Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
JIar3KCVf6.exe

Overview

General Information

Sample name:JIar3KCVf6.exe
renamed because original name is a hash value
Original sample name:9097ab2b2b71f3ea0cf8c9271224b6227e9aa2545ae23d4621f122bdb99c77b8.exe
Analysis ID:1524364
MD5:54416fc42afa9b09ea7e8d8e318f4891
SHA1:8c924431049191e763a14503517a9583f070fdeb
SHA256:9097ab2b2b71f3ea0cf8c9271224b6227e9aa2545ae23d4621f122bdb99c77b8
Tags:exeRhysidauser-JAMESWT_MHT
Infos:

Detection

Rhysida
Score:84
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Yara detected Rhysida Ransomware
AI detected suspicious sample
Changes the wallpaper picture
Suspicious powershell command line found
Uses cmd line tools excessively to alter registry or file data
Writes many files with high entropy
AV process strings found (often used to terminate AV products)
Abnormal high CPU Usage
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
May sleep (evasive loops) to hinder dynamic analysis
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Potentially Suspicious Desktop Background Change Via Registry
Stores files to the Windows start menu directory
Uses reg.exe to modify the Windows registry

Classification

Process Tree

  • System is w10x64
  • JIar3KCVf6.exe (PID: 3536 cmdline: "C:\Users\user\Desktop\JIar3KCVf6.exe" MD5: 54416FC42AFA9B09EA7E8D8E318F4891)
    • conhost.exe (PID: 1136 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • cmd.exe (PID: 6784 cmdline: C:\Windows\system32\cmd.exe /c cmd.exe /c reg delete "HKCU\Conttol Panel\Desktop" /v Wallpaper /f MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • cmd.exe (PID: 5292 cmdline: cmd.exe /c reg delete "HKCU\Conttol Panel\Desktop" /v Wallpaper /f MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • reg.exe (PID: 5100 cmdline: reg delete "HKCU\Conttol Panel\Desktop" /v Wallpaper /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)
    • cmd.exe (PID: 4608 cmdline: C:\Windows\system32\cmd.exe /c cmd.exe /c reg delete "HKCU\Conttol Panel\Desktop" /v WallpaperStyle /f MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • cmd.exe (PID: 6136 cmdline: cmd.exe /c reg delete "HKCU\Conttol Panel\Desktop" /v WallpaperStyle /f MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • reg.exe (PID: 416 cmdline: reg delete "HKCU\Conttol Panel\Desktop" /v WallpaperStyle /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)
    • cmd.exe (PID: 2840 cmdline: C:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • cmd.exe (PID: 6852 cmdline: cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • reg.exe (PID: 940 cmdline: reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)
    • cmd.exe (PID: 6212 cmdline: C:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • cmd.exe (PID: 6044 cmdline: cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • reg.exe (PID: 6048 cmdline: reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)
    • cmd.exe (PID: 5636 cmdline: C:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • cmd.exe (PID: 5408 cmdline: cmd.exe /c reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • reg.exe (PID: 616 cmdline: reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)
    • cmd.exe (PID: 2688 cmdline: C:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • cmd.exe (PID: 1880 cmdline: cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • reg.exe (PID: 964 cmdline: reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)
    • cmd.exe (PID: 1908 cmdline: C:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v WallpaperStyle /t REG_SZ /d 2 /f MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • cmd.exe (PID: 3492 cmdline: cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v WallpaperStyle /t REG_SZ /d 2 /f MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • reg.exe (PID: 1864 cmdline: reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v WallpaperStyle /t REG_SZ /d 2 /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)
    • cmd.exe (PID: 6232 cmdline: C:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d 2 /f MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • cmd.exe (PID: 4832 cmdline: cmd.exe /c reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d 2 /f MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • reg.exe (PID: 4828 cmdline: reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d 2 /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)
    • cmd.exe (PID: 1416 cmdline: C:\Windows\system32\cmd.exe /c rundll32.exe user32.dll,UpdatePerUserSystemParameters MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • rundll32.exe (PID: 1224 cmdline: rundll32.exe user32.dll,UpdatePerUserSystemParameters MD5: EF3179D498793BF4234F708D3BE28633)
    • cmd.exe (PID: 5260 cmdline: C:\Windows\system32\cmd.exe /c cmd.exe /c start powershell.exe -WindowStyle Hidden -Command Sleep -Milliseconds 500; Remove-Item -Force -Path "C:\Users\user\Desktop\C:\Users\user\Desktop\JIar3KCVf6.exe" -ErrorAction SilentlyContinue; MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • cmd.exe (PID: 6712 cmdline: cmd.exe /c start powershell.exe -WindowStyle Hidden -Command Sleep -Milliseconds 500; Remove-Item -Force -Path "C:\Users\user\Desktop\C:\Users\user\Desktop\JIar3KCVf6.exe" -ErrorAction SilentlyContinue; MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • powershell.exe (PID: 1492 cmdline: powershell.exe -WindowStyle Hidden -Command Sleep -Milliseconds 500; Remove-Item -Force -Path "C:\Users\user\Desktop\C:\Users\user\Desktop\JIar3KCVf6.exe" -ErrorAction SilentlyContinue; MD5: 04029E121A0CFA5991749937DD22A1D9)
          • conhost.exe (PID: 2096 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
RhysidaNo Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.rhysida

Malware Configuration

⊘No configs have been found

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
JIar3KCVf6.exeJoeSecurity_rhysidaYara detected Rhysida RansomwareJoe Security

    Dropped Files

    SourceRuleDescriptionAuthorStrings
    \Device\ConDrvJoeSecurity_rhysidaYara detected Rhysida RansomwareJoe Security

      Memory Dumps

      SourceRuleDescriptionAuthorStrings
      Process Memory Space: JIar3KCVf6.exe PID: 3536JoeSecurity_rhysidaYara detected Rhysida RansomwareJoe Security

        Sigma Signatures

        Sigma detected: Potentially Suspicious Desktop Background Change Via Registry
        Source: Registry Key setAuthor: Nasreddine Bencherchali (Nextron Systems), Stephen Lincoln @slincoln-aiq (AttackIQ): Data: Details: C:\Users\Public\bg.jpg, EventID: 13, EventType: SetValue, Image: C:\Windows\System32\reg.exe, ProcessId: 616, TargetObject: HKEY_CURRENT_USER\Control Panel\Desktop\Wallpaper
        Sigma detected: Non Interactive PowerShell Process Spawned
        Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -WindowStyle Hidden -Command Sleep -Milliseconds 500; Remove-Item -Force -Path "C:\Users\user\Desktop\C:\Users\user\Desktop\JIar3KCVf6.exe" -ErrorAction SilentlyContinue;, CommandLine: powershell.exe -WindowStyle Hidden -Command Sleep -Milliseconds 500; Remove-Item -Force -Path "C:\Users\user\Desktop\C:\Users\user\Desktop\JIar3KCVf6.exe" -ErrorAction SilentlyContinue;, CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: cmd.exe /c start powershell.exe -WindowStyle Hidden -Command Sleep -Milliseconds 500; Remove-Item -Force -Path "C:\Users\user\Desktop\C:\Users\user\Desktop\JIar3KCVf6.exe" -ErrorAction SilentlyContinue;, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6712, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -WindowStyle Hidden -Command Sleep -Milliseconds 500; Remove-Item -Force -Path "C:\Users\user\Desktop\C:\Users\user\Desktop\JIar3KCVf6.exe" -ErrorAction SilentlyContinue;, ProcessId: 1492, ProcessName: powershell.exe

