9E2864AD893A1A6727A9B145D1D52
SHA-512:	C664CDC8CAC9595494C389860AD44F19EB9150F536A6CF8EB62B312CADFE60D47D5A8CCDED5FBDEE7B7EA099D8A85BB76F55C6E94FE502A05AFFFE36B7AA9ECC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Microsoft\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2988
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUZ:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiZ
MD5:	1EAFD54AB2EF966BEFDDBC81523CC9A3
SHA1:	B88BAF7E2AEF9583E5D9166BE4FA708D2F90AE62
SHA-256:	525754A2BF80387C752C0B58D1B8E5A42C306B7BB9996EE502E0A51383D6740D
SHA-512:	83731C664680216E99447D813AA39FFDB04899E049067DECD24FD7BE5F33338952EA2258EE91C6ACE643B107E111478ACC096790082B3082998D28EFEBD6279A
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Oracle\Java\installcache\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2988
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUZ:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiZ
MD5:	1EAFD54AB2EF966BEFDDBC81523CC9A3
SHA1:	B88BAF7E2AEF9583E5D9166BE4FA708D2F90AE62
SHA-256:	525754A2BF80387C752C0B58D1B8E5A42C306B7BB9996EE502E0A51383D6740D
SHA-512:	83731C664680216E99447D813AA39FFDB04899E049067DECD24FD7BE5F33338952EA2258EE91C6ACE643B107E111478ACC096790082B3082998D28EFEBD6279A
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Oracle\Java\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2988
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUZ:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiZ
MD5:	1EAFD54AB2EF966BEFDDBC81523CC9A3
SHA1:	B88BAF7E2AEF9583E5D9166BE4FA708D2F90AE62
SHA-256:	525754A2BF80387C752C0B58D1B8E5A42C306B7BB9996EE502E0A51383D6740D
SHA-512:	83731C664680216E99447D813AA39FFDB04899E049067DECD24FD7BE5F33338952EA2258EE91C6ACE643B107E111478ACC096790082B3082998D28EFEBD6279A
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Oracle\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2988
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUZ:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiZ
MD5:	1EAFD54AB2EF966BEFDDBC81523CC9A3
SHA1:	B88BAF7E2AEF9583E5D9166BE4FA708D2F90AE62
SHA-256:	525754A2BF80387C752C0B58D1B8E5A42C306B7BB9996EE502E0A51383D6740D
SHA-512:	83731C664680216E99447D813AA39FFDB04899E049067DECD24FD7BE5F33338952EA2258EE91C6ACE643B107E111478ACC096790082B3082998D28EFEBD6279A
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Package Cache\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2988
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUZ:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiZ
MD5:	1EAFD54AB2EF966BEFDDBC81523CC9A3
SHA1:	B88BAF7E2AEF9583E5D9166BE4FA708D2F90AE62
SHA-256:	525754A2BF80387C752C0B58D1B8E5A42C306B7BB9996EE502E0A51383D6740D
SHA-512:	83731C664680216E99447D813AA39FFDB04899E049067DECD24FD7BE5F33338952EA2258EE91C6ACE643B107E111478ACC096790082B3082998D28EFEBD6279A
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2490
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E55D921118396C9F31A5B2E173A938A0
SHA1:	210E5A9952B8C75E7BCA0937AA817DBD563F76B5
SHA-256:	C0E93AADBABC947992A361C545E9E41CBBB9E2864AD893A1A6727A9B145D1D52
SHA-512:	C664CDC8CAC9595494C389860AD44F19EB9150F536A6CF8EB62B312CADFE60D47D5A8CCDED5FBDEE7B7EA099D8A85BB76F55C6E94FE502A05AFFFE36B7AA9ECC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Package Cache\{12578975-C765-4BDF-8DDC-3284BC0E855F}v14.21.27702\packages\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Package Cache\{12578975-C765-4BDF-8DDC-3284BC0E855F}v14.21.27702\packages\vcRuntimeAdditional_amd64\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1743
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgs
MD5:	AECB094884F8527CC8946D98C0CA9489
SHA1:	27C2BF3B010455FF77BD1C5DCB3B7FD341B58AEA
SHA-256:	D7C6D4EC9BCEF51770FD65526DF578192C51B4B8EEA6BB6B0FE924A77324E99F
SHA-512:	CBB4A6EEDC1895E1F8CB34B5488E5F26ECA052ADD8EBF20046CECE6D6B1C7723AB5D8F135200EF52DC88EE5953BBC336EB74C6DA904D56EEAAA9BB33A0C128AE
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Package Cache\{12578975-C765-4BDF-8DDC-3284BC0E855F}v14.21.27702\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Package Cache\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\packages\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Package Cache\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\packages\vcRuntimeMinimum_x86\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1743
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgs
MD5:	AECB094884F8527CC8946D98C0CA9489
SHA1:	27C2BF3B010455FF77BD1C5DCB3B7FD341B58AEA
SHA-256:	D7C6D4EC9BCEF51770FD65526DF578192C51B4B8EEA6BB6B0FE924A77324E99F
SHA-512:	CBB4A6EEDC1895E1F8CB34B5488E5F26ECA052ADD8EBF20046CECE6D6B1C7723AB5D8F135200EF52DC88EE5953BBC336EB74C6DA904D56EEAAA9BB33A0C128AE
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Package Cache\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Package Cache\{19F7E289-17B8-44EC-A099-927507B6F739}v14.21.27702\packages\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Package Cache\{19F7E289-17B8-44EC-A099-927507B6F739}v14.21.27702\packages\vcRuntimeMinimum_x86\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1743
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgs
MD5:	AECB094884F8527CC8946D98C0CA9489
SHA1:	27C2BF3B010455FF77BD1C5DCB3B7FD341B58AEA
SHA-256:	D7C6D4EC9BCEF51770FD65526DF578192C51B4B8EEA6BB6B0FE924A77324E99F
SHA-512:	CBB4A6EEDC1895E1F8CB34B5488E5F26ECA052ADD8EBF20046CECE6D6B1C7723AB5D8F135200EF52DC88EE5953BBC336EB74C6DA904D56EEAAA9BB33A0C128AE
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Package Cache\{19F7E289-17B8-44EC-A099-927507B6F739}v14.21.27702\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Package Cache\{213668DB-2263-4E2D-ABB8-487FD539130E}v14.21.27702\packages\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Package Cache\{213668DB-2263-4E2D-ABB8-487FD539130E}v14.21.27702\packages\vcRuntimeAdditional_x86\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1743
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgs
MD5:	AECB094884F8527CC8946D98C0CA9489
SHA1:	27C2BF3B010455FF77BD1C5DCB3B7FD341B58AEA
SHA-256:	D7C6D4EC9BCEF51770FD65526DF578192C51B4B8EEA6BB6B0FE924A77324E99F
SHA-512:	CBB4A6EEDC1895E1F8CB34B5488E5F26ECA052ADD8EBF20046CECE6D6B1C7723AB5D8F135200EF52DC88EE5953BBC336EB74C6DA904D56EEAAA9BB33A0C128AE
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Package Cache\{213668DB-2263-4E2D-ABB8-487FD539130E}v14.21.27702\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2490
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E55D921118396C9F31A5B2E173A938A0
SHA1:	210E5A9952B8C75E7BCA0937AA817DBD563F76B5
SHA-256:	C0E93AADBABC947992A361C545E9E41CBBB9E2864AD893A1A6727A9B145D1D52
SHA-512:	C664CDC8CAC9595494C389860AD44F19EB9150F536A6CF8EB62B312CADFE60D47D5A8CCDED5FBDEE7B7EA099D8A85BB76F55C6E94FE502A05AFFFE36B7AA9ECC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Package Cache\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\packages\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Package Cache\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\packages\vcRuntimeAdditional_amd64\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1743
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgs
MD5:	AECB094884F8527CC8946D98C0CA9489
SHA1:	27C2BF3B010455FF77BD1C5DCB3B7FD341B58AEA
SHA-256:	D7C6D4EC9BCEF51770FD65526DF578192C51B4B8EEA6BB6B0FE924A77324E99F
SHA-512:	CBB4A6EEDC1895E1F8CB34B5488E5F26ECA052ADD8EBF20046CECE6D6B1C7723AB5D8F135200EF52DC88EE5953BBC336EB74C6DA904D56EEAAA9BB33A0C128AE
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Package Cache\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Package Cache\{49697869-be8e-427d-81a0-c334d1d14950}\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2490
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E55D921118396C9F31A5B2E173A938A0
SHA1:	210E5A9952B8C75E7BCA0937AA817DBD563F76B5
SHA-256:	C0E93AADBABC947992A361C545E9E41CBBB9E2864AD893A1A6727A9B145D1D52
SHA-512:	C664CDC8CAC9595494C389860AD44F19EB9150F536A6CF8EB62B312CADFE60D47D5A8CCDED5FBDEE7B7EA099D8A85BB76F55C6E94FE502A05AFFFE36B7AA9ECC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Package Cache\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\packages\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Package Cache\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\packages\vcRuntimeAdditional_amd64\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1743
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgs
MD5:	AECB094884F8527CC8946D98C0CA9489
SHA1:	27C2BF3B010455FF77BD1C5DCB3B7FD341B58AEA
SHA-256:	D7C6D4EC9BCEF51770FD65526DF578192C51B4B8EEA6BB6B0FE924A77324E99F
SHA-512:	CBB4A6EEDC1895E1F8CB34B5488E5F26ECA052ADD8EBF20046CECE6D6B1C7723AB5D8F135200EF52DC88EE5953BBC336EB74C6DA904D56EEAAA9BB33A0C128AE
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Package Cache\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Package Cache\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\packages\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Package Cache\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\packages\vcRuntimeMinimum_amd64\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1743
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgs
MD5:	AECB094884F8527CC8946D98C0CA9489
SHA1:	27C2BF3B010455FF77BD1C5DCB3B7FD341B58AEA
SHA-256:	D7C6D4EC9BCEF51770FD65526DF578192C51B4B8EEA6BB6B0FE924A77324E99F
SHA-512:	CBB4A6EEDC1895E1F8CB34B5488E5F26ECA052ADD8EBF20046CECE6D6B1C7723AB5D8F135200EF52DC88EE5953BBC336EB74C6DA904D56EEAAA9BB33A0C128AE
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Package Cache\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Package Cache\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\packages\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Package Cache\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\packages\vcRuntimeAdditional_x86\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1743
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgs
MD5:	AECB094884F8527CC8946D98C0CA9489
SHA1:	27C2BF3B010455FF77BD1C5DCB3B7FD341B58AEA
SHA-256:	D7C6D4EC9BCEF51770FD65526DF578192C51B4B8EEA6BB6B0FE924A77324E99F
SHA-512:	CBB4A6EEDC1895E1F8CB34B5488E5F26ECA052ADD8EBF20046CECE6D6B1C7723AB5D8F135200EF52DC88EE5953BBC336EB74C6DA904D56EEAAA9BB33A0C128AE
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Package Cache\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Package Cache\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\packages\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Package Cache\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\packages\vcRuntimeMinimum_x86\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1743
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgs
MD5:	AECB094884F8527CC8946D98C0CA9489
SHA1:	27C2BF3B010455FF77BD1C5DCB3B7FD341B58AEA
SHA-256:	D7C6D4EC9BCEF51770FD65526DF578192C51B4B8EEA6BB6B0FE924A77324E99F
SHA-512:	CBB4A6EEDC1895E1F8CB34B5488E5F26ECA052ADD8EBF20046CECE6D6B1C7723AB5D8F135200EF52DC88EE5953BBC336EB74C6DA904D56EEAAA9BB33A0C128AE
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Package Cache\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\packages\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\packages\vcRuntimeMinimum_amd64\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1743
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgs
MD5:	AECB094884F8527CC8946D98C0CA9489
SHA1:	27C2BF3B010455FF77BD1C5DCB3B7FD341B58AEA
SHA-256:	D7C6D4EC9BCEF51770FD65526DF578192C51B4B8EEA6BB6B0FE924A77324E99F
SHA-512:	CBB4A6EEDC1895E1F8CB34B5488E5F26ECA052ADD8EBF20046CECE6D6B1C7723AB5D8F135200EF52DC88EE5953BBC336EB74C6DA904D56EEAAA9BB33A0C128AE
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Package Cache\{F7CAC7DF-3524-4C2D-A7DB-E16140A3D5E6}v14.21.27702\packages\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Package Cache\{F7CAC7DF-3524-4C2D-A7DB-E16140A3D5E6}v14.21.27702\packages\vcRuntimeMinimum_amd64\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1743
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgs
MD5:	AECB094884F8527CC8946D98C0CA9489
SHA1:	27C2BF3B010455FF77BD1C5DCB3B7FD341B58AEA
SHA-256:	D7C6D4EC9BCEF51770FD65526DF578192C51B4B8EEA6BB6B0FE924A77324E99F
SHA-512:	CBB4A6EEDC1895E1F8CB34B5488E5F26ECA052ADD8EBF20046CECE6D6B1C7723AB5D8F135200EF52DC88EE5953BBC336EB74C6DA904D56EEAAA9BB33A0C128AE
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Package Cache\{F7CAC7DF-3524-4C2D-A7DB-E16140A3D5E6}v14.21.27702\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Package Cache\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\packages\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Package Cache\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\packages\vcRuntimeAdditional_x86\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1743
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgs
MD5:	AECB094884F8527CC8946D98C0CA9489
SHA1:	27C2BF3B010455FF77BD1C5DCB3B7FD341B58AEA
SHA-256:	D7C6D4EC9BCEF51770FD65526DF578192C51B4B8EEA6BB6B0FE924A77324E99F
SHA-512:	CBB4A6EEDC1895E1F8CB34B5488E5F26ECA052ADD8EBF20046CECE6D6B1C7723AB5D8F135200EF52DC88EE5953BBC336EB74C6DA904D56EEAAA9BB33A0C128AE
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Package Cache\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2490
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E55D921118396C9F31A5B2E173A938A0
SHA1:	210E5A9952B8C75E7BCA0937AA817DBD563F76B5
SHA-256:	C0E93AADBABC947992A361C545E9E41CBBB9E2864AD893A1A6727A9B145D1D52
SHA-512:	C664CDC8CAC9595494C389860AD44F19EB9150F536A6CF8EB62B312CADFE60D47D5A8CCDED5FBDEE7B7EA099D8A85BB76F55C6E94FE502A05AFFFE36B7AA9ECC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Package Cache\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2490
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E55D921118396C9F31A5B2E173A938A0
SHA1:	210E5A9952B8C75E7BCA0937AA817DBD563F76B5
SHA-256:	C0E93AADBABC947992A361C545E9E41CBBB9E2864AD893A1A6727A9B145D1D52
SHA-512:	C664CDC8CAC9595494C389860AD44F19EB9150F536A6CF8EB62B312CADFE60D47D5A8CCDED5FBDEE7B7EA099D8A85BB76F55C6E94FE502A05AFFFE36B7AA9ECC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2490
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E55D921118396C9F31A5B2E173A938A0
SHA1:	210E5A9952B8C75E7BCA0937AA817DBD563F76B5
SHA-256:	C0E93AADBABC947992A361C545E9E41CBBB9E2864AD893A1A6727A9B145D1D52
SHA-512:	C664CDC8CAC9595494C389860AD44F19EB9150F536A6CF8EB62B312CADFE60D47D5A8CCDED5FBDEE7B7EA099D8A85BB76F55C6E94FE502A05AFFFE36B7AA9ECC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\SoftwareDistribution\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2988
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUZ:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiZ
MD5:	1EAFD54AB2EF966BEFDDBC81523CC9A3
SHA1:	B88BAF7E2AEF9583E5D9166BE4FA708D2F90AE62
SHA-256:	525754A2BF80387C752C0B58D1B8E5A42C306B7BB9996EE502E0A51383D6740D
SHA-512:	83731C664680216E99447D813AA39FFDB04899E049067DECD24FD7BE5F33338952EA2258EE91C6ACE643B107E111478ACC096790082B3082998D28EFEBD6279A
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\USOPrivate\UpdateStore\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2988
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUZ:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiZ
MD5:	1EAFD54AB2EF966BEFDDBC81523CC9A3
SHA1:	B88BAF7E2AEF9583E5D9166BE4FA708D2F90AE62
SHA-256:	525754A2BF80387C752C0B58D1B8E5A42C306B7BB9996EE502E0A51383D6740D
SHA-512:	83731C664680216E99447D813AA39FFDB04899E049067DECD24FD7BE5F33338952EA2258EE91C6ACE643B107E111478ACC096790082B3082998D28EFEBD6279A
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\USOPrivate\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2988
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUZ:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiZ
MD5:	1EAFD54AB2EF966BEFDDBC81523CC9A3
SHA1:	B88BAF7E2AEF9583E5D9166BE4FA708D2F90AE62
SHA-256:	525754A2BF80387C752C0B58D1B8E5A42C306B7BB9996EE502E0A51383D6740D
SHA-512:	83731C664680216E99447D813AA39FFDB04899E049067DECD24FD7BE5F33338952EA2258EE91C6ACE643B107E111478ACC096790082B3082998D28EFEBD6279A
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\USOShared\Logs\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2988
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUZ:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiZ
MD5:	1EAFD54AB2EF966BEFDDBC81523CC9A3
SHA1:	B88BAF7E2AEF9583E5D9166BE4FA708D2F90AE62
SHA-256:	525754A2BF80387C752C0B58D1B8E5A42C306B7BB9996EE502E0A51383D6740D
SHA-512:	83731C664680216E99447D813AA39FFDB04899E049067DECD24FD7BE5F33338952EA2258EE91C6ACE643B107E111478ACC096790082B3082998D28EFEBD6279A
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\USOShared\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2988
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUZ:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiZ
MD5:	1EAFD54AB2EF966BEFDDBC81523CC9A3
SHA1:	B88BAF7E2AEF9583E5D9166BE4FA708D2F90AE62
SHA-256:	525754A2BF80387C752C0B58D1B8E5A42C306B7BB9996EE502E0A51383D6740D
SHA-512:	83731C664680216E99447D813AA39FFDB04899E049067DECD24FD7BE5F33338952EA2258EE91C6ACE643B107E111478ACC096790082B3082998D28EFEBD6279A
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\WindowsHolographicDevices\SpatialStore\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUc:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgic
MD5:	2DD89CA2D644D9414D300A8AF16335CA
SHA1:	669A89206DBF779310703AEE89FAF02E45F4BD8F
SHA-256:	96050B4208C71F273887FDD4DC7CE3D2AE8B557916F9B131DD33863B0D59AED9
SHA-512:	9847E81AD1CF2B6C34CF1FA713D3E24F49D3E92E9DABD2CD356CFC574A76155FA3E866D43C2144AAE388E10D326C0682B48187CC0B52D7DF7CB6F3561262E65C
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\WindowsHolographicDevices\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUc:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgic
MD5:	2DD89CA2D644D9414D300A8AF16335CA
SHA1:	669A89206DBF779310703AEE89FAF02E45F4BD8F
SHA-256:	96050B4208C71F273887FDD4DC7CE3D2AE8B557916F9B131DD33863B0D59AED9
SHA-512:	9847E81AD1CF2B6C34CF1FA713D3E24F49D3E92E9DABD2CD356CFC574A76155FA3E866D43C2144AAE388E10D326C0682B48187CC0B52D7DF7CB6F3561262E65C
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\dbg\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3237
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	96:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgs:TWWWWWWWWWWWWs
MD5:	8F4FD7A4A181DFD54758C84AFBB20C6E
SHA1:	64952B85F3DD2099A989009C85A61A3344C64C17
SHA-256:	7635398CCC959633D8F75F7CCEB4FC8F3CFC8A8D910315A6B9A8A105A165BF12
SHA-512:	8D20EFE7B1F047D28D3BFE7B8D9DBB27819A23D23AD224739814D9452AC93EB790299AC804F8C3E64681A49C121FCDD349C93DF35029E0BA994E23B779E28714
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3237
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	96:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgs:TWWWWWWWWWWWWs
MD5:	8F4FD7A4A181DFD54758C84AFBB20C6E
SHA1:	64952B85F3DD2099A989009C85A61A3344C64C17
SHA-256:	7635398CCC959633D8F75F7CCEB4FC8F3CFC8A8D910315A6B9A8A105A165BF12
SHA-512:	8D20EFE7B1F047D28D3BFE7B8D9DBB27819A23D23AD224739814D9452AC93EB790299AC804F8C3E64681A49C121FCDD349C93DF35029E0BA994E23B779E28714
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\ProgramData\regid.1991-06.com.microsoft\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUc:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgic
MD5:	2DD89CA2D644D9414D300A8AF16335CA
SHA1:	669A89206DBF779310703AEE89FAF02E45F4BD8F
SHA-256:	96050B4208C71F273887FDD4DC7CE3D2AE8B557916F9B131DD33863B0D59AED9
SHA-512:	9847E81AD1CF2B6C34CF1FA713D3E24F49D3E92E9DABD2CD356CFC574A76155FA3E866D43C2144AAE388E10D326C0682B48187CC0B52D7DF7CB6F3561262E65C
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\Users\Default\AppData\Local\Microsoft\InputPersonalization\TrainedDataStore\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8964
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	192:TWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWs:TWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWV
MD5:	811D5A70139B373A23BB0FED0F5B8AF9
SHA1:	D8AA4B1A4AEB04B70895C0C6F49F3C46B3AAADAC
SHA-256:	1D2529197868DAE8C8E16E62907DC69F0BBF7010A7264B0B7EBECDA8D5FBBE6B
SHA-512:	15DB71F614A9D3862C3D44FDA540DC10EA09FA4DE8502646AA3A5C1C909F0AF1FE6AC181CAA2957F71D455BA34016AECB82E221F1E5E9C5A2B048D13AE9A730B
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\Users\Default\AppData\Local\Microsoft\InputPersonalization\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	9960
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	192:TWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWs:TWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWR
MD5:	D562C15AB992002D552156FE8599BC23
SHA1:	3149DAA715D5BC2871847D38BB4865090CDB1FED
SHA-256:	54677F24DFEB2CBA4215856E2F08D3824BF207E678086A77DA21ABBAC2ADBDA8
SHA-512:	EB1B7AAD3B7082D62ECB3BDF8E38333819BD4CCE5F0E4B276945B5645A249EFFC3EA27A550B8301B15E890E3247A9B2A8501D3F041B7580A7B981287FAAC73AF
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\Users\Default\AppData\Local\Microsoft\Windows Sidebar\Gadgets\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	9960
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	192:TWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWs:TWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWR
MD5:	D562C15AB992002D552156FE8599BC23
SHA1:	3149DAA715D5BC2871847D38BB4865090CDB1FED
SHA-256:	54677F24DFEB2CBA4215856E2F08D3824BF207E678086A77DA21ABBAC2ADBDA8
SHA-512:	EB1B7AAD3B7082D62ECB3BDF8E38333819BD4CCE5F0E4B276945B5645A249EFFC3EA27A550B8301B15E890E3247A9B2A8501D3F041B7580A7B981287FAAC73AF
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\Users\Default\AppData\Local\Microsoft\Windows Sidebar\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	10458
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	192:TWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWs:TWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW/
MD5:	0C2EEA5C6C771E8F06F7DA8471EADEB2
SHA1:	96F058D1CF203A132F3BEF4496434CE026545F9F
SHA-256:	831C304E05689CEBDC1544921C61647EB95E79D648BF6A369A65E8237C6D2D2A
SHA-512:	A853A98AE739595425409DD68B5937779B3AF0B0AC6BE16E7FC02F00C75C5D46194CDD5DF334469A1B2E94CCCED56D48C947D7AC9C1C08BED3585F53BD483551
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\Users\Default\AppData\Local\Microsoft\Windows\CloudStore\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	10458
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	192:TWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWs:TWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW/
MD5:	0C2EEA5C6C771E8F06F7DA8471EADEB2
SHA1:	96F058D1CF203A132F3BEF4496434CE026545F9F
SHA-256:	831C304E05689CEBDC1544921C61647EB95E79D648BF6A369A65E8237C6D2D2A
SHA-512:	A853A98AE739595425409DD68B5937779B3AF0B0AC6BE16E7FC02F00C75C5D46194CDD5DF334469A1B2E94CCCED56D48C947D7AC9C1C08BED3585F53BD483551
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\Users\Default\AppData\Local\Microsoft\Windows\GameExplorer\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	9960
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	192:TWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWs:TWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWR
MD5:	D562C15AB992002D552156FE8599BC23
SHA1:	3149DAA715D5BC2871847D38BB4865090CDB1FED
SHA-256:	54677F24DFEB2CBA4215856E2F08D3824BF207E678086A77DA21ABBAC2ADBDA8
SHA-512:	EB1B7AAD3B7082D62ECB3BDF8E38333819BD4CCE5F0E4B276945B5645A249EFFC3EA27A550B8301B15E890E3247A9B2A8501D3F041B7580A7B981287FAAC73AF
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\Users\Default\AppData\Local\Microsoft\Windows\History\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	22161
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	384:TWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW:A
MD5:	6388DEBE1CDCB229E86CF9BFD59104CE
SHA1:	1770A8A4BD63E90B5818B380DD58E0032F61337E
SHA-256:	414B497B781BAE512A3CE96A2E950979326B3802439FD42F9CF32B1D56055870
SHA-512:	5564F9AE2B766EDE1B887989582ACD4BA12DC20445B6C59DC0686564C2AD590752D0BC001C090A1201714F1CB05D2A47A8CF1528BEE875DA486F4301112FB207
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\Users\Default\AppData\Local\Microsoft\Windows\INetCache\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	30627
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	384:TWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWw:S
MD5:	C2645B78DC196B134C33EF8D55DAF40D
SHA1:	2D54B02C6A15168C3B790E4CA2EEC929320D079F
SHA-256:	F83B8C0702F59DCD10D99359D94B67E197FC77C14E336053885396F0A19BAB1A
SHA-512:	496A87E3B59B033AAF6844EBA547B49B032F19B3D97121737636C5F83FF133F9F3C5A13D8CCFDB5465EC96367D2A5CAA335B7FC9E16C8FB766A36FFB0CCDF339
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\Users\Default\AppData\Local\Microsoft\Windows\INetCookies\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	10707
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	192:TWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWs:TWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA
MD5:	FDAF578C59DB17326EC8835232ECD948
SHA1:	40B5447293954959741479173381C2B5630F6204
SHA-256:	C4C2DE6161121F4DBD392DB9EFB1FEBEA68E0776C391C084B1D3DE580B2AFBE2
SHA-512:	3C2E901F79196C63EF3E1069EC0299865CAB83B12C015E6D2D0BD28D788C4A75C34DD53A427861CCCD0682136D85A84B64E4A7E94C84411A4B4361697188253C
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\Users\Default\AppData\Local\Microsoft\Windows\Shell\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	10956
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	192:TWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWs:TWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWd
MD5:	84B7D6BCA70B24095F332C392ACB18F1
SHA1:	6F07F9DE9026F635F630381186118ACEDC8FEDFF
SHA-256:	87BFBB379B5C990376C3E49E48A148C28CD535DFE329F6AE7D614E0964E9FB9D
SHA-512:	252482B84B1066923535EFA238A2D35A2DEF64280BCEDAF2B094BF8CAC36732BAC3A4841F3DD085E84E1892DBFA7972F9F79AC47296EF9699435F729EF4BDCC6
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	9960
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	192:TWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWs:TWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWR
MD5:	D562C15AB992002D552156FE8599BC23
SHA1:	3149DAA715D5BC2871847D38BB4865090CDB1FED
SHA-256:	54677F24DFEB2CBA4215856E2F08D3824BF207E678086A77DA21ABBAC2ADBDA8
SHA-512:	EB1B7AAD3B7082D62ECB3BDF8E38333819BD4CCE5F0E4B276945B5645A249EFFC3EA27A550B8301B15E890E3247A9B2A8501D3F041B7580A7B981287FAAC73AF
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	9960
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	192:TWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWs:TWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWR
MD5:	D562C15AB992002D552156FE8599BC23
SHA1:	3149DAA715D5BC2871847D38BB4865090CDB1FED
SHA-256:	54677F24DFEB2CBA4215856E2F08D3824BF207E678086A77DA21ABBAC2ADBDA8
SHA-512:	EB1B7AAD3B7082D62ECB3BDF8E38333819BD4CCE5F0E4B276945B5645A249EFFC3EA27A550B8301B15E890E3247A9B2A8501D3F041B7580A7B981287FAAC73AF
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	9960
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	192:TWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWs:TWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWR
MD5:	D562C15AB992002D552156FE8599BC23
SHA1:	3149DAA715D5BC2871847D38BB4865090CDB1FED
SHA-256:	54677F24DFEB2CBA4215856E2F08D3824BF207E678086A77DA21ABBAC2ADBDA8
SHA-512:	EB1B7AAD3B7082D62ECB3BDF8E38333819BD4CCE5F0E4B276945B5645A249EFFC3EA27A550B8301B15E890E3247A9B2A8501D3F041B7580A7B981287FAAC73AF
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	9960
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	192:TWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWs:TWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWR
MD5:	D562C15AB992002D552156FE8599BC23
SHA1:	3149DAA715D5BC2871847D38BB4865090CDB1FED
SHA-256:	54677F24DFEB2CBA4215856E2F08D3824BF207E678086A77DA21ABBAC2ADBDA8
SHA-512:	EB1B7AAD3B7082D62ECB3BDF8E38333819BD4CCE5F0E4B276945B5645A249EFFC3EA27A550B8301B15E890E3247A9B2A8501D3F041B7580A7B981287FAAC73AF
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\Users\Default\AppData\Local\Microsoft\Windows\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	10956
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	192:TWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWs:TWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWd
MD5:	84B7D6BCA70B24095F332C392ACB18F1
SHA1:	6F07F9DE9026F635F630381186118ACEDC8FEDFF
SHA-256:	87BFBB379B5C990376C3E49E48A148C28CD535DFE329F6AE7D614E0964E9FB9D
SHA-512:	252482B84B1066923535EFA238A2D35A2DEF64280BCEDAF2B094BF8CAC36732BAC3A4841F3DD085E84E1892DBFA7972F9F79AC47296EF9699435F729EF4BDCC6
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\Users\Default\AppData\Local\Microsoft\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	11454
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	192:TWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWs:TWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWb
MD5:	444EAB37B147076A8F76EB7ACBF425C5
SHA1:	A6998D7E3E76FC536E93509BC335167134B09830
SHA-256:	C7D2344D937710874C89FBDB18FBCD75840CFDBC8CD8816EA98E0BB99281E786
SHA-512:	3D49D06EDE5AC207234EC1A7162D6D43A400440641492A5430EBB6B0A61CCBADE9E7B5C9FD4A4415DCF239E180A41DC1479A6F57B7877502A639597AE89F8667
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\Users\Default\AppData\Local\Temp\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	11952
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	192:TWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWs:TWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW5
MD5:	8D26A51D8E04F41AF19A9DDDC6C447A5
SHA1:	54D29B04B5B8F69ACDF3E9B9A0D59B7FA6C4170E
SHA-256:	BE31A869B5EF95BF8E389A34F86D0F095A135980F15D84106BA9DFAB3D245422
SHA-512:	09E4013A2ACC30B899736F487180ACFD711F69FBF8C50C011411ECA19EC45DA23C02E891E49E908804504B42FEDB255FEDDA53B3E574B1B8FB788F9906B9D9FA
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\Users\Default\AppData\Local\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	11952
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	192:TWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWs:TWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW5
MD5:	8D26A51D8E04F41AF19A9DDDC6C447A5
SHA1:	54D29B04B5B8F69ACDF3E9B9A0D59B7FA6C4170E
SHA-256:	BE31A869B5EF95BF8E389A34F86D0F095A135980F15D84106BA9DFAB3D245422
SHA-512:	09E4013A2ACC30B899736F487180ACFD711F69FBF8C50C011411ECA19EC45DA23C02E891E49E908804504B42FEDB255FEDDA53B3E574B1B8FB788F9906B9D9FA
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	996
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	24:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycs:wDUY9SxRUY9SxRUY9SxRUY9Sxs
MD5:	5A76AB1CF8045E124D8352632D48448D
SHA1:	5D81C0542D65E7212B1F2AA4BD8942850E8E55FC
SHA-256:	8874982CCBE2BA22A7527BC611AB771652E815CF03ECEFC378EB418F253AB578
SHA-512:	34111F0E1D76E55260652B4FA31BB7ADD46ACE088DF574D37CFA49FBF3F58477481DDBE739EC76C1F088835024B3EDA5696202C3B1B848E799A40235A68DABC8
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	996
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	24:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycs:wDUY9SxRUY9SxRUY9SxRUY9Sxs
MD5:	5A76AB1CF8045E124D8352632D48448D
SHA1:	5D81C0542D65E7212B1F2AA4BD8942850E8E55FC
SHA-256:	8874982CCBE2BA22A7527BC611AB771652E815CF03ECEFC378EB418F253AB578
SHA-512:	34111F0E1D76E55260652B4FA31BB7ADD46ACE088DF574D37CFA49FBF3F58477481DDBE739EC76C1F088835024B3EDA5696202C3B1B848E799A40235A68DABC8
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\Default\AppData\Roaming\Microsoft\Windows\CloudStore\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	996
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	24:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycs:wDUY9SxRUY9SxRUY9SxRUY9Sxs
MD5:	5A76AB1CF8045E124D8352632D48448D
SHA1:	5D81C0542D65E7212B1F2AA4BD8942850E8E55FC
SHA-256:	8874982CCBE2BA22A7527BC611AB771652E815CF03ECEFC378EB418F253AB578
SHA-512:	34111F0E1D76E55260652B4FA31BB7ADD46ACE088DF574D37CFA49FBF3F58477481DDBE739EC76C1F088835024B3EDA5696202C3B1B848E799A40235A68DABC8
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Network Shortcuts\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1494
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	24:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoM/:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxp
MD5:	7CE6ACB9853F7FABB46F44230D475782
SHA1:	64E98068AC3A0BA9F3184C19D6B0047262789C71
SHA-256:	F4328C73B5C76759B21F35CE313C46F56911E676468BFF73A5D01377726A8DCF
SHA-512:	33C2E7F737238E89587A4674AD06BCEC54B49680125A7A3219F95911780BEE217C4FDE84517326073D15858EC7121788DD018F461FE546F7533E8E209B792054
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1494
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	24:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoM/:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxp
MD5:	7CE6ACB9853F7FABB46F44230D475782
SHA1:	64E98068AC3A0BA9F3184C19D6B0047262789C71
SHA-256:	F4328C73B5C76759B21F35CE313C46F56911E676468BFF73A5D01377726A8DCF
SHA-512:	33C2E7F737238E89587A4674AD06BCEC54B49680125A7A3219F95911780BEE217C4FDE84517326073D15858EC7121788DD018F461FE546F7533E8E209B792054
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1494
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	24:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoM/:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxp
MD5:	7CE6ACB9853F7FABB46F44230D475782
SHA1:	64E98068AC3A0BA9F3184C19D6B0047262789C71
SHA-256:	F4328C73B5C76759B21F35CE313C46F56911E676468BFF73A5D01377726A8DCF
SHA-512:	33C2E7F737238E89587A4674AD06BCEC54B49680125A7A3219F95911780BEE217C4FDE84517326073D15858EC7121788DD018F461FE546F7533E8E209B792054
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1494
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	24:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoM/:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxp
MD5:	7CE6ACB9853F7FABB46F44230D475782
SHA1:	64E98068AC3A0BA9F3184C19D6B0047262789C71
SHA-256:	F4328C73B5C76759B21F35CE313C46F56911E676468BFF73A5D01377726A8DCF
SHA-512:	33C2E7F737238E89587A4674AD06BCEC54B49680125A7A3219F95911780BEE217C4FDE84517326073D15858EC7121788DD018F461FE546F7533E8E209B792054
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1494
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	24:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoM/:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxp
MD5:	7CE6ACB9853F7FABB46F44230D475782
SHA1:	64E98068AC3A0BA9F3184C19D6B0047262789C71
SHA-256:	F4328C73B5C76759B21F35CE313C46F56911E676468BFF73A5D01377726A8DCF
SHA-512:	33C2E7F737238E89587A4674AD06BCEC54B49680125A7A3219F95911780BEE217C4FDE84517326073D15858EC7121788DD018F461FE546F7533E8E209B792054
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1494
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	24:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoM/:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxp
MD5:	7CE6ACB9853F7FABB46F44230D475782
SHA1:	64E98068AC3A0BA9F3184C19D6B0047262789C71
SHA-256:	F4328C73B5C76759B21F35CE313C46F56911E676468BFF73A5D01377726A8DCF
SHA-512:	33C2E7F737238E89587A4674AD06BCEC54B49680125A7A3219F95911780BEE217C4FDE84517326073D15858EC7121788DD018F461FE546F7533E8E209B792054
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1494
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	24:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoM/:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxp
MD5:	7CE6ACB9853F7FABB46F44230D475782
SHA1:	64E98068AC3A0BA9F3184C19D6B0047262789C71
SHA-256:	F4328C73B5C76759B21F35CE313C46F56911E676468BFF73A5D01377726A8DCF
SHA-512:	33C2E7F737238E89587A4674AD06BCEC54B49680125A7A3219F95911780BEE217C4FDE84517326073D15858EC7121788DD018F461FE546F7533E8E209B792054
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1494
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	24:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoM/:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxp
MD5:	7CE6ACB9853F7FABB46F44230D475782
SHA1:	64E98068AC3A0BA9F3184C19D6B0047262789C71
SHA-256:	F4328C73B5C76759B21F35CE313C46F56911E676468BFF73A5D01377726A8DCF
SHA-512:	33C2E7F737238E89587A4674AD06BCEC54B49680125A7A3219F95911780BEE217C4FDE84517326073D15858EC7121788DD018F461FE546F7533E8E209B792054
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1494
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	24:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoM/:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxp
MD5:	7CE6ACB9853F7FABB46F44230D475782
SHA1:	64E98068AC3A0BA9F3184C19D6B0047262789C71
SHA-256:	F4328C73B5C76759B21F35CE313C46F56911E676468BFF73A5D01377726A8DCF
SHA-512:	33C2E7F737238E89587A4674AD06BCEC54B49680125A7A3219F95911780BEE217C4FDE84517326073D15858EC7121788DD018F461FE546F7533E8E209B792054
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1494
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	24:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoM/:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxp
MD5:	7CE6ACB9853F7FABB46F44230D475782
SHA1:	64E98068AC3A0BA9F3184C19D6B0047262789C71
SHA-256:	F4328C73B5C76759B21F35CE313C46F56911E676468BFF73A5D01377726A8DCF
SHA-512:	33C2E7F737238E89587A4674AD06BCEC54B49680125A7A3219F95911780BEE217C4FDE84517326073D15858EC7121788DD018F461FE546F7533E8E209B792054
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1494
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	24:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoM/:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxp
MD5:	7CE6ACB9853F7FABB46F44230D475782
SHA1:	64E98068AC3A0BA9F3184C19D6B0047262789C71
SHA-256:	F4328C73B5C76759B21F35CE313C46F56911E676468BFF73A5D01377726A8DCF
SHA-512:	33C2E7F737238E89587A4674AD06BCEC54B49680125A7A3219F95911780BEE217C4FDE84517326073D15858EC7121788DD018F461FE546F7533E8E209B792054
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Templates\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1494
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	24:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoM/:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxp
MD5:	7CE6ACB9853F7FABB46F44230D475782
SHA1:	64E98068AC3A0BA9F3184C19D6B0047262789C71
SHA-256:	F4328C73B5C76759B21F35CE313C46F56911E676468BFF73A5D01377726A8DCF
SHA-512:	33C2E7F737238E89587A4674AD06BCEC54B49680125A7A3219F95911780BEE217C4FDE84517326073D15858EC7121788DD018F461FE546F7533E8E209B792054
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\Users\Default\AppData\Roaming\Microsoft\Windows\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	996
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	24:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycs:wDUY9SxRUY9SxRUY9SxRUY9Sxs
MD5:	5A76AB1CF8045E124D8352632D48448D
SHA1:	5D81C0542D65E7212B1F2AA4BD8942850E8E55FC
SHA-256:	8874982CCBE2BA22A7527BC611AB771652E815CF03ECEFC378EB418F253AB578
SHA-512:	34111F0E1D76E55260652B4FA31BB7ADD46ACE088DF574D37CFA49FBF3F58477481DDBE739EC76C1F088835024B3EDA5696202C3B1B848E799A40235A68DABC8
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\Default\AppData\Roaming\Microsoft\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	996
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	24:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycs:wDUY9SxRUY9SxRUY9SxRUY9Sxs
MD5:	5A76AB1CF8045E124D8352632D48448D
SHA1:	5D81C0542D65E7212B1F2AA4BD8942850E8E55FC
SHA-256:	8874982CCBE2BA22A7527BC611AB771652E815CF03ECEFC378EB418F253AB578
SHA-512:	34111F0E1D76E55260652B4FA31BB7ADD46ACE088DF574D37CFA49FBF3F58477481DDBE739EC76C1F088835024B3EDA5696202C3B1B848E799A40235A68DABC8
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\Default\AppData\Roaming\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	996
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	24:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycs:wDUY9SxRUY9SxRUY9SxRUY9Sxs
MD5:	5A76AB1CF8045E124D8352632D48448D
SHA1:	5D81C0542D65E7212B1F2AA4BD8942850E8E55FC
SHA-256:	8874982CCBE2BA22A7527BC611AB771652E815CF03ECEFC378EB418F253AB578
SHA-512:	34111F0E1D76E55260652B4FA31BB7ADD46ACE088DF574D37CFA49FBF3F58477481DDBE739EC76C1F088835024B3EDA5696202C3B1B848E799A40235A68DABC8
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\Default\AppData\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\Default\Desktop\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\Default\Documents\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	996
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	24:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycs:wDUY9SxRUY9SxRUY9SxRUY9Sxs
MD5:	5A76AB1CF8045E124D8352632D48448D
SHA1:	5D81C0542D65E7212B1F2AA4BD8942850E8E55FC
SHA-256:	8874982CCBE2BA22A7527BC611AB771652E815CF03ECEFC378EB418F253AB578
SHA-512:	34111F0E1D76E55260652B4FA31BB7ADD46ACE088DF574D37CFA49FBF3F58477481DDBE739EC76C1F088835024B3EDA5696202C3B1B848E799A40235A68DABC8
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\Default\Downloads\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\Default\Favorites\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\Default\Links\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\Default\Music\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1494
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	24:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoM/:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxp
MD5:	7CE6ACB9853F7FABB46F44230D475782
SHA1:	64E98068AC3A0BA9F3184C19D6B0047262789C71
SHA-256:	F4328C73B5C76759B21F35CE313C46F56911E676468BFF73A5D01377726A8DCF
SHA-512:	33C2E7F737238E89587A4674AD06BCEC54B49680125A7A3219F95911780BEE217C4FDE84517326073D15858EC7121788DD018F461FE546F7533E8E209B792054
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\Users\Default\Pictures\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1494
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	24:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoM/:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxp
MD5:	7CE6ACB9853F7FABB46F44230D475782
SHA1:	64E98068AC3A0BA9F3184C19D6B0047262789C71
SHA-256:	F4328C73B5C76759B21F35CE313C46F56911E676468BFF73A5D01377726A8DCF
SHA-512:	33C2E7F737238E89587A4674AD06BCEC54B49680125A7A3219F95911780BEE217C4FDE84517326073D15858EC7121788DD018F461FE546F7533E8E209B792054
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\Users\Default\Saved Games\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\Default\Videos\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1494
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	24:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoM/:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxp
MD5:	7CE6ACB9853F7FABB46F44230D475782
SHA1:	64E98068AC3A0BA9F3184C19D6B0047262789C71
SHA-256:	F4328C73B5C76759B21F35CE313C46F56911E676468BFF73A5D01377726A8DCF
SHA-512:	33C2E7F737238E89587A4674AD06BCEC54B49680125A7A3219F95911780BEE217C4FDE84517326073D15858EC7121788DD018F461FE546F7533E8E209B792054
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\Users\Default\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\Public\Desktop\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3237
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	96:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiYgs:TWWWWWWWWWWWWs
MD5:	8F4FD7A4A181DFD54758C84AFBB20C6E
SHA1:	64952B85F3DD2099A989009C85A61A3344C64C17
SHA-256:	7635398CCC959633D8F75F7CCEB4FC8F3CFC8A8D910315A6B9A8A105A165BF12
SHA-512:	8D20EFE7B1F047D28D3BFE7B8D9DBB27819A23D23AD224739814D9452AC93EB790299AC804F8C3E64681A49C121FCDD349C93DF35029E0BA994E23B779E28714
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\Users\Public\Documents\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2988
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUZ:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiZ
MD5:	1EAFD54AB2EF966BEFDDBC81523CC9A3
SHA1:	B88BAF7E2AEF9583E5D9166BE4FA708D2F90AE62
SHA-256:	525754A2BF80387C752C0B58D1B8E5A42C306B7BB9996EE502E0A51383D6740D
SHA-512:	83731C664680216E99447D813AA39FFDB04899E049067DECD24FD7BE5F33338952EA2258EE91C6ACE643B107E111478ACC096790082B3082998D28EFEBD6279A
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\Users\Public\Music\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2988
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUZ:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiZ
MD5:	1EAFD54AB2EF966BEFDDBC81523CC9A3
SHA1:	B88BAF7E2AEF9583E5D9166BE4FA708D2F90AE62
SHA-256:	525754A2BF80387C752C0B58D1B8E5A42C306B7BB9996EE502E0A51383D6740D
SHA-512:	83731C664680216E99447D813AA39FFDB04899E049067DECD24FD7BE5F33338952EA2258EE91C6ACE643B107E111478ACC096790082B3082998D28EFEBD6279A
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\Users\Public\Pictures\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2988
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUZ:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiZ
MD5:	1EAFD54AB2EF966BEFDDBC81523CC9A3
SHA1:	B88BAF7E2AEF9583E5D9166BE4FA708D2F90AE62
SHA-256:	525754A2BF80387C752C0B58D1B8E5A42C306B7BB9996EE502E0A51383D6740D
SHA-512:	83731C664680216E99447D813AA39FFDB04899E049067DECD24FD7BE5F33338952EA2258EE91C6ACE643B107E111478ACC096790082B3082998D28EFEBD6279A
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\Users\Public\Videos\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2988
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUZ:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiZ
MD5:	1EAFD54AB2EF966BEFDDBC81523CC9A3
SHA1:	B88BAF7E2AEF9583E5D9166BE4FA708D2F90AE62
SHA-256:	525754A2BF80387C752C0B58D1B8E5A42C306B7BB9996EE502E0A51383D6740D
SHA-512:	83731C664680216E99447D813AA39FFDB04899E049067DECD24FD7BE5F33338952EA2258EE91C6ACE643B107E111478ACC096790082B3082998D28EFEBD6279A
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\Users\user\3D Objects\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Adobe\ARM\Reader_19.012.20035\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUc:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgic
MD5:	2DD89CA2D644D9414D300A8AF16335CA
SHA1:	669A89206DBF779310703AEE89FAF02E45F4BD8F
SHA-256:	96050B4208C71F273887FDD4DC7CE3D2AE8B557916F9B131DD33863B0D59AED9
SHA-512:	9847E81AD1CF2B6C34CF1FA713D3E24F49D3E92E9DABD2CD356CFC574A76155FA3E866D43C2144AAE388E10D326C0682B48187CC0B52D7DF7CB6F3561262E65C
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\Users\user\AppData\Local\Adobe\ARM\S\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUc:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgic
MD5:	2DD89CA2D644D9414D300A8AF16335CA
SHA1:	669A89206DBF779310703AEE89FAF02E45F4BD8F
SHA-256:	96050B4208C71F273887FDD4DC7CE3D2AE8B557916F9B131DD33863B0D59AED9
SHA-512:	9847E81AD1CF2B6C34CF1FA713D3E24F49D3E92E9DABD2CD356CFC574A76155FA3E866D43C2144AAE388E10D326C0682B48187CC0B52D7DF7CB6F3561262E65C
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\Users\user\AppData\Local\Adobe\ARM\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2988
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUZ:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiZ
MD5:	1EAFD54AB2EF966BEFDDBC81523CC9A3
SHA1:	B88BAF7E2AEF9583E5D9166BE4FA708D2F90AE62
SHA-256:	525754A2BF80387C752C0B58D1B8E5A42C306B7BB9996EE502E0A51383D6740D
SHA-512:	83731C664680216E99447D813AA39FFDB04899E049067DECD24FD7BE5F33338952EA2258EE91C6ACE643B107E111478ACC096790082B3082998D28EFEBD6279A
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\Users\user\AppData\Local\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2490
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E55D921118396C9F31A5B2E173A938A0
SHA1:	210E5A9952B8C75E7BCA0937AA817DBD563F76B5
SHA-256:	C0E93AADBABC947992A361C545E9E41CBBB9E2864AD893A1A6727A9B145D1D52
SHA-512:	C664CDC8CAC9595494C389860AD44F19EB9150F536A6CF8EB62B312CADFE60D47D5A8CCDED5FBDEE7B7EA099D8A85BB76F55C6E94FE502A05AFFFE36B7AA9ECC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUc:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgic
MD5:	2DD89CA2D644D9414D300A8AF16335CA
SHA1:	669A89206DBF779310703AEE89FAF02E45F4BD8F
SHA-256:	96050B4208C71F273887FDD4DC7CE3D2AE8B557916F9B131DD33863B0D59AED9
SHA-512:	9847E81AD1CF2B6C34CF1FA713D3E24F49D3E92E9DABD2CD356CFC574A76155FA3E866D43C2144AAE388E10D326C0682B48187CC0B52D7DF7CB6F3561262E65C
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUc:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgic
MD5:	2DD89CA2D644D9414D300A8AF16335CA
SHA1:	669A89206DBF779310703AEE89FAF02E45F4BD8F
SHA-256:	96050B4208C71F273887FDD4DC7CE3D2AE8B557916F9B131DD33863B0D59AED9
SHA-512:	9847E81AD1CF2B6C34CF1FA713D3E24F49D3E92E9DABD2CD356CFC574A76155FA3E866D43C2144AAE388E10D326C0682B48187CC0B52D7DF7CB6F3561262E65C
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\Users\user\AppData\Local\Adobe\Acrobat\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2988
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUZ:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiZ
MD5:	1EAFD54AB2EF966BEFDDBC81523CC9A3
SHA1:	B88BAF7E2AEF9583E5D9166BE4FA708D2F90AE62
SHA-256:	525754A2BF80387C752C0B58D1B8E5A42C306B7BB9996EE502E0A51383D6740D
SHA-512:	83731C664680216E99447D813AA39FFDB04899E049067DECD24FD7BE5F33338952EA2258EE91C6ACE643B107E111478ACC096790082B3082998D28EFEBD6279A
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\Users\user\AppData\Local\Adobe\Color\Profiles\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUc:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgic
MD5:	2DD89CA2D644D9414D300A8AF16335CA
SHA1:	669A89206DBF779310703AEE89FAF02E45F4BD8F
SHA-256:	96050B4208C71F273887FDD4DC7CE3D2AE8B557916F9B131DD33863B0D59AED9
SHA-512:	9847E81AD1CF2B6C34CF1FA713D3E24F49D3E92E9DABD2CD356CFC574A76155FA3E866D43C2144AAE388E10D326C0682B48187CC0B52D7DF7CB6F3561262E65C
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\Users\user\AppData\Local\Adobe\Color\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2988
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUZ:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiZ
MD5:	1EAFD54AB2EF966BEFDDBC81523CC9A3
SHA1:	B88BAF7E2AEF9583E5D9166BE4FA708D2F90AE62
SHA-256:	525754A2BF80387C752C0B58D1B8E5A42C306B7BB9996EE502E0A51383D6740D
SHA-512:	83731C664680216E99447D813AA39FFDB04899E049067DECD24FD7BE5F33338952EA2258EE91C6ACE643B107E111478ACC096790082B3082998D28EFEBD6279A
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\Users\user\AppData\Local\Adobe\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2988
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUZ:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiZ
MD5:	1EAFD54AB2EF966BEFDDBC81523CC9A3
SHA1:	B88BAF7E2AEF9583E5D9166BE4FA708D2F90AE62
SHA-256:	525754A2BF80387C752C0B58D1B8E5A42C306B7BB9996EE502E0A51383D6740D
SHA-512:	83731C664680216E99447D813AA39FFDB04899E049067DECD24FD7BE5F33338952EA2258EE91C6ACE643B107E111478ACC096790082B3082998D28EFEBD6279A
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\Users\user\AppData\Local\Comms\UnistoreDB\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Comms\Unistore\data\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Comms\Unistore\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	996
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	24:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycs:wDUY9SxRUY9SxRUY9SxRUY9Sxs
MD5:	5A76AB1CF8045E124D8352632D48448D
SHA1:	5D81C0542D65E7212B1F2AA4BD8942850E8E55FC
SHA-256:	8874982CCBE2BA22A7527BC611AB771652E815CF03ECEFC378EB418F253AB578
SHA-512:	34111F0E1D76E55260652B4FA31BB7ADD46ACE088DF574D37CFA49FBF3F58477481DDBE739EC76C1F088835024B3EDA5696202C3B1B848E799A40235A68DABC8
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Comms\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	996
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	24:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycs:wDUY9SxRUY9SxRUY9SxRUY9Sxs
MD5:	5A76AB1CF8045E124D8352632D48448D
SHA1:	5D81C0542D65E7212B1F2AA4BD8942850E8E55FC
SHA-256:	8874982CCBE2BA22A7527BC611AB771652E815CF03ECEFC378EB418F253AB578
SHA-512:	34111F0E1D76E55260652B4FA31BB7ADD46ACE088DF574D37CFA49FBF3F58477481DDBE739EC76C1F088835024B3EDA5696202C3B1B848E799A40235A68DABC8
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\ConnectedDevicesPlatform\CDPGlobalSettings.cdp Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2022
Entropy (8bit):	6.618701120201026
Encrypted:	false
SSDEEP:	48:va3qLPNP0tcZdGot30KzPPaSRjUFtlTFeolVK1Wmf/srLi0:va3qzSt7ol0JVtTeoA+Li0
MD5:	D637650A0D4A6291461A95319D05F252
SHA1:	ECB6653DF0690236D38515FC8C705959E66BE433
SHA-256:	05B65CDBED5733BDADB0AC9E84C3ECCE1A5621120BEA6D2C8E81E183FDF25D8D
SHA-512:	997FD29232A090C3C473EEE6B21610DADC6EC8C49637A9C519BB0AD5F2722D6E869D61B22445962A7BF9FD2B7F425E6999ECB0F2E9962A1AB532E403E06CBA65
Malicious:	false
Preview:	.Q...A..hY..sbWW)....Q....B...5.........~r...(..q.4.k(.:.....pE?.......'...6c...j\fe.wm9.8.....m.A...XuX.....E...}.0...%..6...ua.).&.?t.j\|..FW..mj......0`...."..BoI.^=...7.......N-d.i.<p..5..,.# .!=...!9.[,.".h..J..{3ER>...K #x.0+.R...w)......Uan...@.k.h.3....Q.z)'...#.A.ff.p..%..rQMo........h........_.IX..}.$.2.Y..........HG.$6.E..u?..lrfM....+..2i.<U...Un.)$.....$.C'....n.....G.....G..................\a...h.Q.....a.y.7vb8.NA.:Ya ......Cz..Q..h.....0g.......&...G..4...H.{b...x.........y......./GZ~B.`p.F....w?.........vV%..`..]S_...[).Z&$.z..Cp+.}o#..&.[..`@iV...P.....\|....e.q.......=Sx..DX]./.G..K...YR~'..N..f.#.Y..e>.I1H...........'_....'.c......u.2.C....D$..P.Se..k...ZxP..!h..w..N.Vp..:....n.J....q.$...(..h....P.rA.V..e,. "CustomAuthClsid" : "",. "DdsAadRegisterUrl" : "",. "DdsAadSyncUrl" : "",. "DdsMsaRegisterUrl" : "",. "DdsMsaSyncUrl" : "",. "FastPathEnabled" : true,. "FlowControl.AckSendInterval" : 100,. "FormatVersion" : 20,.