        Suricata Signatures

        ⊘No Suricata rule has matched

        Joe Sandbox Signatures

        Click to jump to signature section

        Show All Signature Results

        AV Detection

        barindex
        Antivirus / Scanner detection for submitted sample
        Source: JIar3KCVf6.exeAvira: detected
        Multi AV Scanner detection for submitted file
        Source: JIar3KCVf6.exeReversingLabs: Detection: 76%
        AI detected suspicious sample
        Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
        Source: JIar3KCVf6.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
        Source: Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error1e source: JIar3KCVf6.exe, 00000000.00000002.4330582634.0000000000947000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error.rhysidaaU source: JIar3KCVf6.exe, 00000000.00000002.4330582634.0000000000947000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb.rhysidasida._ source: JIar3KCVf6.exe, 00000000.00000002.4330582634.000000000090C000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: Directory C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/winload_prod.pdb entries 1 source: ConDrv.0.dr
        Source: Binary string: winload_prod.pdb/j\j source: JIar3KCVf6.exe, 00000000.00000002.4345542087.00000000043DC000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: ERROR open file_to_crypt C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/winload_prod.pdb/01AB9056EA9380F71644C4339E3FA1AC2/winload_prod.pdb.rhysida source: ConDrv.0.dr
        Source: Binary string: Directory C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/winload_prod.pdb/01AB9056EA9380F71644C4339E3FA1AC2 entries 2 source: ConDrv.0.dr
        Source: Binary string: ERROR rename file C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/ntkrnlmp.pdb/68A17FAF3012B7846079AEECDBE0A5831/ntkrnlmp.pdb to C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/ntkrnlmp.pdb/68A17FAF3012B7846079AEECDBE0A5831/ntkrnlmp.pdb.rhysida -1 source: ConDrv.0.dr
        Source: Binary string: winload_prod.pdb# source: JIar3KCVf6.exe, 00000000.00000002.4345401884.00000000043A0000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: Directory C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/winload_prod.pdb entries 1 source: ConDrv.0.dr
        Source: Binary string: Directory C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/ntkrnlmp.pdb/68A17FAF3012B7846079AEECDBE0A5831 entries 2 source: ConDrv.0.dr
        Source: Binary string: C:/Users/user/Local Settings/Temp/Symbols/winload_prod.pdb/01AB9056EA9380F71644C4339E3FA1AC2/download.errorda-v^a source: JIar3KCVf6.exe, 00000000.00000002.4341853388.000000000403B000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: C:/Users/user/Local Settings/Temp/Symbols/ntkrnlmp.pdb/68A17FAF3012B7846079AEECDBE0A5831/ntkrnlmp.pdbtkda source: JIar3KCVf6.exe, 00000000.00000002.4341853388.000000000403B000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: Directory C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/ntkrnlmp.pdb/68A17FAF3012B7846079AEECDBE0A5831 entries 2 source: ConDrv.0.dr
        Source: Binary string: winload_prod.pdbN@Ee source: JIar3KCVf6.exe, 00000000.00000002.4340714444.0000000003DF7000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: ntkrnlmp.pdb0-3dc6d7aa0P source: JIar3KCVf6.exe, 00000000.00000002.4345756552.0000000004C92000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: Directory C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/ntkrnlmp.pdb entries 1 source: ConDrv.0.dr
        Source: Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\**ory\*\**at source: JIar3KCVf6.exe, 00000000.00000002.4341954989.0000000004063000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdbda*} source: JIar3KCVf6.exe, 00000000.00000002.4330582634.000000000090C000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: ntkrnlmp.pdb source: JIar3KCVf6.exe, 00000000.00000002.4337033164.0000000003C8D000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4340714444.0000000003DF7000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4342872496.000000000417C000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4342327773.00000000040E1000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4341056162.0000000003EED000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4344534870.000000000427F000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4341822842.0000000004029000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4345236557.000000000434E000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4334666942.0000000003B84000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4345401884.00000000043A0000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4340848911.0000000003E61000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4334736338.0000000003BAA000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4341625393.0000000003FA4000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4334859112.0000000003BE9000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4345125210.0000000004300000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4340523377.0000000003D89000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4339441992.0000000003D10000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4343588161.00000000041F4000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4345542087.00000000043DC000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4342467734.000000000411B000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4345756552.0000000004C92000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4345880314.0000000004D06000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4341435009.0000000003F36000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4335624423.0000000003C28000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4341988435.000000000408C000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4341954989.0000000004063000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: Directory C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/winload_prod.pdb entries 1 source: ConDrv.0.dr
        Source: Binary string: ERROR open file_to_crypt C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/ntkrnlmp.pdb/68A17FAF3012B7846079AEECDBE0A5831/download.error.rhysida source: ConDrv.0.dr
        Source: Binary string: winload_prod.pdb2r3b source: JIar3KCVf6.exe, 00000000.00000002.4341435009.0000000003F36000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: D:/support/logging/oobeldretw.dllndows.cortana.desktop-repl.mant.manmanent.mann339E3FA1AC2/winload_prod.pdbsferApi/73e95c97-d13d-4e4d-a445-357cf0e165a8.up_meta_body60-9B4EC72739D8}6ed66a2BDD97BB04_143ca0f173d46ed66a2a69d2085a72ec4cC68D6DECEZtEl source: JIar3KCVf6.exe, 00000000.00000003.4297395227.0000000002E35000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: ntkrnlmp.pdb~ source: JIar3KCVf6.exe, 00000000.00000002.4345756552.0000000004C92000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: Directory C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/winload_prod.pdb/01AB9056EA9380F71644C4339E3FA1AC2 entries 2 source: ConDrv.0.dr
        Source: Binary string: Directory C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/ntkrnlmp.pdb entries 1 source: ConDrv.0.dr
        Source: Binary string: ERROR open file_to_crypt C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/winload_prod.pdb/01AB9056EA9380F71644C4339E3FA1AC2/download.error.rhysida source: ConDrv.0.dr
        Source: Binary string: ERROR open file_to_crypt C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/ntkrnlmp.pdb/68A17FAF3012B7846079AEECDBE0A5831/download.error.rhysida source: ConDrv.0.dr
        Source: Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb.rhysidaysida source: JIar3KCVf6.exe, 00000000.00000002.4330582634.000000000090C000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: Directory C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/winload_prod.pdb entries 1 source: ConDrv.0.dr
        Source: Binary string: Directory C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/ntkrnlmp.pdb/68A17FAF3012B7846079AEECDBE0A5831 entries 2 source: ConDrv.0.dr
        Source: Binary string: ERROR rename file C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/ntkrnlmp.pdb/68A17FAF3012B7846079AEECDBE0A5831/download.error to C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/ntkrnlmp.pdb/68A17FAF3012B7846079AEECDBE0A5831/download.error.rhysida -1 source: ConDrv.0.dr
        Source: Binary string: Current dir entry ntkrnlmp.pdb source: ConDrv.0.dr
        Source: Binary string: ntkrnlmp.pdbperi source: JIar3KCVf6.exe, 00000000.00000002.4339441992.0000000003D10000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: ntkrnlmp.pdbQ source: JIar3KCVf6.exe, 00000000.00000002.4335624423.0000000003C28000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error.rhysidaaaV}Dae source: JIar3KCVf6.exe, 00000000.00000002.4330582634.000000000090C000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: ntkrnlmp.pdb[ source: JIar3KCVf6.exe, 00000000.00000002.4341625393.0000000003FA4000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: ERROR open file_to_crypt C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/winload_prod.pdb/01AB9056EA9380F71644C4339E3FA1AC2/winload_prod.pdb.rhysida source: ConDrv.0.dr
        Source: Binary string: ERROR open file_to_crypt C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/winload_prod.pdb/01AB9056EA9380F71644C4339E3FA1AC2/winload_prod.pdb.rhysida source: ConDrv.0.dr
        Source: Binary string: C:/Users/user/Local Settings/Temp/Symbols/winload_prod.pdb/01AB9056EA9380F71644C4339E3FA1AC2/winload_prod.pdbkata source: JIar3KCVf6.exe, 00000000.00000002.4341954989.0000000004063000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: ERROR open file_to_crypt C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/ntkrnlmp.pdb/68A17FAF3012B7846079AEECDBE0A5831/ntkrnlmp.pdb.rhysida source: ConDrv.0.dr
        Source: Binary string: ntkrnlmp.pdbe source: JIar3KCVf6.exe, 00000000.00000002.4342872496.000000000417C000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: ntkrnlmp.pdb3jHj source: JIar3KCVf6.exe, 00000000.00000002.4345542087.00000000043DC000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: Directory C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/winload_prod.pdb entries 1 source: ConDrv.0.dr
        Source: Binary string: Directory C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/winload_prod.pdb/01AB9056EA9380F71644C4339E3FA1AC2 entries 2 source: ConDrv.0.dr
        Source: Binary string: ntkrnlmp.pdb[x+m source: JIar3KCVf6.exe, 00000000.00000002.4341822842.0000000004029000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: ERROR open file_to_crypt C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/ntkrnlmp.pdb/68A17FAF3012B7846079AEECDBE0A5831/ntkrnlmp.pdb.rhysida source: ConDrv.0.dr
        Source: Binary string: winload_prod.pdbPdRh source: JIar3KCVf6.exe, 00000000.00000002.4339441992.0000000003D10000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: ERROR open file_to_crypt C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/winload_prod.pdb/01AB9056EA9380F71644C4339E3FA1AC2/winload_prod.pdb.rhysida source: ConDrv.0.dr
        Source: Binary string: winload_prod.pdbMx9m source: JIar3KCVf6.exe, 00000000.00000002.4341822842.0000000004029000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: Directory C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/winload_prod.pdb/01AB9056EA9380F71644C4339E3FA1AC2 entries 2 source: ConDrv.0.dr
        Source: Binary string: Directory C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/ntkrnlmp.pdb entries 1 source: ConDrv.0.dr
        Source: Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb.rhysidadat}j<a. source: JIar3KCVf6.exe, 00000000.00000002.4330582634.000000000090C000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error.rhysida source: JIar3KCVf6.exe, 00000000.00000002.4330582634.0000000000947000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: ERROR open file_to_crypt C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/ntkrnlmp.pdb/68A17FAF3012B7846079AEECDBE0A5831/ntkrnlmp.pdb.rhysida source: ConDrv.0.dr
        Source: Binary string: winload_prod.pdb source: JIar3KCVf6.exe, 00000000.00000002.4337033164.0000000003C8D000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4340714444.0000000003DF7000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4342872496.000000000417C000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4342327773.00000000040E1000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4341056162.0000000003EED000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4344534870.000000000427F000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4341822842.0000000004029000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4345236557.000000000434E000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4334666942.0000000003B84000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4345401884.00000000043A0000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4340848911.0000000003E61000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4334736338.0000000003BAA000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4341625393.0000000003FA4000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4334859112.0000000003BE9000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4345125210.0000000004300000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4340523377.0000000003D89000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4339441992.0000000003D10000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4343588161.00000000041F4000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4345542087.00000000043DC000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4342467734.000000000411B000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4345756552.0000000004C92000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4345880314.0000000004D06000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4341435009.0000000003F36000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4335624423.0000000003C28000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4341988435.000000000408C000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4341954989.0000000004063000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.erroridadaH_Ua source: JIar3KCVf6.exe, 00000000.00000002.4330582634.000000000090C000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: C:/Users/user/Local Settings/Temp/Symbols/winload_prod.pdb/01AB9056EA9380F71644C4339E3FA1AC2/download.error.rhysidaidaa* source: JIar3KCVf6.exe, 00000000.00000002.4341954989.0000000004063000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error.rhysida1.jsa source: JIar3KCVf6.exe, 00000000.00000002.4330582634.000000000090C000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: ntkrnlmp.pdbM source: JIar3KCVf6.exe, 00000000.00000002.4344534870.000000000427F000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: Directory C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/ntkrnlmp.pdb entries 1 source: ConDrv.0.dr
        Source: Binary string: ERROR open file_to_crypt C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/winload_prod.pdb/01AB9056EA9380F71644C4339E3FA1AC2/download.error.rhysida source: ConDrv.0.dr
        Source: Binary string: Directory C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/ntkrnlmp.pdb entries 1 source: ConDrv.0.dr
        Source: Binary string: ntkrnlmp.pdbj source: JIar3KCVf6.exe, 00000000.00000002.4345542087.00000000043DC000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: ERROR open file_to_crypt C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/winload_prod.pdb/01AB9056EA9380F71644C4339E3FA1AC2/download.error.rhysida source: ConDrv.0.dr
        Source: Binary string: C:/Users/user/Local Settings/Temp/Symbols/ntkrnlmp.pdb/68A17FAF3012B7846079AEECDBE0A5831/download.errorock source: JIar3KCVf6.exe, 00000000.00000002.4341853388.000000000403B000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: ERROR open file_to_crypt C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/ntkrnlmp.pdb/68A17FAF3012B7846079AEECDBE0A5831/download.error.rhysida source: ConDrv.0.dr
        Source: Binary string: ntkrnlmp.pdb! source: JIar3KCVf6.exe, 00000000.00000002.4345401884.00000000043A0000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: ntkrnlmp.pdbiy%j source: JIar3KCVf6.exe, 00000000.00000002.4341822842.0000000004029000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: 339E3FA1AC2/winload_prod.pdb source: JIar3KCVf6.exe, 00000000.00000003.4297395227.0000000002E35000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: Directory C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/ntkrnlmp.pdb entries 1 source: ConDrv.0.dr
        Source: Binary string: Directory C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/winload_prod.pdb entries 1 source: ConDrv.0.dr
        Source: Binary string: Current dir entry winload_prod.pdb source: ConDrv.0.dr
        Source: Binary string: Directory C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/ntkrnlmp.pdb entries 1 source: ConDrv.0.dr
        Source: Binary string: ERROR open file_to_crypt C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/ntkrnlmp.pdb/68A17FAF3012B7846079AEECDBE0A5831/download.error.rhysida source: ConDrv.0.dr
        Source: Binary string: ERROR open file_to_crypt C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/winload_prod.pdb/01AB9056EA9380F71644C4339E3FA1AC2/download.error.rhysida source: ConDrv.0.dr
        Source: Binary string: Directory C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/ntkrnlmp.pdb/68A17FAF3012B7846079AEECDBE0A5831 entries 2 source: ConDrv.0.dr
        Source: Binary string: winload_prod.pdb7 source: JIar3KCVf6.exe, 00000000.00000002.4345401884.00000000043A0000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: winload_prod.pdbch source: JIar3KCVf6.exe, 00000000.00000002.4341954989.0000000004063000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: winload_prod.pdbA source: JIar3KCVf6.exe, 00000000.00000002.4337033164.0000000003C8D000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdbc81a source: JIar3KCVf6.exe, 00000000.00000002.4330582634.0000000000947000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: winload_prod.pdbE source: JIar3KCVf6.exe, 00000000.00000002.4341988435.000000000408C000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb.rhysida5.log source: JIar3KCVf6.exe, 00000000.00000002.4330582634.0000000000947000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: Directory C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/winload_prod.pdb entries 1 source: ConDrv.0.dr
        Source: Binary string: winload_prod.pdbC< source: JIar3KCVf6.exe, 00000000.00000002.4340848911.0000000003E61000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: C:/Users/user/Local Settings/Temp/Symbols/ntkrnlmp.pdb/68A17FAF3012B7846079AEECDBE0A5831/download.error.rhysidaOG1ida6*Aa/ source: JIar3KCVf6.exe, 00000000.00000002.4341954989.0000000004063000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\* source: JIar3KCVf6.exe, 00000000.00000002.4341954989.0000000004063000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: winload_prod.pdbY source: JIar3KCVf6.exe, 00000000.00000002.4343588161.00000000041F4000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: ERROR open file_to_crypt C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/ntkrnlmp.pdb/68A17FAF3012B7846079AEECDBE0A5831/ntkrnlmp.pdb.rhysida source: ConDrv.0.dr
        Source: Binary string: winload_prod.pdbM1 source: JIar3KCVf6.exe, 00000000.00000002.4341954989.0000000004063000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: ntkrnlmp.pdb~,b source: JIar3KCVf6.exe, 00000000.00000002.4345236557.000000000434E000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: Directory C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/ntkrnlmp.pdb/68A17FAF3012B7846079AEECDBE0A5831 entries 2 source: ConDrv.0.dr
        Source: Binary string: Directory C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/winload_prod.pdb/01AB9056EA9380F71644C4339E3FA1AC2 entries 2 source: ConDrv.0.dr
        Source: Binary string: winload_prod.pdbg source: JIar3KCVf6.exe, 00000000.00000002.4342872496.000000000417C000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: winload_prod.pdbl source: JIar3KCVf6.exe, 00000000.00000002.4345756552.0000000004C92000.00000004.00000020.00020000.00000000.sdmp
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeCode function: 4x nop then jmp 004309D0h0_2_0041E423
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeCode function: 4x nop then lea r8, qword ptr [0000000000461F00h]0_2_0042D0D0
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeCode function: 4x nop then lea r8, qword ptr [0000000000460EA0h]0_2_00428F60
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeCode function: 4x nop then lea r8, qword ptr [00000000004618E0h]0_2_0042BF10