C:\Users\user\AppData\Local\ConnectedDevicesPlatform\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\D3DSCache\e8010882af4f153f\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\D3DSCache\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	996
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	24:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycs:wDUY9SxRUY9SxRUY9SxRUY9Sxs
MD5:	5A76AB1CF8045E124D8352632D48448D
SHA1:	5D81C0542D65E7212B1F2AA4BD8942850E8E55FC
SHA-256:	8874982CCBE2BA22A7527BC611AB771652E815CF03ECEFC378EB418F253AB578
SHA-512:	34111F0E1D76E55260652B4FA31BB7ADD46ACE088DF574D37CFA49FBF3F58477481DDBE739EC76C1F088835024B3EDA5696202C3B1B848E799A40235A68DABC8
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\DBG\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	996
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	24:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycs:wDUY9SxRUY9SxRUY9SxRUY9Sxs
MD5:	5A76AB1CF8045E124D8352632D48448D
SHA1:	5D81C0542D65E7212B1F2AA4BD8942850E8E55FC
SHA-256:	8874982CCBE2BA22A7527BC611AB771652E815CF03ECEFC378EB418F253AB578
SHA-512:	34111F0E1D76E55260652B4FA31BB7ADD46ACE088DF574D37CFA49FBF3F58477481DDBE739EC76C1F088835024B3EDA5696202C3B1B848E799A40235A68DABC8
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Google\Chrome\User Data\CertificateRevocation\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\reports\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Google\Chrome\User Data\Crowd Deny\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GPUCache\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Platform Notifications\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Google\Chrome\User Data\FileTypePolicies\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Google\Chrome\User Data\Floc\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Google\Chrome\User Data\GrShaderCache\GPUCache\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Google\Chrome\User Data\GrShaderCache\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Google\Chrome\User Data\MEIPreload\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Google\Chrome\User Data\OriginTrials\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Google\Chrome\User Data\PepperFlash\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Google\Chrome\User Data\RecoveryImproved\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Google\Chrome\User Data\SSLErrorAssistant\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Google\Chrome\User Data\Safe Browsing\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Google\Chrome\User Data\SafetyTips\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Google\Chrome\User Data\ShaderCache\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Google\Chrome\User Data\Subresource Filter\Unindexed Rules\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Google\Chrome\User Data\Subresource Filter\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Google\Chrome\User Data\TLSDeprecationConfig\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Google\Chrome\User Data\ThirdPartyModuleList64\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Google\Chrome\User Data\TrustTokenKeyCommitments\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Google\Chrome\User Data\WidevineCdm\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Google\Chrome\User Data\pnacl\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Google\Chrome\User Data\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Google\Chrome\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	996
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	24:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycs:wDUY9SxRUY9SxRUY9SxRUY9Sxs
MD5:	5A76AB1CF8045E124D8352632D48448D
SHA1:	5D81C0542D65E7212B1F2AA4BD8942850E8E55FC
SHA-256:	8874982CCBE2BA22A7527BC611AB771652E815CF03ECEFC378EB418F253AB578
SHA-512:	34111F0E1D76E55260652B4FA31BB7ADD46ACE088DF574D37CFA49FBF3F58477481DDBE739EC76C1F088835024B3EDA5696202C3B1B848E799A40235A68DABC8
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Google\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	996
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	24:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycs:wDUY9SxRUY9SxRUY9SxRUY9Sxs
MD5:	5A76AB1CF8045E124D8352632D48448D
SHA1:	5D81C0542D65E7212B1F2AA4BD8942850E8E55FC
SHA-256:	8874982CCBE2BA22A7527BC611AB771652E815CF03ECEFC378EB418F253AB578
SHA-512:	34111F0E1D76E55260652B4FA31BB7ADD46ACE088DF574D37CFA49FBF3F58477481DDBE739EC76C1F088835024B3EDA5696202C3B1B848E799A40235A68DABC8
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft Help\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	996
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	24:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycs:wDUY9SxRUY9SxRUY9SxRUY9Sxs
MD5:	5A76AB1CF8045E124D8352632D48448D
SHA1:	5D81C0542D65E7212B1F2AA4BD8942850E8E55FC
SHA-256:	8874982CCBE2BA22A7527BC611AB771652E815CF03ECEFC378EB418F253AB578
SHA-512:	34111F0E1D76E55260652B4FA31BB7ADD46ACE088DF574D37CFA49FBF3F58477481DDBE739EC76C1F088835024B3EDA5696202C3B1B848E799A40235A68DABC8
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\MicrosoftEdge\SharedCacheContainers\MicrosoftEdge_DNTException\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\MicrosoftEdge\SharedCacheContainers\MicrosoftEdge_EmieSiteList\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\MicrosoftEdge\SharedCacheContainers\MicrosoftEdge_EmieUserList\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\MicrosoftEdge\SharedCacheContainers\MicrosoftEdge_iecompat\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\MicrosoftEdge\SharedCacheContainers\MicrosoftEdge_iecompatua\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\MicrosoftEdge\SharedCacheContainers\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\MicrosoftEdge\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	996
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	24:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycs:wDUY9SxRUY9SxRUY9SxRUY9Sxs
MD5:	5A76AB1CF8045E124D8352632D48448D
SHA1:	5D81C0542D65E7212B1F2AA4BD8942850E8E55FC
SHA-256:	8874982CCBE2BA22A7527BC611AB771652E815CF03ECEFC378EB418F253AB578
SHA-512:	34111F0E1D76E55260652B4FA31BB7ADD46ACE088DF574D37CFA49FBF3F58477481DDBE739EC76C1F088835024B3EDA5696202C3B1B848E799A40235A68DABC8
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0\UsageLogs\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Credentials\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Feeds Cache\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Feeds\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\GameDVR\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\InputPersonalization\TrainedDataStore\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\InputPersonalization\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\BACZYXTY\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\BC6XF3KU\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\E5F0NRSV\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\URW0GA4Q\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DomainSuggestions\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\EmieSiteList\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\EmieUserList\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\IECompatData\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Last Active\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\Last Active\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\TabRoaming\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-314712940\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-314712950\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tracking Protection\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\UrlBlock\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\VersionManager\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\gee00pr\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0000AD76\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Media Player\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Office\16.0\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Office\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-400.png Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3259
Entropy (8bit):	7.617406431489036
Encrypted:	false
SSDEEP:	96:xL7bzOkuOaO5qzjvo5+IaEJTEOum8ARWjbAgttttt10:xHbzTaO5UHjEZEOV8tfA20
MD5:	61A8303D64ED1C80BB2A8BE613131EC9
SHA1:	98B4338AD5DF84B5F4A96C082EB509E60C803217
SHA-256:	F3C67A0B94A5A9049692613F5EAC046B182E647BABCBD4C6D43BA1EFF2262AA1
SHA-512:	B081213802602B9B1AB431633C20C8185072C8B1C5E9BE3A63A1E16BABC856EFDF8B01A1EDC0998C44263A3A9DE6A80BE86C1A760429D8DF0B731DA631279FF4
Malicious:	false
Preview:	.;J..7....a.G.d..Z2.q...x..<.Y\p...<.+...k.X4..F.$...qf<jp......G&}..'..G{[...z. >...z[..D...P^..#.M%zdV,.O1(r..eXJ!.k.Y.6.h.a....8pw....._"...........q.d..p.....qwcx.w:a.fA.X.bx..@..Km..4y...L\:..:"i..F4..i.........p.?BY...w....H...v#5.)......M....$..-.....0..l.1Xr..>.iv..b..G.......0.mO.......t...B..B~..h...\.Bm....{.=.-...G.$ ...-..x.T....g./#......P.4\.].@..5.D.....>q.&#..xR(...D.g.G{W.=...Q\|...\|....RV.n...r...=%......M...qe8.....k..g..,......tFFW...9E.2,i....5O.G.r..W\|`./...Q....../..`.h.^.l.U.\..qmN.t.<9...h6D=:..+6............x..O....9..=Uj)=..y.8.Y.(...aJ#..=I...............Y.p.'x.qP0Lr.d...+...[x.q...A-0.1....j,e.v...c....cO.....Uk.G....,.^;.h..t.+..j<C....."Sg.....5.....vd.v.t..).U..D.Ie..)A._........;y:...............E..U.....-....VV..+-...7.o.v.Q...,.X[....C.......oXg!X.q)x.....`1_.p...q.,\|..S.zc...`..r%Y..;.d.....[....%X.4WC.f.e.].......1D.x.5.6:....1ulq.~3../..h.....!....e.9.9l....TD=...h...-.:n~...VU....G..j..-.....ab.q.a.

C:\Users\user\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-400.png Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3571
Entropy (8bit):	7.584386438741195
Encrypted:	false
SSDEEP:	96:65VEgBod7SUiLHQK4QfSA8m8P1Pa5n6VjUCttttJ:65LBod7STQK5SBm8Ja5c
MD5:	3422623CD06FDD824C12B7C1A95AE95D
SHA1:	D016613B386F581C62E63C7B6F4F813D0B748C9B
SHA-256:	6F724C5BA705163B697904DA634EF4A6A4BB2B6CC939EDD7FB663F0D734986A8
SHA-512:	877A375E940D0845E017FE0E2B8B68E0E179273B2E3F733E6CEBE30B0B2B37FE1030EACD658A0413955430C2E6105FDF5483AF15A73B0AE12717FBE6D93F00D7
Malicious:	false
Preview:	A..c,.`.5..{.b.I.......+...f-..}Rw......U5...\2.nw.M..Y.I3bM........6B:...F[..#..>r.2.&.$.....Tc.."...'....o0.<{q..,....W..'b.i....#}..\|6=..L..BT.......I6...Vg.......A....r.GX.j.8..U.&.DA..$......;.:6\|.....+...g_u.W]..v.......8.....G..U1.j\dk~PO..r..Dz..f......H]+..8=Z.t.\|.s...P..X~H..\.l..g&..m"55.;...3.)@.B.F..C.z#..F#...k.qj]gK.7.!g.....Z@......q....v^.....#.*Ro.....`..-..;..^...}+..O:....m......_...h&.}a....:......A\..JY.!...-...[.`:..b..l.y@.8.6c...._.1s..d..yn.Fl..s....~..,..-.T.`a....\|9.j.....0....b...Tx.....L.W.&...8;..\|...>.A.....$.YE.B...D..C9r...Q..622./{c....\|.u..v....KCA....X@.......=r.^..j.S.A..^.6...Mw.#.W.I...u.....A=v.c....9..f.?.^...\j.}....(Q+#MM.M.,RW.`t.m...w}.V....o?...z.m#Cc...cu.p..q.7.V.(...I..,.Zv;D.C.!.G[.\..+X.....e.... X..`....fV.+p...,........3D#X..`..[......CG.`....[]3.RA.,G.`...N.....+.z.#V..kk/......d9b.K...5+...G..,.k..*"Y.X..,..L....%X[..^...,G.`..6r5.3h.z.....%X[x..^..v...+X.U.v-n.:..,.k.p.9..`..`UQG

C:\Users\user\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-400.png Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6551
Entropy (8bit):	7.628420359502165
Encrypted:	false
SSDEEP:	192:Y5BjanaO5UHjEZEOV8tfA2xW8z/TRaO5UHjEZEOV8tfA20:qBuh5UHjXRp88DTRh5UHjXRp0
MD5:	D525184F6EDB7598F51B3491173976B2
SHA1:	7062CE7BEDC2B6C6B7D1DDEA8BF86C1CC690AE65
SHA-256:	500C2D4A570C7BF56B11A3B5FA87A95AF9FE9B7B44EC64ABAF93C5DC5BE16F20
SHA-512:	27992854C6232C5A161BC264DB6AF52CE5ADF385BED5C917B8D1AF54C01D86D0630BAAEA870B4B6CCD6BE413EDCF6E933A140139573CFBD15B9EF83F7D30B54F
Malicious:	false
Preview:	.o9t..H.i..p.....m.:xgV..;8j.. U.{.....^q.II`@k....p....S'].&q...I.Z......D.u?....j#.....-..f.Y.v7~.......&.gao.TQ.n{7....../.G..r6.<..f.g.{b+gZ.\|..0..G;.';c6_.U6q.Zi.......Sd.. ./.YW...IX?....`. j..e..9]..U5.......-f.4F.s...........m.M\|...>{..U...&.b['Jl.v.....wNN.s."a.W.;..@.(.........W..Y.?...W$.O..3.M.._.nj./......}.R..r.t....M...v..J<.;-..D..Yf}..`k..D.;.a.[.3....)R.@.<U.l?..B.Z...7_.`..."..c.Nc...J....J,.4dwJ\|4...E......./9.A.5.z}..j.5w.R.?.C...H..%d...?.s...0.-..J}...$R..........>".U.y..\V.....jN...Q..y.i}G..(...K.9iiU.si....,.....E?;.1.a..eQ.kE...k.....wH\.b....$..^.V4..'k..^].....ET.........c2..}..m..bxW].e..?KG.....8'..{P...G..0S...I.4.@.....(C..6...6i.>X.=.;...A....d:.>.$.$\G}..' ...........0.+.%m0(......E..U.....-....VV..+-...7.o.v.Q...,.X[....C.......oXg!X.q)x.....`1_.p...q.,\|..S.zc...`..r%Y..;.d.....[....%X.4WC.f.e.].......1D.x.5.6:....1ulq.~3../..h.....!....e.9.9l....TD=...h...-.:n~...VU....G..j..-.....ab.q.a.

C:\Users\user\AppData\Local\Microsoft\OneDrive\LogoImages\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\OneDrive\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\PenWorkspace\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\PlayReady\Internet Explorer\Desktop\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\PlayReady\Internet Explorer\InPrivate\Desktop\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\PlayReady\Internet Explorer\InPrivate\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\PlayReady\Internet Explorer\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\PlayReady\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\TokenBroker\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Vault\4BF4C442-9B8A-41A0-B380-DD4A704DDB28\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Vault\UserProfileRoaming\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Vault\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Windows Live\Bici\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Windows Live\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Windows Sidebar\Gadgets\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Windows Sidebar\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\WindowsApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\WindowsApps\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Windows\0\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Windows\1033\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Windows\ActionCenterCache\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Windows\AppCache\5FW32JUO\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Windows\AppCache\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Windows\Application Shortcuts\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Windows\Burn\Burn\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Windows\Burn\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Windows\CloudStore\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\NotifyIcon\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Windows\GameExplorer\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012020093020201001\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Windows\History\History.IE5\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1245
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	24:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMG:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs
MD5:	8766426D6D81E1886F6D0D6EFB63D7A2
SHA1:	773B9C6599985EF47DA003F782D136334A10D5E6
SHA-256:	79F6BE4AD2E7DA2FDD12A1FB17647C980D77775A490B5E91AC32407639877208
SHA-512:	D63F7D9EC36D610394AD53756606582C5E2D8661DD504AF7394B7CCDAA960AB32E556740A454E790E06F14D55B1590B71964D99D9E5731CE8A1AD48BB2C7E0E2
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\Users\user\AppData\Local\Microsoft\Windows\History\Low\History.IE5\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1245
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	24:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMG:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs
MD5:	8766426D6D81E1886F6D0D6EFB63D7A2
SHA1:	773B9C6599985EF47DA003F782D136334A10D5E6
SHA-256:	79F6BE4AD2E7DA2FDD12A1FB17647C980D77775A490B5E91AC32407639877208
SHA-512:	D63F7D9EC36D610394AD53756606582C5E2D8661DD504AF7394B7CCDAA960AB32E556740A454E790E06F14D55B1590B71964D99D9E5731CE8A1AD48BB2C7E0E2
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\Users\user\AppData\Local\Microsoft\Windows\History\Low\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1743
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgs
MD5:	AECB094884F8527CC8946D98C0CA9489
SHA1:	27C2BF3B010455FF77BD1C5DCB3B7FD341B58AEA
SHA-256:	D7C6D4EC9BCEF51770FD65526DF578192C51B4B8EEA6BB6B0FE924A77324E99F
SHA-512:	CBB4A6EEDC1895E1F8CB34B5488E5F26ECA052ADD8EBF20046CECE6D6B1C7723AB5D8F135200EF52DC88EE5953BBC336EB74C6DA904D56EEAAA9BB33A0C128AE
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\Users\user\AppData\Local\Microsoft\Windows\History\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1743
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgs
MD5:	AECB094884F8527CC8946D98C0CA9489
SHA1:	27C2BF3B010455FF77BD1C5DCB3B7FD341B58AEA
SHA-256:	D7C6D4EC9BCEF51770FD65526DF578192C51B4B8EEA6BB6B0FE924A77324E99F
SHA-512:	CBB4A6EEDC1895E1F8CB34B5488E5F26ECA052ADD8EBF20046CECE6D6B1C7723AB5D8F135200EF52DC88EE5953BBC336EB74C6DA904D56EEAAA9BB33A0C128AE
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\Users\user\AppData\Local\Microsoft\Windows\IECompatCache\Low\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Windows\IECompatCache\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Windows\IECompatUaCache\Low\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Windows\IECompatUaCache\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Windows\IEDownloadHistory\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	996
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	24:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycs:wDUY9SxRUY9SxRUY9SxRUY9Sxs
MD5:	5A76AB1CF8045E124D8352632D48448D
SHA1:	5D81C0542D65E7212B1F2AA4BD8942850E8E55FC
SHA-256:	8874982CCBE2BA22A7527BC611AB771652E815CF03ECEFC378EB418F253AB578
SHA-512:	34111F0E1D76E55260652B4FA31BB7ADD46ACE088DF574D37CFA49FBF3F58477481DDBE739EC76C1F088835024B3EDA5696202C3B1B848E799A40235A68DABC8
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\BB19ylKx[1].jpg Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4105
Entropy (8bit):	7.9022341732078765
Encrypted:	false
SSDEEP:	96:qUSRgrYS1FJvIgl+9q3Rh6nUlc/JOmkvIgl+9q3Rh6B:2sYSXywmCXlc/J1wmCW
MD5:	D7465747AA1311D28BBC0A07D22D4CEF
SHA1:	4932F7F45E26D6205F3AC6FEEED8332B880986AF
SHA-256:	F2DBBA4042191C2A21B08615C8490F8541A0412C3E45BE71452DC6618F803809
SHA-512:	99FCD888DCABB3371C9756C33BCA56F5AF2113A58EAAB0DAD5CFE4198D49517FA6BD9CFA7525A026628C6FD54AFC473A0646A4080B88B2CF6D897B528CEB379D
Malicious:	false
Preview:	#b........9...C.T.P%.k..nD....0-q.<A.l...\|T.4xr.6...Ca...i.]-bk&..W.'5.@..-...zUL.. ...U.E..jY5R1..M. "...\....vkz.....?.gP..#....Y\|....[#vF..1....~.,L...4...a......i..F.......F.J..lL..O/......p...{2c.?K.. ..Ah.$...+.6\|J."@.m.....B....Q...c.6.iq.. .2........}..c.t.WH....:...."v.%r.T.wz......,.Ck...nQk...;.G.P.;..[...y.T....!$...;LF.p....t...`..>.8./.pu6..A?dk..v..L`b..Y3M_......O..V..5v@. ...M.R.f.e.Q.&..#..u=.m.{..j.P.~....k2i-4..N..Dx.~..B.G&...I........q\...=K0`..J@c..........1y.....M.'..S.....0..T....y~..gr.G.\| ..PB...3.b.k.f-...a..?\|L...3/<y..$J..3.`'.~.w..a.5.=.%.......O.VIN....8......Q.Fn{...^...uI1'd&2.....g..w]1c..VnE/...v..dOt.<.p..t5...h..N.$.n7.[.........(.H?.#......!......GEHY.....q`.L..-.5..L...P.IS.Ir./.i.`.v..r....\..=.P3%..gq..'=y.>Zc..A.0O..SU.s.~...%.V.R....-R.q...G...?.I.....i.$.....aEAGHV.G.y.......i...]gSg.Y.?>1G+..&.q..H..f....P...a.3.c..u?.[I..wR.W.1Q...+..f.LU..-.z..jj:.R.-.R*..I..t........`.L...@.B..q.Z..!.k..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\BBPfCZL[1].png Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2346
Entropy (8bit):	7.81282555868632
Encrypted:	false
SSDEEP:	48:YL4cQyUUUz/RlzQi33fS+PuSsgSrrVi7X3ZgMjkCqBn9VKg3dPnRd:FXyU1LR1Qi33q+PagKk7X3ZgaI9kMpRd
MD5:	106336EFE373E51ED2232257B9E68FE4
SHA1:	FA898DC44B435F74CF15260BB4D6E5B04D5C4923
SHA-256:	BE366A5CFCA886332871ECF37E0B79632DA2820A6F3D88E05151DB4019CF1717
SHA-512:	1C71F9FBC77EACDA87873EBC725B4FEA73BCD2D723C3C7EC6C49D66ABF50FE45A2ED884C1B5B0C17C953BF5365210191A0707CB6F970241AC1E6FF09463F3E63
Malicious:	false
Preview:	....P.Y...t...=b9.#...U...{.;..p..(.37.VK.[..n..KJ....i.f9.w.IfG[..?..$...4.f.E.]...Q,..0.J..q............Yn>..Z..p6...27..u.....6.sF....U.V.\|..;..\..&`.EL..B.A...w.(......I.U..G?.....}....H...2.WE.N......iP7hR....n'...z9..Yt.m..F,~,....;.?b...j..8._.Dqr....^......\%..&.h.$._..c.4..O..=.I...rWx.l.\.(...J?'..[1....o..Be...d.{.....m.R.\|.G......<H..O.b9.:$.....c.....h.$eO..._.s..a.........\|...m...{S....qJ/...;.8..%2z\...a..\|.sk.k./.8..b...n#.....VK.4.V.X.Mg.3.\|..xm..T...Q....J.......veF...7.........j.cy.D.b..,{...H...36.Z...6H.(..4Qd...o'.flW.).qo6ya....VP...A{]"...i............I.c.'.!..".fr:........6N..X.r....~.O].=.Z..m(.n.u..iP.}fnRC/.._q......h3......w..o..R...-.8......7.}.......m.DCl.....0.M.^".B..W...%`<I.ge.~[...!..=.....O.y.......6..J.......)V..g..5.......!..NETSCAPE2.0.....!...d...,....2.2........3.`..9.(\|.d.C .wH.(."D...(D.....d.Y......<.(PP.F...dL.@.&.28..$1S....TP......>...L..!T.X!.(..@a..IsgM..\|..Jc(Q.+.......2.:.)y2.J......W,..eW2

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\RE4DnuZ[1].png Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	9939
Entropy (8bit):	7.974765289136986
Encrypted:	false
SSDEEP:	192:cYPfG2ztxCm7y6Wzv/aKFBRFGYbXfjIn45vSnAEIrxyqLFMSrlFWM:cYGatxCmbWz3bBbFbvM41w2xyoFZrqM
MD5:	A1F11AD9A9E299CDB8376AE827D94AE8
SHA1:	A9D3C80C4EAA917AFAFFDA347E0E289E1F7E0DBD
SHA-256:	21F4373A320067CA34EA11C37FB38D2B74F9F0C0F544989E97F37106BEB2A6EB
SHA-512:	779C1DB2CEAD28CE84168E743FCCAD52E0B5E0253B2242750DCBB2ADDA2C63DC6E27EE1EE40865CD39582E7B02A3D1EAB29275C952E3BEE515CC08B0A33BAFA9
Malicious:	false
Preview:	C(4./@.@.OF.y.c.>=G.I..J..?...Ec:Y...v..;e_c.5..E.....`..Yp...k....K...k.'.+S07.....`/..,sT...v..x..#..#.......)o...1a.@........g.%s.9..5;.z@..V............r.p'u.$JO..J....N......~...2......... ...+.2..........t..?.h...,...K.wXe..E.....s..P.....s`...,...&H.+.#..Il.#.@W..Rc......k}.....\|........A.........Qlq.f.-z.M.u....7...9M.G._.H.K..%..m.....W'..rh.Y.2..............%.t...P...P.z.......l"..\|.h.7......:..L...B.\o..Pp..f......FS..n.'.....kPawg..%V$Y. .P.3....5..\|$.n.Oo#w.l..#..L.K...k.P.....U:..$...p5.... .HK.........J.y.?....N.6EP.k...-..H.q..#.{..l.......+..a:..6`b...[NJO06 ...../....:..pPu.8.]V.c_......t.H..F\>/.....g.....^.4...[..$.....g..!....T.....~..UF).uFx[...<...\|$!(7.R..c..q...p.XhD0...8J........c...g.../NT>+s..d*..a..2%..6......{...._Rx......f0Vn.#.3...3.A...Ueps.. .=...HK.%\|..G...FZ..g.m.I..Y...z~]..sY&K..d.....Z..}`..ms{..TE.>.d\|.....u....L&k.w.l.}p..N.e.b...hM.!7!.%.S....F.g..._O.8..m...E@.88.........8.......x9..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\RE4Dnv6[1].png Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	10526
Entropy (8bit):	7.972899480000252
Encrypted:	false
SSDEEP:	192:zlHkVmy8SiQfLUq5cwGD8BL8HIXNDLMutho0ClDHidju9sFeitlg:zlHc80Qq5tGYBL8o1L7tuFOm0/tO
MD5:	65225935CD7010F2F2232542433FE5DA
SHA1:	1F8B7FA2AB88ADC111776A081CC7D809E0A26813
SHA-256:	124083F163E30D095C55653718B08F3D91DCA6BCF8422DA78A0BD5BF5AEB32AA
SHA-512:	A52A79FCD6B037B9F0905B9F2C41D6A2ABCF6991D75972D648A7758C1334B65EF6174EF9E142DC5ED0BF12447FAFE49C704A1DEBA172CD0F79DA1DD8EC008FA7
Malicious:	false
Preview:	....(_.....X4...H......%....E..(...........N...;.EKXA.w^.....3.s..E...\..........AY..a.Qq...........).....2s...%.Qm...n\|ok6...i.A.Eso1k..G.K6&..4m...w.N.4.l.&R..~.../r[..os./."..T..z....%R.b.......N....N......($...c.$../0"..%f....p.\M.4.n"..h1p?......hH.Ac._l.^h...F...m..6:CK....>...............V...".i._N`..d7....]}Q...X,.DP/.. ........n`"6M......[.....ipZf.nm....E.....\|.g...PO.rR.......k(..4.+.^t.d.....l..#.b3.%..`.4J.J....iMcz...8pA.@'..J..{..E.\|....`k.......i....q=.../4ad./......wK.........x".}..EKx..J.......s^f.Y=..}8.@......B....B...Sx.u.....B.^...o;.&^Z..........).O......y..mR.....m..b).j]..o-T4Ev,Gzd...C=%X.pQ..hM...a*^..l......}..K..5)..=.......'.....d..2$.....M.,..R..`....U........X.T\v_...=7.....5.PX.u..`..&......).$....:.i.G..x.......O............3.c2..ps...h<R.H.D..3.HM$/...dfd...`..A`%.JY..}..zD.=......i%..=O.................Vi..l........u.0.\|..!."..Z...O........i...xQ...xubz4S.........H...^Q..v.I...8{...x.,.H

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\RE4n1yl[1].jpg Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5871
Entropy (8bit):	6.760214013224134
Encrypted:	false
SSDEEP:	96:K2f5KCNOsk1eftTk2kCx6uY5Hfpp2URYEYVzKms8Ygh9daGWJjHnAN:KgskOsk1ef+DCxeVxIURYVljdiHW
MD5:	4B6D7964122CD9C2375FDB9C7C540651
SHA1:	E8D695002836BCAAF10E68F930FD0D1EE5544AFB
SHA-256:	DDB652AA8833B2F3FD5EE8E77393FFEA1A0B5CAD2961AB3FF0414D4073E606CB
SHA-512:	4B509B9DB12FDDA1C6713F02EF95B4765DAE567B545CD0D42DE90903B1E7F57052A41EC223F08631383C7EC7CA36D4C5B94384ECD6444F396A3BA5446535D4CA
Malicious:	false
Preview:	.....c5...$.K..+@...a.I..&z..G`..+..4:....7{.Z.E....<5.....H...,...'....l....<..s....].A..Y=:...V..U(.g.3..0...Z......R{<=.@YNU'Rs.1....B..6..{B...5...6.s^....,-.. R../J....A.6..}....[R[.!(a...x........^!N...4...H..X.w.i......]fH.@...$.._R..o..*.)....4...E;.([+ .v....CP._..%....%".....h...............Y.c....i(.Y.K8.U}....bk.............%.\WZfa..g...LQr+..w\.0..a..Q%[.0..)..0..V..s.v.P.......4.......~...d.R.0..~.%......T.x..q...CQ.Q.......k5...<....B..Y......H..K.........@c.]l.tv...dBI{.....UL9+..RA..`.1....S?..Y......P.\....s......;...i.P..Y.SA.j.]..Tf.........e.+F.......e...^..PRB..g.J^.Z->..K.T...Eu,.........F..l....g..C./C.)...jv..X.R.."\r.Xb.D._..\.lL]..h.@..$-.%.~.C...>!~.c.)#.......}.....\|..._..6.:....E.P.......R.1t...v.\.u..6.!t............t.-.N.?.!65).Z^m\...........Y.Y+!B...<..C.................k~...;o.k...........=.`..zx..........).p.]...\|..............,..>..@..........%....T~.n=.^..........,.-ZW;..Yc.c....p...........o?.l.RK.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\RE4n4cm[1].jpg Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7164
Entropy (8bit):	6.983944400935104
Encrypted:	false
SSDEEP:	96:amj6mMitxHSXUFVk2kCLww3bhPLg6NNuIvALBdzlpIoNuYMMN+C9v7doo9O5AN:l6ZOuUoDCLwkdp7RvAV9ltuYvoC9J5UQ
MD5:	FA3CE3DC1C2B0FA95929707F0221FF5E
SHA1:	253CF807C88435C45DA0A4A6AE42DBCC31BAD697
SHA-256:	326AFFE3F70FEC8500D1DEBE2FB1A133F56463EAC98D4AC147740F3C28BA77CC
SHA-512:	5E831C1830460F5FB2CF3E9238C988F016BE30226051B8121156BAADA0678CE1262EF0218B2736184D7D63BC6C2EB8763EDEC6E2BCF1576E97A8008ABC2A05F6
Malicious:	false
Preview:	R~..3p......,.[..?mC....S~.....mb~....uC..Y.x.b.Tx.e....^%$J......r.F.zk.......Gp.t.....Y......26.1..[([......g.-.#"..'..R.q.X....c...>..V;...7V.,....~s..j.uY.Z..+.....3S....E.[...X`.&......t..-.5.<..n.+.V.UkBl.R=:g....H.Z......{.x.........1.....H...A.V.4.B`\|2..07.......Y....i....26..6....H....{.'...E..a.;.L(.h..4....SE'f.....Qz....0..\Mz.2..s..i..v ..e...N.R..v24[......MD.V...-....j(i.6...;...S[..@.v+k.pa!..K:&.>L}=H.C...=..4q..m...@fH..G.....5{.5....=..QV.67wPT8...T@.&...4`..9.!..#d..kDy2.YN.5.\|M.\|.D.g..i`.......76........s.&..`.g......i......i.1.i.+W...y.l.`k--..N..F.h..7...&.:.pHZ...UZ....vW..a."'.....w-v....r.K.......a1..k.N..>6...{....`jc...O.L....E\|....I....^@....M}...F\|:^]./MC....m.{...@.S.7.....<U....S.....L5c>.........../......~.~_..<./fo..........Ddj...l..................."2<&&,..d*...&Z1g.6o.............].......?\..1.'6o.............].......?\..q.'6o.............M.......?\....(6n.............I......c....x.m.{............1.v

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\RE4ncJ7[1].jpg Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8229
Entropy (8bit):	7.165650495915239
Encrypted:	false
SSDEEP:	192:gX22DCUlh3Lk2YSUEcmR6wzB73xJpaBDXjO:k22D5lBLk2jtcmRt0BDXjO
MD5:	E248FD5A87AA40FF3DA7BB0DE2034759
SHA1:	AE122ADA914D5D104A3AEC3B83E7C86E54875757
SHA-256:	581BB003A33A523365D5B53B9530C99285CEF158EEA174DC92C1FE307D3C2DFD
SHA-512:	F947F6764030CE819B0232C2647C1665C40697D15DD93D5BFEE25C5DDEB482463B2700B625D705FD34DEE280B27513AC7B74E59E75FC561FF712C983A9E55179
Malicious:	false
Preview:	.;B....>..1D.....s=k.../../.......%c.J.7NS....K... w.>..9.j.....Ph......=.o.C...........L& K."F....h.~.=..m......!......\..#.J\.....5.bq.....2.....dK..P...W...U. ...5.k....I.-V...?......$:.B...C....I7.Tfp.K.3..JpmX.-..k.....WsE:M.....ZT.X.5..w...\..R.0...~...I..B..2A...!...B?.+.. kpHA....x..."..`...d........h.)..9.....<....N..?y,.f.aO..T.9.V...GO.....R...h...c>..MK-(!..&c.}Kg........".%.%b.}.wFs.Z..!...J..c9.e...g.n.7D....k..[....GJ.$...Np.;!~...[V.Y.#t....M....s=.,`.FH....<.A.l>...J.`.~.~6.^..~......K...~..Vdp...]+.#.6.a. .../...A..GN.!l..c...`..d\|S3y}....." ..GY.(....eK...j....Z@..$......5.n....S...B..=..B....M.....H.V.u......bj.}.tq.j..W..G..V..>......./.......o.....d~42..\|o.0.U.d...$..d.u.gp.....#%..[LTw".............<e...R..>.........<.I!............-.U\|......c..{.{....a...............y..VN;..B..r...W.......c..`...........0...>......M.Y}z..K.-6.^\|............./c.R./..{.C.}.....5.r.@........i:..P.<+.:....-.......

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\RE4nqTh[1].png Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	24653
Entropy (8bit):	7.971012191449033
Encrypted:	false
SSDEEP:	384:A96SMdUe+v6MtCfX85n5aUQ2V8iQ0kgh4zFITc6oQGQhp6i8UaYcAG56GyP:AYGv6Mq2aQV8iQudTc6iQ9ax56/
MD5:	B1CBE8E9D9F1DDE90AB6A0F2E37415E6
SHA1:	56B7E00E70D05E86B3887480B98BC34CDEF8B18D
SHA-256:	56B43CEF26A54927117EA77EF2EA9271054240D28EA69B8BADA442AEBF16624A
SHA-512:	6B18FAC7F38B719E08DFD87FF17A606DC52B0452BA08FF7938CAACC091A41CDA80B5A0184E51D40F639A64C8CF333036E15CB10549FE3122B0564012446BCE40
Malicious:	false
Preview:	....T......7=.6..B.1\...YU.<......}...<..v..D.h.X5....{.Q..u{....@...2...n3...RQW...f..J....E\....K...1...Y..C.......J...........f.OHX.\|.RDw.../..w..n...!..o&R...c6.O....8\|.j.....S...+O...[6.'G.....i.....)...x...A.6.B1.Z..T..F.>.......Q.F95a.....]..)qL...-.{.... O...O..M...z`....O.:.%v.^%`...-.c....{.4.h....tD.F.p...1.4&f.....(.ow....P..z{<qB.I..I.XmF.k....V........c.x7r.....m....6(...t.s.,...!.s....2n".D....H....Ci..^.6...d.;p..........x0H..Oo=..o...........WkR...;...D....t..-e..-....~...c.v.BpI.........8.s.H.......U.x...{..cD1Q._...p.i...s..Sc.l&.{.<..=E]>q ....%..pZH...V..:.].6..".....@)..@../.....c.,:v..bZ.~..y/r./!f..A.....-..].4..Y+...3.[i..."!.v#'.\.}^.4...F.q.[.)..YR..F......2..B...\|\.....vk....<....%`q\|^..L..7...do.~B.1.]....g...._.x8pC@N4.D9C..$.7=.?".........H.....6..8...u....KL.7kE..N..#.t7.j.O......j.t..%.w?C...8.....{../...1..]....D.-_n....C.3.g...n\|.".;,....7...>..5.".n.2....(...op.@...;(8.0Z..,.]...g...4!....{.M...A.O..-.A

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\Windows_Cortana_Google_img[1].jpg Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	16802
Entropy (8bit):	7.956452684445683
Encrypted:	false
SSDEEP:	384:LxCdGgSnRVmkn/TjOZq4lJY+uk0UemuQ9EjYxTz:LxCd0V3638+z5CUFz
MD5:	79B72637744838C1F03A5117C0B15A95
SHA1:	E2E10D802A89E16925B10A26C526EAFE6B225254
SHA-256:	323A665DF7821C3F7E20980A27520701017C3E1A7EE70C75C7CBC3D52317B52C
SHA-512:	A91FD7AF1210966989484DD5622CE0A78C629ADB0380E9998A2A04F107EC4759EF312F905203F0F841F479B731D3F85530EAA9048E1BBB260F2818B8A6527BE8
Malicious:	false
Preview:	.{.q.0.U.h.@Hr.j....\...x.{.cE..5....N4.WC.....D...T.u.......%...B.s...t.../..{.f..0.x"s.hQ..j`..`m.n.z....w...&.....D.i.r....l......$sJ$....H.y.i..qh".#....A.........b........P.N..z......S.E..Z..&.....r..M:..i.....{..Q.c.ay.,/+E...\|+e.#..P..).q.6B......a..2.Pf..8:..Qy...........~VZo4>.=....5....q@.......w.'.f9...._A..hW....:C~X38....S6..1..-.....H...-....q...h......m../cu.{{...e....1.LE..L.N..8.#...O.....R#Ks7...(........Z..n ..T..C.S`j\|%.Ywqs..Sp.......k.D...cKX&...~5..(..G...}.6......}m...H..8.%.A#.duH3...)Q......cx.N0U...l..O2..g].......-3.0........S..Z....c7.6.Rx-..t......(;.1./EQj0.G.+"E(=.a.q1.E..Y.n.......r?.''.[.4...[.%........?f.(..2{.e#..k\|..2..L...i...(...5<...-..}..a...uk..."....{..k........U)aYjW..F.z.A...L.....NMM:DocumentID="xmp.did:44D8DE8A33C011E7B648938718D13067" xmpMM:InstanceID="xmp.iid:44D8DE8933C011E7B648938718D13067" dc:format="image/jpeg" xmp:CreateDate="2017-05-08T12:55:23+05:30" xmp:ModifyDate="2017-05-08T13:00:53+05:30" xmp:Me

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\big_pixel_phone[1].png Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	61387
Entropy (8bit):	7.953807465439722
Encrypted:	false
SSDEEP:	1536:z/S0oVPkIKJQ7LzwyA/S0oVPkIKJQ7LzwY:zjShHBAjShHP
MD5:	2B7D6565B7CC4773F9553D086AFBABFE
SHA1:	1370E2E094E9B3AFA14BB40061D087280CEF0586
SHA-256:	BF7AC60EBA1CE08FC7814BF5F91C0543F03E3B8352F3F2D0B91F935D2906C0D7
SHA-512:	CE0C7C3ED711C5E39420ECA94EB04EDF4428407F85A9AF741B2DC80AE34AE3095FE5081C35E426F46D5C63AD13337138D89ACAC94DD2928FB9AE6796A267874C
Malicious:	false
Preview:	H.....\q.CH.y.Q........../X...J.3.].0.8Y..0.Y..=^-.w.f..2....,..r?.2.r.C$.H.y2..>@..#d..3.O?....F.i^(.=............e..?.t..1.37.'.H.....9n....u.k..E!T#.^....1.....S.Vw[.B...n.....}...}..^...fm..Q.C._..1...Q.%.x.RY.....'C'HN..O.....E5D..c.).._.,.Pq.....B..\|.m5.:...j...^./...[..F...Yz+.V\|...._.D.F.p.`.m...4...y1..4.....I.)....RP.C.1ET.&.v8><x..../..u..<..c....3.t..b.M8..>...b..wz..nD...BsVC.j`.......E....`$Fs..O..N:6Z....p%.K"...O..$..7W&......U^....?..BB]:.v."....a.z7..A.[XY........~$,..KI3!f..XN...tV...n..(W..".h.2.....)..K1......E..3G.....5.W....<....v...Y4....#....# AR.2.=....,AM.t..Y....j..:....x.}RW.T...k.3.0L..:f..N7.z.....(. !..Fo.}.W.S.S.Z'.0...3...&.lqD..b4..%..^.%..0.."'.K8..[...6...Bg..y(.B..'>}[...#..4.a..R.=:.JG.;,......k..D...fkTNn@7.t.YNK..+.......uy..A.,.o.,....i..3.......3tRNS.........[.#..../iL;~t.........n..T.......z.7...t0IDATx...n.@....N..pW..dL..J....o.=v.xG.6.U.(.:?g~vv.&$....c.g.f.J... .~m....k...\H

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\google-canary[1].png Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7476
Entropy (8bit):	7.929553564084301
Encrypted:	false
SSDEEP:	192:bm+6kMey7G480h2TkMey7G48aaj9DYkMey7G480:bPyy480h2iyy48lxhyy480
MD5:	7C4439F0666187C9CE9F1BFF31918768
SHA1:	733FC2AD11960E883BB9C1B79C1BEE121165B8F8
SHA-256:	7627F504FA5C4FC12C0091A6C361485D37876F58B68FF032CACA7696B4552244
SHA-512:	068E2341975B1CC981DF494FF8A3C4E277DB7EBAA774C40BA7591049441DA884EEF04360664A0F82E287F0AE64C78E2991E14C22216F212564E5A24A032426E2
Malicious:	false
Preview:	U....s...4ct..>.H....(..4..pWX...\~..A.u...)...?.B.^..z....G.^..y..F(\|....M.m.&xZ...m.j......@...S.z....k....xEv........O..........x............{...A..hY@$.,.2..2....J.5....ac.s.....Rk[....i...t.+......jn(.-.,.P-k.Rc+q\S.C.3!.. ..$.2....r=;..,.........C..>....Oy.?:.....~..`.s.Xl../........2r..s..P..r..+..Vf}........m.._q".2.W.J.A..!)X-B.O.v.+..>.I..0!{...../.......7.O.4.."..[=.e7.V1.....>..rn.l........_......\|........H.{..K'_..P...1.6R..]...j..N.a..t........l{...B?.p&p.s.0E.g.3.t...R..(.Sx.A..e)6z....1.W6..,P.......c........ThjBT.....pi`.]....;8m....Nz...2....l..."..J..od.;...}.W?.....N..D...J.&I'.kb....v.wR}n......G0..#SW...N{c6oU.. .f.AKj{....#%p]..s"....J?.......&..%..6....#...[fR.U...'=..r.)3.......}.\|....g.{..{..".....X{7B.w!T.c.=.5....@..H.xG.q...^.(...........!..B......D..p...M.F\|.oaG..8......9..........x?..G....5..t.z.=s.Fh.../}...."..1$....@..'...../P>?Exj...[.....2....T.s.&#2...x.N......\....;.......{.C.~..E."..1

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\google-chrome-logo[1].jpg Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5589
Entropy (8bit):	7.897951766747541
Encrypted:	false
SSDEEP:	96:uD52tLrkQi7AbbNNbeVMBDdECzYlGRD1XYuZSyAbbNNbeVMBDdECzYlI:FBkD7ADeaBxEC8E5YuRADeaBxEC8u
MD5:	4A7A2CD7467092BB22FD292EA3E1D9AC
SHA1:	2E43E8B5650EE3562431EF184080FE3FAAAF92BE
SHA-256:	F2E24690DD3C5EC0ED647BA32442B14085CA82AD4E56171FCB90C899D11678FD
SHA-512:	E8C3CB3D735B594EC50A5B8F9C6EDB03D8B9BF8FD5BFEF8B90175310970529644967571A1472D68560D957887874FA25E4CC217ABE4C70B67AAF1F05EFAFE0F9
Malicious:	false
Preview:	..cd.s..nT?..s.l..H.....8y...../.a.....'..Z__:..7=s.~........u.u(.....Fs....%.....M...Ar.[...'...3;~......q(....}gA..)...)....H?q.i...?}8.j.V....,$[....c.d2t.. InO......6..1...T.z.H=L~....=...ao..Hk.(.2.Z..C@...o..p......$.`....M.$.KQ.mS..K......s......Ms...W.V.g...aU:.8......w.....5i...~...........!6.<L.Vn..3....(....I..5.....C....Q%.8.)3...{..]....a....j.../.WZ^...p..6..<M.31....Y.j..u{.v~..'".........].D...=.....r..nO)..z...s..hs?......O.M<.J.....)a..f63rKF.......@Jz..y..........]..Yt~..."..........a.d%H..-.]......c...L.hZ........`....:...T..o......n..H....X.]...lE.c...<"....NTV.By.....P...V... ......%....@..m.,.....S..Bz.Fa...H1.%..k......h:......NZ..j..E...=..............8.h..}.3.{.>.!.sD..&&P..g..Da_.p.ch...u....\|.G.1..2..a.d.Tf.._.'.?.._..+..:.f...+.#....LM-... ..\|.lo..Lt\|.J.4._....VzH.....g.....J.NH.....8!o.!.........*.&.C.~c+.p....5...GsA.5.%n.:}E...=...g1...}....:.P........f.b..r.X..;.P..].2.".t3D..h.8.:.....)3.I