        Spam, unwanted Advertisements and Ransom Demands

        barindex
        Yara detected Rhysida Ransomware
        Source: Yara matchFile source: JIar3KCVf6.exe, type: SAMPLE
        Source: Yara matchFile source: Process Memory Space: JIar3KCVf6.exe PID: 3536, type: MEMORYSTR
        Source: Yara matchFile source: \Device\ConDrv, type: DROPPED
        Changes the wallpaper picture
        Source: C:\Windows\System32\reg.exeKey value created or modified: HKEY_CURRENT_USER\Control Panel\Desktop Wallpaper C:\Users\Public\bg.jpg
        Writes many files with high entropy
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Diagnosis\EventStore.db.rhysida entropy: 7.99828054912Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\fa-IR\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\eu-ES\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\fi-FI\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\fr-CA\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\gl-ES\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ga-IE\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\fr-FR\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\gd-GB\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\is-IS\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\he-IL\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\hr-HR\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\it-IT\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\gu-IN\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\hi-IN\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\kk-KZ\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\id-ID\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ka-GE\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\km-KH\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ja-JP\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\lb-LU\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mk-MK\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Diagnosis\Sideload\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ms-MY\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Diagnosis\TenantStorage\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mi-NZ\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Diagnosis\SoftLanding\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mt-MT\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Diagnosis\SoftLandingStage\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\kok-IN\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\DiagnosticLogCSP\Channels\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\lv-LV\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\DiagnosticLogCSP\Collectors\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\lt-LT\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\DiagnosticLogCSP\DeviceStateData\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ne-NP\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\IdentityCRL\production\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ml-IN\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\pa-IN\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Network\Downloader\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\nl-NL\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\nn-NO\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mr-IN\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\sl-SI\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\nb-NO\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\quz-PE\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Network\Connections\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ro-RO\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Settings\Accounts\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\or-IN\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Search\Data\Applications\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\pt-PT\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\SmsRouter\MessageStore\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\te-IN\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\UEV\InboxTemplates\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\pl-PL\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\User Account Pictures\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\pt-BR\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Clean Store\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\sk-SK\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ru-RU\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Support\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ug-CN\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\$WinREAgent\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\sq-AL\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\$WinREAgent\Scratch\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Features\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\tt-RU\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\Users\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\LocalCopy\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\uk-UA\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\DLPCache\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\sv-SE\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Adobe\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Security Health\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\tr-TR\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Adobe\ARM\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Adobe\ARM\Acrobat_23.006.20320\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\vi-VN\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows NT\MSFax\SentItems\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ta-IN\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-0C0A92D435E5}\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Quarantine\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\th-TH\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Packages\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Snapshots\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\cy-GB\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Scans\History\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ar-SA\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\ssh\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Scans\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\cs-CZ\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\dbg\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows NT\MSFax\Inbox\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\USOShared\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Scans\RtSigs\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\zh-CN\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\Users\Public\Pictures\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows NT\MSFax\Queue\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ur-PK\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows\Templates\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows NT\MSFax\ActivityLog\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\as-IN\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\Users\Public\Documents\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows NT\MSScan\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\Users\Public\Desktop\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\SmsRouter\MessageStore\edbtmp.log.rhysida entropy: 7.99758890325Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\am-ET\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows NT\MSFax\VirtualInbox\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\zh-TW\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\AppV\Setup\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Security Health\Logs\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\Users\Public\Music\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Packages\Microsoft.Getstarted_8wekyb3d8bbwe\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\da-DK\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\Users\Public\Videos\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\regid.1991-06.com.microsoft\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\af-ZA\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\AppV\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Packages\Microsoft.SkypeApp_kzf8qxf38zg5c\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\hr-HR\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Device Stage\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\eu-ES\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Crypto\Keys\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\bg-BG\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\ClickToRun\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ca-ES\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Crypto\DSS\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Extras\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\bn-IN\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Crypto\PCPKSP\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\EdgeUpdate\Log\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\SmsRouter\MessageStore\edb00003.log.rhysida entropy: 7.99679366813Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\SmsRouter\MessageStore\edb00001.log.rhysida entropy: 7.99718849198Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\SmsRouter\MessageStore\edb.log.rhysida entropy: 7.99688957973Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\SmsRouter\MessageStore\edb00002.log.rhysida entropy: 7.9971569999Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\User Account Pictures\user.bmp.rhysida entropy: 7.99969698694Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\el-GR\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\fa-IR\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Crypto\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\es-ES\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Crypto\RSA\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Tools\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\km-KH\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Diagnosis\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\de-DE\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\DeviceSync\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\id-ID\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\DiagnosticLogCSP\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\WindowsHolographicDevices\SpatialStore\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\fil-PH\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\DRM\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\en-US\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Diagnosis\Temp\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\ClickToRun\MachineData\Integration\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\fi-FI\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\DRM\Server\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\ClickToRun\MachineData\Integration\ShortcutBackups\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\et-EE\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\EdgeUpdate\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\MapData\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\User Account Pictures\guest.bmp.rhysida entropy: 7.99971458383Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log.rhysida entropy: 7.99952891501Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.app.json.rhysida entropy: 7.99839687247Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.app.json.bk.rhysida entropy: 7.99851361143Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Diagnosis\TenantStorage\P-ARIA\EventStore.db.rhysida entropy: 7.99473982398Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\is-IS\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Diagnosis\TimeTravelDebuggingStorage\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\fr-CA\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Provisioning\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Diagnosis\ETLLogs\ScenarioShutdownLogger\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\en-GB\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\IdentityCRL\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Diagnosis\Temp\DiagTrackTraceSlot_aot\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\es-MX\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\IdentityCRL\INT\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Diagnosis\Temp\DiagTrackTraceSlot_alternativeTrace\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\he-IL\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\MF\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Diagnosis\Temp\DiagTrackTraceSlot_miniTrace\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\hu-HU\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\NetFramework\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Diagnosis\Temp\DiagTrackTraceSlot_diag\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\gl-ES\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Network\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Provisioning\AssetCache\CellularUx\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\fr-FR\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Search\Data\Temp\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Vault\AC658CB4-9126-49BD-B877-31EEDAB3F204\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ga-IE\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Spectrum\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\gd-GB\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Office\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Definition Updates\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Diagnosis\ScenariosSqlStore\EventStore.db.rhysida entropy: 7.99487720258Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.privacy.json.rhysida entropy: 7.99557933577Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db.rhysida entropy: 7.99907591405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\SmsRouter\MessageStore\edbres00002.jrs.rhysida entropy: 7.99760329396Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\SmsRouter\MessageStore\edbres00001.jrs.rhysida entropy: 7.99692117382Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\gu-IN\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\DLPCache\NetworkFilesMappingStubs\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\it-IT\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Speech_OneCore\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\en-GB\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\hi-IN\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Search\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Definition Updates\NisBackup\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ja-JP\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Search\Data\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Default\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\mk-MK\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Storage Health\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Updates\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\kk-KZ\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Settings\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Network Inspection System\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ka-GE\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\SmsRouter\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\DLPCache\FileEvidence\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ml-IN\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows NT\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\kn-IN\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\lv-LV\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\UEV\Templates\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Network Inspection System\Support\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\UEV\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\am-ET\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\UEV\Scripts\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\WDF\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\af-ZA\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Vault\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ar-SA\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\SoftwareDistribution\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\as-IN\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\cy-GB\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows\Start