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\google-dev[1].png Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5673
Entropy (8bit):	7.942460167112004
Encrypted:	false
SSDEEP:	96:zgfLK4du61Djw7RMtsuYarp0Elvmw87rx/4Jg5AY1Djw7RMtsuYarp0Elvm8:zI9bRw7juY+O1/Mg5AYRw7juY+B
MD5:	3EC4B5293E60F5AC047AA7A39FA0A8F5
SHA1:	0803DCFE9E2EC8069464C1B46A581F5EEEE8D1FB
SHA-256:	36ED679F9424FB3272725E43D9EACAD58AF0DD5A385D333AF1F93498DF178CCB
SHA-512:	1034B7743E26525BAD39D399861277A4CDA4C3903D91E67073A0143808286EFEBE4CCBA116AD5873550A8EE6E35AE6EBB5771CF325C89D59B293B99B36F2F7D4
Malicious:	false
Preview:	=...=5B8CiRM.....[...v..f}K&..t.67D0...:.vM....o..Qq._S_s9.:.:...K..4.^.E.....j..7...V.Ck].C>..h>+.@.CR.T3G.....@&.J...-e=O.M...%.#....N...H.....n...9r`.%S2........").1V.(B.....v..C2&./p9p.C^N.S..S.n=.....JTZ..Y..v....a.....>D.M....v$K.g...5Y...C_.8F.......A.5...y..W(..<A..3.QY.@V.e-...a.h19.C=.-..#...'.5Y.U..../....r..p.U...5.?4.MX......\|[.`...s.....$cp.Zl.x.=.......U8.A"$.Q.....]<.l....k\|..{\.L=..>p.l..7....M;..d.-Q(}.....n.a./....]........1..3.f......u.[.....XP.~..xc.%P.1...B.......O5d\|kF...M..r/a..j..JB.@.D....>~...A.....9Uh..4..".V...`...;.y....g.o......s.TTs;..C..!;.^.q.J.....y.o\|.8..~IO...^w9..p7rZ......U...5....."&..b.....Q#E.h...dBR..1.;W.....9...a.........C..Y..*......d.,J.\|..s/...b..&.f..1..h...`.v.sd....=.....L....0.....ryX7\...W.uA.pbDW8Fv.sd..k..k.;..y...x.t...._.Wk.....`..5#.3.......K...Y.J.(.X..5.....SQU.D..M....gEG.Z..w.vB..P..#.6tB.f....u.:.ao.4.#..j../.....qT.....%}..`....D.K... g.4h...W..a...<.....y\|.H...8Q\|h.J7uE.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\google-logo-one-color[1].jpg Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	10083
Entropy (8bit):	6.174961210849453
Encrypted:	false
SSDEEP:	96:RvkE5M8glIF5qyUuT60iCvPRm8WOTcDSD5fETM0XKa0jj5qyUuT60iCvPRm8WOTr:R8EkKgyTT6b8WXEcKJfgyTT6b8WXEx
MD5:	FA1481571F3707AC4A3B992430CEFF74
SHA1:	13FF3FD583B2A9AC9E6CA6554504625BA4405E74
SHA-256:	05A764E9D550D6A269C9AED0675059653E169279DA005CE4842E012B8D6B3766
SHA-512:	68EF54B65DE537ED2EE5366B40A09A6B6E3E56BC53EBBBFBDCE32B43D589DD3914FB184EF931DFED4BE02DBA5B28D0C4D35AD967CBD0B8011CA40DD43D365CC1
Malicious:	false
Preview:	%..o.IvV.;}...dF./8(>{A...8.@...C...6..>.lm.Mt...W8....].!...=\|^Z!Q..qV4...1...7.V...B....h.....?...A.8.O..N...J.=......A.c..{,.Q.Y2P...M.....X8W.....W.^........H..B.~I....Y.:........d.'\|"\|.w?...;o.M#...h]....>-..<y.3.zo7c.4......0..F...I..T{...5S.&...n.kt...0.>......ee. +=Y....V...j..#Hc..S..iS.$ZR<.A9..+8....JU.Z...8"9K.$.........rl>.U.(.6.{.Cm},.~o".F+)...N.....-.E.M.T..l.\...b.."O..M.].H..{....:c[.<.2R.....@.../.............{)=.(.l.9..A.?;....,.c..\..V.L...N.).$.U.c......G. Q...\|..Sq...f...D.....`...._..,..jJ...-......`2...^O..p..$.......G.w.B.......L......X......!...C.9.N.....^.S..KC[...U}..%A....J!...D......y..[.hI._........1.......S..K%.L..M\|..Lq.w3...Kog...5.r...04....Sd......\../I.9..W.r.E....p.&....Y6. ..J.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\googlelogo_color_272x92dp[1].png Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	13537
Entropy (8bit):	7.942983401252999
Encrypted:	false
SSDEEP:	384:1Fojn2PH6WNa7cr7FliUuaJ78UOr0raQR:wn2PaWNks7ziUuagJ0lR
MD5:	4BCD6E35170295D7E236FC81F8E8D56D
SHA1:	95DCB9464D2D3294B62232EEA7F1BA482EA6A86E
SHA-256:	17B445D89427268C5077E09C8888B5C0865AFC145FA930FB6A655DE82ADABB8C
SHA-512:	1A17819D3C3A2891D25E9F447D4378E25231BA24D7426FD5FD11547B5CCC6B6BA867C56FC7E2C63D791AFF602E747092851562BBF91D7F43845539E29831A008
Malicious:	false
Preview:	..7...1.\y....8..CB.......@\.W"....Z..c..#.=..C..z.K..+..ng.......WD&..".dAn.`D]..l.H..$^.2...,9....<...{N....>.....t...O....<..6..{L@..f...~....<......t 7..W\|.mCm^8:.l}/......A.......tpw.......{...>...g.....(C.]..q.....\.....Y.c.k"..h...J@.......rI`..A.O.QR...:54....#9..a...`.f.xJ..f9`.5..^fx.ai..6....=.M.r.....pZ.;...GI.B....+.P..u.`.Q...I..............Z..l<!xG...Xq....[FVz...8.6##..9.....F.......v..!.M.v.N9.J)WZ%...pi..;.M....P"M.,L.+.qh...k..F.D..`]....>e..$.&ug...k.......#.<...3..l(`.S\|C.}M.-#......!:.tR.=.3.0.E.....,M....].89.....Hk.m...C..).o.)s.w..J.n.....By.....W._g....K4\|u6.`...:)+=.......[.l.pd.J......[(S..\p.}.!.qV6...I&~{.E.!.5.t..?..S...}\NNq.6..oX.$.........rL....jA...J[.NCq....4...jC6va.J.\.l.1{.........(..S.]..hI...[>."d....#..5F....Q.?/...89.<...t..../.)>..r^.....Dbc..p:.4m....U....4.;.Ft.Ft.4...:..5?<?m..!_.We._...#.0...".k)L..\|Yz.t./.. >...A..d...+..4.]...iz.H.[.x+.W..]2.&............e.L.q......H.....S....@....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\googlelogo_color_92x36dp[1].png Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2101
Entropy (8bit):	7.90064247792031
Encrypted:	false
SSDEEP:	48:QPdZp2ZZmbk0DnbhZOPaPWddUVVWmMDPCaqJc:QPd6ZMbk0DnuagdsWmADR
MD5:	7DFB0DC8F71A87DA8735E2FE60C684D3
SHA1:	FFF7C5E02AD49EEBD4CA5DD4073DA01D6EB9F15A
SHA-256:	F977096CA33FA18837237D4C0143351CB92EBF669BE86D077FF91EA631E788DF
SHA-512:	7235651023EBD1F0B7F6A4F19520308D8CEE4A9C7E6A3DD34A4D2D4FA0164CD05A5BBDA32789374550E28A27E6EFC2966A31BE0E2B3C7292C16D81058F3149CC
Malicious:	false
Preview:	R..5.'a.e:).\|.=4{..Lv..{. .7G.s.h....f@....(T..g..r.(c.cD...4M&.Q.E.....n.....8z).B{$......^.}..Ex8.....n..]......n.......z8..R.N."......Z....)}j..e..?.z..6L....iU.x...R.....M.&..........r.......B\..Cl.7..7.V..2Y@...1..r....$....Q....A\6Uo....By.H.,....Q#..l.Gc..,..@...c.s..I.......N.;)...3...!.....Cs.......f..NU.KPx.{....JJ..4\|...G.m.A/....oOn..f/x,.....s...{.i.&_J.....O.....{}.K^....VH4i......7..Q]Qf....X.Kec.......h..........E......K..^R.....WH~...&....8..............A.4........a.\...4..3.9.......S.G.R&x..2.XH.n...\.O....9..?...j...i\..@..r...}.M.....n....vmhd.1..1.....H.V.`...x=5.A.=..d.2x......nC.p..B.9....}`...........Y.q...1..m....3!...]Q.._?c..#..cs..1..`-<..([.e%....<wft8iQ...y.!.7..z...V.&(..&p.8..J,.[....$F.J5......>..[......(..-.z.B.........G..I?...p.=.^.\(...#.w.-.... 7...`.Ny.k4..@...iG...K.o*.;.......B...gu.m.j....F..Tj...3...~&...`>...e8..x...pnS..5.....VQ.@O...x...2.l.Z.4".u....u.y.,#.b..).c..G.... -q.(..J.O..h...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\icon-twitter[1].jpg Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	9942
Entropy (8bit):	4.822029678759889
Encrypted:	false
SSDEEP:	96:Qt65ACnEOEtUH5q3MIykT4GNzHJ/4UD3Exb5q3MIykT4GNNvtTTMZejyj+6yT5qi:ySnSag8+VHJgUIhg8+zJTMQY+3Tg8+A
MD5:	2F89DC4EFA54EAA61D200633D5BFA0FD
SHA1:	EEF2BA2C56481B3FF68DA8790CE4B8949F9D7E0F
SHA-256:	14289E686A36376DF70D79729CD33E6BC99DC60A5D51AD8E08E76489381F98FA
SHA-512:	F1AC45971C0A1A7E8AD23C4A14EF9AF42264436FA3E01FE477B6EAC53FAD5AC7D3F1E0529057579711600E9A9D63BA7BE3ABAD2B7F51AAD58824FAE0D1BFB346
Malicious:	false
Preview:	...P4...l.'.".......n...FI...g,....w\...7r..../.c...Tq@...&......I0.V...i3....[+.Q.}..A.,.Lv2..\R.m(K.ai..5....,.,.(..w...-..c...=..(/?.......M^4/'.5...."..^.O.3..DKH.y.2lD.).g...D..F..Wd....\.a~.)P.1....U....+....l....AV..E....s;Li..s.?u.+$....7.n.....-.-.u8..R..Hy1...x.Ds........$(.6..U..7Dg..7C.^.t....o.8).%...I{.....FJ5]9?......].>]..{-k..N9..1......i..s......Y.m?....A.g.I..6.rp/.l..c....0......~P...A.2.....k..eB..a.7..w...WO..C...M.(..:%>..b..;....[_.....G.s...w.V0..D....W..[..5...R5.x..1-U.50......]....N..f....0.e....a..Ye.w_n....."..&G>.:.k....drk9e....p...*.......;.Y......=.V.].2.=.H.jm....G...P.gt.......D.uBkb........9n.LEU..A.:.M....b......~.p..M._..K....8...p.....g....."..})\|.`......^....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\images[2].jpg Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2551
Entropy (8bit):	7.904082169408622
Encrypted:	false
SSDEEP:	48:RTVOuOiF7BjsRqbxmG5yg7LW/GZofuUaz+uSNTG2ChaiceTWksi94V:XuiF7Bwmkg7sG2f6zaGQiceTW3V
MD5:	18FDFED2F064B4E125C67475245C5472
SHA1:	4A1040D38D22DF5135C7061A2EDF0287287C80C2
SHA-256:	B4272CB70FF926308AD7502CB6731253033E4F452E1EAD585B1037C1310D0EAA
SHA-512:	D6D9484CBAD528EDD37DACCE1F1B60816D1AF9F7327A7ED31A8EEC80CEEB9CC61BF1223AB437212853089BFDB3DB116949E4BF492286ACDEDC403D1BF351DCBB
Malicious:	false
Preview:	g.e./_..<..I6..v.........3....8.w.N{...;....3..eu..-b...}'AG.n....P.6..../........)f.....$..coF..f.....:-,........W....A2.W.8I).7.\.M.c....p..E6.8..h.DQ8.32F.....V..5a...)....,.A..Ymd.....z7?.8..H.t.m..z....}..t...RK>..s'.I....H)I_nIc..x.a..e ..aW.y.....].T..W7...N^.........k..".E\|a..e.Z).......\;f...bV..p._.9......%.p..f...;...wK.!;...ep..\|_......o.bm...J...8\.I...[.aW.M.).......4.#/.]...%.`:.-Zfu....CT....G.{e.%.\#....8...ef.0E\...dP.....5.........)...8...........-..pR.A....).\.h..{VG..9..!9.}.v........O.q......`$g..5..c..U..)......q..6S...>.......\!......E.]..G\.3..y.y....^.4...I/..d6...e.p..,..w.l.B..K..$ g.)....=^I..h.!..pz....#...@.....@[...'l...P.U..ru..KH..h......_R._..J..#....9.[.6c..w...ODTz.~...T3.l.cg..$..#....4.......f...-H.....c2.A...M.3.OU&...3..\..6.yE.^k...-....$)7.,O>...?I.>........u...e...... .....8..8.<..+q;$..6u;..(.^..Zl.z...i..K.....8..+.9..1.9{!.H.P$.+.b..r...........*N..0.C..:..A....q.y{:....6.....U'.Y.aI..T..UH.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\images[3].jpg Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3216
Entropy (8bit):	7.915354926372153
Encrypted:	false
SSDEEP:	96:bGQHiAWL/B69JThmfXB2Os5+D3O4lvOkop2Tv:bGRL89JTcB2Os5ml210v
MD5:	5611C1F6FD8C9E2A0AC13FD7ED2E6EA2
SHA1:	4C35FEFCC72471CC273D55C0AD9C9A0BD650C624
SHA-256:	4F7C288D24844336A0A94BD6746A2428B9D7D7E04AD052521C7DE0B69C7B1347
SHA-512:	4AA1658348B69F3EECC0109B10B41517D92F209187BCB8677DF004179ADFD83FA21DB8AA2961016598E3CF2E0CD5B9294470E73A7A7B721713099C24F342916C
Malicious:	false
Preview:	.. 1....1Fe...{.$....y,.3#...!...-.k'.9.J.Q..(..I..#1.u.{...0...>}....A.'r..F.>.....#^."X.4q:.. R......x..M..R...3....V....Z.-.m=...=...&k..6....U..^..5..C...vR..e .3i...#..C..R...A.......e..F..k... gW..]+.}.?....f..b...7...:...$n.2.N5}a.@..e...w..k=e\..SH.h.G.H)...xbI.....@R.X.w...Z..pB1.:.Fu.MjI._..E.?......A...%...2E...0..t.K0\|+.N..j.R..2.nBY..L.C.g...O.JX ....e..@..7"K..~.7.I..............T...L>.R..N."....a6Ap...9U....QG.......S.@..?...\h.........0g.U..{,N4..`.....<up.)..q.../...X.iL..%..vF......."%.E\|H....&..'A[.!.....I._..l.-..%.U..R..W2..o..Jx......."@.0.g.^@..9...........8M...9.."..b....d../.G.sZ.K.L@.l..B%C..k..l}...U.y..`.mi..Vm.q.Oj..?...p.l....&.>..."..y.}1_,.\.:..\.......GAW...pw..s..g.h....[..........RJ1Yb9..............#Jz.%.,....IfX^o.u..i..8..u.8........S..7.G.}....W.q...[...p.M...U=.S......^.S%.0..9+4...h..)...$.(...JyY<....S.Hr.*Ve......>...g.8....ZJ.7..0.Ja.....%.w.J.-Q..R..6g........@...#4....}d%%f..:.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\images[4].jpg Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2301
Entropy (8bit):	7.91180341261411
Encrypted:	false
SSDEEP:	48:4bE+J8KUGP5dL1At/2qbu6KO0DDBu2NU63zcSraR/xc5+:WEMUGP5ZGteqbu7DIy4uaR/c+
MD5:	3878EEBACD44F6E22569A6FC459A1192
SHA1:	1748A9BD30A62E9887DD765945A5975008BEC727
SHA-256:	D50F8A9319E2739D173213DED41E0C0C168EB7445580DDB27DFC0529886A149F
SHA-512:	857F8E3DB5405B0F9C1062F760AF30CFFFD8E36641D70026333CFEE328DE170B0F90C45BD1EC7A350D18B41435516DED09B2D2B26794B658972B268D68787DBA
Malicious:	false
Preview:	ZG...Yf$...K..:E..A......H..Q.D.F..w.......z.fH.+.sO..lL\....m.e@o...t....`.2.s......4..)o..V.P..W..4......t.d...`........t..9.....q.Qa.X..]L\|.m..IMd.E...{..K<f..N..Y...........+..&..f.$..CP....}.n[.<.....G.=..A--E.........Te].X~.?.U.8.....>:..%.,..\|...Q<x.j...s..d\(...p.0C-.7........\.c.e.l.l..&.m.a...5rh..T+ L7..4.`(.@./.F..u-..Z.Z...7xZ`......f._..._.EL.x1Ww.....;Z..=..h...J...t..o.......Y3.S..qN..\|...[...#..h.7.l.....Qod.9.....b..S....TN.'?..d7P..+....3.Vpd..Rw.P.wOx.S.^..F.....}........z....\...y.[..?..z.....s..7...Qr..N.&...Z^.V...f.^N$...V...0yM.i.;o..`.q........n`..6U[......$WB.fV,.....E1......+(\&......l...s.2 ..B.n<..N......\|.w.5S-.Y.c.sFu....}3.....A.<.d..(.......g..jyL..yY`...?..>..%.....3.vA.V.5.8../...fk.D..99R..%%SpA.........$.dI..>.L.%{".y....E..RT....Y....,...s....2.'g..<=..i....BFR.UQs...<....J.\.j..RG_0.MP^.i..d...0.......e....p.<p......Y.g...OS.//*g. .H..-.....B....X6..dh'.4H...2....4;z...4..t.....7..+......

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\pixel_tablet[1].png Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	126207
Entropy (8bit):	7.955145358302313
Encrypted:	false
SSDEEP:	1536:M5Vb0/31NlUuCBQ7jVRuUpx5Vb0/31NlUuCBQ7jVRuUjn5Vb0/31NlUuCBQ7jVRi:Cl0PxCBQ7zBl0PxCBQ7zRl0PxCBQ7zi
MD5:	D6D114DA0B26EFF81EED75BFD2182479
SHA1:	5F1DEDBF10E5D80A2EFB2DAF3DCABFF0B3D42EC7
SHA-256:	B0F7FCD9EDDFF9724A94CE721565B092C942A8EEF30940084FCEF0960FF0BCD0
SHA-512:	4101DC40610372FBCFCD8D7300228BC003CC3ABEDBD7601BF6A5C0F0291D9A0529576C53B25C9C7B63A70D7480A189CD01E3386621BD1BDB3510089B82DB5455
Malicious:	false
Preview:	.\.\....."..rw.6>.V.&..Y9.T_...m...j#.G.$.}.........\.p...j._.w.e....t.[lq..."...A'...H&b..2..._...Iw.....L..Y........E.u..%y.<#<K%..u.C.5j...<....:.^x."..N.C...x..W3.8....:.=..<c...v-\...-....&....g...Yp..]yi.x...r...~..+9...GsX....e.;..#.b.X."....Ez....Z4.&.C=.VR+.7...X_...-}.v..?..B.?..z.Y!F. .k`s........rS2.........8....=r..P.x.d......0.7" .......r....[..b]{..D.C..R.%.....h..........0${...x..$[...!...h.:XZ\..........H0.H.oR.;....A...4.k#.f......6.. .......\......o.<........:G.qb&.n..... ......M...9.$B.#~.Z?...(u.....#7.]k..y...a....[..n}.........K... ..?.p..l?@D.V.c5ys.....j.-}.\|....y4.....9..........JQ....G.e...u-N..0F......sy.$."5..!...2T..`.)........t.x...e7.....m.s..#MN.e...G.StH.....$.....g.6...P...X..NB&..u......zil..qv.n.Ssw..(Zh@8.4K...\|&...o`..J...K.R[N.....tRNS.......(....B.l.[..~....IDATx..N.a...DV7(j....N..b\.!..V...X...Cal%.m.lAk.....gf...D...y.9.....g<w,&.W..M\h./?>..S.s.....?........b..^l.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1992
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	2D707791A014BFEB049FBD7D87170190
SHA1:	87AF3841A3259CB1016FC2D7F4482BA8F1EFD3A4
SHA-256:	1077033D0E9374BDB9DDCE254EC1D80AC2B02A10EEFC5DEB9A4F59BB6C31791B
SHA-512:	91EB7F9B388ECAC04D9FE2F604F265251A484C8AC10486DD80E44E39B62DEE1C00DBC3DC54E4D6B277A96E5F5E06D2CDB2C95B0EBD21BCAEF6391CC9AE770510
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\1599143076228-3140[1].jpg Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	262313
Entropy (8bit):	7.979054409384697
Encrypted:	false
SSDEEP:	6144:GzzECR2bC0AVo2ivTRI81eNozzECR2bC0AVo2ivTRI81eN8:GH7QC1XibRPEoH7QC1XibRPE8
MD5:	88A9BD9D2D9C98715788133629E0FE9B
SHA1:	6480F901E8AACA88B1021E247EFC4A228D886FC5
SHA-256:	A73738EA245A8778768CDE7D0C3B39DA3844BF80F7834AB9F6165EDC71BB40DD
SHA-512:	AF6FC5B07E9D76222BC9CD3C982CF5F3B3687ED70B08B74F919F217E4DAAC0418C16163B35B475BE7A89BDE3269194B60CC0A4B4F4F2C77D70C6D3C0ECDDDC8F
Malicious:	false
Preview:	L.J".R..U.F..$...k...n.nc:.x.bFV.....,\|_...W6.../cg..f......@6....S....bj.a?.....wB..)B.z..1.x.NwC...`7.....> .e.....4.].or...\|.T.(.....~.mm.0+.G~.....d..Z.b.H.X..\.....tp........gF..o...@P.k.,.#.w..S..... t0.8.....E=....:...c....r..C..k....<1...a<....t-f8.....23Gc..V..]...............x.o.6...@.b....b.?..l.TqA.A.W...x.........cknO..".fj....9...b,\|z$..O..w.B.d...O....'...N.,.^7..=8......k.<.]..5...RR..q. .x.\|]...G...HZ4k..$m.J........u......$"...R.....6..D...$..6.[...k....e.x.G.........I&.q.1.L5.J....0..uo...`.8e7......c.K.".....\...........\.nU..VO.oh...6t..U..n.....>-..p......t...5...5...V....C.:..4y[...c..I....=7g......7?{...'.d.H4...yTK.L..d.H";..\..8,sA.$#....ES...w..O87.D...M.@b..?..J....\........oam7...4OK..w!.......6.H..E.~.\|.r.R.......$..F)I..Z./.c.q[w.....E...4l.*..;Wn4W.D~...A.....HX............Z. .b..A..F3....Bn...x.^.0#...;.6h^.........>.n2,f..A....x.x..}..V.\|............e=B....b.......o..+.a.h..V..0.k..r=G.q...`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\20180416_102356[1].jpg Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	11495
Entropy (8bit):	7.950734478743823
Encrypted:	false
SSDEEP:	192:Hd5RL3oVO/wqIHnKJE5OwrlF9/VqOySVh0Cw8oVO/wqIHnKJE5OwrlF9/VqOySVW:95RL3JI9nKublF//yqh0AJI9nKublF/o
MD5:	73592A00D192C5976C52D79AEE703A3A
SHA1:	A20F29796187347F53A7263AC6A714E31170E289
SHA-256:	68EB4961A853D12B8933F6AC78F651C9B1B8FD49EDF7B2FC417D1EB33BB8133A
SHA-512:	BE06994ED528C72603892AB4FFDE74E891AFC9ED727C065F82ADBB912C2B0876FCAF5D615D3DD0005FFB2B0DA450C89E5C052D26B5D76EFD09D4760F410F928C
Malicious:	false
Preview:	h....f#.IPZ.SbB......q....lRc.>.O...V...!..~.s%.N..K9.c\|6...n...2e.....o.......^.5.4...%.7b.+>B../#.......y..........:{..,..KHR..M....0.u.u..d,V.a.}..D.~......3...Y..l,....B..Uc..ZD...(.^.H...`.../n.O...6O..'..4..I&.......E...!.....D$...<.<....ju..!.q..5V....q..,...ZySc.._0.;....h.....s.[!{^.Y..0hTY...b.[..8Wzj.#O..ZE..r.1.D...n.lZ....g0.H[..f.....K........[....{q....C.$;'4..x..).H....P.H..E4..+.K..j. .j....%..u.tE~.)....>..B.8.j..h...%.........8...T..A...j.~...-SZ.qy...8.h.7[.k......6s~@...?.a/..m...'.W[.....V..$.u.6u?2.R>.b)~.,.........O...-..<...r:.C..#E3".^.".).$.c.g$....AW..P..d..Q..6W..G.c.H../J.b...e....W.I..k....../..S...rX.u.$Zx............_.;.3h.P....;..<....>4.:...0./.e..K..?...-.yQ.Q....s.`..y....u.9,w.(??K..O...[...EN d..202.e^.Y..:..Y.[..$.."...Vb........\._...<...]D)1.9d....rH.......o7....,......x.%A.... }G.m.Z.....'....'m......Ko<{-2..-!.O4....@.;.K0G..$.s..( m..P..s.:*hT..'..\.'.4...=T.Y.N.:.U........8....[Zk.P.1

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\BB19xJbM[1].jpg Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5139
Entropy (8bit):	7.927930499162897
Encrypted:	false
SSDEEP:	96:CBdlfOS8J7yN0OXzMvBgVocffFkHap/KUn0lBuyN0OXzMvBgVocffFkHaE:CDlGrkNX0c3FkHaBTn0lPNX0c3FkHaE
MD5:	160EE0858F2F149D5C783561C873A91A
SHA1:	86CC3763BD54332DC250D6C04C9EA96A76637BD1
SHA-256:	011430CD77E2E96FBF353A13D316C4BBAC55B35405EEEC94415950821AA8011F
SHA-512:	121E3C90F927E05FD8F5ED781C4A2AF4E94DCDD819537C658C43C974DF1DDCD47B97F8D6642B9ABCB3ECF3CB8E8658B4EE1453EE696E2583B6C2B7C2CFC9C063
Malicious:	false
Preview:	.......\|.c..J..TX...._.N ..Vy.s..C.....Q.....RE.~.~.xxa.C....4..]Cx..'fw.....T...R[[a:.R.2..4... ..@...)MkR.+....m._..R..YD...s.....z7.R}.]@.2.T.d....B}.X..=0;..d..V5....J....\|sP.....<.'....KJ...........M@.o.....G..:#....g.z2Q)UKF"..K....5..E.....DD..EHT..w%..s.......[.Iy..,.....W.a u..a.....g..[..b+.Lv.R.-.......$.U..Aj.^.]..s.Rd.T..H.&._..Y..]Z+w...&.;m.Fyd...V_}.....6..wh[2}........q..J...,.h./..bo.X..A.7o../]...Q..........}.n2?....\|6...].....+.....8 ....F.R8.[.....P....m.... ..J..8g.C<..f.P%.L<..c.L.\.L.@...U.O...9{a...e,.Ja....!.:.@2..-.y..Ud..V..NY#.P....A.......B.Z&.s._>.+.i..c5.f.....i.'l .6L..M.,+3c..."..xD..:....M'.6.Om....%.a......Z...sd..Tl...0W;v`..U..p...e.'g/.Id..Q.."?!8.2...n`{N.>Gs^........x.p....mu...Y.....DQ....H.4..{+g1..c..tw..I!.D.;p.p..x6..u.....e.X.@.....l......c\|.g.\Z.[H.i.........n.n#..Qe.A.?.....jB.3.g..3....V.b[w..w.>a........c:.oR....?.....%YN.Fv.....`..\B....d.....5(.<.=.B......OU.+._....gh.......8..i...c....J.;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\BB19yKf2[1].jpg Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	25905
Entropy (8bit):	7.966423875851623
Encrypted:	false
SSDEEP:	768:1naOV3hy3zikvZk//t7paOV3hy3zikvZk//t2:1neDp4tteDp4t2
MD5:	5B306639615FF64EE3BDBC4502462067
SHA1:	384ED4EB519E698302C3E6277C2371365C1ED63D
SHA-256:	14DAAA7A517E007D50ACBA62467C01F6BEEAC0FB8473CAFBA482161CA05383F7
SHA-512:	79B4668DCCDC3D101458C79A295A6C0D81D9F8AFE6AC386EC2B9AC676206046B71EF5962D92A5FFE2BC38E46A9F0062C1AC238D97D0F2D40945035562AF2A3AC
Malicious:	false
Preview:	......_e-J.(..y...u..?.z.......ov....o=..3....U.B..&.Pm(.B...e..S..m.\.......60...A#....@.E.......L.}..V<Eb.. ..H..n.${.R.......{@...-.B...".S.9MCa..5..6.+.n...F2v..4..u?w....&V..;.2e26.;.1nX<...\<....rw.....Wst...........%w.y.....2x7.,...jr=(.n..0..eo..&q..D...'....6c.y...p.v..+..F.....`....o...S_...1..st...t.{..#.....[..j......,6(.[.\|,Z..@p.iT..N.l.mP..Y...9.......z1...m..........&..x%.!...s.....CY.;....4...[....?;z........d...k.s.wg...mwI.T..".Z0.m9uf.<&.ey).r.[9......].z.../h.2>.. ....-..q....P.`.,.....Th......j.X1.D....K.h..)\|o&B.CO..<~.;Ed..Xao.=..].k^.9&>b..F..^...P>......GC)..d.?.2..z87..?o%..`U......S1c~'...6.................}...e....SIg.. ...u..OI..\|.a.o.au..(..BG.%.....#.o....x..I..:..[..l.x!-r7..V..~..F)...:........pO.HD6....1S.. LZly...1.=.7&.......HS0...;S....aU..;....i.,c..."...I$..q..qQ..{.7W....Ta.Vd...w.:.W.......u.$......7..2Q)ld.!.07n.O.V...8....f..t...h"T..3.......5b.r..@zu.\]y....n.!.I.j..h.wq2..Q...z..u;#`mdNc..#

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\BB19yuvA[1].jpg Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	25879
Entropy (8bit):	7.956207100411313
Encrypted:	false
SSDEEP:	768:/PrFUkW/7xLu114tTxrFUkW/7xLu114tTt:/WkWFLu11cTUkWFLu11cTt
MD5:	16FCAB68AFB5F671BEE3043EFAC74ADA
SHA1:	F07A2B59728FC3EF5DB208AAAE9D2BE7F41888D5
SHA-256:	8AB4DF7D28089AB80C3C6FC9D8C89D2AA824B6839E376A2E52D4F9A357C4AAE8
SHA-512:	15D084AD110840690158E4CA38BEE2C04ACAA4591623EA947994188ECD0561C04FE622ADB353130C314469CF5C35E7220A1DDDA6A7A7FFBE0D4EA05A40C778FB
Malicious:	false
Preview:	.XE..15 ........^....,h.>cq7...}........'9.a.Pi..S".N6Z}.bz..L..0.1..t..&.Ekv..".k.x....\.. ..M.{.88z..;..RX..I'..........~....x..@....F.!YK..:..y.Zj..d"j.t.....A.[.......B....v....e..k.v.T..!..(.Q....3%.u.......+.e...D....(.6vZ.p....&.Z.5.b..>... 9-O..yq.w.....}K(....K.\|.N..00....v..+{..,7P.S.^.Q.......H.>d../.....lm..A.\|:...i....9.+.l.8.v...Z......x..;3...~;....?..r...@..... .o/<1`...}..k....3...>i.rZf......&.X.6..~...9.W.....B..F..q.BV... .@..:.-}<.X......u%wd..M........s...6../..P.2?...9....[.b...\.H..gh..JO...?..A..]U.......1...\|g..../..P.....m.=/.ikw_ntM.=6....q...+....8.X.6<...=.Q.4%.....C.q....u.&.....bl..I.SC....j...Y..c.{Z..DT......;..'0#.....$...^.T..@.TG.I..........X.....y........o-b..O.....TM.E...\8..I.6.`#...6.......M...(.I.LP.x..&)6..x..&)6..#....Q`..(.I.1E.....v.@BzR.,Q..........(.R..W......m..Rb.-X....O.K....m.M..h...T.h.N.r=.m.v..\..f.!.T..N..T..<......Q............A...8..S.8<:K{ .F.m.k..H....F.`C...6.M...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\BB19yxVU[1].jpg Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	15239
Entropy (8bit):	7.933300602104866
Encrypted:	false
SSDEEP:	384:et5irxAenBPYAQn5GztHgwbrxAenBPYAQn5GztH2:G5i9AeuAQn5KHr9AeuAQn5KH2
MD5:	6A5E7176C93314FDB7968FC3C0046137
SHA1:	854B0AE68B2486F71D52B780D0130385E7222DCC
SHA-256:	F81BE1CB8EADBDAF8DA71FEC62AF5A883163F90C871C645875D2ACD90C965723
SHA-512:	E6305E96FB93C55EC331C36ABEFFCDA8202FA5FEF87C682D17BA6D58DA9DBD4726B30575F2AEDCBA21751AC324BEF1092C00E6F9638EDB97AB3251514E7DF924
Malicious:	false
Preview:	..%osLp...B.r......Y.Q....p..T2...2E....@Xq\|0.....e.!,tQ..........Iy6s..L......Z..M.yT4..t.........3.\l....G?...J$.g.\~.$..`..D}1..3..1p.<.......9....1.n..!.b{..t5.....T.p...U_..k.B;~G8....h..;...w;^,\|..q.3..i......u7...e...y..a..5.:.JT.F~}n...K..R..r._........Y...r..E.R..-....kN..._k&..-V..p.OU.".e.q..h..<.ok.A.....?..U....P}..A...!8.QA....[7.J.%.8..\...K.M....-...;....-k...A2o s\|.D..#.Mz....M..(.7../......%.{..V..x..."..sZ.x........../..s.H.~-.b.6...I@.]jrF...I.....&.r~.....o4-.H.v..Z0.[.-TD-N..UO...........~}.4^}."g..7..._!"4>....W.#-.[.J...M.1.`......7s.Ym/=z.}...~...1..._%......1.?.P.;\|Y.......#...Y...&=aM..1g.5F'l.G...../.-5..,.s........./.c..Sqdae..!.+..........9.]..h......n.}..s9....`.sE?.....UD.EI..)C....G.09.B.........E.)..q.....5.g"..0..}.}EB....a.aR..r..r(.X....ue.....s......u `..BKi.....E.b..q2~".I.l.`}..RK....>.......S..#....2."e........C../ji.6.zS.G5 '.....E....m>.?J.......(.&...j?...U.......h.......w..?v..A$.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\RE4FBmQ[1].jpg Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	124783
Entropy (8bit):	7.975226002723387
Encrypted:	false
SSDEEP:	3072:WVT1s2rsGlFs6pboua8pzmRGOhQo/LL+1e:WVS2zEw5yUOhHLye
MD5:	D2C08A02183E05723AC279ED86C71CD9
SHA1:	89AEED1572B09AB9980BF3C1A9EE89F85A5A0EAC
SHA-256:	5BE22C562DAFC32C1A5C7FA44BF78C3B293A4E02FF3447D9E5C2055E9902EE50
SHA-512:	32C43ECBEEA4C19256A8D88F3EBCF983C7E5B0FDCEBB68A7F139F2E9761F7382BA485B0DE80BE801B696965B8A85D06525396A7F72873F0B09C99441F2441178
Malicious:	false
Preview:	5..;.`.h.\.eW..E......bC.....Z..%..M....\...J......\|s/Dd..H..9%.....V.)b:..9....Q.\.{.~d~....-Z.J.b...a8......'7....r.......~.[\.!.$...Q5X@...../...p.h.9.}..itn.B.0..d.5{.'.....<..P.p..+..)=...y..m....m...#..rK..T.\k.;....%......0W.Hu..R..;.Oe.".....@.4...e....D..\.#o...G.Y.@....9....j%.....$...........7e......_...vK.m[L.JaJQ..t.h....'.PBp......~./>S.=......S.MR\|...{v:..Ig...\4...c....=..L..9a..>......C....K8W./J.P......XeP.8r.o.;......!N..~^.l..Q...h.J.....0^...l..!z.?~.d."U.....m.....m...oD.......rP&.G.<..&Rc....Pvu...p<.Q4~V^.z.(.W...........\....<...rY..f...y.$..w..%..#E.D...4...b..WB..pM.Zql.f..h...*.i.[F.%.'..#...v[...U."SX.L.<;8..i<?.ap...a.t.....^...2..(.;.......T...sN./.8v.r's../a....5s..jc..2.n..w..S..w..pMM:DerivedFrom stRef:instanceID="xmp.iid:138b084d-3c9c-4541-b718-c628b6913011" stRef:documentID="adobe:docid:photoshop:55f71296-615e-3f44-961f-90d1c4adee58"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\Windows_Cortana_AppStore_img[1].jpg Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	15017
Entropy (8bit):	7.942701406798053
Encrypted:	false
SSDEEP:	384:hwMF/izFabOzR4Nz+EhoRNLqm2EHDNU66k:hwKicOzEhoX35Z6k
MD5:	118099350B5219AECDDD42F2457F7E60
SHA1:	499DEE28416370789B54BF45A2A8F8C785CE1DEA
SHA-256:	BB7B18AC332741805F6CA724D51A5D03CCE1FE8BBC75B09D77C875568DEC15B2
SHA-512:	4D68622E0A7F54FF3588DA77F8C0768B5B3C31388EB769D44F921E9D9D6F807D44A9BBEB5424A279F790532D45A1E1B32815A5C11CB44AF4CEFB6F204702526B
Malicious:	false
Preview:	....I..:.o>F...8.O.I.1'~^....'....y..:R.;..N.:...=...... .+(.d`.....e...HT~E..HA..`.j+@@...h.4~....&h.f.#..npu.....}J)q\|.#].?...#z..r/...L.$.dB.o.....E....m.?.......ln.=}!2.I...U....).......!..T..{.u..k.j.C..5G.A.~.y#.&.L.I.{.Nv.U....&.&.Gz..>.K.....p...w0.=..S;.7.o..H......./VP\|.8..Qq..Py..~.#..s...M.5\|n`6..a...C....w."..~N.T.'.}JaHr..6h9........9"jh.a{z-K<...(..z..H.'.......+..9O`.J.....\.w.+..>...pG..-J.{../zs....x......<...........k".g..i$*.}..cnS.IPN....3..G....L...<.\.1...a..2_../!......E...'7...yj,)'..;r.b.."..l.Oj..&.K...0........G....D{x.\............j.;,c+5.J!.@v.E....j...{.........]..O..N...l...W....k....7.F...ry..T..e-.q.{Z>&...n.U.Y.b..M.WIf...`X.zQ...H^..{.......$.U..\.U..@H4.....?...P....3.am...9.Xz.66..+.0...:DocumentID="xmp.did:48E74BC833C011E794658E8F355BFA24" xmpMM:InstanceID="xmp.iid:48E74BC733C011E794658E8F355BFA24" dc:format="image/jpeg" xmp:CreateDate="2017-05-08T12:55:25+05:30" xmp:ModifyDate="2017-05-08T13:01+05:30" xmp:Metadat

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\cursor-replay[1].bmp Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	13056
Entropy (8bit):	2.5499571280161426
Encrypted:	false
SSDEEP:	96:VMdKdj3XMoqk3olHWix5jvJLoqk3olHgSfEjLi3oqk3olHR:p38oolHBDDJLoolHgkWLi3oolHR
MD5:	594538432C2E7B0B6A71A41B7488AE20
SHA1:	8E0AEC2055CA0659D32218CF0038E712A4CA4C69
SHA-256:	D6951849ACD551CD25CE6AA9FDE663E0B9F9DCBF2D10902EC43F3A52CB0F124A
SHA-512:	46DCB96141145FF3ECF19310BD3E6489E293F4B05332D96C88B5C7A584546637992829ABB0F59586DFC8AFBB9BB56FBAB571635448903D0AB1BA3A537AD26B94
Malicious:	false
Preview:	M!O.-Y.b....'s.....!.!iiD_.w.^...n.~...JD..V........fk!.F....t.u/x.z.C.....U.^....YW?.>x..........5.X..%..a......f..y.....g.f....-.....`q.l.u...dbB>D..WEH\..%P[.yDp.b.9W...UP.u.S....c.O\..__.M..).J .+....0.`..k....u.."g...J...Y..N.....1.]di..(.....$.a.J...v.....AA..}.yA..}....>.......:.wl....7d.i.....ry.[..C.Mt.am.T.....P..23.t.&.....1..........4E.1..."Z.P.^OCU.....-S....?...O{.3D.95.o.Q.....Z.....T.s.%H..Z.[[....v.`.........>...{...;.0....f.!s.s.O.R5....!O0t..#5>..3..8...;.}BY.M2..?.1a......ser...ZL8.16"......a.$....GE"......n..E6.......:@6.F..B...G.....o...;.{.....W..`.:.r.v..{.P.1..#.`..u....,.G.t.d.......(...h.aW.s.o.n..m..=h.Q..f.9...........L..._..._...t..`..n..{`/&.W..zG......1....%.4;......\%.4.J[...`v.hGa..d........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\google-play-download[1].png Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5369
Entropy (8bit):	7.913538139688611
Encrypted:	false
SSDEEP:	96:nuEUGPoYKpuef9XcAGMrO4fqvZ8Z6KK2wFD+HZ8HGPoYKpuef9XcAGMrO4fqvZ8F:nuXftcAGMrtyv4lIFDqMftcAGMrtyv4j
MD5:	D434736146B39125957A0027F064B514
SHA1:	D80E629E5FFB80374B6B613D268CDC0194425496
SHA-256:	90522A6FBFD793395A559A25E5ABDF6561A510E58EE2A680A62F19A58DF07912
SHA-512:	A64E35E92F418EBC0540A62E93BB6E711FB776007E6AE57ED7753FCC16FD39C0FE9BECFE059460AED1AFA22089FFE1E5F8DB8074C1DF71328CB94177D8E1348B
Malicious:	false
Preview:	........g,;T...&.^.;"........+....m.@..2...N..4...hB.!.70.^R.a..z.HM8.[.H.^..#.@......u.r..M_......%0...K.3(.w..cC....c.OO8..?./@......T. ....q.JT3%...G...E.....d;r\.....bX].q..x......7\e..-.u..O......{t..(#(.;,R.......1....^..5...Z...u.../&..B.j.......s6.}.?..J.5..$%..T.9...).d&...H(..h..[...7......K.+Do[7^..D.9..l...."...2....E....s.j.1.'.......K..x...{..%...m..B...T...B...66.[.3)_I. C.W...,.....M.J.U.....=/...u2....Q}E.4...W..Rt\|/....l.ET.N.x..... .y=...? ....i...}........t.7.....z0....YD..B+.&>4.....vZ..".Y...F......z6&h.U.W"P..W.r...v-l...ay.....X.........YNw.._.............q..;y..$$O.##.x\|XDJ.+.....C.r...9...;..T^..YP.......JZ.......>.......(.........}..?...c.........]...E...j.K.E....../.8I..U.g9.A.=..S.d..;\.....F.....9....]U....?:.....{.+...i...................~..r.tm.UI.:0...Ak....tRNS...o...../..$g....IDATX..u..A.......b.6b+vwwwwwwwwwwwwwww=g....y...........;.B.d"...6D..6D.H.M.F..3w.#w.P....m.QP.7M.!..MA.0,.*:.-.B.`L.b..`N

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\hero-anim-top-right[1].png Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	29063
Entropy (8bit):	7.828435323695791
Encrypted:	false
SSDEEP:	768:g4GybPzPVvYMfCiN9x/B5tBybPzPVvYMfCiN9x/B5t5:g4BHf9nPteHf9nPt5
MD5:	B09BCB7F0D68C940452D6074049DB6CF
SHA1:	07D57C0303A4B1CEA9EEC9CBDDB29D788E97A752
SHA-256:	F33506E9803EFCA571F88E7F729778AE9529537E91EC050B8F456E4B395C9BB2
SHA-512:	2F7704B16FFFFE417C8DA7E1379CC29D6E34B2026B6D27A8A36CFD93A47E8161623B5871192D9D2EE62D39E354EDAEA8BABCE69E33F74E805B1BE4CA51273A63
Malicious:	false
Preview:	m+.;9:E0.\|...8..Ra.z.<>..X..E...^.3......od.........S.\;...F.3.;9.;W.dQ0... .."....9..'..B.F.c.>..`v...Zv.#8./l.p..Lt.......(........%..$T.....G...m.x..(.s........%...>.d.[E\............a.......3H......~T./g..pP.1.....>.I....[..\O..].:+m...6.u..#....._...C..E......e...s..c.'5P.~......N!!...w...ZyhoW /..U..S...'I}..u.0.T&..MN........e.Dw..Ur.>.o..{.8...`.......0O....]rz..{(F..@7?+"...Ry.8.......Fo}wb<....e...F....+.H./u.F...@W..d.H...Y.S&.R.LW..Z..}M..1\....Rt3l.....M..Q..S$5..z^.8o.p..AF.../..9...C'."yr...........N2/m.{....O3...d..e..1`.8.....Kc..XMjM.&...-.....4&Y.%...m..>.......p.L..8...W..$?.j7.<..!...5>H.......U..U.T..9\....BCv(..\...x\|......f0...LM......7.......q....G.0.i..o.;Z...5..i(.z. .\...dK.Y.+Vq..67e.wt..#sy.?.....1@g..@......0...^...4..rQ..../...&.N...\;.,>H6. .M...@....>VV....;..V."..)...f.....#>....@...8....p.\...,..C......@..^.}......Vr7.L.......#..M.C..s...?k.$.....d[.D.eQ>.8.U."{/.a...#'{8..mU.@.5J.c....f@.......4..w.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\homepage_features[1].png Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	13325
Entropy (8bit):	7.861220197192373
Encrypted:	false
SSDEEP:	384:oHC7oFMllBWrh4xJ8DuNEYwK01CVFMllBWrh4xJ8DuNEYwK01n:o6JwrWx9EA0YgwrWx9EA0V
MD5:	73DB1FB77138046D21FA5F9E78B19176
SHA1:	7C794FFDA30B077E62B948FA8D74B2D5F987BB89
SHA-256:	EA39A01531F85BB39D34A4A435E4207BF514EDDDBD924C37E0A27F41258A9D7A
SHA-512:	5BCCB910C484CF46536626FA48049D2BDB66206C483759A2B2D358FCC58F2A21430877E04DB3E9C823897DB58717BF71ACFA648E35F838A942AA66B2F9AD9584
Malicious:	false
Preview:	.-W.6.g<..P.(.....'...O.9Z..BP.BX....7.Lg..CC..`.R..C...`.}.N..o]*.>....N..^.b.Q.........p.f}.....k...{=....Y.......3..l9..8y..0.....H.`....Cz..p8Ct.......s.T'"way..;.....pp.tH..Z?...F..T...u/....3..f..&..X&..G.....y...P.C...J....&_..E..7...y.@.s.Dv......sN$...S.wjO<.50......=....Zw..u~...^.wDM..)....h F...k..+..E...n.....b ..X......U.).7k..F'F.FZ"..D:..I......A...b]F..#>.(....q....T....N.....#.SG88........c..Ew'F................/..].FZjS.p.<......&Y,D....._e.B..H.gg.z.~.._.!EB.p^..H.6.uX_j.I'..%.4.A3...h.y..U.....U.......,&l..f.%.A...z/..U.EY.c...3K..1v.0.j....<..N.:.....!M.....}R.r).b.,o.t.0..#..L.7...w+.3.....7......A..a.r7_.....S...z.0.i/&...p.1.u....H...O.....Ml.T..'.p..VM.0....=\=\vdq.A..!...1.....$..K........=_..........#..^...I..........{.pe2.\m\UtMD...........................B....6.....uV^......PtRNS....R ...... ....71=%..+!..6.!.pA .....j......jUD....RR<0...A..........uo2&tL.T...7IDATx...;j.P.Da7)B......:7...K..C:?Pc....t....(..IW...q..<.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\images[1].png Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2440
Entropy (8bit):	7.915659352062932
Encrypted:	false
SSDEEP:	48:231KA1iiE+4nO7xNnThD5WChrkHeDJZ935q1joPh0u063V/Rg7V9:23W9nOlD55Ief7mu06F589
MD5:	376D2F7836F0885B7586CA26CB78B8A2
SHA1:	00E06C710584537AC66A8FE7F2BF5F5E3835509C
SHA-256:	06A6071FE7018B43B56FCB4D164961C1EAB02096FAC4186200954B012FB98D09
SHA-512:	ACE757C09246C3B25D7D68018074D99E8FC9046D20D09835DBDD0F4BF49449C25819434CA463FE6796088FFFAA73E500598EB1179FA0FCF8BBCF2EFAA6482368
Malicious:	false
Preview:	F.t^..27..a.1.U_.L.j<dgX.bY.XQ.z..:I.F....%D..5.R.O.G<F.........+$WS.X,s......f4......7.zJ..X0.bJ..DzIe...h\.E.\|..eF...'8!.FF...........:.....k....F....H\.Dy...O.........,..4...y...+...(......0...$../....3..&'~.Fw..F.@....L.....G...Wv.0m...C.4...Eg.,.C.+..a.^..u!F..wFz\.:.....cl..v.R.@...Km..@A._.?..".O...)...,.z..\|.0"ML.'6j.r.Cd.4....vL.H..Y{.r]].....LK6..<..B...y2\....u.Dv.xv-.5.M-..;...d..p.Vy.....t.y..KK$.V...s..f.....6.......-WA<.$..m+.S...I..........l TJ.Sgu.^.K.x....:9....u..Z.&G^...Xd..<...\r.8...R.>...<..]...+.G.4..j.Y.<....(14......a..w.;..! .......h+.F+...A......g.#..b.....(h..+.W=......e.f......[..(.... .#..Cl.{u.<.i..`.`..VLm.... .o.f.,J...SRa..Y..6.?.=."z.O1/....~..p..C>jp......]...u........`.I.T...{..Wp?.......Cj...+....2.G......'.\>....._.-<.E)46.G.=PZ..[}ix./fr...r.\"..A._%A X,......pE.H...k.u........'O..%.\|m.z. ..s....!/.1._.l>....ok2..y.....[:.......Sn....{.b~..[H,...7...~.B.......;+...Z.g......uzbY...'_?.z.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\images[2].jpg Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2281
Entropy (8bit):	7.899937524878011
Encrypted:	false
SSDEEP:	48:5rVweset1nGdEFkwXB+yutj23CGAzyzWeuHo4h81b1P8rCOw:Z3G2R+yw2LAanv6w
MD5:	9FA237363ED8F8EE65F461B396C866FE
SHA1:	C457F2A54ADF66161C477C1103CA4006550C8280
SHA-256:	DB6FFE3AE82B08461EC412589B8F54697689E74811E16653377CEFE7336FF364
SHA-512:	E79BC3E53CA2678114D793BED7F6A2D675B56A7A3854B16425F91BA3A938511BB279225D4207F408F6BBCEB5E754596A42970A61B6CF7F5C60AE9D8BD98C6D2A
Malicious:	false
Preview:	b'm.d,..Y.V.!..B.....8...9...8jk..`.....f.....Ym...:.s...I@.......t...H-R0}.b..P......%DkM..K...b,.........3...@L...vF...".]...\|...C>[...?.@.W...F..wE.^.~-..v......w>o.;o..5.j....B.X,..o.l,.-.[P..s...o0.......\|../0A.S..U...#..b~.w...E.5.)...o(...HD..A.%.?..-...4Y.E.r..1..:.....=R!Y.$&...-..f.e..."8..(1...=.........7...{..5...`. ....FC..Z..mKw....f"m._..~%s.q...B....an...5....}-.^@.J.6>Q....G.EP..Hs.~./..(..~< .M....q...fe.b.R{\......B@\e3.....x.......b..<)....b..D..G..<..!u.(.hf#`W+b.!....7a.."..:..........@..2..."36].r...#f..Ib...H@2.. .{r..AH.^....E..g.;.N.y....=......8.-OiQ.![...;.....t.<........P..D..Z:..6.T...b.....f.m.?..D.c..0.P..4i.......#...X.z.AxL........i.A.)9.2...#G.........A.....\|..DEH.B{..C...Y.c.<. .F.e......v.X.._x....j......O.\|......%g>.Ga.....s.-.....m..55N.TW.....?.=.%N..0....4.. ..V.<[.}.n..e..T...N..}........?......F...U....O.#.t..9>G...n)s..].k.X.....>..:.._J...{.=..r..4V..s..8?.v/=$...).N3.4.t..a'..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\images[3].jpg Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3058
Entropy (8bit):	7.9236382389497
Encrypted:	false
SSDEEP:	48:W+ahh64ygs6lHTGLQv/haaCQ/P9mc60eTXBUkUBByxbctBJUW5RkA0DWz36:4hhvypuTGUWOPjyxgtzUWPkAjz36
MD5:	E18483285B5E81F6E999CB2FC089C0AC
SHA1:	0387964C4047AF772A0774FB003B2FB1C9B091C1
SHA-256:	89A8D01FE0E364BB59E7F0B55F28C5A41CA718ADF1AC4956CDF695FA62C925C1
SHA-512:	7CAB6665A38215633AC5C70D2F8979A06DB0E2D0B49A83EC7937D2913770E35ECD7894EC145B7DAE8E228DD9F1158AAB0F48ECD7412621A2511F71ECC2BAE09E
Malicious:	false
Preview:	.. ......[.c'qc....!0...b.'p..zi..._...`.\|.....d...&.c.$..4;m.........v..J.?.c....@.&.<..m%.s..a.4{...j.d.!.X.3.B......6U.._.B.O-.yV....z..K..A...`g6.E.nu....^..}..YcE..<.\|..+.{.5....%..[..tu.5...Qw.?..9{..U.6..u..1~`...)...J.5..37..8._.......q.'s..W......m.[.t.G6.....e.5..'..fxx^..}hY.t..L.u.1...t.".X.$.O-bw!_\|..S.%.Q2.w..b.r.J...3.@.Tv..q.P~..:..z.......8V..".5..O.."D...7......[.\|.t.zx.ub..Z}.R...:...;.X.?.j.V.\H...%G).....[...O.`i.`O..kj....9d.x.z..I..^.I^z.!7.v..#F...9.'..G0.....Vt..b...s....Y..u.[)Y.h.Q..9B.9.........c..[..ih'..5L.~..p..G..A.x...\|c......r..=<..@.Zi..!...=..X...Fg....;.(.}.....#.l."..Kv...O./...\|a..\Jf...c...6z.8MHS...].....T..d...a.. ..H.....2j.tQ.....-@s.V.I.y]P...7@Z[.&..4.2.J....a.......p?q..T.....P...2.}M....r`n..3.G...Y......R<.E.e._.[(.\.,.t.%..X..Y!Y..Z].C.h..h....?.......y..H.....S@9.^.v..7....L.'..v7h....2..;.....n\|G...'h.6&-../k!...~.ks<....g._..He.X2.ua..S.,...x...Seu...`...'..q..2...&W8..}.X....s.:d.....s

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\laptop_desktop[1].png Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	27889
Entropy (8bit):	7.96294306070121
Encrypted:	false
SSDEEP:	768:2aPL0UOi/btsKr4/ZbVx5L0UOi/btsKr4/ZbVY:2a4UO+b7rmZxIUO+b7rmZxY
MD5:	66631BAFB5632FB25371F603DD3B4D4A
SHA1:	2314B290736D1018EDA96D31E56FE4B1CAFEE8FE
SHA-256:	933B554472421BB5D5F0082E2E3406844D8BDAF583E4583D537C5D1CDCC6AE5A
SHA-512:	F7AF379E017A0F5440E5427E321E69BC4B30A7719E330BDD5799704D2D2BBA46EC45F0E550DFCB17FCA7823AD5F9F4B25B65AD79A5C3FCAB68F8EE9032954D6B
Malicious:	false
Preview:	..nn..{+..C............wc....[.."..............D..,KJ..U....y...<x..sL'+.../..Y.>..D....0..m$..\.d. .....5.y.i.....;....P..(.5L...y.z.5..i<(.J..2.J!J_/....B.uoDQ.......Yb.{4..z..Zk........PE.P.K.Kw.+.0.G/...1\m.B..$9.p.O1($s...G.\|........(.`.2!U..za..:T...`..Y.......&T..y......\|.h>c..?..t`.....gw.:..rx..l.G..'....p2g..............5..p...?c..z.:..~.O...qm.d .t.{Jb.........)..f.^3sQ.>........).Pi.x.....l.j.."...... 1.T..7.b_.z.!....t..AS....Q.0et@H+N.....i.6..v.....>..!b.B.l..3..9q...l...XP..w..c.#a..#.B.x.O..`p:.H.}.n......>...\ZI..Q.6..N/..e.......i.d.j.Is4...%.8.0..43...#..C.$...4*T..7S..:.OLr....:.m....4.......^..o8.7....0[ta...-.\..V....J..lQ#....G.........U.ml....S.d...f.;y.c%..%..............R.iN\|.....m..j..#..J.j,.j.UI..F......r.b.z..F~F<.;......c.`./Y..SsVQ..E.).s..+....E.Udj....tRNS......=U2......)`...G..z..Bk.....s.h......:.^..2.IDATx...n.0...U.(+.K.E.H=".....R........{.\|... ..Il............(.i..$...$w.u.DC.......

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\nav_logo299[1].png Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	24054
Entropy (8bit):	7.938880539369036
Encrypted:	false
SSDEEP:	384:u9P3dsaABjAzc1GbOhhQASgpdNdsaABjAzc1GbOhhQASgpdsUZdsaABjAzc1GbOu:uVLLm0OhjSYXLm0OhjSYCMLm0OhjSYe
MD5:	B7B1057D5614B4320702D9D9D5AADA50
SHA1:	649BBB77F28327826249CE50C7FD736CC1E2AE04
SHA-256:	2F973B6799085B504BB54A55093F57D05F271B4B0D103499415C708042CEF209
SHA-512:	09CF411F895D47A8DC1C6DE13416A850364980B65147E2274B1AD25E29A2B71FDC32A3D723295CE6E619777A347E349D1FD94207B9B1A9E5AF4BF60B70DFAE99
Malicious:	false
Preview:	..c.,a.Z.@.9.........z..$.......Tgx.4....5_.[..NA7..V.HFk...TvA.....[W.S.n\|.L..=..k;g.a.hD_L...7v.lxD.+!"..$.2..q~..-...@:...9.:j).Av.[...7.-..I:...=..J.;;T^8."....p..W..c.:8...~X.........G..gx.IB..%..N..j..7...>.P.......0.b......j.}....w..V.+~...P..Y.!.H..[.bS..=...GX[YT.=....&P..T.;^..z...Z.....n......Ot...m..L`#...X.X..3Q..Q\|.`r>..fx.c'N...(AX.....qw._.}..R......S._..._..V....d!..'...6y.[).H..q.q .....K....$.y. ...'.s.......[.O.d..W....\|...N.4[..;.......l.uSDM.N..r.(..&V`.h.n.ho.(.;.w..9.=G#ta.'.?..M...8.'+g"..D.t5:.........`...tD..F..-.%......Z@.#..]M.G...\|bu.......EU..H..D.fY.g...... 10m.;p.......5..$..;..C;x...(.%{x..+..8.......:...1..&.....JVn ..n0.8..y.X.(..\|I..F9...8..$J{/D\|.c...... .]..ZX.....5S<..n.W{-~C..,..P...........i......."..".D....{............i..w.s....@..8!..9,...c...h..w.R@..ZPa....3.f.q n.......(a .@....:<..H.H..t......Y.^..q......;..`...%...V...)Z.IS..:.M....H`..Bb'....~2... .@l.>.u..@,0........~.c.6..G..6G.....#...0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\pixel_phone[1].png Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	50784
Entropy (8bit):	7.9752496488078455
Encrypted:	false
SSDEEP:	768:Xj9QSRsYNxnEsN6uayzj9QSRsYNxnEsN6uahj9QSRsYNxnEsN6uaC:X5prNWu5prNWh5prNWC
MD5:	569B8981BD56E7D45EE290DF1F58310A
SHA1:	613F2C6F14445F4BFE546FEAE7CBCA54C2F42E29
SHA-256:	F363C4CA376BFB6C2EF362DF902D9228307D138796B48D4A2384E35DFCE35CCF
SHA-512:	9B20DD8D57A448FB9DC2CAD27A6233993AE152288376620AF589FF1F347B30D7FB0A665E540FFB84E7D942119366465EFF4C428C25CF235B83E93E172B0626DA
Malicious:	false
Preview:	...=...j....[o.e'.#t....{GP....'.a{..P.MC<.v........!.....p.C.W......MF..>.......<..CA......EEe='...t.%.......... \..z.o..lz..&;...@.9l'...........N..o .d.:P..eP[;G......=.j..{H...N.-O.........w6..m.p..+.CE6...'.s'l^.3.^B...%..<X7.N...].BO;iS\..A......AO..1Q.....f..?.I...7....K)t7.P....jU...... q.NJe..oi.0..b:.L..E.'g.....x..p.,L..i...,.....Yd.x.......B.4.Z.......=...4.y.P.....8..C%#]anE....z.f.S.Fs.:.w...z.A.U.@2O...T.....T.Y'=$..'q..n....y} ....N..Y......?:.P.%.$......joZs.?.0D.#.!...4<.j..W.V....p...^....\|rR..g........:.S...h.5'026O.(./..Q.`.5..&."..T...h...u.-...../.c..m/8eJ.h..(1pQ..Wa[o.......rGW.9....,...&..iOq..:P3]..ic}....j..M..O.x...Z8...:.K.......W.....Z.x)...N....h..O..D..~.._\|.xGd..&..%I...fZ..'a...\|w.........a..\|}v..l..Z...}.....{s../d..!!...q(..'...............tRNS..jZ.'...J..7l................/#...>qIDATx..M..0.........PU"..-%..ac..D......g..=..V.'iBx<.D....=..\|8...p.~.:.u.`4.9.:......OE..[..P.....9

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1992
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	2D707791A014BFEB049FBD7D87170190
SHA1:	87AF3841A3259CB1016FC2D7F4482BA8F1EFD3A4
SHA-256:	1077033D0E9374BDB9DDCE254EC1D80AC2B02A10EEFC5DEB9A4F59BB6C31791B
SHA-512:	91EB7F9B388ECAC04D9FE2F604F265251A484C8AC10486DD80E44E39B62DEE1C00DBC3DC54E4D6B277A96E5F5E06D2CDB2C95B0EBD21BCAEF6391CC9AE770510
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\BB17eTok[1].jpg Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4139
Entropy (8bit):	7.92324153429613
Encrypted:	false
SSDEEP:	96:DV0vaoR2gtZBtEp9REBRbwi4ARfHMPsbGvBcp9REBRbwi4AR5:2vNQEAp9RWqAlisbrp9RWqAL
MD5:	67B23D32C5FED4367C390B4CBB71CC4A
SHA1:	0EB1562A43E98F893621845E086ECC9E2082EB0B
SHA-256:	A9BF12107478E255AB05B92579D25DE4CB4B1E251E7E0B94A0CB5A52753061F6
SHA-512:	9E8410CCF837C1FBD7730D6996CF37F66C8ABF5C91A78F19B6A1D9215E9044F50BB2C8349C095A27C78E2F44E79ADC541A442F577CDF0B53F0A997D38CAD6372
Malicious:	false
Preview:	....3.HM.T..f\...Y..f'.e..:N..=KI_T.kv/-..j._G.M5.x..Ts.y..\..:.&f.W.....J"...:..E.}.}K4..M8..[.(JSS.0......e...4..K..m....jP=......C..j...J...k;.....,>......(t....C....9....d.NY. u.y....O...G..f.MX.!....)....i.Q...8Q...]..D.?..n..c.Hc.t..\j....^P.+`7(D.w.....l..i.I.~A..w..1.i(1M...F.G.F......]....!.$..N(........... .......xK."c........5...8.;j3.....^.^\|...:.v..'X/wX....._.mdO.._/..O...L.V....L.vg..6..TRo...nr_._q4.4I.:8.z...Z=.qdZA.j..@f_-`WS.3....+..n.V...1..Q.3.(.w~.1`.Ue..]h..8........V.jH...i)..r.~8.\qR.L.h..E.5.@.+.......;..gY..ci.ca.S.t..".....A6....w......kDR....c..m..D....A.kL.k.V7-.X.}.@..h.q...+_....aO..t..}....)eyp.d.=:....d\\....Na..\&...........r......}'R7.....v..0...C.>.4aQ./...UJ....?.w..o.h8i..E.<..P..\|..^<.... ..C^...}.9..r............s@Q...c.9.ZaW....L.7m......dG....uho$...M.~94PI..\S.K...c...,L-.'......[s.D$.....>c..q.Z..b]8.E..,..0.\|..POe.....L.!p...-.N`...L.5..4t.i..~.s.x%...o.?.i.0..8....=....T.,{.-.3...$..VG...llr

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\BB19ywNG[1].jpg Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4295
Entropy (8bit):	7.925303484056644
Encrypted:	false
SSDEEP:	96:8GlwQa11YFJrxFWdR+XBRmtFc9A1YFJrxFWdd:Rlwp1YZFWLBtFcG1YZFWz
MD5:	824B1946F047A5977112193125103970
SHA1:	A13326A768397EC78865EA73DA701A2234654910
SHA-256:	5F47BAFDD0B263E93B89BC49BA4B4DCABA453067B8EFF553A126F6676BB340B3
SHA-512:	D999699222A2C7061144EA90B7D11B45F037E316DB24BD707DC76486E02F3E52837F08D45B19A822ED08FB03336374055A4548E122E7CE3A40F193194D811F03
Malicious:	false
Preview:	...Pq........7.A...............].U...$S.~....OOJ!......fP.y...v..:..............^...#].....\|JbS.F.w%.j...Q;...{hH....k../..t9.X...v.d........;@!..d..(.8.+..a..;...o...]...K.V.ZT....Y^&n.....z\|....c....~[....P....}%....@...-S...S...~.....`..ZP..&....(.4......I....K.H.#5.Aw..,.=.SW.o...j}57..nt......$/n....:.....]%!I.F.....7..wc(..,~.^.y~...............H../.4)..Z...."..lw...3.$.TE5....T9...D...W..z.[~l3..T...D...5u4..p.(.."..v2..~.$..a/&IBi.........5Kj)30Aq.!bYlH.te....u5..}A...e.w..6\|.N)..8.F?..c..cu.RO-=k.8.jj..h.L.V..U....4...-.....ko1K..{W....9.o<PV.........Q..E..#......C;YO{.jp..Y...w>l..j.G...0......8a8%...:.+\|..4......'..-..OA.F..C....5VW..O.O...h.c....... ....d. YE.>^7I..{MN....>X%!I.x..~...+SQ0....#&..X..W@".>..I.#c.:.+.......X..`:..Mo%.#.Fx.p.`.\.....3Kl..9..q..>wftbik....Xa.1a...\.h.....}3N....].X.n...p>0..\|.dx..F..w.^....C..F93.......Z.......F....3..JJ.l...s.ph.J..=wL..O.;?....o.......+a..dz.mCys.ks B.H.........../

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\Chrome_Owned_96x96[1].png Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	12453
Entropy (8bit):	7.951291955719806
Encrypted:	false
SSDEEP:	192:IAJbxbf5N2TuB2Rvc2ryzZhtG7drgqnnf5N2TuB2Rvc2ryzZhtG7drgb:pJ9DibZrrKZhtGm8ibZrrKZhtGmb
MD5:	652765B45CDC8F228AE025C4DCB8A894
SHA1:	71F62B249E114BDEAB8B1028D6FE3CA6900DEDAA
SHA-256:	469882A9C4B36F25F7B09C1535571F8AEEE23C83DE54875B62B84F2ED2A7A487
SHA-512:	E93E1D6FD7013335706F7A2350FE9612F1FB69A97D651D4415266802F4C79188896EADD5C27558E6414A3124BF935D197FB2A937F177B9D9B42244DAEE651007
Malicious:	false
Preview:	H.F^.mV.d.3.FK.........w.:...o..>.....z.._.........>.%.u.L....Q#.E.3n...`.t. ...eFH49.....ds.....ow.....k@..).ek/.J-U}Bx....O$.P...C.1}G0.n...N...A..XM,.\|.F........E^8....(..:3Ri9....A}sT...Q..g..g...c]..K.0.2!.F...."yjS....B..8_.6....d]..4....S...u..VV.......$.H....M>".9a.....i.>.(........^...W.0...,.p.q......8...k...D...\..P....w.K.I.Mj.<..c"j=.. &..\pmi..#........$.s..J......z.....l....I#..+.Ej.Y.S[....h1.QyB4n..h.j_;.......it.g.N.-V........K...?.W..+.wj/.!...ad.#..t.J.t.2%..M..j..Z...P.....t:?.4..Gx..~.....[Y.J.!.............Jx0.<80.....D!@....!.aHy.d%&....tx...p..j... ..G.Q6]..Q.P.Ya.W.....m..i,~ ...g...R.&.q._O,..k.2...A.j..sy..[.J5...K........G&....e.....T=@g..W&.P.K......Hq..........r....5>L{..........CN...#.#.OJ4v..H..P..Q..a! e....q..\<..mH>`...CM...8.YC.H.2.......`....k5.~.n..!!`.....I..X.<1.&A.......R6....a.@.#..~@.`I.&..^t.....3./..K.....W.DM...k.E...~.9w.T.^..c_..\)..\......z..R......#.@...o_z.....9.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\RE1Mu3b[1].png Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4087
Entropy (8bit):	7.9303009655033545
Encrypted:	false
SSDEEP:	96:ERtCGfx3vE724xoiRQJPrjpLKSFl9oX31Z1d:OhOroLtIclm31Zn
MD5:	02F384F387EF98BF4D60C2B20854AFED
SHA1:	B2DDC7D4CCDC659D088AD7C7D076127A8B3B67A0
SHA-256:	63D1E1A9AB0D3CC815352AA08B448943268EB10BFFADC78A5FA281F47065EE4A
SHA-512:	848128FA2EBEDDEA2C183CEBE4344F1109FBDC623E152FF4004C0CF8137820DD4045FCE9FB5EF8F4554C67362AC0D87B4197B22CCD8E923EB0FE09B8EB7C15FB
Malicious:	false
Preview:	h:C..=.x>..1m.$...U..q..Q..\K)..FI.9...a......!.V...BE..`Y/....A............k.@..(.)...!.vL..hS.m.^....R..CZp.}.g9aJ..Z.a.+..y._...#&..[...W9..C....&.`#..J......]....X.s...v.Z3.....?.....b...Ta..9vF/..y(-.....i.N.X. .k....F3/N.y2.V6...lo....S.%...`."yZ..0..r..Q..6EB..B......,CZ.[.p..%..Q.s.......B..D....(.@..o7.........I..=.l..CW..c......Kuj....z.V.....gBDHm)..I.$.......$W.k...O.`..N.=J..A(#..g.`.=z..2.....i..8..y....}...4+.B.I5.O.A.N7.....+...Hr.g9..8q..p.A.2.\|q0...=..5q...#.;..5:SB...z......a..:(hy..>.x..UAQ0i..Yd.Y...i.)p+....\|@..{..$..C..r,.....Wi...DX....=A[.l.g..9.!E.!_0.9....$..0..K].....]e.........K..g......T...R.J......D..s...-.Z....2.v.e.0...$.....Cj.E...u...........T.w..p.;..W.~[.....8...t ) G.4".Tv{.7.f.470A111E6AEDFA14578553B7B" stRef:documentID="xmp.did:A2C931A570A111E6AEDFA14578553B7B"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.......DIDATx..\..UU.>.7..3....h.L..& j2...h.@..".........`U.......R"..Dq.&.BJ

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\RE4FGwC[1].jpg Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	134098
Entropy (8bit):	7.979824958174559
Encrypted:	false
SSDEEP:	3072:ddA5jGA1mxEwLzUbPm+6x30mFj3MmzTUAC2I7Wl74wYBnqZ:d+5/196Rv2mzrkGYBqZ
MD5:	7B0B6E66250EDE69411422266F7C3DBD
SHA1:	700F23E5BC577413561317CDCDA125BBD3DEDDF0
SHA-256:	F8BBB29017D9B7C612447172F5C16C286CDC4B63956D5ED740751FC88A90B0FC
SHA-512:	E11F55641FF9D142E9207018700362774E4B98CE346BF5C3FE677EA0B2632D62EB53CF0152980B4F9DFF22BC255636CB7595EDEC6B1F5A1301DD2FFE1A7590A0
Malicious:	false
Preview:	R@B9..G..].V..7h&....O..S#.t+.=.O..c-..'d..u..Fh.;.. ,.l..Kz....8M..}.@..Re.R[.7,.lqtb...8.;(.7l.D.8.g.$t...d.......&;..K..X.....:..Y^....).v....=...p..b.@.5{,..s.......T.W.&..."%H.a....{....!9w.S..+m[.FA.ez........{5..j.C7"&.....0...I%...Y.."~.hU.~1.. .X}..._P....S~.3...r.m..".+.;@vJp..-.c.v.......Q.......+@G9<.Li\...Gn:..h.o....[...>....]z.:..+..RC..m.8@..I...GM.V:...X....v.>....B6=.!...,...S..G-.....9......#..].L\}.0.._......f..N!~.pM".2.l..(..}E.\|...\|...S..~2QJKQ.]_C..6.......rk..oX...K.Z_7..y<$v..Y.T.".....$5.\....V......0.:.b.]O.;......X}.,^../.%..'..L..x.....a...\r.+.%.XO.O...l1fw.......R.....L.-.5...._.._.D.^...ZhuW[.h...`.....)[.!G'uo..k0.h....\|....CrC...b`..y..X.M.1.o.4.&E..&.{....['~"d..O+..+.i]^.R\.yI..*+3..1(.lXpMM:DerivedFrom stRef:instanceID="xmp.iid:01975f7c-45be-4eec-892e-ddf3cef31740" stRef:documentID="adobe:docid:photoshop:81832270-9d95-4244-b31a-520c871695ac"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\RE4sQww[1].jpg Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1331385
Entropy (8bit):	7.985896205502885
Encrypted:	false
SSDEEP:	24576:NGe/77J1xXvIZgeHgpFoYZJP4kiOJwFaMJ/QltP7Dtb/pWMDKvHr:NHz7JzSgeHgDB94QJwF+tPVbhevL
MD5:	B09AC1CB8B3D8B030EEA8C3E33BE6863
SHA1:	50F54C34D257927C7E41059441BEC16F7942E9D1
SHA-256:	0B0EB766F53B102B862EC771FF3D065DF98A6B31D37686A030973FD30F1D9DCF
SHA-512:	31C6221306D49FCB7AE7EA30D3806786564E5E2C02F278CEF40CE47073F825CFDE262D4CD244C376C3FB7774FA17E0DCC9E217086970D8A149A70E6F1ADA9385
Malicious:	false
Preview:	h...X..2.+.......\|....].G.9..9.L.!...5...?y..Si......(.8.nY..W.....7o8.C.J0.I.R.xU.r.....2..x.o. I........[.".{.b...Dd..D..Z!..u..V:#...QM....<.h.g...,..R..I3.u.Q.o....K.......m..]`.o......3A...h5M...W."QG....@.z..^.2...C......W.7...J,M..H.g.........1G..(.Hr...j{...Ze.....H......L....+.!....Y.m..)"F.J..F...N...k~.`&.+.z.#...\|..4...ir.w..5.u...B.Tk3Fd..T<.R8..MV....U....!.nA...k...)................]ON.V+....w....y.............M._.....r...vI.>../...f.... .x...../.z./!.T..v[...%)...j.........".7._.(84t..T.@O.8Z\|&.z.O.......!..P{.5K.!....Te].$U.hF'.X.~...L8...0.pM.S.V'f....}R6?.....j...txX.uL..5L.....3PTj...\|.....qs)n.Ya..1..P8.#.n..a.. ....q.r].d..7..2..x.AQ.^uN...E..k/.l1.O.........p...o....iJ.Z8^.P.F...v"..d:.,u.#1..),..u...ns:tiff="http://ns.adobe.com/tiff/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:creatorAtom="http://ns.adobe.com/creatorAtom/1.0/" xmlns:stDim="http://ns.adobe.com/xap/1.0/sType/Dimensions#" xmlns:bext="http://ns.adobe.com