Menu\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\hu-HU\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows NT\MSFax\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\et-EE\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\WinMSIPC\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\el-GR\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\WinMSIPC\Server\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\bg-BG\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\WwanSvc\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\bn-IN\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft OneDrive\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\en-US\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft OneDrive\setup\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ca-ES\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Package Cache\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\da-DK\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\cs-CZ\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\de-DE\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\WindowsHolographicDevices\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\lo-LA\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\USOShared\Logs\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ko-KR\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\USOShared\Logs\User\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\es-ES\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\ClickToRun\MachineData\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\fil-PH\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\es-MX\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\ClickToRun\UserData\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Crypto\DSS\MachineKeys\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Crypto\PCPKSP\WindowsAIK\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Crypto\SystemKeys\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Device Stage\Device\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Device Stage\Task\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Diagnosis\CustomTraceProfiles\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Diagnosis\DownloadedScenarios\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Diagnosis\EventTranscript\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Provisioning\AssetCache\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Diagnosis\ETLLogs\Autologger\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Diagnosis\ETLLogs\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Diagnosis\ETLLogs\ShutdownLogger\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Diagnosis\FeedbackHub\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Diagnosis\LocalTraceStore\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Diagnosis\ScenariosSqlStore\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Diagnosis\TenantStorage\P-ARIA\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\ProgramData\Microsoft\Diagnosis\Siufloc\CriticalBreachDetected.pdf entropy: 7.99213908405Jump to dropped file
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeProcess Stats: CPU usage > 49%
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeCode function: 0_2_00425D300_2_00425D30
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeCode function: 0_2_0043E8F00_2_0043E8F0
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeCode function: 0_2_0043D8F00_2_0043D8F0
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeCode function: 0_2_004300800_2_00430080
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeCode function: 0_2_0041B0B00_2_0041B0B0
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeCode function: 0_2_0043F0B00_2_0043F0B0
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeCode function: 0_2_004319300_2_00431930
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeCode function: 0_2_004491C00_2_004491C0
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeCode function: 0_2_00424A700_2_00424A70
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeCode function: 0_2_00438AD00_2_00438AD0
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeCode function: 0_2_0041D2900_2_0041D290
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeCode function: 0_2_004323500_2_00432350
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeCode function: 0_2_0042DB700_2_0042DB70
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeCode function: 0_2_004423100_2_00442310
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeCode function: 0_2_004363300_2_00436330
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeCode function: 0_2_004253F00_2_004253F0
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeCode function: 0_2_004319300_2_00431930
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeCode function: 0_2_00426C300_2_00426C30
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeCode function: 0_2_0042D7C00_2_0042D7C0
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeCode function: 0_2_0041B4800_2_0041B480
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeCode function: 0_2_00429D600_2_00429D60
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeCode function: 0_2_004245600_2_00424560
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeCode function: 0_2_0043D5600_2_0043D560
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeCode function: 0_2_0044AD700_2_0044AD70
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeCode function: 0_2_0043F5300_2_0043F530
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeCode function: 0_2_0041C5C00_2_0041C5C0
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeCode function: 0_2_0040E5F20_2_0040E5F2
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeCode function: 0_2_0043DDF00_2_0043DDF0
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeCode function: 0_2_00436DF00_2_00436DF0
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeCode function: 0_2_0042FDB00_2_0042FDB0
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeCode function: 0_2_004386400_2_00438640
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeCode function: 0_2_00431E500_2_00431E50
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeCode function: 0_2_00436E600_2_00436E60
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeCode function: 0_2_00442EC00_2_00442EC0
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeCode function: 0_2_0042D7A00_2_0042D7A0
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeCode function: 0_2_004426800_2_00442680
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeCode function: 0_2_0044A6B00_2_0044A6B0
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeCode function: 0_2_0042C7700_2_0042C770
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeCode function: 0_2_00433F700_2_00433F70
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeCode function: String function: 00449EB0 appears 46 times
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeCode function: String function: 0044B2C0 appears 40 times
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeCode function: String function: 0041F850 appears 252 times
        Source: JIar3KCVf6.exeStatic PE information: Number of sections : 17 > 10
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg delete "HKCU\Conttol Panel\Desktop" /v Wallpaper /f
        Source: classification engineClassification label: mal84.rans.winEXE@51/341@0/0
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\Users\CriticalBreachDetected.pdfJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2096:120:WilError_03
        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1136:120:WilError_03
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\Users\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\Temp\CriticalBreachDetected.pdfJump to behavior
        Source: JIar3KCVf6.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe user32.dll,UpdatePerUserSystemParameters
        Source: JIar3KCVf6.exeReversingLabs: Detection: 76%
        Source: JIar3KCVf6.exeString found in binary or memory: -startinfo
        Source: JIar3KCVf6.exeString found in binary or memory: -StartupInfo
        Source: JIar3KCVf6.exeString found in binary or memory: -startinfo
        Source: JIar3KCVf6.exeString found in binary or memory: F-startinfo
        Source: JIar3KCVf6.exeString found in binary or memory: -StartupInfo
        Source: JIar3KCVf6.exeString found in binary or memory: g-StartupInfo
        Source: unknownProcess created: C:\Users\user\Desktop\JIar3KCVf6.exe "C:\Users\user\Desktop\JIar3KCVf6.exe"
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cmd.exe /c reg delete "HKCU\Conttol Panel\Desktop" /v Wallpaper /f
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe cmd.exe /c reg delete "HKCU\Conttol Panel\Desktop" /v Wallpaper /f
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg delete "HKCU\Conttol Panel\Desktop" /v Wallpaper /f
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cmd.exe /c reg delete "HKCU\Conttol Panel\Desktop" /v WallpaperStyle /f
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe cmd.exe /c reg delete "HKCU\Conttol Panel\Desktop" /v WallpaperStyle /f
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg delete "HKCU\Conttol Panel\Desktop" /v WallpaperStyle /f
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe cmd.exe /c reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v WallpaperStyle /t REG_SZ /d 2 /f
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v WallpaperStyle /t REG_SZ /d 2 /f
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v WallpaperStyle /t REG_SZ /d 2 /f
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d 2 /f
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe cmd.exe /c reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d 2 /f
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d 2 /f
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c rundll32.exe user32.dll,UpdatePerUserSystemParameters
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe user32.dll,UpdatePerUserSystemParameters
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cmd.exe /c start powershell.exe -WindowStyle Hidden -Command Sleep -Milliseconds 500; Remove-Item -Force -Path "C:\Users\user\Desktop\C:\Users\user\Desktop\JIar3KCVf6.exe" -ErrorAction SilentlyContinue;
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe cmd.exe /c start powershell.exe -WindowStyle Hidden -Command Sleep -Milliseconds 500; Remove-Item -Force -Path "C:\Users\user\Desktop\C:\Users\user\Desktop\JIar3KCVf6.exe" -ErrorAction SilentlyContinue;
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command Sleep -Milliseconds 500; Remove-Item -Force -Path "C:\Users\user\Desktop\C:\Users\user\Desktop\JIar3KCVf6.exe" -ErrorAction SilentlyContinue;
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe cmd.exe /c reg delete "HKCU\Conttol Panel\Desktop" /v Wallpaper /fJump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg delete "HKCU\Conttol Panel\Desktop" /v Wallpaper /fJump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe cmd.exe /c reg delete "HKCU\Conttol Panel\Desktop" /v WallpaperStyle /fJump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg delete "HKCU\Conttol Panel\Desktop" /v WallpaperStyle /fJump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /fJump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /fJump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /fJump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe cmd.exe /c reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v WallpaperStyle /t REG_SZ /d 2 /f
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v WallpaperStyle /t REG_SZ /d 2 /f
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe cmd.exe /c reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d 2 /f
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d 2 /f
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe user32.dll,UpdatePerUserSystemParameters
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe cmd.exe /c start powershell.exe -WindowStyle Hidden -Command Sleep -Milliseconds 500; Remove-Item -Force -Path "C:\Users\user\Desktop\C:\Users\user\Desktop\JIar3KCVf6.exe" -ErrorAction SilentlyContinue;
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command Sleep -Milliseconds 500; Remove-Item -Force -Path "C:\Users\user\Desktop\C:\Users\user\Desktop\JIar3KCVf6.exe" -ErrorAction SilentlyContinue;
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeSection loaded: apphelp.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
        Source: Window RecorderWindow detected: More than 3 window changes detected
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll
        Source: JIar3KCVf6.exeStatic file information: File size 1261752 > 1048576
        Source: JIar3KCVf6.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
        Source: Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error1e source: JIar3KCVf6.exe, 00000000.00000002.4330582634.0000000000947000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error.rhysidaaU source: JIar3KCVf6.exe, 00000000.00000002.4330582634.0000000000947000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb.rhysidasida._ source: JIar3KCVf6.exe, 00000000.00000002.4330582634.000000000090C000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: Directory C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/winload_prod.pdb entries 1 source: ConDrv.0.dr
        Source: Binary string: winload_prod.pdb/j\j source: JIar3KCVf6.exe, 00000000.00000002.4345542087.00000000043DC000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: ERROR open file_to_crypt C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/winload_prod.pdb/01AB9056EA9380F71644C4339E3FA1AC2/winload_prod.pdb.rhysida source: ConDrv.0.dr
        Source: Binary string: Directory C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/winload_prod.pdb/01AB9056EA9380F71644C4339E3FA1AC2 entries 2 source: ConDrv.0.dr
        Source: Binary string: ERROR rename file C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/ntkrnlmp.pdb/68A17FAF3012B7846079AEECDBE0A5831/ntkrnlmp.pdb to C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/ntkrnlmp.pdb/68A17FAF3012B7846079AEECDBE0A5831/ntkrnlmp.pdb.rhysida -1 source: ConDrv.0.dr
        Source: Binary string: winload_prod.pdb# source: JIar3KCVf6.exe, 00000000.00000002.4345401884.00000000043A0000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: Directory C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/winload_prod.pdb entries 1 source: ConDrv.0.dr
        Source: Binary string: Directory C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/ntkrnlmp.pdb/68A17FAF3012B7846079AEECDBE0A5831 entries 2 source: ConDrv.0.dr
        Source: Binary string: C:/Users/user/Local Settings/Temp/Symbols/winload_prod.pdb/01AB9056EA9380F71644C4339E3FA1AC2/download.errorda-v^a source: JIar3KCVf6.exe, 00000000.00000002.4341853388.000000000403B000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: C:/Users/user/Local Settings/Temp/Symbols/ntkrnlmp.pdb/68A17FAF3012B7846079AEECDBE0A5831/ntkrnlmp.pdbtkda source: JIar3KCVf6.exe, 00000000.00000002.4341853388.000000000403B000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: Directory C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/ntkrnlmp.pdb/68A17FAF3012B7846079AEECDBE0A5831 entries 2 source: ConDrv.0.dr
        Source: Binary string: winload_prod.pdbN@Ee source: JIar3KCVf6.exe, 00000000.00000002.4340714444.0000000003DF7000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: ntkrnlmp.pdb0-3dc6d7aa0P source: JIar3KCVf6.exe, 00000000.00000002.4345756552.0000000004C92000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: Directory C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/ntkrnlmp.pdb entries 1 source: ConDrv.0.dr