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\RE4tIoW[1].jpg Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	17036
Entropy (8bit):	7.099337277899407
Encrypted:	false
SSDEEP:	384:fjUPWnaC57MZzsl+v1svJMknvMY1lyMNME502kMlyMgFMuMuEJPmMBMOMBMWMfS:fj1a8Z+v1YDTmqd502kFhNBEJ+ofuNKS
MD5:	0CC3E13BA8057B6E60544ACBC83D4239
SHA1:	2CD3FF6E2EE680D0B821493DB229091B4ADFB5DA
SHA-256:	004D24C9202F113B8985719099C97AECF2F2473E7C8DFE5B9240B6C2E0CD7037
SHA-512:	75FFE882FA08225C5F705B111691A0CD3795AED927AD23D21A9035CAAB3DB4BA011F616F683D58BB717999BB474BD5F6AAC74C95A18FA6120E05D888D4130DEC
Malicious:	false
Preview:	.../D..U.lu;.......8.....or...o+.6........d.AJ.....K7.U....F(...Z....o.. 2K.Y.D.=(.=.a..2..J.`.I.kC.[..2&.>..hH..N+Q[{y!..Z...F..:.#.F.N.t..(..[..x..$........+..W...(..".;.5A.1.)..'.^O +.b...7..P..>O`uZ...f....0.KB.iT...2V......(A)d..,@.].26tYja;]`.B8....y.Ja..s..ld..&...^..I.B.+.{^9...ia.\|W)[b@.ME..9i.pT<tz.....l'P..Oj.N.Xp....OQ.n8A5.=...(...eZ..*d..i......[?.Q6.N.$.U...e.E.i...c..D..E....... .9.c....S....%s.aW .&.....".H.x.../?1..uo.^..^...A...=i ...v...g.......M.s....\|.....7..hX..=....w.....y.3....cx.-..s. {+.zQ+...K.._>...:...\eky..+.......u..\|@....@.1....z.&......8.Iw.......?.e.B.H....z^.......5.r..e....+dC..#4.3...<yT..M.[......_...d<..........$S6..\...W....b.r.i.tc..\|....}. C.w......\|..h..K5...'0V^..#....Z.5Llk.....................................?.........................................................................?.........................................................................?.....................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\RE4tMOD[1].jpg Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	17043
Entropy (8bit):	7.0981856237063905
Encrypted:	false
SSDEEP:	192:27T078g6a2jbyAFnvr8yE8n1daGUA+3pH8i2W/92T9JMf14U8uxs8miBmiqif5vo:6K6a2iAdvrRuAHzoEH2CyPDVBoBfNx
MD5:	D8FAE01814E764C6B7B4CC7785B98FFE
SHA1:	325A072BF0EB99BF768F663E51296DD78C7ABDF0
SHA-256:	21DDF9D2E85E8362D457D353BF2FCC3BF7854403F2D7B1DA49056DCCE2B5C62C
SHA-512:	4E9F9DC77FF09B99CE9149A313076D0134B32F6D3A65284C9439D997E5D4349625FF5E9758DBAC129D38E356370D6E976F427FDA43F0AA61FD6E3D70EEB54CB7
Malicious:	false
Preview:	c..D..,..E9.........{....o....8.s%.3.1.H.G.-.....]6....sc.........3.i.CL.L.a.."}....[........;.b.c...v...C@....Xe%x......v.._...."d......F.......'.tnN...%..:p.pOS.....~.....dA.....]j..k.Z.yI.e....Wp..KJ...G5c...4I.g..d...b...z.>...@.....e.v..@L&....D.$i..7h..(..g...S..S..Sxj...j...c,^$"s.....uj.M!...W......:.D..o!..(..v%..n..iS+..:...au....l.........W......D}".....mp.-..e.......;.H.o.Y...6..q.P.UQ!c.....y]\.O^y..(.i..z.7.?.fv...,L.......4^`X....p.c....~.I...^.AS.w.....r/.q-./k.}.;MU.8.@\.Z...r8y.........4...1.@O.....H.../TBK..$w..wUz=../8..X..).FO...O}.....B-.O...P......Vl..T@*Q.....^.9.`........hQ..f.H...,....E. .{......"..#...P...P..c.........?....1..e.V..&...b.Vxu.!{5N...d....B.~..2!.x..M.f.?\^.h..f..Y.....$._P.B......................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\google-beta[1].png Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8448
Entropy (8bit):	7.935415356326549
Encrypted:	false
SSDEEP:	192:GF2OL4BYdE5k2wRlTVD3vs/R1i4BYdE5k2wRlTO9mMga4BYdE5k2wRlTF:/ODR361y43F
MD5:	5B9AF4398479BD2B248AE3ED14034ECB
SHA1:	01A9242BE28538E0E74765A7B10B82696B7216D3
SHA-256:	CB8978F8AF9E537C5A602433ED860B1A1A21032027CF1FC802EC2941ECB03A32
SHA-512:	A3D3738E860022528B44A3593CAF8D7558425C5A65EDA8A2CB2BE85CD6B9571192F20C0CC4C7AE7B9D0C2CA3A76ED2B9390E4F247DEFB7EC5D08FCE82C1475FB
Malicious:	false
Preview:	._.#x.xDP.Vt.1!......J..].DDW..!6.qd.r.....9Mb.JfL..{V...Ppl9%....q...l... ...7...G"l.ER....Z.4.\|.d/...g..4.}.....C.A..A....."...@}.0.o..qi....7....-\UQ~Sf..N..........&.E!.w.\|..:.J ..=x..pm.@,W.J...\.h'.$..g_4=.]+.........Rt.g.(.~[..........2..f@.J,..^..]....Zb...~...G...F..~/....Eks..&.-........,.3@.qV....=....1....lB.&5.\|...'....L...s.c!L.v....'...`...j[Z.x&..e...!:..%p........3.{.1.CNQ.q.pf[..d..s..m...@..4.F.W.u.7.km...\|/.E.^p..$M9Wy....x/..:.....&.Z.;....w.d..C.T..m3xs..N...M"......w.4.g....=;..w}.fl-....&..a.y..M..[.$..?F..u...$...9..fm....z...gs.h.hH.7..W..#;...P.'.7v.....f.by.....a.LW. vh...>._.....f.3PqxK{c....X..{.....V.....9...'..J.....Y...Q..h.AC:&(..6.!......@.......Mp\U't...%?.....N#.s..i {.M.A[....b...i...i....U1..^H,r.i..j..r.K..[:.m5W._..C.}........i....g.V.....u......U.......F.....yC..^.D..z...x.........S...d<.....8k.OOEg.+lyD.rE..6..............8...b&.sE..\g.Acp..Z.L.^z.}.......\..S..s....nh.v.5g.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\i1_1967ca6a[1].png Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	22173
Entropy (8bit):	7.936144922819014
Encrypted:	false
SSDEEP:	384:ZS/rQQ1BtCwPk8PK9tfO+21BtCwPk8PK9nOv1BtCwPk8PK9T:gQQtCP8PKDD2tCP8PKwtCP8PK5
MD5:	CDB20C264F871E218C72C72A08591224
SHA1:	3AFB46242F9209A1A341BBFDD214F7731B9CE385
SHA-256:	A2A2AD9989B3D12EC822393E4F1CC72E4401302B1549FD942F652AAC93DA775A
SHA-512:	2F6ECE8FCD49E4166B080C0BAC1937122410EB73DC62FA940DF55BC8419B9D94A089D93C0796F2498E59A36E6C1097CDC1535951C52BA5715F1771A46AD20078
Malicious:	false
Preview:	.i.H.Q.uE..N.g.....R.....N.L...kT.Jin.......7.E..D...z....Y...y~@...!m...Gm...Z..^.i.3.n{...S.60T..7....w.G...c.,.a....y.Q........Q...jC..iR.s......R...J.l...kQn}Sk0.B...a..(o.yk>J...u..J...L..0T..G.v...=Y.7.{....$....T4..5......E..9Dj......J#...'.A.Ksf4HlB.....$...D..L.{..5....B......Ai..H....2.fX.4..j..UDh)...a'f%r...k....B..'.c...sa.=...N.........k,.....i..Dx..!..O.UY)...36........}M:.8.z....a...8<..=.n..g=>1.m.b..=.LN^;R1\..zX/.>.{..}..t..}I}..,..[..+..e...]0)..,.[.fv....<..45.F$...v.5.J&......P.c.l>(.".2.\|}.J..b^..jx(....s...Ru....\|.5.V:Q.Ef...LF).J...'uo.#*/...'.U.-.s..P.@.."..k.K.4.M.f.YQ...,....X.>5T....B....D.s.3.&.....u.r....m=J#..9.D=.2b...Y.r.}.#...q8.p<..C..I).^5..]......Kgn.OiB...s.#M.!.c.....U"..5x.$V.,.o...}.....!A4~@..[$@@,,,.u...w.u....5....v}.....?K.>...y...Q..t.@H0.`........ME.>...d.<H(C.%3.[.....i....Cf......cf.}....l~.>......Y...X.Y....B..Oh....... .....O.K.....E....X..w~.w.$..+.J.^.Y._.;..APzq..0...+..C.....@...k....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\icon-help[1].jpg Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6673
Entropy (8bit):	4.846843251865339
Encrypted:	false
SSDEEP:	48:Dsqo4ncJAg2Z+r5Xhw3li+vx41+1p933/Qce6F23Srj5Xhw3li+vx41+1p933B:Dxc66r5q3lBOo3m6F23y5q3lBOo3B
MD5:	99990D0FC92CE1C9BAC6E6D16A3736C3
SHA1:	EDE56C08A016A6B01BDE16F13776D1E9D52B13E1
SHA-256:	7D76DA927EB420D864E946BD4A5A5160279347D9FAAB1512D512223833B174AB
SHA-512:	9F05F557C0BA66FEB24D54EE3D3F4D40209602A1F0829492177C6FAAB65A56279338A1553D6B26027039FF2F59A01686D87F575AFDA0277C167C5BEA1401E664
Malicious:	false
Preview:	.4.....H...t....9D....l.&.!.......Xk.y...b..`..............*.m.(....9...........brs..m.R3...D..q7..Z......Y7...U7.......2.j...E.....`...n..;...[..b.A.\c$.r.`......5g>.S...Ce..j....^4.X7.....j.......z..}/M2.^...<B.~..G........S._ .Y6.....H.2] .p.QbG13zj.........7..%vj..T.d...=[..N.."..\|.}{.DP..n.4BU.1G...\|...#...n.........dt......m....Zh."....z....A}.0}....../.=.8.......s.w..CY....V...%...B........=WTM4...f.>.....47.J.;...U...q\|.R....\|..8OM.......=.G"H-.h.W.@...L._....M......tS5..s..FC....5s.1.....tat.\..@..\.. 0.v,..~<....N..].\|{.p.D..>.)W.2\..+..c...}X.........W..{+.Z.?-..n.&(s..=.../........fc..dC.\.k..H.4h .A..L.?E)@w.v...1.tYUIW..a.o..D...'F.n~....9.j.w......NM.F..s..`x.f...^..zh..E..b.....d1c.....x....S.{..Ig....kaWji.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\images[1].jpg Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2140
Entropy (8bit):	7.89397874824521
Encrypted:	false
SSDEEP:	48:FS5Ric1X0LNQ2OtEjO/I4NpC4nWW3L9/+3PIZBoqyXpQmOeIb3FNQ29mZ8ln:FSvd0S2abNpC+W69qxXpQmOeIb1u2cOn
MD5:	873175DE8F7426331D415606074CE050
SHA1:	E9B68D0999D8DB46771DAAACB8206C238B450489
SHA-256:	93C8A6C049947AC39666472A5D52769D9EE3BB2F29573F444CF056E56CBD6050
SHA-512:	3857072EB9E4733E9C1597828C6798D51A21C85548E4EC2360C4B9F10EA642E149726252D34F12C02A540DA7471AAEFFFEDBF72310CAC5DCD27FFA0B4DA2A2FA
Malicious:	false
Preview:	'.:.&y.qG0.l](...\..s.....^0.\;..Y.T..W...N..kms...(s...q...L...a."L{.....y#n.. .:..d.J+..(.yV.w~.&.l.M.u..o....\|..5qF634vg..?..@.;N1W/X.....#..w8...o.>x..%""s.......%N.Z.Tp.VB..5.-<.v.Ut..:.Di..5...gX....s...nq.@X...x../.J.8\|I#.V.k.no..2.Z.P...f...$........ n..'..l:..2......V..W.2....k._1.tYqx.=.....1....=.....1.]\....L...y..By...-........P.....Z..O...V.jf\|...... ^..j2;.}....i[=..A....Y....8.V).c.8...q..:...../..#b....t.g8.. ....!%.`.a....Q.....M.M..A5.K3..]..]...6.G.}[.%.......vH~...I....z.`.0......."..#.HYwVa01O..H#.......#.z....B_x9&i}...E....j.i.\|.t......7.Z...\....qd...Um.z.....L..O.;..:.f6.}.xB{R..r..1...p....\|.F:p\.h..CZ.;&1).>a......n*.PJg;...Et.[..B...H:.,.n....%.........t....;J..r.....+9tFk.1U.I1.a.O.....SE...u..O.)I...........7...,.......z...s.z.W..&..zQA.Q...F.z.:..?..w`Mb..u.m..Vg......'.n..`X.'.2......)....2V.i5L..$.;..~hkZ......`.I..a..G."%?......$.mx....-..^rl..0......`...0...7..q<'.,...-.U...].r.....:..9R.\.NM%\:.r

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\images[1].png Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3692
Entropy (8bit):	7.948185724857944
Encrypted:	false
SSDEEP:	96:ck8Bnn3poy8BszHC0tRxviyjObX+Gw0NPmovh1r94:cpBnn3pNfRi9+GDNPmea
MD5:	08542AC8A38BB84DF63E3AC2DF76ABFC
SHA1:	80A160E8114DE2D0B4D6589BA9538466DE0A28F6
SHA-256:	910546309B72B8E5666650BAE9182F4C66763F6DA4FEB7EA78F6A5EF98DE2EA6
SHA-512:	F5AFE6A0CED243EA58DDFD99B1B235A846865E94C9A245D049879D51D2B313EF140A091091345D44B1080E382A67E8840D80226348919E50599F6D1404F1A3F3
Malicious:	false
Preview:	/.......j.{..c.N@.......r...am..._..c...x.@>o...".T....aR-4.1....h..g.q..F.C`...#....C.....&G.4d...........+b.$.r.)E....!..(.L.,.P1..(8..... .0..h:....=.X.1cm.;.M..........3T...u9NQ0......7.t.5...O.?.BI#.Xq.n.A...I....D.~....d....}..4.Z!U50.F..mM..g&........'...ca..,)..w......6....y[..Ox.".....LCG..Y.y...B...`.k....FE.,.P.7...DC...QM...ud.Zm...[.>..9..).y..`.JX~..v.(h...bu.YG..:.}..Y..:o....\.".l.G.8..m.x....Z.....h.[zr......1]...^.)&=3Zb.<x+.....Ya/...xy.T.....V.uM......:...[..lk..x;...\|.....t.\|/x...]V.;.m.eJ......p,....^(..(V.Y..D...).8nDx....GO2V......\|..?4..d........\|...h...%....J.,....\.2....m..=.......Wr.#.iC.%..9}..=&..;.=.kC........^.(0....j.\.! ....7.....^.......Mt...._..2B}.Kw...B.S....\|+\.zhq.Z4.....(..:..\c.u.1....r.U......z..aG..J0~...??....b....2.......F.....v.V1..Y.:.[.=I.\|.p..}.=..2z.{.G.=..\|#:..../E..;'q2...g.......osB...N...>`.z.`p.Gf...../.tm.....h.?60.P6........).,.=%....4..q@IIe;.....2......=I.{.\.S'%X"..K...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\images[3].jpg Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2190
Entropy (8bit):	7.914089175077123
Encrypted:	false
SSDEEP:	48:kk1LwKgglv1VIFdMssY5nGiArVm03jAmbkkxTb540HzGNx3In:4gFIFKssAnGiArVm038mbkkxTl40HaIn
MD5:	9F2BC9A492B5C5B52C6E260B3914B311
SHA1:	034E624EEBDC2A8D579A8403B3A98166D77A05E7
SHA-256:	9CABB04E7E6CC8EDAF8DD62C88541E7620396AF74347D7A6AF5B9ECD967AA950
SHA-512:	3912CA2777C7CB702EB063C45E41FB3DCC5244B694F419721910B270EA40498A3345F4C00E6525F9050177E4842225D955B8AD214616D48A7CC925ABAFF942B2
Malicious:	false
Preview:	..BP.}..~@..]~....gF.?......u..Q......... ?...fa..F.....Jju...K..c........`.Q.Y...@\..s....Q..j.[...u..pD...F...}u..d...3\|..........F.pA.p.)E.j.G.b=...X.......N.iT.v.......@YUT(..H12kG.U..F..g.b{(..Hb....s.....<.._.5.Lf&.......^cc....lJ...2..0...6..b4T..;.I....K...\|..v..TZ.T....<.V}..C.....rS.@...]......'......:..r..2.../.....L....."._..O...\.JK...9.....h P..zeWl....^....e.... .5...0..QY..U....vf....UI...M.ns........P..8..h.......f...G"..L.Vt]:.z.....A..Z..dL......e.. &.UYH.......'...D..'+.l9.;....k...WI.Ht.:....%.$`...x._r;(.>.<.~~U..T0.....(..'={.).O..<A...d..h$..z..G..\d.....}7(.l.?..rK.....v..IJ..vP......k.Xl#..G..'....2r.(....%..Jr}.x..KKD........z....(..e... ........u..n.....Q.......B.....TiD.u......fs._a....t....43.)%s..g.......O.J....7;+.@..\|.q..))v,.Y..'..'\...`h.E4.sw8NH.X.T...y2...F..L..P.....c...h..$.....B..HM'V...mp.....C.\|.U......i.m.-I..t.V.@.0O`..C...".O.:.........p.3..Q....K.k.-..5...8..<..p.{I...%.9...O...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1992
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	2D707791A014BFEB049FBD7D87170190
SHA1:	87AF3841A3259CB1016FC2D7F4482BA8F1EFD3A4
SHA-256:	1077033D0E9374BDB9DDCE254EC1D80AC2B02A10EEFC5DEB9A4F59BB6C31791B
SHA-512:	91EB7F9B388ECAC04D9FE2F604F265251A484C8AC10486DD80E44E39B62DEE1C00DBC3DC54E4D6B277A96E5F5E06D2CDB2C95B0EBD21BCAEF6391CC9AE770510
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\BB18T33l[1].jpg Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	17859
Entropy (8bit):	7.953511056609684
Encrypted:	false
SSDEEP:	384:M3MKYIhcEo/1/W5Tr7FsCCwDt8z1hINbmMKYIhcEo/1/W5Tr7FsCCwDt8z1hINh:OMKYco1/W5TX18HIBmMKYco1/W5TX18u
MD5:	8DEE138C99FBB1911EADCDF04D136FD3
SHA1:	667DEDE32609916449BD1269646A9D54363708F6
SHA-256:	A2FEE3C48851423A34A2B3E0DBDD6F2E32F5ACCDD47967FAC2F78AB1AC064180
SHA-512:	B371F3436E12B54E5B19A2AD4133611404905883417555CBF24DE67414A8176F390BC7F30691BB7CAAC1797F51A783363175CD2274237E8DDD37EA93C272C729
Malicious:	false
Preview:	..4./.......v(.....&P,.S..?I.....T..Lr....&G...v....nX...aF.e.;.+}....O.v..p6...%...s.v.2...z@.{.... .....@....r....=n.w.'.t..x.5.^02(84}.p..[.5.u.3.....N...+..7...........0GZ..@.^=.f...kK.}..NzJQ.\|Lb..........4.?o.Ar......\|%...'.z...A,t..t....y..F.........5..5........p..S!...D...#O....&36DU../!j.o....s}I..;;....e....`..FY@....]9...;y._..\oJ.(...A.C...S%......^G.)/d.........]s..xz.3.,..!,.r..x...y.........[....(,@B1. ....v~...i.s.).y..f...(#.i. .x.]...;aoCl@~'Y.-.."4.d;..4IH..z.q.&.\|...I..KE.a.~....H.pQ...P..o......5.4.[....V..1....vN%.@u/....\n....GV.t.....\|B.>.,.W..5.}e...\|f.... e31f[.V&..k..s.lu.A.......@ .2..p.<...+..w".T2..........gG&.Pc..D.r..._..".&.P.n...B.....D=.U....)V..#...!.[.vne..3..j.p..Y(K.X6.F.!.<{.R....J.........".E.P ..).R7.?JZF...S-.P...E.W.....(...(...(...(...(...(...(...(...(...(......$....d.i>Py.SN..op........t....rV..h..h.^D1.chU.]..#.l{/..d...jX..%...q.3...fP.8-.q.Cgkr.hEW<.>........Z.O.(n......Gu`.....p{

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\BB19x3nX[1].jpg Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	13997
Entropy (8bit):	7.950542067609158
Encrypted:	false
SSDEEP:	384:gpWM2PYFnKNQIf3CtIpWM2PYFnKNQIf3CY:Md2PYJKyXEd2PYJKyq
MD5:	83B01005923F2AA32A12B05F0A1973DC
SHA1:	20E5164F908408091B81F67C70A4020FDEB64637
SHA-256:	46AAF6C22EB797A24143E641D018AC5A8B45EE6151205221A514D50F594E5945
SHA-512:	D2573B679CDA1133A6701843FCABB987C203502512343E4E015B3A2B35D85231EBFE9CA7EBBA37BFC1B98BE641F236E551A779CBE611AC319EAE8D8BC7376E8E
Malicious:	false
Preview:	.6.}..P....7..2..`/..".4...\L.oL.,v...{..ZeU....E9....T....u?J.O.p.a/.(S..8r;S..Y....zJ.UW..]d...&.s.......r`+.wG....?=._.".h..2..\..$X.".....-.)fN;...,...k.-.....Q.t.k....q;....Z..<C...%}.w.....Hd$.:M..-.s...2....g..fz.z.+%4.^.mvF...Z.....^%..x.,G.+&.....P.:.V....5.oH..6....O.....n......\|R..28G...:....f#.)..2$bg..l....R:....A.[h..V..\|(..K...f..Y..'...z.YW6/,....TZ.VM.x......v1.Q.%f.."W.@...{$E.GuVo#B?......^..k.. ..C..C.X..K.../N...dl..=..."..e..?zNm.d3.2..7..I..aDZ......X....'`.....?.`....Wa..Qq....6...Kl. .S.._...K..Xb......{.........3..07.........r).=...;....b..........V....@j,%.,.%C.......E.z.el.....9m....f%T;4.V./f..U:3....x+.v...y.]......\|........lC.wLi..H....Z..b).a+F4..P..0..^w#4.7\-5...$..{./.....TT...........vH........8H.....F..@$..A.zgY.liQ.......P\|.CZ.aR6..#t...b..."#..z..9..`k.2Oc.Bt..:T.S=.]..U..,..}.p..8....s...j%-....r.sR.....da.k^<.MJ.....i..MH...T.....8.m..H...f..h...M..@.*..Y...A..!../\..b...7\z..<.E!.D...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\BB19xGDT[1].jpg Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	27777
Entropy (8bit):	7.963528585005223
Encrypted:	false
SSDEEP:	768:+wEcuiytOmcpbbkO4nNwEcuiytOmcpbbkO4+:Tpnyopbr4nOpnyopbr4+
MD5:	79F00232E55EAFD4933ADA1F40B7513A
SHA1:	D40F5A12C80F7E63B48CF812362C5C05BBEE92EF
SHA-256:	92EBFE8C9E415DF9DFB177F7ABCE6D6222084B762659BA33AEA9515959D72DBA
SHA-512:	9CBD2FF872A07B2616025DFCF709AC9BE820753A7E1E2A60511B00EF8A4DF7E423BF1601953B2647EB1DD561E5FA6651D917FA50401BB6F1519E5A8F7A79A75C
Malicious:	false
Preview:	........ .8.. U.......LH.{"...(...W.X..a........b.~%.}.7.ir..6....v..h.k...4.Z+c.I..o...9?c..q......9N.Q.X.l B'... .2iR..R..y....T.D.3... v!}.....VB.{..&".2.H2.zG.3..Q.....c.....UL_ ..g.Ip.. .+z..2.L....C...6g0.9/c.W,zK.1.:,..(........%....u..?..f..A.im_....(Z.\\;.9.mm!..4XP.>5.j.%...d...yt.MM..y..VP..Q..eM......V+%&.=J.$..u.]+."...k...-W. ...H`d{[.,....\|-.bl.W....7d.}...lXp...n^^..6.P....=.>i.<i`(....w2..T.8...?:7Ft.V.X-.B.......9........ :D[..=5.E.9.o.../,v..0h..u\|...[Lh.AT...1...5.6[...d$....c...S.p.@74J.R.b......D...{=YU;.Aoq....W.j=..v..&......x..).-.'..a.{...IcK..F...L.(..kva..)..RY@..S..#../...O..:...RCxZ...nY...;. ...$...E........^ZTQ.b...`..u@..7s....mM%p8C_.Q....vD..7.@.....w....4.....x5+..j.r.x...IR.......Xr... -SL.J...qMI..\}jq@.\..}j.#\|.9.....F.p}..#...Z.xF..?.K/.7....=.).1...l.*.u.....6,...8.^.f....X..L@_P1.:f$...K..y.Y.Y.O..M.....kW../o.FP........Kw~.5;c..E..0=../:]..(z.5.<2....8....Fo5.<.y.EO..7/.+.....V.M.Vq-.2)%@......6

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\BB19xaUu[1].jpg Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	15417
Entropy (8bit):	7.9569441707839985
Encrypted:	false
SSDEEP:	384:Lm9aKQVwEHONIZdJJQBP8JKQVwEHONIZdJJQBPK:aARQBkRQBi
MD5:	72F9FB05DB32389D424CA6025531A908
SHA1:	49796C52EEF79C68271F5BA51F205A9EBF060FAA
SHA-256:	E23DE94062A4509BB032C368C2C11DCE1D2C80EAE602D3807ED79792B2BC6C4F
SHA-512:	C01055B6B52128376B8740192C593008C9F8F9ABB360286672B189AAB35D8435E7E8BA5EE1ECD42A3A907CE108CA0C6DC536C94625A9CF5C2483E18A1C5E3CAF
Malicious:	false
Preview:	.....B`.]G,.3..h.Y........._.M.n;v.g'..=....._.....aW,..Bs...8..2.............K%6.....}q.....T.X...n...jQ.._...L..:....j..[......f#.]%r.w...%.Ff......l.`.4tK...u.m.hV.yU..I...zW.5.?...-R.3.(..c..S.[..<-Y.H;....m]......D...g.R....k._.g.P..%.......(!.>9..-.8.....0K.......vD..f....^.w...F..n;v".....qP?.9A.......r ..3..._O.~ ..8Y...)DO.q.1.p.0.K..@7....kM.za..MA.^{.2..."$M...H......<..c...y..G..^&J.]... j./D.=.'..fSb.#.Fb0k%&3.V.t.....LN.A\|<..y..1..>.bA..w..$......$..@.D..i..,0....i..D.6zb.].Jm.$#..m.&u/t\|.#P..S.&.Q.....Nn..}.Z@.g.#r7Fyv.I^.f.^. .`.s...=../..\....}.x.,9.....t._...+c.Mz.TW..,..V:.I...O..~....e.AE9.....]...~53.....`..c....7.a.E&b..g..N..M..R.....1..7M.......E..n.........}r.slJ.l..$.8.6.[......$._`.AC!n=:.>.\....M2Q`.2,q."...)qU..B.X........K.KS3I....Rf..3H..4....i3IE..k+T.V.H'(9.A\...[.pC/.. ..8.oCZK[......P...y.f2......y...m.m....54W.H..,3..T.Y.4"..I.........X.-..i.d.ncn....J&F9q..c.XW.w..E...6C......_4....Hj.DW#;..g

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\BB19yF6n[1].jpg Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	28015
Entropy (8bit):	7.957903165252
Encrypted:	false
SSDEEP:	384:yDx5s6TdiZoam+VUFMEB1pg53dECAAXx5s6TdiZoam+VUFMEB1pg53dECAJ:y46TdcVUFMW25eYU6TdcVUFMW25eR
MD5:	A6F1A96A5B33EE194C843610758D407B
SHA1:	3CF95A8659C9B92598E3E547BB44A00B4A44DDE2
SHA-256:	B1922287E67B5AED55AA5C6FDFF369F20BFA3EF6776A917C16331099151197C6
SHA-512:	F25BFA73900240E2B385074F94AA04F966BE2F505CC9EC4F5D9AC9F9398E395948FDE148A23129401F6F1B311AE68BA46B094094FC40F2E96072453BE6A39D1B
Malicious:	false
Preview:	e'..'.8..........g..k[ ...Wq_ht.%v.u=.{FZ....m~....#..\|..&.8..dB..x.?...e.,T..a..%bc.u.r"h... -.3.%......o.`.~"....v..C...#..`=/=.G.\|.Aj.s..L..)...l.\.j...r.J.z+.Q6..g(........eG!.=.#.f..T...9.......f7..27.........._.:.F...8.iC.y)....#T.9d.. .:.r.io}...+..5o.-....(...6o{.(#.. Je^u..oV...Fo...z&mp..YsP.G..v;.Tv..\.2yZ..T...o#Ko.t^.b).um.....i..........?..hCqXJ...$....;<...L.W...X.[...T.^.C.<....j.i.;7.]".d...l...4%..Q...hc..:.d.qeA.^tI.u.@.?f.T..@.%&....?.1..9.c`...........1$..[.2X.O.k.fC./..n..\|.,.[.b.y.{h5.*.......)y..M.+\...0....G.\..q.Z...5......o...y..P=U..6......y....aa..-{.U....c..d...1..~..uj....s...K..A......f..G{...d..u...._.3.r.D>.h.3.Q"@s@.1\|\|`...!....X..(W..HN"l...v.h.e. W:\|...`.Or4.Q....f...b..k.)...}.,...ww.v.K..".S.E....M......2.8S...HC.(.!4.CL4.j3L..))i...).D]..........!.......p..L.....5$v..7,o..m.. EE9.....m....HM0.I.Bi)..)....XK.(..M..z.Y.@.8.%...8!Q.2>.e.k..W.)...\..BA...i..Y....o...O.S.V...b)9..s...r..6M.......$L\|....qH...)s.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\RE4FBmV[1].jpg Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	256040
Entropy (8bit):	7.975334519201422
Encrypted:	false
SSDEEP:	6144:+Op5fRJINYSXXz0j48yx625/AwyJzQfuhO+26nF1rPer:D5i7nzs48yI254wRfbn6nFFWr
MD5:	EBF1A082825C3D86C4F13A0E0B3C6E13
SHA1:	48557408C5A0E145C7244AE182B86BAA4EB35A61
SHA-256:	5AFA2E911291F15581435F216A6324BD5A37F30945771D393F4D792EEEA6C299
SHA-512:	61A7EC4CF1D761E0A085A99D74FC33396A5E068F77592BDCC3E30C1AD25AFFCC2E5B082D6E2AAD19A5FB293A19F2C15C9D20EDE3D2EC46BEA441D9D4B9F88802
Malicious:	false
Preview:	&...N4].q.....j.2.7}Q.'z..l..~U...jW....+.5..L2.....5..@.7}.o.D.q..A. ..F....Ki....!.....4......;]..../x+\.5.\|..6..6.<../...4.....>.q]...WF.....sO..t@..s.......mSH.......x.......OV.4E......g"R.2..Y....`..E.....gM{..<.s..~kb...d6...lnD\..... ....~b.J.E.. .....\.....z..Jf..x.\I&....iPi,.P.]..Xa.po{...>.x..D.k.`...L ..tu9}....G..;.Z6;.......4(.ho....S...O..9Z....p..%.gCn...Q..(.t.0..~u:J...E..8......TR.]..KL..........+.$....^.,., .......N.[,.a..Xj......tG...C]....my..%....d.....i.....-.e~.z,&.`.....tN.l...!..5S.Y.Q....." b..'.q/..5.{.gH.......G.2....jd.2.....7.O.7m..V;Z.?.......A.U....#......T...+.]...6...\..~wF.m.C....!..jKp.."..I:hUo<.n.u.=hsy:.w.j....g.8.n...F...a.A....p.....8.4.m..v.6..2.(...=......?.(L.(.%...6.pMM:DerivedFrom stRef:instanceID="xmp.iid:1436F67CE40F11EA8185BE8D2649EDC0" stRef:documentID="xmp.did:1436F67DE40F11EA8185BE8D2649EDC0"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.....................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\RE4FBmZ[1].jpg Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	272125
Entropy (8bit):	7.975760621011833
Encrypted:	false
SSDEEP:	6144:lpeS2zBRuPY8Kv5pKKfp+dkPylrfRpBIOFb8l2dmP:lcSeBRuPY8KvJfpmkqlrJDImOEw
MD5:	23E4410BBF0791CD05E7FAC62B92604D
SHA1:	E8551AF130E66F43C327EF72C0EF379F06C5A97D
SHA-256:	F3346598886BE77E62AE0A3A57B129161ECF90F54DEFE977FF4A199A5D735C04
SHA-512:	DBD9F7DA91D90BA4394689581D40D183697020C525E76A70341C168199C82BEC8F4E4FCD1EF5DA2BFC7CE0C6C18E986AA1132B5940D7E554EE9E9E64FE9C2040
Malicious:	false
Preview:	S.....(.\8..<....W....5\]/....1. 1(.bh.X...+M.....".P3..u..(.......<.fZ%.o1..q...3..L.>....\X.J.i&.......C..:v.(c......5....fG:....;{.MLn.A..2...$.5......6^\|.n5>.D.Hx.3e....C1.q.>.y$...[.......s.&..x.:....:e.....[W..^....F.n...y.e...ms5.B.Hp$,.kWi..v.@..Tj...8.?\|......ct~S...HQ...1.....C..-...z..z.j..EM.{......A..7.)Y9..^..Rz1S'.V.bmmL.a....HK....$..*!.V.!.S...j..B.0H$............II....o.A..2(.?<U.jQ.ZGl..r.T..!.nk.=...g?.:....a...F..v...%.\|..P.....U...."fFRlS..x. .RB.!f..I..5....f..o.4y..._q...1k..q;&q...c.-..X..v........O.Fz.Q.;.l.T...5...8.~g.O..YJ.. ..&F..}..g.Q..0Y...rO..f3.U.n.KjdY..%.G ~.L...q.i~...G.H.#.A..;.1!....:...r.F..u1...+...@H.j...Z....b...E...jK.D.,/.X..%......\B$..}..t......qq....\|n@?..u59.#..pMM:DerivedFrom stRef:instanceID="xmp.iid:2B46F5F3E40D11EA8185BE8D2649EDC0" stRef:documentID="xmp.did:2B46F5F4E40D11EA8185BE8D2649EDC0"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.....................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\RE4ncJa[1].jpg Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	303034
Entropy (8bit):	7.928041935376861
Encrypted:	false
SSDEEP:	6144:v1+b8qAB82Xk5RAVXASfbH9GoDBK6RVK9akhHN/gpVkkcBF:vYgG20bUbMoDBtwnt/6OdBF
MD5:	6E8BA745F647980C591B466361331511
SHA1:	CE07092EFC2E19EB12507B5E18F5418A34C3075E
SHA-256:	9B0303AD04AD7061432B65FF7FB538E80E40A9FAE6F0E69F3E8D2442C9188A5F
SHA-512:	2E720B549B1E4B7ECDDBD9DC6C27FF2D5936B0C96B27932AC7B36999F8F736691D2585DAFC12F68A7747E9E3A51979E87F559C4C52568E5A4B0DAD5BD451BDC3
Malicious:	false
Preview:	.d.)t..X...f.Y..,6.N...8.a.....N^..:.RQ0D.v.il9.\.......E.u.\|..2.[* ...K.......o.k.c....o...,....Pj..0..dY.b.5.V.v.Y.q;..@..OEh..5.H..d,m..HS..Q.l....o.~B^g.9...M....o..."5.........>...T"....y..T7C..cm.&...v...:<.V....\6..x{...)<.X.+.VI...Bw9...H..,......hO.e.~B.....l..^..........u...o\=D7.r.L..G.i..P.tS...c~.P>{.F.>R.!&...:..'..%.#."...:.~..).g.{iu7...fi.G..2...3#.{......."...S..{.K?...7F.C?...k.6...k.?A..BC.L......6....+..........}.n.&..B.e........C/..V%.&.C....?.k..'.l..m...Cw}qkr..B.*..7.....rktP...fD@xA..%....~07.eG..i..... A...].:K`.......=~./.....b./.'=..1..0..b.>9.P.........R=S.L....,...[M:esy!.6,..X.i%.m.K16\b.G..{3.[X...?i.MO.p....SQ_....p.C.Iz+1.....B..E..#H..#.U./S?T@.k....[i4..[..q<..;.G..T..Z=..)P.i......,.r.e..documentID="D6D9EE93C73FE032909961A41E780051"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d...............................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\RE4tD2S[1].jpg Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	217648
Entropy (8bit):	7.97738976730439
Encrypted:	false
SSDEEP:	6144:VVdriJHZXhRpdDs+k/XcT2TGvtZQZN2R0ObNT:VVtAZrDsJyyW3Q3u5bNT
MD5:	0B9489C0ECBA6120CE1286A00E1594F1
SHA1:	79F51F001056E80CD0D69C1E97639D77595FD0C5
SHA-256:	10C8740EB1568E053AF43B98CEF3706CCD44464D1492BC7319289634615F3CCE
SHA-512:	CF234E6D016E8F8D62ADFDCB6AE3B1ED91221BCD5B6022315A88555450DF63F350F51AB3DA7877E44A0E9C0A28E9D064966D6AB9D98F2CD87C6EB9726CB18E58
Malicious:	false
Preview:	J..3\`..3I...-/..x.(M'.p.....R]q#g.Q..n..}...!.\ ].....6..D{kv..H/.z..y....}b'N_5.....p$.J.qF~.a./....`.8.&.yN[..]...../5.4x...^......(Z,....O$.....3A.8A7,/.".!..o......-...(.H.nF<.!0.a......{........f.m......~..P..j.........y.F`..F5.f.w.!.e..{Q...g..~.....SG.3...O^L."'.dZ.i......).YP..t.f.s.]...S........k4.....4.C.I<..8$....;.Y.I.....5:....SV4... ..C...0.Ha......b....N.#3..,I...J.....C.#k...3e.........l....S*)'... -.c;.Y.}..5..^A.O........P...D...V.IP....0...].Y.U]p1..h..(....t..._......D5!k....e.a`..YVj...J.l....Q.y.qa...X.......M..>O~...O.....-`.......Lv+F.dvw..U....c.+..B...a.U6...Pv..+.'G^.`.5....R.Ea....y.HVx....^C..b...B...!.2.......KQM_.....wL.A.V.&.fl..q.-.._E..._.wQ.~O...A..}..&a.. _....v....A.......a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a..a

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\RE4tG3O[1].jpg Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	13879
Entropy (8bit):	6.811975571988965
Encrypted:	false
SSDEEP:	384:yr1iogZ9YPY+BFGNvZg6GAsG111111111m+:Siou+6vqN+
MD5:	5991D72D657405D7A5BCB64B8501594F
SHA1:	72E7E35AECF2EBCAAFA9ACCA7B3C44C7B56BF5A1
SHA-256:	5D462903438AF9384E2D8CEBE05F58F6222C72435CF89F4283D17BAE9E9BB96C
SHA-512:	C3762C67748853C50A561ECB854D319694D8712FE621FEF70007FA34EF7DA91BBC6513356C194D9575E3BAB47C7CEADF82E3D4F608ABBD9360AB4BBF97543BB9
Malicious:	false
Preview:	.?K..`.sj.dO..CAD1..SE^.\|..,eh...}...m.`.n..>k.M..('...T..d.]WL.&E.......M...j.d.:..m..J.....!.Z....}\...]w..w.. S..>....n..Z..K.B........BQ.....N..\|..I.,.%...\|.. ?5.,.h.j".X.P..PJ.......?X..yD.a5'.n..r.*..`.........]f....fP).+gW.f........3N.UT...\|.U.{.Bd ..F.....P.C..........!...B.K<.T.a._..\H.....S....l.#..^.c...e......!....;.\.....K}P].......)0tI.Y.N-P...?...w.6E.+.p...l..O...%.......F..M...r...u.z... ..nv."]...uaU..&v-...5..t.]..Kq.........$b....X..U.a./F...-].9..6...y..T...N..~\|oQ.....UY........R...L....y...u.@.xk... .B.........X.D.E....v.3.X......!.&.?..>~..\|,.xmD.a..(......`....7..CR..}L<.t..Lw.taL../9]..a....X>.....8=.Q..BP..7.x[r.dk.N....j.^F.5...}..........q...:&.4....)v..FK.V..&...z}J....xZ.w..+.u.6......................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\RE4tIoY[1].jpg Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	170749
Entropy (8bit):	7.972957708565767
Encrypted:	false
SSDEEP:	3072:Jb2nxDd5sjde9VHFREL+tvS1KsODqRoEg6i3/p4PdRcHfUUORRUbDF:ZcDtVH/EqtvkKsijDgRykRON
MD5:	B3ED6A37A8FE515EA7DB005B7184148C
SHA1:	9DF78EE5C443748CF2D5C9CAA60A95F85550F210
SHA-256:	48DCAC6EE0E8F47EB4E6393C1CCF9F3A775D3E43BB841F5DF88B5480A7E25927
SHA-512:	37EFA713178E1FFA82993F508C64E4577B9AED940D4C128426013CD64698AA1A591E835E8F8762FB2FBC50806026DF20E648BBE966BF1C70E9CA0EAE8CC62731
Malicious:	false
Preview:	.)Au.7..m.4.e{.X.Tb..T..Z>...[5..M..A.hT. ...V0.f..&.9..Lc)....!G<!.{U....5....nmQ........._./V..s.>....}59v@`n-......0.3.hv.2.$...pA}.c%.i.e.m...`...b...x.....O..}..7;..067..~j......B/.j.....\4...:+..I;.n1.j.t4...iH.T...=x.i.cc...y....?a.k>..p..{...B..q...E.id.p}.J..q....o..?....c-3..-..T.=.e..X..5(........Nd...%...N;=.7..[Z..%.".ODC).;...6@.p...&.F.^a..6.9.Z.X....!/J".^.%.V).q.zU.H).b."........'..>.x.\|....n..W..H..pC.P>..u.(d.....>1....A"`...[..O../.?q..&\|..fms....d.)..n.Kc.!..'.4.vi..9.?.={/.].......e...j..L../..<..oq...#Q... n....G<...@....^...T..P....ch.AP.\.....Dm.Z..0r...U...,@}...i..h....m.N..,............7..nNrk'...."T.rS<z.BX..{..1...$.4..S..P....Yd.....i.u.gx.IlciKbr..f\.r9S.........fw.........Fj.4Q.P...A..s.....@2h.M...4.&.d.....@2h.M...4.&.d.....@2h.M...4.&.d.....@2h.M...4.&.d.....@2h.M...4.&.d.....@2h.M...4.&.d.....@2h.M...4.&.d.....@2h.M...4.&.d.....@2h.M...4.&.d.....@2h.M.P.\|..Nh.M.B.)f8U..=..$...v.Di.c.Ub.*....7.....9

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\RE4tKUA[1].jpg Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	106114
Entropy (8bit):	7.923253442658809
Encrypted:	false
SSDEEP:	1536:COqtPPKAdvi7hjJIwc86/nogKAXynAERZBlaKTjpmALGGAws93eFl59RjPb:CftPBvghVIfP/nkAuAE/N4Al+932Bt
MD5:	7AC9892F6972A52AFFD1A6F5A6D2D5B6
SHA1:	C20A6B0A3D667284FA90354208DA0ED09165A314
SHA-256:	4F1D682A8FC66E1544812452F94EAC86D4DA997E95F330CA3C9E171B29E312BC
SHA-512:	17BE67AEAC45FB986EEF1F2F8D812EDC376E1B65F986A6D020258FCEA0CDD849246E1A1D648845CD17B04DD1A579738134C64D124D36BC3AB145059D05DC50E3
Malicious:	false
Preview:	..U.4\|.......8..$Az.l....NI5........H.cv\.Un.#.n....4..N..}.H_._j.0........R_~qs...f{......0O.....czf[.s...1o..V.{Q,.........{v_.vo.~......+z..V.....1...Cg.~c.$..F._.p...."...x.Q...Fp .!e...V&..GD._. .wh&=b5.?..M..;..E+.s..I.og....p...U..'.w..RW.....HmN......H......k...G.I.>....3..D.x.Cb..M....4i.}...]^A.....~.5.!.^.....@.v....n..,.....>..K.&.'.....3w..hi\..2c.2...=;ebk..nB..\..4.MV..L.gs.H.....A.!e...OT...mOv7....w.}.+W.G.r.gA.-.W`.q8..^.1..p^...zx..O..=.........hr..D..\|...K.......;..@...)f..mL...s.......J..Q&..i..2...d...j......7:1q..[.Yt...@..{...c...8.#.....m...-Y..Z..n...,..4....7..x..Pd.E#......O.C...PS...0r.0.W...h..)....#..y..'..%+.q*h...m.K..c....EZ5:Ll~.../..D..Z }y........a..n.A:..RtzC..%...0s.UE..m.%L......].....................................................................................................M.....................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\RE4tMOM[1].jpg Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	108801
Entropy (8bit):	7.804879223211447
Encrypted:	false
SSDEEP:	3072:DcB3vbKK9eMXMsM5cVf4FhtEsnKGTeQ0K:Y159FBiFhtEsn7t7
MD5:	FFB56689DECEF284E8AA4C9D9B9373E5
SHA1:	FFA1C884DEF36A640F99F6BAAB97C27731154289
SHA-256:	96FF068AAC2DEC5B6E8A1E546E6B9DBF5D09C9C240D05A2F8B69D27FF4A73F12
SHA-512:	E86F38856381B351536B776A0401FCFF505703987EE0EDA1B98D60993C68A132A17EA23CC22DE87F61142EF6EE8C28C0923F59FAF0C404DFA79AF8B8A42E0DE2
Malicious:	false
Preview:	w.!..-F.7]...<.9.$.~-..V.u#.....S...Z."v..l.aD lf.E.j..#w.m3...:.o.W.>7:S5.q`..Y1.@~...s..QV ~...45~.-m>cd>0.)....n.W......k.Y..NNN;.....[.;..F...k\?....{.R>.e$g1V...~.MZ.O...f....W....u.`5....w.;.x..t@.:....e.&..6:...Uz..A..$To.d.4W@..k...nn0E{XG..3..u....x...l}.#X.P.......[..h.O.}....#..IV.=e...@_\|.`.%...`.....jM..+.s..K...d.i...Ic.CuG.....g..0.......N52p.U.y).Q.9.E"....I.m=....'..k..42.jb3..E.......:.!..Y..D...e..@..i..RM.n..E.n....,..\|.p.h..]........v3..G....\|0.d..,d..4..C..#.f.%E.%.l9.z..L<.ti.}0.N.!.9..m.?..y.p2"f.!.tU.h.....C.E.&.o'.7....d... k.m.Ub.....S.fR._0.....~.@.G..X.Zf.wn[ \|xE>...t...5.....ac.E..&.......Wqx;%.....r.`.SY..@.%.B..v.OU88..7..0f...k....k.s..e-.3..Ek..../&..f.Ps..DT.....+%..i1..xQ.:.0/-.W1....0....V..r.e>...........M.........#.U...x......H.U{...$\|......>U^.w...x.;..W.`..G..0..#.U...x......H.U{...$\|......>U^.w...x.;..W.`..G..0..#.U...x......H.U{...$\|......>U^.w...x.;..W.`..G..0..#.U...x......H.U{...$\|.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\RE4tQVa[1].jpg Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	11084
Entropy (8bit):	6.4196195688618705
Encrypted:	false
SSDEEP:	192:smHeQ6gHlGDrjH188iSQxOsJQhYomvFgUADe:fHe+gptiJxOGaRkC6
MD5:	8074CBBA3372527148D53D8C2344EFE8
SHA1:	B3B22FF79BF55A81B4260F335AD228B087EFACA8
SHA-256:	E7D03869E24C34F637CA8F1875B6396673307108DA9E34D1E26F2D6849253B4F
SHA-512:	CA38A5BD8A2FA29194DE1A7EDBA8DA6332FA8E33DAA7C0253E20FB725C8E9BEE41F7C1DFEFB55EC1B1552919E535FE6BEB763B048AB9D4566D2BBC1D6820F604
Malicious:	false
Preview:	....D..(.![4.:......i...#P.#.s.....,9.lW`.g.<...)..ZRb..t.F...<..mj.>2I....7.k..4.9.b...o..7..`...ID'...<..@"....b:[. `.......'.#].Q]...5L....;4.....I....A..6..g...7.....a:....?.....I.F..LS...H..$$9.s..A...d ...:.. ...u.6."z.\|"...j.....q..\|.Wg[P?....e?."f.......F...u..:..e..<]Ud.nG...9"~.Z.D.e....C...6..9Dh.._@..5..]..w.... Y.....Dk;..%.Z.h..q.!..Au..EiF..q.....d..u...g..D..c...F.].M.DN.. t{u...W...f.C}{$ 8.-Y.Cp.2..QA-hP.8?.M.r.>{E..~....4..(A.A.O.7.M.2.Y..Z.I..`z.^M{._..M.....O.+{z.\.../.AO..... ....R.l.[1...#~2....R.Ik.K.uH'M..T..g.....p..N..5.0.mr..<.P.#.v...%z..6...W..I...M......l...P3..{0.2....Kx.-7.C6LNq\|...D..wUa.Gv.i..\7...~A.u...I...8.N.$B..v./..:.?..U4....Wr@......8f...\|.5...3..Zwk...+..n.z...@r.y.T..E.....................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\RE4u1kF[1].jpg Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6757
Entropy (8bit):	7.966804322612872
Encrypted:	false
SSDEEP:	96:W1DuMlU96CwGeTa3llyAelV9nrqT7wHxxHpcMgQl00NxH5fGh4p8GMjCgKMzCg1y:ylHx4g5V1rqqpF53XGh4O9zjzCg1y
MD5:	F075E26359ACA84C73D85D3385A1BADF
SHA1:	2B9AE02233E105F6819D3F443A34A26A826CAE74
SHA-256:	E41AAD3BB8DC4DE1936F3F7D10E6BA8685F3EEB2D139821365C6DABFBF6EAF75
SHA-512:	8EA6F2C1929F7A81088997875C44D8030E1D8290EF2DED4E60BC0F33E5995135BBF617013D2EC4BDC8508B9EA81CBB6480BF58A49AA585866539F1521B87BD87
Malicious:	false
Preview:	....{tW9.L.9....3Cj&.....m..y"&5."..H.(.V.W....G..p.>y.C..v...puc...'.MK..G.1...O.(..0S9..)c..k#._.n.EY;D.d.HL..}vk....f...nK...9he"[..MR@Zq.&Q.......Me<B'....D.Zt.`.........~r[`...9D.`...R.!.m/..N%..W....x...u-+.4{... ...K...E)Xv..1?#c.[...M.@..LK.x...\...6...h.....H..8v.S^.QV....d... ..=.M5>...<...yN,.`...$..@Ehk.`......8.. ../.....{&....w..:..\.w.il...N.... ..N6...u.....Y....ZEj..\/\|i....SD.....L.....qp-;..OEI$Y...N1.+...k.g....@.,Q..43b.6_......\|....<[.g....hG.2.....;.Y...d.+kXf0)dXh....i?.D....w..}..i.;p._c....E=yQ..H.n..D...O....L.]yw..9...V..<&5..0.G-.......`..H...(.....d.......4.W.t.&...... K...(_w.(..8>aU?.[..9.-..`...4...Z......q...V.Xz.Hb......;...T2R.we..mlx.6..=.P....m..;.a....%Or.3'.....%.(R..F-._.Rz.... ..3...Q.\.d.......O\Zx..)...9.S..,F\|.H._,..n.;.[.....r.H...;.Q.v.;5..v.@."K!..i..0.DY.i.`.h.........5.........?...s......L..(....T.:..q...2m..<jh..\..J.G.:C......m.,.7..v.j..=.....,..S.IB.g...&i#`2...Z......{......K6..>?.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\RE4ubMD[1].jpg Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3767
Entropy (8bit):	7.92978734445756
Encrypted:	false
SSDEEP:	96:x6QmLucIJlKGSlFEbff+twNLHL+io6HzUI1wKn:x6Q71lfSlOjLpo+AIN
MD5:	E1D567B2CEE8D186B1A136FC9E8E8E44
SHA1:	42F1FE7EF86B00D37DD12B9B16B5286DE975D270
SHA-256:	CE6E23E0AAABBE61F09079D8753F0B8F36697CA9CA180AE28F261D199CF4738C
SHA-512:	24BFF6E3258C0A664D7029A6961730CE879D873FECC0C88D2DD62E228C3ED18A490517AC7598696C8C1E711EB7A638A11104E9BC873AD4F2E7D2BC44299A5A00
Malicious:	false
Preview:	H.BPF...Fy...:..S........k(.Sw..8=&..,.].<LK....M.&Kl...s."Y...9[.[Pr.t....jJ..n.^-?.p.Y.{D.#..5(.!..uV.........Y.'..<.g2....n%....X...\...h........F-.......C.....4{"...d..{...I.k....0...K..gj.0.[.....b..h.%.@.....bk]..`/2..Q....~..s..W...t1..^...UQ]i.E.>7...?......Q...1...(..H=...k...../n.s..........3.....ON.-.....r.>...v...y..N..:.....m....[.d..&.!..j+.._+..R.0..#.....[P.0...Ww{.RVdY.&\|.....$X~.F.T..j../@>.&.g.E.'...n..S.Q7L....C....2ZRw...Z.nDM.3...l.^.g...+h...l.....Q../...^.;.._f..L../.(.......{..Bo.^?..}..F.Y.k;=.VD.*P...@..bU8?{d,kXr1...qo.....$r.../.F........y......e2..=Wo.4.o.'..).&.;8....Ir....~.{.&\|D.+^....5...A.r.s..[.x.uGq...^,2N...t.7.o.....uQ.....z.(X.H. ....Q...i;.......Iz6.@R.@...@.mC...71~...%B...Ta....H=...!.1.....x}k........A..X.@..ND]DY."r~9ww..l..+.;..,.VOnR.....Q...Z)$.........s..7.._.u1N.y..r.8.c..C..........9..."..N.8D...N.8D...N.y........<..??...xE......gqqDS......{st.....Z.>: E".,.K[YQ.r..HX!......

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\RE4wqj5[1].jpg Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	117633
Entropy (8bit):	7.982720011043676
Encrypted:	false
SSDEEP:	3072:glz/xSsXzOkyW8GCZO7HTGQDck3GMySdCbz0DFX3o:4/xK1xOHTGQDPzybz0R3o
MD5:	43EA430C0A748AC2ACBD8BD73CAB3EDD
SHA1:	16561E6F3F1BDDE100C5F730BC6A15B7E0B4C60E
SHA-256:	7DD955EF58B20CC28CF800893169BBB1C1B9F972C25A919F8942E54D7CCBD9A9
SHA-512:	E54550A3A2606403682832DB5F74F353A458B3A59729B1E708CEE4ECF1567DC48D16C8486CD8A7107DFBC545BEA4520FCD80C58F45EE7FA16F44302D0809488C
Malicious:	false
Preview:	q=....._6...s..2(f.lo......zW.1.g.u.~)%._.s........o......Z......O....0_.....y......Q..~...?...L..&.,.p0d^?/...........q.=..H.u9.....b.F.p/.7..yxE..h..u..~.(.c.Hn\|..,.......tZ.x.B..B..I.0. .]F.."!Gs...?.q.N.w.X.{...7..x.....f.Q3..<. .U}m...ir..."....d...M..b..i..o-&....:[F.@.=s...8.]D6`X/.. [9.......-..,.h.G..>.....A..6w..%......I.o......M,EMH....QgH..0a..Tq.y..f...x.....\|.3..pu..j..\|J....A<5C.."FF.Lr.N.K......[.fC.-..@..%..D.:..O9...U\.;..k;.YPk...D.v\|.[a....z..:7.T........u...\.i..c[..G.@..u..~_..x..".k...4.:#Q.y8..K..1g...n~.P......F.......GD.f.u..R.N...b]D.2<H.TU."..?...(_^....<..=.......\|.. ..8nXg..?.L....v...(......e9...J.$.....A.yP...C...;.$.xk.m....+>...b......5.T.b.ZU~G."=`...x..QF..>..W..V..].....g.".^....=..e..v&.s.s...c"]&.c.Y..Z<.ws...1.3C..w..c6.....E.-3.,...&8..R..\|.E...].p.........i..t=c..y...zL^.a..fCT.YE.!..G:k.>.P../.....k...8.'.\|...IL.......#\.i.. .hA1...2K...~.uB.a.:e...,.x...@.y7$k].&./.u.aG

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\RE4zuiC[1].jpg Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	62651
Entropy (8bit):	7.952472775853044
Encrypted:	false
SSDEEP:	1536:EBeEV1UeB5KigIdgJ3uXWt7sUWdeNvB4Y+4:EdV1B5Ki9K+mRsf4Nve4
MD5:	89EEE45988897B530CF727098C9E758A
SHA1:	3229C4C29C84C8C4DA4F718B2E72AA351562221D
SHA-256:	68EF285DD8236419BE94159B4F90EF0AE6898684A75109F8C4519746679EE91D
SHA-512:	BB347F074E25D089C31D124F0F1C3D40BF8B47955F84B571941119DAC0FD3B3DE7125BAD75FFCB781F82856D62DA1DD34A067D1C19E46AFA4B99983F1EFB94A2
Malicious:	false
Preview:	.......%)0.KuOz.oWuu.....,.4...Bi...x.$<B..n...G`.....k.Fv.n.M..v..F..y....k...(..s1....S..zF..+X[..".k...)...F.....L.E......E46........L....Y.r....F.)2.^[U.5.x%.S.;..;.$~.b....7..zJ.?0........ .d....L..<...#..n.c.5R\|.6o(....QDr.....d]%/3.{...-...J..G56o...{..K..6....0OG...C.E.:......E...!.....O.....Z..E.....O#/.&+{..;c.I...YV....-.'.#..oi}.B..!.8.......c...O.V....[.......I%.n'.f...K.4<.......]a.f....w-#>..x.....;...45...... ..QZ.(...pJW..0.m.b.H(^......R}....0>.....&.Bj.&.SW..H.!U.0/a..1=~...D..x.?;...8.+.s..6{..n.N].....yA....@)=...Y.6.......L...........M...~.#......b....P...e.l......c...+.L4.....:..?g..M......J...j....X&.a..f......4.=.$....\...Y. ...#pH...."....W4JC....U...o=Q.7.K...L.....}.........&.d.W...............{6l.cY.j...0H.@.ZW...l.%..`.Z5]s.t.~..'}....\|C.C.y.....8T. ...,.M_...^......`.....8...q.F..#.x;d....>...k..s]..4\.......xVn....n......c...#.E......i.0.....1.....\|D....{.^.v.........~..........5....K.>?.....\|..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\google-enterprise[1].png Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5111
Entropy (8bit):	7.923031315300294
Encrypted:	false
SSDEEP:	96:VRZ0/aIrwXIJThRUyxeij9+pxCZf8BMOJOqO+rwXIJThRUyxeij9+y:VikXmhCyQ0+pUZf8B1kXmhCyQ0+y
MD5:	AE19C53DBCBAEB53A1103279AB031EFD
SHA1:	D6AD9E6126F61EDA97CC81EF05A91A651FE4FDC1
SHA-256:	2DD34CA31C650D8F067BD3DF00F772885FC8E81429401F4A573C9A25AEF1335E
SHA-512:	62D26D091BE24554CEF595E47E541C62A0758784186D0F29CA47646E9B4B0C1888C1D1257F0F0CF478D84BDFE337D3FECB1346477C701F73917E2FA83FCC20F1
Malicious:	false
Preview:	.........X ...7m....a..e.5...]<.wV.d...zHLr.pc...$m{.u.......A.T8#.e..WRR6T...n......~....K..../.Er..../.]..".....y.....8..jJ'..<'..}6....gh...\|....W..sD....yl...f.R!9..s.1xa...l.C...H&..UJU{.._.7..`.zU.~..J.~&>..G.aM...r.H..=..5..7x..Kl...s..n.........E..g.T~..........V9.F.F...]>..G.no%J .X.:..KndD.../..I.3......T7...)].'.5h....S.0. ....T.EM-....n....:......c...].1L...._.......qJ....?T.?........!...B....7...zf....R.#.pV.Q[vU...l....zx?.W...9...)t.Y.U...>.mA..@!z..AW....Rx(:.G.,.2...[w....IA{..k5....:.S....>...+....d8...S.,.h.3.r+SJQ..`M..=4.,......7^W.:..%.<.....C.n./....G..l.Jk.6.F.....VY./....<.=i....OnT.(.m..i....f5...a..?e..!....T..a.......L..8..>........r...T{........_..3...f...E.9.<k......;"..x..k.....j.=.4...h..S0......._..5.....H..WRy_$.. .?.59....G-...C}......0..U.....?...........\8.K........... ...G(Q-..+...9p65...M.g..pj.Z._..c.CpbI(....yE(N....'..ah.......p.\|M......xb.l..s.s.4.c......&..."{).......I.....EG...v......<.m."

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\googlelogo_color_92x30dp[1].png Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3864
Entropy (8bit):	7.936734930272666
Encrypted:	false
SSDEEP:	96:tPiohhZ25tO+44s8NUH0Rdv4RzObT1koUpwGx+F:t6ohP+44s814RidrrGx+F
MD5:	47CA3F394764B9BE22FEA62F39739F63
SHA1:	EF8F9D05E222BEBA5934F1AFDE1507067B383130
SHA-256:	9238D2D48D7FB788A8411062F5FA19813AE772A5613810AC36B309FBEB744E1D
SHA-512:	AC6A5AA4A2F86EEC5A754E8B1FF727F5F222F4298C48B0B79C347C93C613605CB1E9A0EE2528A6BF6DD4A7162325371D31AE6D1C95F448280A9B13C326E40C2F
Malicious:	false
Preview:	{..#F2}y...5......d.T.....d...~..!...OA.Zu..}.FV...)..2.U....,..m."[.......I!..(..~..D..K..eK:.\|.......&.h..j.........K.&..P.....P....g..T;...!/k;E..]T.99?.......E.&...<.....c.Tv)B#.{.$QPQ.,...C...q.r..F.q..)...0..J...r..k.J....mP...%\*..j...`.D.vUJ....)../&..O.f.v/.YB.../.............}.S_......))...7S'...ii.8.i.....+.l)N.t..oH..]nM$....K.x..X.Q.,[..6.o>Q..}..~[..?mo>..t.-\!lC...-k ........3.6...j...!.B.p.B..>~&V...=...&...@.@+..<......Ew..a.<..t.%}[.-...C..{G..Ec<..9S....q..8...)0.L....M.$?...d.M.?MWI?.D.#(..P...frW.Uc...{#.-.#h.._5...Y...Vl....t..x...!...........$......SH@.....V....s..Kj..KJ._....[.g....z..aK....x.,..Q.n....b../.A.O.d...F......Ba..+..M.[DE.Ij.......<l....#........v..$.S...].=.`.A......q.D..$..S4/.v..i......ShM.....+5\....#..4HE;.=..I.\|....7XhgK..2..4".......].b.5..?JA.^..].....q.g.3..M..P..7..Q.+..............Q. f..3r5.=1...D6.L.....7-...5a...R5....u.&...V.....8=.4.-..wb.&k.1'.....^L.=;..U4.y.........,x.\.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\hero-anim-bottom-left[1].png Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	20839
Entropy (8bit):	7.9045268842075584
Encrypted:	false
SSDEEP:	384:C37+gYbLVULWrS9O2IA3W6SrqDieNKt37+gYbLVULWrS9O2IA3W6SrqDiQ:qkLVZ/A3W6Srq3K7kLVZ/A3W6Srq/
MD5:	5EF4A5677ADC527959B0E6854A875446
SHA1:	9F0CDB550DFF8A3BA4E516473336AE0D33ED3000
SHA-256:	B8B2687E4AD112E7084217AB9D62262FF430B1842CAF2B475C3153802AC09E38
SHA-512:	06E46A767ECA247C393870E2A9EF486A4015E2CE0F1C61D4FFD4B790640D9A5FAE5E75C35DA2328F06B496550E0E3D22ABBCF8FF42CF8060BBA3E67441F238AD
Malicious:	false
Preview:	.`F..%... ....`...j..!r...YS..U.x@....i...+[f..D.d4.srQ4.3....U(.xWg_4'..5.=k.e.@'...Z.~E.......%K...s.."G.5..Ybr..qV.2...^FF...rV.hU....%........y.D..}.e.n..._ZnZ.).....E...[....G.......W.1...I.&......5s0Y....u[......Y..P....h.)x.M....)~../g.8.=/....("V...]0_..M.zO..&..U.....Q.V^..<.N..1.........R..J.......F.R..A#.u.eR......E.I...Kk...^.(.1k.+...Ym..p.d.?-%....P..6....1....9..Dt...{...N..M..]zP4..eId....'.}).\|.v.KVZ..r...%.....x.W.J...$..(..j}^.8,0..\b..z...,.ri.>...W...;.+..K.Oc.S..r....J..B/6.y...2../......j.....-... .PB.{8. .k....U...{.o/Su...m..he....2.....Q`s.7..^i.......&..I.......X$....[...j4fF.].L....t..C."f.)C..Ri.6GS..J,....9r.D4.WS..O.....4......Q...?.cQz..b.....rE......[_..L$]..........5..._?.u=@.....u.ac9.Z%.......E.Q\|.."......I1a~...g..[.....]ihTBh.(9/.j`.r.z.a.mf..ma.q9......\.v....$.m^.`/......7C....nfY.......9.+...ar.0.N..lZX.y{...in.#4...a.Z.r.6.Z. .....4..'.&..mZ.e.........$...2...cw).....8q.]..Gh`'.}':3.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\homepage_privacy[1].png Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	21882
Entropy (8bit):	7.893786952449915
Encrypted:	false
SSDEEP:	384:Xu40+Pxwx52H9pMWIG0+Pxwx52H9pMWS0+Pxwx52H9pMWp:XuetplI0tplgtplp
MD5:	10BFCA4EAEC314A30C2ABF273F589B10
SHA1:	0D9ED576D8A083EB35D658B9F0DB0345ED234A2F
SHA-256:	A0DA757673E046EF8DE42BF53C32568F85E79743C043CC6B953ABED1B658E831
SHA-512:	8109BB4795A35DD493B770F592091E4C6DBD34D7B1FFE4077110D670B4E10278752945DEA2032CD974B441E4600CA8E3EBAC2588D8E5137186F0AF4961220E64
Malicious:	false
Preview:	.....K..u....a.&.:..f.\|.~R....D../6.g...w}D.>OK.CF.T..O-..F.Y.....:....VH...~.....k.[........U?<..'..v..d.7w9 a.H.^dqiq..fJ.2...X$2.I...V.e.,..K.../........^.Dt......6Z..I..c,....p.l...ck.g.P...Y.....gB...3}...V.u.X.k.....z.......x...u=......j..]~A..\|W..;...+..t.$...a.....1...Y.,....c....\...T.....Zt..A..Mk.c.c.fDQTju....z..Y....k...{).%"...b.Z....N.G....Z......69"./...f9N..j........M.A_.ge..(..7nA...S..&-.......8..<T..4.....x.y..RY..Y.}.7~....Q...Q..4vC.....W.j...E.If.Ks..^..mk.u........gH.37R7:e....#.......y#........RobWw..z.1(.O.%8.uq.A/4bj...#.......`..pmZ..9...%..li.J....}...[..9.........L....\T.5.5...s..U_.....A..V...V.8...<.}.u&..~X..S..L.!.lk+.^.#J.....^f..h..t.}6j.>.,.;.O.V.n.N..5.`........ay.<.A=...^..k^.XN....................~..by.b.nYPTW.-.D...ntRNS...o. ..!@..@p...)=.4`.......9....@#......P0.._O.@`......iNF.A0!.q`PJ...2)..Q;.....V"..........~soa@@..m....IDATx...1..A.........I<..^..l......`.5..j.CL...=..g.yT.....f.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\homepage_tools[1].png Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	38069
Entropy (8bit):	7.953791507107795
Encrypted:	false
SSDEEP:	768:5BSt8BpPXORFn58XaFvPzSt8BpPXORFn58XaFv3:3StQeR6snzStQeR6s/
MD5:	BEBC3BD32F85FB0D542657D46787FD8E
SHA1:	BA1C7A44F9A627CF2E5685E4F8B0F455A9A8F4FC
SHA-256:	9AF626E79A0DAA11F97C4FD7CF72C5CCAB61F646398E803442115167BD5FDE49
SHA-512:	0078BB3275D33EB5C8FA639EA5EAE93E0729C125B50A46D04D5F74BE95236A12871BE24165B696B97F86C3BC04D8087AA5270D2E1F7F42D49A4DA9C6E67E7222
Malicious:	false
Preview:	j.>.]?.-d..Z^...qt..(.;..<Cc.?.QD5.4s..8..v&X..>.s..b.P.`...M.....eu....M[.y..rZ.......uc..K..&z..F.k.\|....5...Q.z.Gl.T..`.h..Izj.....!..CQ.u.G.....j.N..Q.x.5..E..5.....d;C\.............8...!.q..Zm...npw......z.(....q.3c...jzR..0.k./8.1.9.kj..O[-..N.\T^..c......Y..ghw...V...$8..$O.v.W.L..d.o>...=!n...rG....?. ...`.].4...(..h.n..@.].H...2 Ok.v....s../O.]R.3Z#MG.}X,X..x......8...`.X'e,.......#U<p..5...1.".v.N..&j...0Z.vs.......!,V.h.l..l...(..+..x..t,..;..3.....Z.#g.z..oA6....?..=....L......... .Wv..?8....:.e..O.A.6.&..t.0.y?0.o{...W.).....^I).r....6... .V-.l..........Z){}R..Y.#4.Q../.....NH.;..D......%.. ....>B.....f22..7t1.+c..2..3...y k.n.].....s.k...s....-."....,.L......i-K....z..L\|.W..L..m4...^..S.....v4O.k.{.U...!w....CLY......}..p..^l....6..26?......16>............o.........RtRNS...... ... .<....2p&7@, ..` ..0........\|oS.y`P......aGDC.._..r.a0...X...h0.;.e....F.IDATx...Kn.P......l.......c..U.....Lut6..1)......8.hqinJ.!...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\icon-fb[1].jpg Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3306
Entropy (8bit):	4.791432632574388
Encrypted:	false
SSDEEP:	48:A8YFTJUG2BWu8zqCcXqJ5Xhw3WQGI5rnC6V:A/TJUG2I3qC1J5q3WQ9I6V
MD5:	6A4FEB552CD4B1C5362E443DC604C2DF
SHA1:	84BBF4869801576335509C9DEEE7F84F0CD433E3
SHA-256:	55ABEA06A82D0C8C4D0B51947E79719AC6F788B2D5D7BC0996707720D6FF67D8
SHA-512:	E250CE5243CD6B44F85013740680EE6A56ABBB9525B385AA1467E77DAD74EEA1B41EA8B9BAC8AA187DF66C54C40F41077FFA46834FA9F618FCB981DADE5B8978
Malicious:	false
Preview:	.P.`0r..vl.u.}..T....Q..1...lo#......@...=.P.A@[....k.D%..$...F...r...).<..w...I.......j.\Us...r.GX...@.,...74.w....t.:...4.$.x.<...v.....pD..nV......[....i...lAHW..N6....77.!...G......G......1...P..b.B..Q..s1.:Q.(...q..5......\|..i.7zg.k.L.a.\....~.r..._..^......h/...\|I...vJ..\.U....P..OB...Y?.B.m^...cL..?P.y...Z....s.L.X.0[..c.yC....O..\|..^..,#.B..)......M{%....[`..8..s...j(.T...C.nb.wym.Q...........B.PZ..s@W...r .....&...95.~.Mm..kpP!....)..f.....E<......H.0...3...>..:.j!..]."u...-....j3T..`+.zy...e......x.P..6...?....ag....JN....`G.B.N...0.{o>.6u.*..b=..U..:....?.jC56.o.s-.1..7.w.\.........M@c.....(1G. q._XQ......q.c.Q2..V.T....k}...L...I.b.L.`..q.D).....E;.,!..SR.^._h... ..}n.Z...Ct7.....D:.._....2.F^z.].T:..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\icon-youtube[1].jpg Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	9588
Entropy (8bit):	4.650867521215546
Encrypted:	false
SSDEEP:	96:+M+IUKARi5q3jHMp6P5/MfTrui5q3jHMp3vizWIszvv6Fi5q3jHMpd:+OUKARigt5/Mf2igmizWIszvvYigq
MD5:	8CCA5F471141EBA76F2D4D2365676041
SHA1:	A069C8102ABD27183410133F362C57A1281447EE
SHA-256:	E65A0EC40BD1C9DA724EDE8EA10B5EAF7472CC1510441148C6F0798780C96C36
SHA-512:	654526D146530C5C70224C416F786E9ABE8B61864F8A85A98F7F799E83BABCBEEDA83DE49963CC37F03CC8C5E6DCFA0EAA09F543F8B5E2E9B7126380A4F5EFBA
Malicious:	false
Preview:	...i..uZ:..Yq>..0.D.J..n.}..f.Cuz....(v......#c]...7..#.........y\|.......G.C....@E:.:M.h..T....9........X..h.N..3U(...s#...y.P'..;....pR.v..o...i.7.F.za!R>...UOkU.;.Q..8.qx...DA..E..V.0...H..)e..p..p-d....09.1U)..XV...p.z.D.'X........0=...B.P:....ke.U..rrP..t....7I.+8r...UL...&......Q..n...........0.._]......M.8..E..o.^.d.....;4U9x...5f.v4........`.....^$i..h.C\..T..JU..[.&.rW..w..>.40$,_3....^..x. ....o.wW......J.:18..2g......q.W-....y....Yb.j"r.@.S"R.E....D7Q.>Y.V.....k.U._ry@-H)...I8N.]..;j.:v...W.3..vuH.U.H..*a`...<..Z........-..2u+.......\|..^..f.Q.b2./)<q.;..G.I%...'B..0....../.:6`...c...^..>.....33.i.%Ul8..{.I.s...uT.....1...x..{..5.....Zp..b..e.T....y.7.d.a..Qz...\Xc{.X.7Z....9.../X$..,.SA2.1f.A.C8y..t....+~.. d..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\images[3].jpg Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2174
Entropy (8bit):	7.9177874306665155
Encrypted:	false
SSDEEP:	48:ouEfPrGbYjwKK9DPhRfEaKE2cSWnsTmaLiZCooBAtAH:ouEfnI/sascS82iZrtAH
MD5:	835B21BA5B0B8973010BB2DCD7C29F53
SHA1:	557933C3612B59E8EFAD2E059CCB35222D2E7037
SHA-256:	A50BF408F9FA2BD84CDC508D2A7DD2B7730E70DA75AF6B95A7388F7DCE7ADFF1
SHA-512:	4C0C05C0FD07C73E0ACA0C6F49E8552AB41704FEEDECD1FD2CD96AA7AADDD7DCD8FCAC4D6AFD4E612DFB15429ABAD19FF77CCA5A6DDBC79138E59F3EE9F475DA
Malicious:	false
Preview:	O...}.~.Z...jm...S.......R.....D.t.=m....o.=8....:..t+.xz...>....j3&..Q.nRp.....'_..............,..n.\.\|.x. M,..._....j......6.........+..o_T........E=.....g.Cz.....E/..;.@..J..[...X.~.q..f.....qF.....r.38Mg.,L..uG}K)4AJFN..[j.%&......2.dWgv..S. ...2.8..f{....N....r.....\|.1B[g.....5..Y....+=mCO<R._.,.a.3 vN5...s.....K.6..}........).@@.[..N.t..E.h.O.?. ...$U..b..A.!....F.K.;.u....P.....^....UK$.%.-]2.3...%W.bg}.8.T........k.V......2......?..;a.Y.Y.i.0.w...@.W...]lQ..$.\|....dN.....J......\c...x.L{tL.=..9.9.to.O.S..hI.S.N.9ez.^...^Xu....k.1.CT.C...D7.......N.@.xEL.'jU....<...#.A...."0.a..].i.3...3.M[.pm.DB.dj/.dbi.W...P.ce..3..].K.....N.tq...F...wi.,.i.\<..#;Z0G.O7Q3"9.....pB3...TsE.%.J............$K..x.A.YF....d.u..bv~....J........f.iK.e.HJUk6D...'-....^...g."{...L....N....Z..+...w.{...Lz.~.....o.t.t...T.L.............>....ug{....H..Ec.Y....!.V....1....K../E..gON..........R.#.6..".3.....z.X...M...r...I.!..`q$Fie....AM.".....7s.....ZQg