        Source: Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\**ory\*\**at source: JIar3KCVf6.exe, 00000000.00000002.4341954989.0000000004063000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdbda*} source: JIar3KCVf6.exe, 00000000.00000002.4330582634.000000000090C000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: ntkrnlmp.pdb source: JIar3KCVf6.exe, 00000000.00000002.4337033164.0000000003C8D000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4340714444.0000000003DF7000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4342872496.000000000417C000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4342327773.00000000040E1000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4341056162.0000000003EED000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4344534870.000000000427F000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4341822842.0000000004029000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4345236557.000000000434E000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4334666942.0000000003B84000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4345401884.00000000043A0000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4340848911.0000000003E61000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4334736338.0000000003BAA000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4341625393.0000000003FA4000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4334859112.0000000003BE9000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4345125210.0000000004300000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4340523377.0000000003D89000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4339441992.0000000003D10000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4343588161.00000000041F4000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4345542087.00000000043DC000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4342467734.000000000411B000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4345756552.0000000004C92000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4345880314.0000000004D06000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4341435009.0000000003F36000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4335624423.0000000003C28000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4341988435.000000000408C000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4341954989.0000000004063000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: Directory C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/winload_prod.pdb entries 1 source: ConDrv.0.dr
        Source: Binary string: ERROR open file_to_crypt C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/ntkrnlmp.pdb/68A17FAF3012B7846079AEECDBE0A5831/download.error.rhysida source: ConDrv.0.dr
        Source: Binary string: winload_prod.pdb2r3b source: JIar3KCVf6.exe, 00000000.00000002.4341435009.0000000003F36000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: D:/support/logging/oobeldretw.dllndows.cortana.desktop-repl.mant.manmanent.mann339E3FA1AC2/winload_prod.pdbsferApi/73e95c97-d13d-4e4d-a445-357cf0e165a8.up_meta_body60-9B4EC72739D8}6ed66a2BDD97BB04_143ca0f173d46ed66a2a69d2085a72ec4cC68D6DECEZtEl source: JIar3KCVf6.exe, 00000000.00000003.4297395227.0000000002E35000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: ntkrnlmp.pdb~ source: JIar3KCVf6.exe, 00000000.00000002.4345756552.0000000004C92000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: Directory C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/winload_prod.pdb/01AB9056EA9380F71644C4339E3FA1AC2 entries 2 source: ConDrv.0.dr
        Source: Binary string: Directory C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/ntkrnlmp.pdb entries 1 source: ConDrv.0.dr
        Source: Binary string: ERROR open file_to_crypt C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/winload_prod.pdb/01AB9056EA9380F71644C4339E3FA1AC2/download.error.rhysida source: ConDrv.0.dr
        Source: Binary string: ERROR open file_to_crypt C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/ntkrnlmp.pdb/68A17FAF3012B7846079AEECDBE0A5831/download.error.rhysida source: ConDrv.0.dr
        Source: Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb.rhysidaysida source: JIar3KCVf6.exe, 00000000.00000002.4330582634.000000000090C000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: Directory C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/winload_prod.pdb entries 1 source: ConDrv.0.dr
        Source: Binary string: Directory C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/ntkrnlmp.pdb/68A17FAF3012B7846079AEECDBE0A5831 entries 2 source: ConDrv.0.dr
        Source: Binary string: ERROR rename file C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/ntkrnlmp.pdb/68A17FAF3012B7846079AEECDBE0A5831/download.error to C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/ntkrnlmp.pdb/68A17FAF3012B7846079AEECDBE0A5831/download.error.rhysida -1 source: ConDrv.0.dr
        Source: Binary string: Current dir entry ntkrnlmp.pdb source: ConDrv.0.dr
        Source: Binary string: ntkrnlmp.pdbperi source: JIar3KCVf6.exe, 00000000.00000002.4339441992.0000000003D10000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: ntkrnlmp.pdbQ source: JIar3KCVf6.exe, 00000000.00000002.4335624423.0000000003C28000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error.rhysidaaaV}Dae source: JIar3KCVf6.exe, 00000000.00000002.4330582634.000000000090C000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: ntkrnlmp.pdb[ source: JIar3KCVf6.exe, 00000000.00000002.4341625393.0000000003FA4000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: ERROR open file_to_crypt C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/winload_prod.pdb/01AB9056EA9380F71644C4339E3FA1AC2/winload_prod.pdb.rhysida source: ConDrv.0.dr
        Source: Binary string: ERROR open file_to_crypt C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/winload_prod.pdb/01AB9056EA9380F71644C4339E3FA1AC2/winload_prod.pdb.rhysida source: ConDrv.0.dr
        Source: Binary string: C:/Users/user/Local Settings/Temp/Symbols/winload_prod.pdb/01AB9056EA9380F71644C4339E3FA1AC2/winload_prod.pdbkata source: JIar3KCVf6.exe, 00000000.00000002.4341954989.0000000004063000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: ERROR open file_to_crypt C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/ntkrnlmp.pdb/68A17FAF3012B7846079AEECDBE0A5831/ntkrnlmp.pdb.rhysida source: ConDrv.0.dr
        Source: Binary string: ntkrnlmp.pdbe source: JIar3KCVf6.exe, 00000000.00000002.4342872496.000000000417C000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: ntkrnlmp.pdb3jHj source: JIar3KCVf6.exe, 00000000.00000002.4345542087.00000000043DC000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: Directory C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/winload_prod.pdb entries 1 source: ConDrv.0.dr
        Source: Binary string: Directory C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/winload_prod.pdb/01AB9056EA9380F71644C4339E3FA1AC2 entries 2 source: ConDrv.0.dr
        Source: Binary string: ntkrnlmp.pdb[x+m source: JIar3KCVf6.exe, 00000000.00000002.4341822842.0000000004029000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: ERROR open file_to_crypt C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/ntkrnlmp.pdb/68A17FAF3012B7846079AEECDBE0A5831/ntkrnlmp.pdb.rhysida source: ConDrv.0.dr
        Source: Binary string: winload_prod.pdbPdRh source: JIar3KCVf6.exe, 00000000.00000002.4339441992.0000000003D10000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: ERROR open file_to_crypt C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/winload_prod.pdb/01AB9056EA9380F71644C4339E3FA1AC2/winload_prod.pdb.rhysida source: ConDrv.0.dr
        Source: Binary string: winload_prod.pdbMx9m source: JIar3KCVf6.exe, 00000000.00000002.4341822842.0000000004029000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: Directory C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/winload_prod.pdb/01AB9056EA9380F71644C4339E3FA1AC2 entries 2 source: ConDrv.0.dr
        Source: Binary string: Directory C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/ntkrnlmp.pdb entries 1 source: ConDrv.0.dr
        Source: Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb.rhysidadat}j<a. source: JIar3KCVf6.exe, 00000000.00000002.4330582634.000000000090C000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error.rhysida source: JIar3KCVf6.exe, 00000000.00000002.4330582634.0000000000947000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: ERROR open file_to_crypt C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/ntkrnlmp.pdb/68A17FAF3012B7846079AEECDBE0A5831/ntkrnlmp.pdb.rhysida source: ConDrv.0.dr
        Source: Binary string: winload_prod.pdb source: JIar3KCVf6.exe, 00000000.00000002.4337033164.0000000003C8D000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4340714444.0000000003DF7000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4342872496.000000000417C000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4342327773.00000000040E1000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4341056162.0000000003EED000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4344534870.000000000427F000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4341822842.0000000004029000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4345236557.000000000434E000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4334666942.0000000003B84000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4345401884.00000000043A0000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4340848911.0000000003E61000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4334736338.0000000003BAA000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4341625393.0000000003FA4000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4334859112.0000000003BE9000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4345125210.0000000004300000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4340523377.0000000003D89000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4339441992.0000000003D10000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4343588161.00000000041F4000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4345542087.00000000043DC000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4342467734.000000000411B000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4345756552.0000000004C92000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4345880314.0000000004D06000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4341435009.0000000003F36000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4335624423.0000000003C28000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4341988435.000000000408C000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4341954989.0000000004063000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.erroridadaH_Ua source: JIar3KCVf6.exe, 00000000.00000002.4330582634.000000000090C000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: C:/Users/user/Local Settings/Temp/Symbols/winload_prod.pdb/01AB9056EA9380F71644C4339E3FA1AC2/download.error.rhysidaidaa* source: JIar3KCVf6.exe, 00000000.00000002.4341954989.0000000004063000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error.rhysida1.jsa source: JIar3KCVf6.exe, 00000000.00000002.4330582634.000000000090C000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: ntkrnlmp.pdbM source: JIar3KCVf6.exe, 00000000.00000002.4344534870.000000000427F000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: Directory C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/ntkrnlmp.pdb entries 1 source: ConDrv.0.dr
        Source: Binary string: ERROR open file_to_crypt C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/winload_prod.pdb/01AB9056EA9380F71644C4339E3FA1AC2/download.error.rhysida source: ConDrv.0.dr
        Source: Binary string: Directory C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/ntkrnlmp.pdb entries 1 source: ConDrv.0.dr
        Source: Binary string: ntkrnlmp.pdbj source: JIar3KCVf6.exe, 00000000.00000002.4345542087.00000000043DC000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: ERROR open file_to_crypt C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/winload_prod.pdb/01AB9056EA9380F71644C4339E3FA1AC2/download.error.rhysida source: ConDrv.0.dr
        Source: Binary string: C:/Users/user/Local Settings/Temp/Symbols/ntkrnlmp.pdb/68A17FAF3012B7846079AEECDBE0A5831/download.errorock source: JIar3KCVf6.exe, 00000000.00000002.4341853388.000000000403B000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: ERROR open file_to_crypt C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/ntkrnlmp.pdb/68A17FAF3012B7846079AEECDBE0A5831/download.error.rhysida source: ConDrv.0.dr
        Source: Binary string: ntkrnlmp.pdb! source: JIar3KCVf6.exe, 00000000.00000002.4345401884.00000000043A0000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: ntkrnlmp.pdbiy%j source: JIar3KCVf6.exe, 00000000.00000002.4341822842.0000000004029000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: 339E3FA1AC2/winload_prod.pdb source: JIar3KCVf6.exe, 00000000.00000003.4297395227.0000000002E35000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: Directory C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/ntkrnlmp.pdb entries 1 source: ConDrv.0.dr
        Source: Binary string: Directory C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/winload_prod.pdb entries 1 source: ConDrv.0.dr
        Source: Binary string: Current dir entry winload_prod.pdb source: ConDrv.0.dr
        Source: Binary string: Directory C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/ntkrnlmp.pdb entries 1 source: ConDrv.0.dr
        Source: Binary string: ERROR open file_to_crypt C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/ntkrnlmp.pdb/68A17FAF3012B7846079AEECDBE0A5831/download.error.rhysida source: ConDrv.0.dr
        Source: Binary string: ERROR open file_to_crypt C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/winload_prod.pdb/01AB9056EA9380F71644C4339E3FA1AC2/download.error.rhysida source: ConDrv.0.dr
        Source: Binary string: Directory C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/ntkrnlmp.pdb/68A17FAF3012B7846079AEECDBE0A5831 entries 2 source: ConDrv.0.dr
        Source: Binary string: winload_prod.pdb7 source: JIar3KCVf6.exe, 00000000.00000002.4345401884.00000000043A0000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: winload_prod.pdbch source: JIar3KCVf6.exe, 00000000.00000002.4341954989.0000000004063000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: winload_prod.pdbA source: JIar3KCVf6.exe, 00000000.00000002.4337033164.0000000003C8D000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdbc81a source: JIar3KCVf6.exe, 00000000.00000002.4330582634.0000000000947000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: winload_prod.pdbE source: JIar3KCVf6.exe, 00000000.00000002.4341988435.000000000408C000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb.rhysida5.log source: JIar3KCVf6.exe, 00000000.00000002.4330582634.0000000000947000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: Directory C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/winload_prod.pdb entries 1 source: ConDrv.0.dr
        Source: Binary string: winload_prod.pdbC< source: JIar3KCVf6.exe, 00000000.00000002.4340848911.0000000003E61000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: C:/Users/user/Local Settings/Temp/Symbols/ntkrnlmp.pdb/68A17FAF3012B7846079AEECDBE0A5831/download.error.rhysidaOG1ida6*Aa/ source: JIar3KCVf6.exe, 00000000.00000002.4341954989.0000000004063000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\* source: JIar3KCVf6.exe, 00000000.00000002.4341954989.0000000004063000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: winload_prod.pdbY source: JIar3KCVf6.exe, 00000000.00000002.4343588161.00000000041F4000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: ERROR open file_to_crypt C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/ntkrnlmp.pdb/68A17FAF3012B7846079AEECDBE0A5831/ntkrnlmp.pdb.rhysida source: ConDrv.0.dr
        Source: Binary string: winload_prod.pdbM1 source: JIar3KCVf6.exe, 00000000.00000002.4341954989.0000000004063000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: ntkrnlmp.pdb~,b source: JIar3KCVf6.exe, 00000000.00000002.4345236557.000000000434E000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: Directory C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/ntkrnlmp.pdb/68A17FAF3012B7846079AEECDBE0A5831 entries 2 source: ConDrv.0.dr
        Source: Binary string: Directory C:/Users/user/AppData/Local/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Application Data/Temp/Symbols/winload_prod.pdb/01AB9056EA9380F71644C4339E3FA1AC2 entries 2 source: ConDrv.0.dr
        Source: Binary string: winload_prod.pdbg source: JIar3KCVf6.exe, 00000000.00000002.4342872496.000000000417C000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: winload_prod.pdbl source: JIar3KCVf6.exe, 00000000.00000002.4345756552.0000000004C92000.00000004.00000020.00020000.00000000.sdmp

        Data Obfuscation

        barindex
        Suspicious powershell command line found
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command Sleep -Milliseconds 500; Remove-Item -Force -Path "C:\Users\user\Desktop\C:\Users\user\Desktop\JIar3KCVf6.exe" -ErrorAction SilentlyContinue;
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command Sleep -Milliseconds 500; Remove-Item -Force -Path "C:\Users\user\Desktop\C:\Users\user\Desktop\JIar3KCVf6.exe" -ErrorAction SilentlyContinue;
        Source: JIar3KCVf6.exeStatic PE information: section name: .xdata
        Source: JIar3KCVf6.exeStatic PE information: section name: /4
        Source: JIar3KCVf6.exeStatic PE information: section name: /19
        Source: JIar3KCVf6.exeStatic PE information: section name: /31
        Source: JIar3KCVf6.exeStatic PE information: section name: /45
        Source: JIar3KCVf6.exeStatic PE information: section name: /57
        Source: JIar3KCVf6.exeStatic PE information: section name: /70
        Source: JIar3KCVf6.exeStatic PE information: section name: /81
        Source: JIar3KCVf6.exeStatic PE information: section name: /92

        Persistence and Installation Behavior

        barindex
        Uses cmd line tools excessively to alter registry or file data
        Source: C:\Windows\System32\cmd.exeProcess created: reg.exe
        Source: C:\Windows\System32\cmd.exeProcess created: reg.exe
        Source: C:\Windows\System32\cmd.exeProcess created: reg.exe
        Source: C:\Windows\System32\cmd.exeProcess created: reg.exe
        Source: C:\Windows\System32\cmd.exeProcess created: reg.exe
        Source: C:\Windows\System32\cmd.exeProcess created: reg.exe
        Source: C:\Windows\System32\cmd.exeProcess created: reg.exe
        Source: C:\Windows\System32\cmd.exeProcess created: reg.exe
        Source: C:\Windows\System32\cmd.exeProcess created: reg.exeJump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: reg.exeJump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: reg.exeJump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: reg.exe
        Source: C:\Windows\System32\cmd.exeProcess created: reg.exe
        Source: C:\Windows\System32\cmd.exeProcess created: reg.exe
        Source: C:\Windows\System32\cmd.exeProcess created: reg.exe
        Source: C:\Windows\System32\cmd.exeProcess created: reg.exe
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\Users\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\CriticalBreachDetected.pdfJump to behavior
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\Users\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\CriticalBreachDetected.pdfJump to behavior
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\Users\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\7-Zip\CriticalBreachDetected.pdfJump to behavior
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\Users\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Java\CriticalBreachDetected.pdfJump to behavior
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\Users\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessibility\CriticalBreachDetected.pdfJump to behavior
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\Users\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\CriticalBreachDetected.pdfJump to behavior
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\Users\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Administrative Tools\CriticalBreachDetected.pdfJump to behavior
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\Users\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\AutoIt v3\CriticalBreachDetected.pdfJump to behavior
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\Users\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\AutoIt v3\Extras\CriticalBreachDetected.pdfJump to behavior
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\Users\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Maintenance\CriticalBreachDetected.pdfJump to behavior
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\Users\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Microsoft Office Tools\CriticalBreachDetected.pdfJump to behavior
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\Users\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\StartUp\CriticalBreachDetected.pdfJump to behavior
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\Users\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\System Tools\CriticalBreachDetected.pdfJump to behavior
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeFile created: C:\Users\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Windows PowerShell\CriticalBreachDetected.pdfJump to behavior
        Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
        Source: C:\Users\user\Desktop\JIar3KCVf6.exeWindow / User API: threadDelayed 7106Jump to behavior
        Source: C:\Windows\System32\conhost.exeWindow / User API: threadDelayed 5228Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3087
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 6655
        Source: C:\Users\user\Desktop\JIar3KCVf6.exe TID: 7156Thread sleep time: -71060s >= -30000sJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6944Thread sleep time: -12912720851596678s >= -30000s
        Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
        Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
        Source: JIar3KCVf6.exe, 00000000.00000003.4296825900.00000000029F4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: D:/sources/replacementmanifests/microsoft-hyper-v-drivers-migration-replacement.manw5n1h2txyewy/LocalState/ContentManagementSDK/Creatives/280815/imprbeacons.datf4149c624e1f9ff93c886f3321ad_1A8E}_AutoIt3_AutoIt_chm411C1E69BDD97BB04Apprule703500v0.xmlWNMx
        Source: JIar3KCVf6.exe, 00000000.00000002.4345460475.00000000043BA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: microsoft-hyper-v-migration-replacement.man
        Source: JIar3KCVf6.exe, 00000000.00000002.4345460475.00000000043BA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: microsoft-hyper-v-client-migration-replacement.man
        Source: JIar3KCVf6.exe, 00000000.00000003.4297395227.0000000002E35000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: D:/sources/replacementmanifests/microsoft-hyper-v-migration-replacement.man1-47d7-afa5-30f752dc978blState/Assets/c4d0028eef040a7ffac470afe683d9cdcc1cbec1a0a32156f64ec8d93ea2b3bd}_AutoIt3_AutoItX_AutoItX_chmtertrie.intermediate.txtFAEF8289v0.xmlv0.xmlS
        Source: JIar3KCVf6.exe, 00000000.00000002.4345460475.00000000043BA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: microsoft-hyper-v-drivers-migration-replacement.man
        Source: JIar3KCVf6.exe, 00000000.00000003.4296825900.00000000029F4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: D:/sources/replacementmanifests/microsoft-hyper-v-drivers-migration-replacement.man
        Source: JIar3KCVf6.exe, 00000000.00000003.4296661450.00000000025B1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: D:/sources/replacementmanifests/microsoft-hyper-v-client-migration-replacement.man
        Source: JIar3KCVf6.exe, 00000000.00000003.4297395227.0000000002E35000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: D:/sources/replacementmanifests/microsoft-hyper-v-migration-replacement.man
        Source: JIar3KCVf6.exe, 00000000.00000002.4345460475.00000000043BA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: microsoft-hyper-v-migration-replacement.mana
        Source: JIar3KCVf6.exe, 00000000.00000003.4296661450.00000000025B1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: D:/sources/replacementmanifests/microsoft-hyper-v-client-migration-replacement.man/AppCache/MOJJRSYN/7/tIa_X3QDXj2Izj2HpQ_Mo9f1WiM.br[1].js0091/imprbeacons.dat538f65}/settingsconversions.txtte.txtows_immersivecontrolpanelgs.csg0.xmlrule70502v0.xml
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformation
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe cmd.exe /c reg delete "HKCU\Conttol Panel\Desktop" /v Wallpaper /fJump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg delete "HKCU\Conttol Panel\Desktop" /v Wallpaper /fJump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe cmd.exe /c reg delete "HKCU\Conttol Panel\Desktop" /v WallpaperStyle /fJump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg delete "HKCU\Conttol Panel\Desktop" /v WallpaperStyle /fJump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /fJump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /fJump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /fJump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe cmd.exe /c reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v WallpaperStyle /t REG_SZ /d 2 /f
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v WallpaperStyle /t REG_SZ /d 2 /f
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe cmd.exe /c reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d 2 /f
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d 2 /f
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe user32.dll,UpdatePerUserSystemParameters
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe cmd.exe /c start powershell.exe -WindowStyle Hidden -Command Sleep -Milliseconds 500; Remove-Item -Force -Path "C:\Users\user\Desktop\C:\Users\user\Desktop\JIar3KCVf6.exe" -ErrorAction SilentlyContinue;
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command Sleep -Milliseconds 500; Remove-Item -Force -Path "C:\Users\user\Desktop\C:\Users\user\Desktop\JIar3KCVf6.exe" -ErrorAction SilentlyContinue;
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
        Source: JIar3KCVf6.exe, 00000000.00000002.4334040350.0000000003A22000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000003.4298090769.000000000346E000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000003.4297030473.0000000003AB6000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000003.4296390955.000000000268B000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4333991092.00000000039FB000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000003.4297352481.0000000002C80000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4334118520.0000000003A44000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4333792167.00000000039B4000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4331518145.0000000002C80000.00000004.00000020.00020000.00000000.sdmp, JIar3KCVf6.exe, 00000000.00000002.4331377010.000000000268B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: MsMpEng.exe