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1992
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	2D707791A014BFEB049FBD7D87170190
SHA1:	87AF3841A3259CB1016FC2D7F4482BA8F1EFD3A4
SHA-256:	1077033D0E9374BDB9DDCE254EC1D80AC2B02A10EEFC5DEB9A4F59BB6C31791B
SHA-512:	91EB7F9B388ECAC04D9FE2F604F265251A484C8AC10486DD80E44E39B62DEE1C00DBC3DC54E4D6B277A96E5F5E06D2CDB2C95B0EBD21BCAEF6391CC9AE770510
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUc:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgic
MD5:	2DD89CA2D644D9414D300A8AF16335CA
SHA1:	669A89206DBF779310703AEE89FAF02E45F4BD8F
SHA-256:	96050B4208C71F273887FDD4DC7CE3D2AE8B557916F9B131DD33863B0D59AED9
SHA-512:	9847E81AD1CF2B6C34CF1FA713D3E24F49D3E92E9DABD2CD356CFC574A76155FA3E866D43C2144AAE388E10D326C0682B48187CC0B52D7DF7CB6F3561262E65C
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgiYgiYgs
MD5:	E613EA5A41C14189D4F1969F4C1D08C7
SHA1:	5C7B6BE01793461B7E46DF1F5CEBFD1AD0D2E469
SHA-256:	356A44ED44C06703A5B15A3B35A60CE3D3B0D275FD59DA1118A0F47B928BB05C
SHA-512:	E6BD0469D1E4A10043DBC273DE44073B4BDCB799755491C8C13F5185B3FE98C32BC3E9BF5FC9D6FE62F515DFAF43D0DFCFD5ACD11B4F814D0DA72CE3C6C89929
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1743
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgs
MD5:	AECB094884F8527CC8946D98C0CA9489
SHA1:	27C2BF3B010455FF77BD1C5DCB3B7FD341B58AEA
SHA-256:	D7C6D4EC9BCEF51770FD65526DF578192C51B4B8EEA6BB6B0FE924A77324E99F
SHA-512:	CBB4A6EEDC1895E1F8CB34B5488E5F26ECA052ADD8EBF20046CECE6D6B1C7723AB5D8F135200EF52DC88EE5953BBC336EB74C6DA904D56EEAAA9BB33A0C128AE
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Virtualized\C\Users\user\AppData\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Virtualized\C\Users\user\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Virtualized\C\Users\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	996
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	24:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycs:wDUY9SxRUY9SxRUY9SxRUY9Sxs
MD5:	5A76AB1CF8045E124D8352632D48448D
SHA1:	5D81C0542D65E7212B1F2AA4BD8942850E8E55FC
SHA-256:	8874982CCBE2BA22A7527BC611AB771652E815CF03ECEFC378EB418F253AB578
SHA-512:	34111F0E1D76E55260652B4FA31BB7ADD46ACE088DF574D37CFA49FBF3F58477481DDBE739EC76C1F088835024B3EDA5696202C3B1B848E799A40235A68DABC8
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Virtualized\C\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	996
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	24:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycs:wDUY9SxRUY9SxRUY9SxRUY9Sxs
MD5:	5A76AB1CF8045E124D8352632D48448D
SHA1:	5D81C0542D65E7212B1F2AA4BD8942850E8E55FC
SHA-256:	8874982CCBE2BA22A7527BC611AB771652E815CF03ECEFC378EB418F253AB578
SHA-512:	34111F0E1D76E55260652B4FA31BB7ADD46ACE088DF574D37CFA49FBF3F58477481DDBE739EC76C1F088835024B3EDA5696202C3B1B848E799A40235A68DABC8
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Virtualized\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	996
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	24:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycs:wDUY9SxRUY9SxRUY9SxRUY9Sxs
MD5:	5A76AB1CF8045E124D8352632D48448D
SHA1:	5D81C0542D65E7212B1F2AA4BD8942850E8E55FC
SHA-256:	8874982CCBE2BA22A7527BC611AB771652E815CF03ECEFC378EB418F253AB578
SHA-512:	34111F0E1D76E55260652B4FA31BB7ADD46ACE088DF574D37CFA49FBF3F58477481DDBE739EC76C1F088835024B3EDA5696202C3B1B848E799A40235A68DABC8
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1743
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9Sxs:LYgiYgiYgiYgiYgiYgiYgs
MD5:	AECB094884F8527CC8946D98C0CA9489
SHA1:	27C2BF3B010455FF77BD1C5DCB3B7FD341B58AEA
SHA-256:	D7C6D4EC9BCEF51770FD65526DF578192C51B4B8EEA6BB6B0FE924A77324E99F
SHA-512:	CBB4A6EEDC1895E1F8CB34B5488E5F26ECA052ADD8EBF20046CECE6D6B1C7723AB5D8F135200EF52DC88EE5953BBC336EB74C6DA904D56EEAAA9BB33A0C128AE
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\DNTException\Low\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\DNTException\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\ESE\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\Low\ESE\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\Low\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\PrivacIE\Low\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\PrivacIE\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Windows\Notifications\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Windows\Notifications\wpnidm\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Windows\PRICache\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Windows\Ringtones\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Windows\RoamingTiles\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Windows\Safety\edge\local\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Windows\Safety\edge\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Windows\Safety\edge\remote\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Windows\Safety\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Windows\SettingSync\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Windows\Shell\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Windows\UPPS\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Windows\WER\ERC\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Windows\WER\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Windows\WinX\Group1\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Windows\WinX\Group2\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Windows\WinX\Group3\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Windows\WinX\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\Windows\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\af-ZA\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\ar-AE\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\ar-BH\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\ar-DZ\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\ar-EG\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\ar-IQ\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\ar-JO\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\ar-KW\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\ar-LB\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\ar-LY\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\ar-MA\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\ar-OM\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\ar-QA\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\ar-SA\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\ar-SY\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\ar-TN\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\ar-YE\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\az-Latn-AZ\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\bg-BG\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\bn-BD\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\ca-ES\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\cs-CZ\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\da-DK\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\de-AT\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\de-CH\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\de-DE\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\de-LI\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\de-LU\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\el-GR\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\en-029\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\en-AU\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\en-BZ\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\en-CA\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\en-GB\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\en-HK\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\en-ID\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\en-IE\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\en-IN\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\en-JM\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\en-MY\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\en-NZ\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\en-SG\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\en-TT\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\en-ZA\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\en-ZW\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\es-419\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\es-AR\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\es-BO\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\es-CL\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\es-CO\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\es-CR\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\es-DO\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\es-EC\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\es-ES\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\es-GT\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\es-HN\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\es-MX\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\es-NI\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\es-PA\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\es-PE\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\es-PR\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\es-PY\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\es-SV\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\es-US\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\es-UY\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\es-VE\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\et-EE\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\eu-ES\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\fa-IR\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\fi-FI\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\fr-029\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\fr-BE\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\fr-CA\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\fr-CD\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\fr-CH\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\fr-CI\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\fr-CM\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\fr-FR\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\fr-HT\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\fr-LU\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\fr-MA\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\fr-MC\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\fr-ML\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\fr-RE\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\fr-SN\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\gl-ES\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\ha-Latn-NG\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\he-IL\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\hi-IN\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\hr-BA\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\hr-HR\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\hu-HU\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\hy-AM\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\id-ID\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\it-CH\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\it-IT\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\ka-GE\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\kk-KZ\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\lt-LT\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\lv-LV\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\mk-MK\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\ms-BN\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\ms-MY\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\nb-NO\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\nl-BE\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\nl-NL\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\pl-PL\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\pt-BR\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\pt-PT\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\ro-MD\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\ro-RO\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\ru-RU\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\sk-SK\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\sl-SI\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\sq-AL\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\sr-Cyrl-BA\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\sr-Cyrl-ME\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\sr-Cyrl-RS\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\sr-Latn-BA\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\sr-Latn-ME\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\sr-Latn-RS\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\sv-FI\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\sv-SE\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\tr-TR\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\uk-UA\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\input\uz-Latn-UZ\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Microsoft\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	996
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	24:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycs:wDUY9SxRUY9SxRUY9SxRUY9Sxs
MD5:	5A76AB1CF8045E124D8352632D48448D
SHA1:	5D81C0542D65E7212B1F2AA4BD8942850E8E55FC
SHA-256:	8874982CCBE2BA22A7527BC611AB771652E815CF03ECEFC378EB418F253AB578
SHA-512:	34111F0E1D76E55260652B4FA31BB7ADD46ACE088DF574D37CFA49FBF3F58477481DDBE739EC76C1F088835024B3EDA5696202C3B1B848E799A40235A68DABC8
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\AC\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\ActiveSync\LocalState\DiagOutputDir\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\ActiveSync\LocalState\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\ActiveSync\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\AC\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\F46D4000-FD22-4DB4-AC8E-4E1DDDE828FE_cw5n1h2txyewy\AC\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\F46D4000-FD22-4DB4-AC8E-4E1DDDE828FE_cw5n1h2txyewy\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\InputApp_cw5n1h2txyewy\AC\INetCache\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\InputApp_cw5n1h2txyewy\AC\INetCookies\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\InputApp_cw5n1h2txyewy\AC\INetHistory\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\InputApp_cw5n1h2txyewy\AC\Temp\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\InputApp_cw5n1h2txyewy\AC\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\InputApp_cw5n1h2txyewy\AppData\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\InputApp_cw5n1h2txyewy\LocalCache\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\InputApp_cw5n1h2txyewy\LocalState\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\InputApp_cw5n1h2txyewy\RoamingState\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\InputApp_cw5n1h2txyewy\Settings\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\InputApp_cw5n1h2txyewy\SystemAppData\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\InputApp_cw5n1h2txyewy\TempState\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\InputApp_cw5n1h2txyewy\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\AC\INetCache\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\AC\INetCookies\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\AC\INetHistory\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\AC\Temp\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\AC\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\AppData\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\LocalCache\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\LocalState\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\RoamingState\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Settings\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\SystemAppData\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\TempState\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\AC\INetCache\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\AC\INetCookies\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\AC\INetHistory\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\AC\Temp\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\AC\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\AppData\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\LocalCache\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\LocalState\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\RoamingState\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\Settings\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\SystemAppData\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\TempState\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.Advertising.Xaml_8wekyb3d8bbwe\AC\INetCache\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.Advertising.Xaml_8wekyb3d8bbwe\AC\INetCookies\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.Advertising.Xaml_8wekyb3d8bbwe\AC\INetHistory\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.Advertising.Xaml_8wekyb3d8bbwe\AC\Temp\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.Advertising.Xaml_8wekyb3d8bbwe\AC\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.Advertising.Xaml_8wekyb3d8bbwe\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.AsyncTextService_8wekyb3d8bbwe\AC\INetCache\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.AsyncTextService_8wekyb3d8bbwe\AC\INetCookies\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.AsyncTextService_8wekyb3d8bbwe\AC\INetHistory\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.AsyncTextService_8wekyb3d8bbwe\AC\Temp\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.AsyncTextService_8wekyb3d8bbwe\AC\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.AsyncTextService_8wekyb3d8bbwe\AppData\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.AsyncTextService_8wekyb3d8bbwe\LocalCache\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.AsyncTextService_8wekyb3d8bbwe\LocalState\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.AsyncTextService_8wekyb3d8bbwe\RoamingState\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.AsyncTextService_8wekyb3d8bbwe\Settings\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.AsyncTextService_8wekyb3d8bbwe\SystemAppData\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.AsyncTextService_8wekyb3d8bbwe\TempState\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.AsyncTextService_8wekyb3d8bbwe\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.BingWeather_8wekyb3d8bbwe\AC\INetCache\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.BingWeather_8wekyb3d8bbwe\AC\INetCookies\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.BingWeather_8wekyb3d8bbwe\AC\INetHistory\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.BingWeather_8wekyb3d8bbwe\AC\Temp\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.BingWeather_8wekyb3d8bbwe\AC\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.BingWeather_8wekyb3d8bbwe\AppData\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.BingWeather_8wekyb3d8bbwe\LocalCache\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.BingWeather_8wekyb3d8bbwe\LocalState\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.BingWeather_8wekyb3d8bbwe\RoamingState\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.BingWeather_8wekyb3d8bbwe\Settings\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.BingWeather_8wekyb3d8bbwe\SystemAppData\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.BingWeather_8wekyb3d8bbwe\TempState\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.BingWeather_8wekyb3d8bbwe\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.BioEnrollment_cw5n1h2txyewy\AC\INetCache\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.BioEnrollment_cw5n1h2txyewy\AC\INetCookies\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.BioEnrollment_cw5n1h2txyewy\AC\INetHistory\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.BioEnrollment_cw5n1h2txyewy\AC\Temp\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.BioEnrollment_cw5n1h2txyewy\AC\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.BioEnrollment_cw5n1h2txyewy\AppData\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.BioEnrollment_cw5n1h2txyewy\LocalCache\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.BioEnrollment_cw5n1h2txyewy\LocalState\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.BioEnrollment_cw5n1h2txyewy\RoamingState\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.BioEnrollment_cw5n1h2txyewy\Settings\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.BioEnrollment_cw5n1h2txyewy\SystemAppData\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.BioEnrollment_cw5n1h2txyewy\TempState\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.BioEnrollment_cw5n1h2txyewy\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.CredDialogHost_cw5n1h2txyewy\AC\INetCache\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.CredDialogHost_cw5n1h2txyewy\AC\INetCookies\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.CredDialogHost_cw5n1h2txyewy\AC\INetHistory\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.CredDialogHost_cw5n1h2txyewy\AC\Temp\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.CredDialogHost_cw5n1h2txyewy\AC\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.CredDialogHost_cw5n1h2txyewy\AppData\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.CredDialogHost_cw5n1h2txyewy\LocalCache\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.CredDialogHost_cw5n1h2txyewy\LocalState\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.CredDialogHost_cw5n1h2txyewy\RoamingState\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.CredDialogHost_cw5n1h2txyewy\Settings\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.CredDialogHost_cw5n1h2txyewy\SystemAppData\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.CredDialogHost_cw5n1h2txyewy\TempState\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.CredDialogHost_cw5n1h2txyewy\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\AC\INetCache\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\AC\Temp\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\AC\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\AppData\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\LocalCache\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\LocalState\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\RoamingState\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\Settings\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\TempState\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.ECApp_8wekyb3d8bbwe\AC\INetCache\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.ECApp_8wekyb3d8bbwe\AC\INetCookies\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.ECApp_8wekyb3d8bbwe\AC\INetHistory\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.ECApp_8wekyb3d8bbwe\AC\Temp\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.ECApp_8wekyb3d8bbwe\AC\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.ECApp_8wekyb3d8bbwe\AppData\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.ECApp_8wekyb3d8bbwe\LocalCache\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.ECApp_8wekyb3d8bbwe\LocalState\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.ECApp_8wekyb3d8bbwe\RoamingState\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.ECApp_8wekyb3d8bbwe\Settings\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.ECApp_8wekyb3d8bbwe\SystemAppData\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.ECApp_8wekyb3d8bbwe\TempState\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.ECApp_8wekyb3d8bbwe\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\AC\INetCache\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\AC\INetCookies\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\AC\INetHistory\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\AC\Temp\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\AC\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\AppData\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\LocalCache\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\LocalState\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\RoamingState\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\Settings\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\SystemAppData\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\TempState\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.Getstarted_8wekyb3d8bbwe\AC\INetCache\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.Getstarted_8wekyb3d8bbwe\AC\INetCookies\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.Getstarted_8wekyb3d8bbwe\AC\INetHistory\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.Getstarted_8wekyb3d8bbwe\AC\Temp\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.Getstarted_8wekyb3d8bbwe\AC\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.Getstarted_8wekyb3d8bbwe\AppData\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.Getstarted_8wekyb3d8bbwe\LocalCache\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.Getstarted_8wekyb3d8bbwe\LocalState\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.Getstarted_8wekyb3d8bbwe\RoamingState\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.Getstarted_8wekyb3d8bbwe\Settings\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.Getstarted_8wekyb3d8bbwe\SystemAppData\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.Getstarted_8wekyb3d8bbwe\TempState\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.Getstarted_8wekyb3d8bbwe\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.LockApp_cw5n1h2txyewy\AC\INetCache\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.LockApp_cw5n1h2txyewy\AC\INetCookies\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.LockApp_cw5n1h2txyewy\AC\INetHistory\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.LockApp_cw5n1h2txyewy\AC\Temp\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.LockApp_cw5n1h2txyewy\AC\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.LockApp_cw5n1h2txyewy\AppData\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.LockApp_cw5n1h2txyewy\LocalCache\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.LockApp_cw5n1h2txyewy\LocalState\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.LockApp_cw5n1h2txyewy\RoamingState\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.LockApp_cw5n1h2txyewy\Settings\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.LockApp_cw5n1h2txyewy\SystemAppData\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.LockApp_cw5n1h2txyewy\TempState\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.LockApp_cw5n1h2txyewy\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.Messaging_8wekyb3d8bbwe\AC\INetCache\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.Messaging_8wekyb3d8bbwe\AC\INetCookies\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.Messaging_8wekyb3d8bbwe\AC\INetHistory\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.Messaging_8wekyb3d8bbwe\AC\Temp\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.Messaging_8wekyb3d8bbwe\AC\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.Messaging_8wekyb3d8bbwe\AppData\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.Messaging_8wekyb3d8bbwe\LocalCache\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.Messaging_8wekyb3d8bbwe\LocalState\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.Messaging_8wekyb3d8bbwe\RoamingState\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.Messaging_8wekyb3d8bbwe\Settings\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.Messaging_8wekyb3d8bbwe\SystemAppData\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\Microsoft.Messaging_8wekyb3d8bbwe\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\adobe.acrobatreaderdc.protectedmode\AC\INetCache\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\adobe.acrobatreaderdc.protectedmode\AC\INetCookies\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\adobe.acrobatreaderdc.protectedmode\AC\INetHistory\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\adobe.acrobatreaderdc.protectedmode\AC\Temp\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\adobe.acrobatreaderdc.protectedmode\AC\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\adobe.acrobatreaderdc.protectedmode\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\AC\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Packages\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	996
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	24:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycRPyJHYYLoMTycs:wDUY9SxRUY9SxRUY9SxRUY9Sxs
MD5:	5A76AB1CF8045E124D8352632D48448D
SHA1:	5D81C0542D65E7212B1F2AA4BD8942850E8E55FC
SHA-256:	8874982CCBE2BA22A7527BC611AB771652E815CF03ECEFC378EB418F253AB578
SHA-512:	34111F0E1D76E55260652B4FA31BB7ADD46ACE088DF574D37CFA49FBF3F58477481DDBE739EC76C1F088835024B3EDA5696202C3B1B848E799A40235A68DABC8
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\PeerDistRepub\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\Fonts\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\Licenses\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\Microsoft.WindowsAlarms\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\SettingsContainer\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Publishers\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Temp\CR_94EB1.tmp\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Temp\Low\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Temp\acrocef_low\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Temp\acrord32_sbx\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Temp\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Temp\uiv4hfp2.zbn\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJs:wDPyJHYYLoMTycRPyJHYYLoMTycs
MD5:	F108AC415F52B11ABD2E51683785B1AD
SHA1:	4EFECA7D382D6F943162F8142FB25163AB2E3FFB
SHA-256:	B2AC325F95FF3903638F40792DBD72EE44CA5BBB8F88C635E598905CE1452E0F
SHA-512:	8AAEE9C033D28E46EA762F80654E37598C5162768CED6A9C941EA829FD7E1AC788C9215AB3AE3F3F3C78DF3390296A2EB1095BD876BCF57A497A51A81BFD1C09
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\Temp\{F98E098A-0ABF-4C65-BC96-7001FB4A77C0}.png Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5829
Entropy (8bit):	7.915699076330811
Encrypted:	false
SSDEEP:	96:Cq2Fgt5oQ35jzrCArEPbFKy1S9Lcu1lzeqqIIg7hl90EDTGlDn+5nxQAa2p:CqYwfVrCfPbFL1SFlSl2hMpQ5xQAag
MD5:	CB9352BD7CE7B853B114FB008FD30A42
SHA1:	F672D4DA91B67239444BB61D0AE44E23912F3AED
SHA-256:	1E899DD5E6C31E06A54AF154CAFCC6C9748FB37551C0E8503C6C1192CA4C805C
SHA-512:	59FFB42EA8EF55F3FE6B07C91AC0BDEB74AB265321F31C086F837A065C265F25BA6DBED85B108AD9D011001A83D1E5514FB1F0D026948C995AD15210290D13E5
Malicious:	false
Preview:	Z_..:>nx...I.'R.3.:3=.I...1..e.......l@.m...N....#.2..4..Az".'a...JC/.M.s..-S..f.3...UI....3.P.....\.i......H ....+.Z.}...v...[e..T.c..%....bCi.,....DJ.9.].ng...\|d.G..&j......._@,.q/-Y..y......&t.*D.P..N.._......v.....d.?.V9...OeH...G..&.....\|Ru.5..G).C......;...7.M......QJ.....!.:j.5..V.........yM./.c#-.`....^..........1C..k...&.{.z..)I...g.s...1.....[...m........9...H...E..&....Y(o. .~f..uAV...3..)..6...?l.).k..j..'..C.o....6D...$3s.i..@.\|.#..$C..{.Y.i..b...t..C_o7E....;..... V.U.......`.....}./_E....7W..I6$sX....8...........3.N..u..6.k;.@.I..s&......]6.......7..1..M...lN..S..a.z@o.....A..h..T1G.9...G.Ek...~._\y.~G..j..u....t..L...o.....'...<..<.x.<V........{..X.yg4.s 2.._../.Dz...-.....N\|IZ5J+.<.i..[...0 p.S....C...6....B.w..n.I.h,.M.A..A.......X>.?..TU..~3..Zb.....0u.w.....Rh........Z"..yr....CK(b.XZ......hL...A6..GU`....`i..h'.q....w..A6kn....x.........;a.uh3D..[J.....4.....,W../........%.3@.M..F....d.e...v... k./...{..... ...

C:\Users\user\AppData\Local\VirtualStore\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	12:wGwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YLPYfDorQTybWJcwTAgQwyJH1YT:wDPyJHYYLoMTycRPyJHYYLoMTycRPyJ8
MD5:	0F0F7FDF8029AC475ADF5A6DEF9289FD
SHA1:	F9D599E47642BF66A44F5A43DBC65A09922EE637
SHA-256:	A3B534AD46213458A73F23C297DB61D417F32087DEE8822BD2586A2BBBCFD646
SHA-512:	E052B4821BB65B5622FD7B309B19FE867607AC0779BCED7F59907755732AD1EB0D0CBD2E4B8A8377AFC8650526BB23D56FCF11E655611E1C6E5ED51D107900FC
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\AppData\Local\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2988
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	48:wDUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUY9SxRUZ:LYgiYgiYgiYgiYgiYgiYgiYgiYgiYgiZ
MD5:	1EAFD54AB2EF966BEFDDBC81523CC9A3
SHA1:	B88BAF7E2AEF9583E5D9166BE4FA708D2F90AE62
SHA-256:	525754A2BF80387C752C0B58D1B8E5A42C306B7BB9996EE502E0A51383D6740D
SHA-512:	83731C664680216E99447D813AA39FFDB04899E049067DECD24FD7BE5F33338952EA2258EE91C6ACE643B107E111478ACC096790082B3082998D28EFEBD6279A
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1....

C:\Users\user\AppData\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\user\Desktop\s.bat Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	52
Entropy (8bit):	4.48151514150159
Encrypted:	false
SSDEEP:	3:WIVdks0yoNKpovtzERovn:vFoN/vZ4y
MD5:	5303659755209B3C49825A1E21139057
SHA1:	EA27A30BC0DFB73B7873492A05E55BC5F853A7CD
SHA-256:	373316657D5CD18BB86CB6E08445EF96AB5C3D57E458CEC86476775686C1E8AB
SHA-512:	B25E6817DF9AA39B1ECA78D36C38E795FD266EF93898196676DFE9590BD54475759F212F5A3B90958A0CD839B78ED86613453BA87976704B530C51B26F9A2C64
Malicious:	false
Preview:	vssadmin.exe Delete Shadows /All /Quiet..DEL s.bat..

C:\Users\user\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

C:\Users\readMe!.txt Download File
Process:	C:\Users\user\Desktop\cA3HKPci26.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.333459854644713
Encrypted:	false
SSDEEP:	6:wGFdlurZTAgQoYEyJHRP1aFNLPYfDorvF/NRWTwEcgAWsgaWs:wGwTAgQwyJH1YLPYfDorQTybWJs
MD5:	721F830C7E337182A3D0C34D8B1F445D
SHA1:	2B2B437E528602D8D072D9098197E82A55755A3A
SHA-256:	2D4F107EE03CCB6789E988BAA6C921E95D0B8E50CC7DD00EB2F23057C75B0885
SHA-512:	E60A98C35EB9F04B7589D13EB8B16B514DDCC328AEA257E854624C1256AAFA312DD63D745342FB3BA06465BA83D778DEE00733AF0D3FD5BDDFA84E06B1D437B0
Malicious:	false
Preview:	........! .... ..... ............ ........... ......... .. e-mail yaga.babushka@yahoo.com .... .. ...... ... ......... ........... ....... .............. ............ ..... ........ . .. ............. ...... ........... ....... ... ID - 13201612toj1

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.754209746977936
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	cA3HKPci26.exe
File size:	29184
MD5:	a20e47d870f92c1787bc4a5622586859
SHA1:	f39d211787e0b114279030472ff75c99e413856b
SHA256:	cddad8bdfdc2867eab55f6cf96a82eaf0832cb6539ce3c3fd7c3355325a38095
SHA512:	a5a028cd44ecf9c31b9f58090f36b649a8155343f082e7554b5e279e8bf9c2ae57758e3ee850074fef12dc8fd6700bf9157eb1ed857c8ac17352768647a300ba
SSDEEP:	768:Mm1EORfbNZZpPWe/hTxorgdIUHuT7sAwYcV6w8w9b:Mm1EORfbN3peeP2gdIUOZY6lw9
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...;N.V.................H...(......ng... ........@.. ..............................A)....@................................

File Icon


Icon Hash:	2366a3a3a7bfff7f

Static PE Info

General
Entrypoint:	0x40676e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x56964E3B [Wed Jan 13 13:16:43 2016 UTC]
TLS Callbacks:
CLR (.Net) Version:	v2.0.50727
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6718	0x53	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x8000	0x2500	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xc000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x4774	0x4800	False	0.514973958333	data	5.27857415519	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0x8000	0x2500	0x2600	False	0.491673519737	data	5.89662838151	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xc000	0xc	0x200	False	0.044921875	data	0.0815394123432	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_ICON	0x8130	0x10a8	dBase IV DBT of @.DBF, block length 4096, next free block index 40, next free block 4294967295, next used block 4294967295
RT_GROUP_ICON	0x91d8	0x14	data
RT_VERSION	0x91ec	0x374	data
RT_MANIFEST	0x9560	0xf99	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright 2015
Assembly Version	1.0.1.4
InternalName	.docx.exe
FileVersion	1.0.1.4
CompanyName
LegalTrademarks
Comments
ProductName	.pdf
ProductVersion	1.0.1.4
FileDescription	.pdf
OriginalFilename	.docx.exe

Network Behavior

Network Port Distribution

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 4, 2021 21:06:27.795423031 CEST	53097	53	192.168.2.4	8.8.8.8
Oct 4, 2021 21:06:27.815510988 CEST	53	53097	8.8.8.8	192.168.2.4
Oct 4, 2021 21:06:55.140311003 CEST	49257	53	192.168.2.4	8.8.8.8
Oct 4, 2021 21:06:55.158493042 CEST	53	49257	8.8.8.8	192.168.2.4
Oct 4, 2021 21:07:01.418530941 CEST	62389	53	192.168.2.4	8.8.8.8
Oct 4, 2021 21:07:01.452625036 CEST	53	62389	8.8.8.8	192.168.2.4
Oct 4, 2021 21:07:17.315020084 CEST	49910	53	192.168.2.4	8.8.8.8
Oct 4, 2021 21:07:17.333039045 CEST	53	49910	8.8.8.8	192.168.2.4
Oct 4, 2021 21:07:37.376307011 CEST	55854	53	192.168.2.4	8.8.8.8
Oct 4, 2021 21:07:37.394217014 CEST	53	55854	8.8.8.8	192.168.2.4
Oct 4, 2021 21:07:38.486759901 CEST	64549	53	192.168.2.4	8.8.8.8
Oct 4, 2021 21:07:38.507296085 CEST	53	64549	8.8.8.8	192.168.2.4
Oct 4, 2021 21:07:39.402756929 CEST	63153	53	192.168.2.4	8.8.8.8
Oct 4, 2021 21:07:39.421531916 CEST	53	63153	8.8.8.8	192.168.2.4
Oct 4, 2021 21:07:39.793863058 CEST	52991	53	192.168.2.4	8.8.8.8
Oct 4, 2021 21:07:39.834604979 CEST	53	52991	8.8.8.8	192.168.2.4
Oct 4, 2021 21:07:40.640656948 CEST	53700	53	192.168.2.4	8.8.8.8
Oct 4, 2021 21:07:40.680511951 CEST	53	53700	8.8.8.8	192.168.2.4
Oct 4, 2021 21:07:41.332276106 CEST	51726	53	192.168.2.4	8.8.8.8
Oct 4, 2021 21:07:41.351104975 CEST	53	51726	8.8.8.8	192.168.2.4
Oct 4, 2021 21:07:42.106705904 CEST	56794	53	192.168.2.4	8.8.8.8
Oct 4, 2021 21:07:42.127269030 CEST	53	56794	8.8.8.8	192.168.2.4
Oct 4, 2021 21:07:46.617960930 CEST	56534	53	192.168.2.4	8.8.8.8
Oct 4, 2021 21:07:46.652348042 CEST	53	56534	8.8.8.8	192.168.2.4
Oct 4, 2021 21:07:48.291460037 CEST	56534	53	192.168.2.4	8.8.8.8
Oct 4, 2021 21:07:48.319309950 CEST	53	56534	8.8.8.8	192.168.2.4
Oct 4, 2021 21:07:48.354286909 CEST	56627	53	192.168.2.4	8.8.8.8
Oct 4, 2021 21:07:48.396867990 CEST	53	56627	8.8.8.8	192.168.2.4
Oct 4, 2021 21:07:50.154222965 CEST	56621	53	192.168.2.4	8.8.8.8
Oct 4, 2021 21:07:50.170598030 CEST	53	56621	8.8.8.8	192.168.2.4
Oct 4, 2021 21:07:50.633403063 CEST	63116	53	192.168.2.4	8.8.8.8
Oct 4, 2021 21:07:50.701925039 CEST	53	63116	8.8.8.8	192.168.2.4
Oct 4, 2021 21:07:58.642239094 CEST	64078	53	192.168.2.4	8.8.8.8
Oct 4, 2021 21:07:58.662612915 CEST	53	64078	8.8.8.8	192.168.2.4
Oct 4, 2021 21:08:28.954436064 CEST	64801	53	192.168.2.4	8.8.8.8
Oct 4, 2021 21:08:28.979919910 CEST	53	64801	8.8.8.8	192.168.2.4
Oct 4, 2021 21:08:32.095896006 CEST	61721	53	192.168.2.4	8.8.8.8
Oct 4, 2021 21:08:32.122340918 CEST	53	61721	8.8.8.8	192.168.2.4

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: cA3HKPci26.exe PID: 4632 Parent PID: 6408

General

Start time:	21:06:29
Start date:	04/10/2021
Path:	C:\Users\user\Desktop\cA3HKPci26.exe
Wow64 process (32bit):	false
Commandline:	'C:\Users\user\Desktop\cA3HKPci26.exe'
Imagebase:	0xd50000
File size:	29184 bytes
MD5 hash:	A20E47D870F92C1787BC4A5622586859
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: cmd.exe PID: 6692 Parent PID: 4632

General

Start time:	21:06:48
Start date:	04/10/2021
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	'C:\Windows\System32\cmd.exe' /C cd C:\Users\user\Desktop & s.bat
Imagebase:	0x7ff622070000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 5660 Parent PID: 6692

General

Start time:	21:06:49
Start date:	04/10/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: vssadmin.exe PID: 5436 Parent PID: 6692

General

Start time:	21:06:49
Start date:	04/10/2021
Path:	C:\Windows\System32\vssadmin.exe
Wow64 process (32bit):	false
Commandline:	vssadmin.exe Delete Shadows /All /Quiet
Imagebase:	0x7ff6f5920000
File size:	145920 bytes
MD5 hash:	47D51216EF45075B5F7EAA117CC70E40
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: notepad.exe PID: 1744 Parent PID: 3424

General

Start time:	21:08:09
Start date:	04/10/2021
Path:	C:\Windows\System32\notepad.exe
Wow64 process (32bit):	false
Commandline:	'C:\Windows\system32\NOTEPAD.EXE' C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\readMe!.txt
Imagebase:	0x7ff608980000
File size:	245760 bytes
MD5 hash:	BB9A06B8F2DD9D24C77F389D7B2B58D2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Disassembly

Code Analysis

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report cA3HKPci26

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

Initial Sample

Sigma Overview

System Summary:

Jbx Signature Overview

AV Detection:

Compliance:

Networking:

Spam, unwanted Advertisements and Ransom Demands:

System Summary:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Network Port Distribution

UDP Packets

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: cA3HKPci26.exe PID: 4632 Parent PID: 6408

General

Analysis Process: cmd.exe PID: 6692 Parent PID: 4632