        Mitre Att&ck Matrix

        ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
        Gather Victim Identity InformationAcquire InfrastructureValid Accounts12
        Command and Scripting Interpreter        		1
        Registry Run Keys / Startup Folder        		11
        Process Injection        		1
        Masquerading        		OS Credential Dumping11
        Security Software Discovery        		Remote Services1
        Archive Collected Data        		1
        Encrypted Channel        		Exfiltration Over Other Network MediumAbuse Accessibility Features
        CredentialsDomainsDefault Accounts1
        PowerShell        		1
        DLL Side-Loading        		1
        Registry Run Keys / Startup Folder        		1
        Modify Registry        		LSASS Memory1
        Process Discovery        		Remote Desktop ProtocolData from Removable MediaJunk DataExfiltration Over BluetoothNetwork Denial of Service
        Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
        DLL Side-Loading        		21
        Virtualization/Sandbox Evasion        		Security Account Manager21
        Virtualization/Sandbox Evasion        		SMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact
        Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook11
        Process Injection        		NTDS1
        Application Window Discovery        		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
        Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
        Deobfuscate/Decode Files or Information        		LSA Secrets11
        System Information Discovery        		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
        Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts2
        Obfuscated Files or Information        		Cached Domain CredentialsWi-Fi DiscoveryVNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
        DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
        Rundll32        		DCSyncRemote System DiscoveryWindows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
        Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
        DLL Side-Loading        		Proc FilesystemSystem Owner/User DiscoveryCloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement

        Behavior Graph

        Hide Legend

        Legend:

        • Process
        • Signature
        • Created File
        • DNS/IP Info
        • Is Dropped
        • Is Windows Process
        • Number of created Registry Values
        • Number of created Files
        • Visual Basic
        • Delphi
        • Java
        • .Net C# or VB.NET
        • C, C++ or other language
        • Is malicious
        • Internet
        behaviorgraph top1 signatures2 2 Behavior Graph ID: 1524364 Sample: JIar3KCVf6.exe Startdate: 02/10/2024 Architecture: WINDOWS Score: 84 66 Antivirus / Scanner detection for submitted sample 2->66 68 Multi AV Scanner detection for submitted file 2->68 70 Yara detected Rhysida Ransomware 2->70 72 AI detected suspicious sample 2->72 9 JIar3KCVf6.exe 291 2->9         started        process3 file4 58 \Device\ConDrv, ASCII 9->58 dropped 60 C:\Users\...\CriticalBreachDetected.pdf, PDF 9->60 dropped 62 C:\Users\...\CriticalBreachDetected.pdf, PDF 9->62 dropped 64 306 other files (305 malicious) 9->64 dropped 80 Writes many files with high entropy 9->80 13 cmd.exe 1 9->13         started        16 cmd.exe 9->16         started        18 cmd.exe 9->18         started        20 8 other processes 9->20 signatures5 process6 signatures7 82 Suspicious powershell command line found 13->82 84 Uses cmd line tools excessively to alter registry or file data 13->84 22 cmd.exe 1 13->22         started        25 cmd.exe 16->25         started        27 cmd.exe 18->27         started        29 cmd.exe 1 20->29         started        31 cmd.exe 1 20->31         started        33 cmd.exe 20->33         started        35 4 other processes 20->35 process8 signatures9 37 reg.exe 1 22->37         started        74 Uses cmd line tools excessively to alter registry or file data 25->74 39 reg.exe 25->39         started        76 Suspicious powershell command line found 27->76 42 powershell.exe 27->42         started        44 reg.exe 1 29->44         started        46 reg.exe 1 1 31->46         started        48 reg.exe 33->48         started        50 reg.exe 35->50         started        52 reg.exe 35->52         started        54 reg.exe 35->54         started        process10 signatures11 78 Changes the wallpaper picture 39->78 56 conhost.exe 42->56         started        process12

        Screenshots

        Thumbnails

        This section contains all screenshots as thumbnails, including those not shown in the slideshow.


        windows-stand

        Antivirus, Machine Learning and Genetic Malware Detection

        Initial Sample

        SourceDetectionScannerLabelLink
        JIar3KCVf6.exe76%ReversingLabsWin64.Ransomware.Rhysida
        JIar3KCVf6.exe100%AviraTR/Ransom.tvoap

        Dropped Files

        ⊘No Antivirus matches

        Unpacked PE Files

        ⊘No Antivirus matches

        Domains

        ⊘No Antivirus matches

        URLs

        ⊘No Antivirus matches

        Domains and IPs

        Contacted Domains

        ⊘No contacted domains info

        World Map of Contacted IPs

        ⊘No contacted IP infos

        General Information

        Joe Sandbox version:41.0.0 Charoite
        Analysis ID:1524364
        Start date and time:2024-10-02 18:08:22 +02:00
        Joe Sandbox product:CloudBasic
        Overall analysis duration:0h 11m 14s
        Hypervisor based Inspection enabled:false
        Report type:full
        Cookbook file name:default.jbs
        Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
        Number of analysed new started processes analysed:41
        Number of new started drivers analysed:0
        Number of existing processes analysed:0
        Number of existing drivers analysed:0
        Number of injected processes analysed:0
        Technologies:
        • HCA enabled
        • EGA enabled
        • AMSI enabled
        Analysis Mode:default
        Analysis stop reason:Timeout
        Sample name:JIar3KCVf6.exe
        renamed because original name is a hash value
        Original Sample Name:9097ab2b2b71f3ea0cf8c9271224b6227e9aa2545ae23d4621f122bdb99c77b8.exe
        Detection:MAL
        Classification:mal84.rans.winEXE@51/341@0/0
        EGA Information:
        • Successful, ratio: 100%
        HCA Information:
        • Successful, ratio: 100%
        • Number of executed functions: 9
        • Number of non-executed functions: 68
        Cookbook Comments:
        • Found application associated with file extension: .exe
        • Override analysis time to 240000 for current running targets taking high CPU consumption

        Warnings

        • Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
        • Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe
        • Excluded domains from analysis (whitelisted): ocsp.digicert.com, 6.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.7.0.0.0.0.3.0.1.3.0.6.2.ip6.arpa, slscr.update.microsoft.com, ctldl.windowsupdate.com, arc.msn.com, fe3cr.delivery.mp.microsoft.com
        • Not all processes where analyzed, report is missing behavior information
        • Report size exceeded maximum capacity and may have missing behavior information.
        • Report size getting too big, too many NtCreateFile calls found.
        • Report size getting too big, too many NtDeviceIoControlFile calls found.
        • Report size getting too big, too many NtOpenFile calls found.
        • Report size getting too big, too many NtQueryAttributesFile calls found.
        • Report size getting too big, too many NtQueryVolumeInformationFile calls found.
        • Report size getting too big, too many NtSetInformationFile calls found.
        • VT rate limit hit for: JIar3KCVf6.exe

        Simulations

        Behavior and APIs

        TimeTypeDescription
        12:11:08API Interceptor14129x Sleep call for process: JIar3KCVf6.exe modified
        12:11:35API Interceptor2434x Sleep call for process: conhost.exe modified
        12:13:15API Interceptor43x Sleep call for process: powershell.exe modified

        Joe Sandbox View / Context

        IPs

        ⊘No context

        Domains

        ⊘No context

        ASNs

        ⊘No context

        JA3 Fingerprints

        ⊘No context

        Dropped Files

        ⊘No context

        Created / dropped Files

        C:\$WinREAgent\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\$WinREAgent\Scratch\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\.curlrc.rhysida

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:data
        Category:dropped
        Size (bytes):1044
        Entropy (8bit):7.81184693402884
        Encrypted:false
        SSDEEP:24:YNDbjmZjJQeNVBrJ+ZyXE/DYnWDXXCLIL+kyQtD3vlq:GDbjwVXE7XXN/338
        MD5:07573FE791AD2F30A961DC0FB9E20AF4
        SHA1:AD6D4F9EEE4E0DDD6CA389A7F5844FD3A348CFB7
        SHA-256:52D8662BC045018DC66CB4784DAF86F61FE853967BB2E3C837800DED9DBD4DC0
        SHA-512:6BDFB4874E7814ABB414B201054C7A3678394789256183BD50C81F9345FF5F8F96B0EF7F8D8007EFCF1D2CF3E279798EE37B57D85F80F701E1E81CFE2CD5EFF2
        Malicious:false
        Preview:.....XS..c..:5..........J9......4....aO.o....f.;..[6r.'...R..k.S.."....S.....P...Xr<..h.v.Z.3~&....[.^..5....1..)...C.D+..G.KI.U,.NO.n?C.....)h.s.%...D../.O.vQ.H..q=u.&.....c.%........']?tt.Kh.g........Q(.^...s.P...J}..... )D.2\,f.7Hu"......Z.L........$v..1.c..`!...xvYh+......~...A.o(.jo;.....%.....xC.?].Z.9...3...S...~-..m.38dV*d{$..,.{..`d..p.b...?..{.=.!frj.....Ei.pe....j,u.WS..B.i...H].M.c%Q^&...8Ij......L...7V)0..5..#/HE<9.Eyf#.....<.nK...D.>"..{.{...?H.y..xF..b.....{......-......Ey..-K........c.W:O...p.....0...Zq....f...G%/..s1\0....8...'......yz.[.+W.Y..9.4..........H.. .E.9..O.. ...aM.WCsX..W...`. .L.O..AC.5.b......]..p.l..y.{..BV.u..z..\.x+....n^.6Z"+.!..?...?.~..,.#V.F._.R.......N..^.q..<.{b.e...p.WF...r.|..#.....1.. ..l".....\o.=..YM...S....R.H..|@..+._$FL...3...<....i6..*..q..+w.,2....D..x..%p.Q#/.`h3d\....3.Z.Yj.p.....2U........+:...3.....5.k....M.....$.....A..{.....i..S.T-~N.0..;....x..P#...HI.....x........}.....-..0e4...(.#.....G

        C:\ProgramData\Adobe\ARM\Acrobat_23.006.20320\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Adobe\ARM\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-0C0A92D435E5}\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Adobe\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft OneDrive\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft OneDrive\setup\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\AppV\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\AppV\Setup\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\ClickToRun\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\ClickToRun\DeploymentConfig.0.xml.rhysida

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:data
        Category:dropped
        Size (bytes):3010
        Entropy (8bit):7.946708137002594
        Encrypted:false
        SSDEEP:48:sYhkdQfhBYWPDGwjaAQKTp2mfLrC9CgyFYi93STZkzNNpX+uDyVuprcPEK7WcqP1:sb0Kt4XNS9Cga9+ZkzYUyVupybyl
        MD5:2F6DF7A1CBFD95B46A4D98B8FA29C7F3
        SHA1:A044DD811DD640FD3790FBE2C0895C85E86DB3E5
        SHA-256:112203F680F94AB185199457DE95D8211D8408F024E2828EEB410EC25A60EEE6
        SHA-512:02DF18A0A46F739E7BC29BD364BF73D3EEA7797A973DE383F5ACB202D2CFD0B0FBA1FF1A5C9C7E7941E3DF84788EDDD51488D1EA677CBCC2CA47EDB3229B2BD1
        Malicious:false
        Preview:...P.r......@.Q9?....@C3........U.<....|....}_..T1J...$..Y...(...K....) ..B.,...%.?`.$NV...f~....T......6......!..jr7..*.....L.{l....8x......_...@d.G}.$?.AU....;...h...H.Fn..Z....xk.9C.]...J.|lY.w........CIy.T..z.... .P.iF.............#?..0*1.*.[K.k..@v....*.b!g.o.C....b....S.3...XV.x.(..+n..?...D.{...-.u.....E.................P...5....FZ..Gf.*.dB|.s3|..4Q[..........)c,!.9J..'x.......!sW.%...f......t...;/.ZPc.....3....G.Y..(..Y(.........a.l....^hH...E...g....R/..0.....U.P(*...k...NJ.<Z......<8<*.7.~.....<.v.G...n.....t.,H^.T..........+.d.@....~...j.4.x...P..b.........t8E...')gV@.G.Q.k7!j.7.~...oj.?.*.... .|..P.T1HK..1....e....o.m..U.A..s.2.t.........=.t.......p..V.,n..<.aw..V..%M&3..Yv... .........S..Z.5.z...G...E.I..S...z.\<.1...k...5......K7[.v..2......u\....b...d.w;b.{...m......<.8...#...S. 3>.7...E.+..A...'DM.Iw>.....+.`....\..U[4..>Cn.T..j.XGU...|....[f.....{).X.....?.3q...L4.....G.r..e....o.u.j.P.b.......K\....N...g.

        C:\ProgramData\Microsoft\ClickToRun\DeploymentConfig.1.xml.rhysida

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:data
        Category:dropped
        Size (bytes):2418
        Entropy (8bit):7.908782727687198
        Encrypted:false
        SSDEEP:48:D0z12dmvyp2mjqlQv3Hwci+uUWxMrdKuH5cL6s/J7kJfk:owMu2r985UR7ufk
        MD5:24D5D5B0B94EEFA7B7244339D46C9B7E
        SHA1:2D9DFB2FC003782D7E960D855A3553D1706F5FEF
        SHA-256:C13815DB165263FB930BF6667B8931C24B77042E7F2879C0F0DADB832430AAD9
        SHA-512:4F46C7540CFDFE747BD90EEA4C100E43AD6FDB58C8194D7F6D50BEDA411BA1B19F6034223FA47FAD52E5E9416C2BC0877DE31D30D86C77E4C4F77217A4B291A7
        Malicious:false
        Preview:....T......^..9O7..2$.B..U.@...b*..<zM..&. .R...eIb.C. ....%.u(L.F>z...c.kh..}:z>m..5-.Cl.r.g..,...!.0...0f....\....J.....J.G.-..!N....I?.EY~P....^.s]....6..J.w..r...y..C...D.ol.......u...hE0....(..8/.j[..2............i.t..V.O.I...X-.-.........8`".}..i.1X.O7).c..or..|...&.J.W)....g...."&.4L..Z\.......?......r..."....}..FE.r...`.poh..=W.Z.'.....c=..W...v^.?..1..V-.p...f.....~..W..h|...$.......i...s....z.x5...D..X...xR...oN6..D.2.~3..Y.!..[..)Ai.E.$E.D^.n..T._n.;...r.b.S5e.H..Ni..\..x.."csY...N.....4......_..`#.Q.M..MD...1.........i.}......N...,X!..,...B.;7...E..<...^.....\$.......{..J...........o..R.....f.....Y..V..1o0.]P]....i.....a.F..i%1...7.8...@.}Mv.S.R..x*..)PM...n.~." ..w.=i..~.|..&]O......]"0.,n.{..^...UX...nO..`....X.OE.T.~.M"..."..Z,..z..mmK.6|>.~....S{{.Pt.....N...[.vj,Nk=....Rq..o.9..].$].S/.z....9.!....E......S...KT..1.......J..Zw.u.@;..Dg.=..*Q2W...9....?."......t....s.V..L..\....-......&hd.%.).L..._..&u3..B?.q.9...8.....}.{f;!........

        C:\ProgramData\Microsoft\ClickToRun\DeploymentConfig.2.xml.rhysida

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:data
        Category:dropped
        Size (bytes):2418
        Entropy (8bit):7.917965338909296
        Encrypted:false
        SSDEEP:48:VjE5f9yU8tnU+0rxIqFrnfzYMHT34AaYXzZFviS3TBEwlVWTzzcM40DQyc6KtksA:VjE5f9R8NU+OxIwLMMz35aYX1FtTBP6r
        MD5:B56340B5D692A0FA20DBE9F5AC5CD21B
        SHA1:31CF21264AF07FCFF41423CA0E1594162CB3B591
        SHA-256:EEFEC2BC33AED8C7497B9AACA1AA513E86C3F5C701F6463D6DDA7DC48199F0BC
        SHA-512:BCB4E9C1D2A53852814B2AEF2DFF32ED39B6B0EBF9161AC0F5D7FB29C6185C010A8D92662A8173D6A89D83E8765C3F382E393AFA18C519CC06FE830B8C373A6E
        Malicious:false
        Preview:..K.jks...s.^...2..6.>\h..^....U....z.R.4.....#.@M.~...4........H..e......PS.u..z...hVF..).A..,.*1U..`#.F.....dx.r..7}....7..BH..N..om%.g...O<.J.!_.h..h.....G..n......<..C.Ka.a........k....Mj.f..G..8...Q.t..),<.3>...p..n{...?...2V..q.|.y8..5..`....#...3l.S.. ...FZ$\.....9_Z....{;..b.@.78a.....$...4O....-..`f.&.E..t. ...f....U....#j.{@p._....8.$A1..y....;.wM...E...k{..-*.[....U..[@.v..ty....N..U9!Y.#.....@.\J\...j..u....,...(......:bQ..N:h..}..e...!.O....U8..2I..@....[..`_.t3..x*.3.VG.V.E....$-0iz.....NN. .<.E..]....BZ...l.V...u.v_.v..J>oN.".8..:z~..(..7.; ...n"...6.....Q*....J.U......4....I...........P..8.b#.*\q...t....].!. @.....<...WX>0D.s....UE!.....Z)..!.bc.r._.:....cx%..............b..p...i.s..F......`FG...k.\.......d.U.....N.a.(.C....v4.I.).O.?..-..K^..Z ..3...k...8SMH.......}c...V.?l.C.....y.....r.m.$t...Dok..lx.#..c...Lo...">T.;.....i}y.OS;.{D.2..0.\.lu.....mM......2....f.hiW..[.....RN..yCi.,.$..>l.Y.wo.TSu2W.;..

        C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\ClickToRun\MachineData\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\ClickToRun\MachineData\Integration\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\ClickToRun\MachineData\Integration\ShortcutBackups\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\ClickToRun\ProductReleases\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\ClickToRun\UserData\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Crypto\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Crypto\DSS\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Crypto\DSS\MachineKeys\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Crypto\Keys\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Crypto\PCPKSP\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Crypto\PCPKSP\WindowsAIK\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Crypto\RSA\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Crypto\SystemKeys\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\DRM\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\DRM\Server\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Device Stage\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Device Stage\Device\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Device Stage\Task\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\DeviceSync\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Diagnosis\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Diagnosis\CustomTraceProfiles\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Diagnosis\DownloadedScenarios\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.allow.json.rhysida

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:data
        Category:dropped
        Size (bytes):1941010
        Entropy (8bit):7.27367543832223
        Encrypted:false
        SSDEEP:24576:CZzpHwPtEexHqMOWOJ83ymF1jDyrwt0yquRmJtEcNZ/ey0C:7lEGHqoOJZSCrwDTaKcP7
        MD5:D3EE9E025026ACC31CBFADED8B22ABB6
        SHA1:4A44A7B38EF59C4FBE0418BD9E453F8014691FF4
        SHA-256:7602D4713B6EA8F0FC39C3505F87914840A9668B0E53A2C8EB7B42BF58D1C2ED
        SHA-512:FE4A7575BBB46254FF19F3539D3A1CE2BB9F5542175045D0ECA49DE528AE7544EEB30F19DE44CA3A5B75E37C74B94BE8FA08D6F09651104757DC15990F342F99
        Malicious:false
        Preview:."D.#.@.7.....Xz..'..(.RH..cy.s.. .....K.Q. ../....K^..Mq[.L.8|..y.9f$.Y...z.G..(.'w....}...9]..qo.P4......Iy....}@G...v.~..?.T9..5....V.,2...\g.5fX#..=....U~......al&%.A.........6.0..v......B.L...wDj...K.u.....^K..qy.......r..jW..8+....(..Q.!l.9.Y,....)..... ...Q..._.8.?....L..9q....=x.M...$.pf..#.>E94.K...a'..&..@...[....KqF.P..#..Z....,H;2J..:....>....Q....7........7*8.l.&....$.!.(q.U.Rv..z...h`..b......h?K.a6.6...t...!.Jx..>$.\|8:.`^.zq..Po..d......A....+......ZN...D..Ei..6.09....>.\.........g.*.Bk"4.....W......G@]Lr.I..X.6F.DW*.U.....>p\....].....R..O..l@..W....{K..@..*.S...].zmH.|..YF...S...W.\.J...X#....KC.V..T.{....6* I..jk.*.9...JZ.&o.q..._KG.H0.7.}...s...R}.qW.f......UI.....z.x.F`Ko.[......k...1..k.g...=d....mI....M0...*.=.E.e..}.....^.g..)....*.q..y..`.H=......m.....e[O....BXn ..%.3.pd...^./....r.;[....T.Yi.F..w.......4..j>#.;....Z...s.L.._c.<.Ci.k...P\.?O....M...%........."m:.,=.....wjS....Ew.p.._.W..Qs.YC..\uH.o.

        C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.app.json.bk.rhysida

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:data
        Category:dropped
        Size (bytes):112968
        Entropy (8bit):7.9985136114257065
        Encrypted:true
        SSDEEP:1536:U1cyzbGmR2SpnNW1VyYZ2hNA/5GMiaxTY0TO2DNwm9vGkiKJegpKeK3gyhurbJ6w:aPGnSpnNQVWy/UfZyDEKJZK1kbQPEH
        MD5:6387214A36E70F430BE5DAB0E1482DF3
        SHA1:55748AAD51EA813CF29D76199A42A3F6B6868090
        SHA-256:A5D6CA902916C033374D8C58E163F26FD466A72941DCEDEB9047446F8ECD15FB
        SHA-512:16B98E49C0B6F2D0851F3C1305918CBF5351EA861FED0C3FF2AA789BB0C8144432CAA1FED273D82C3E91F5F433E259EB91901085EFE07AE13098D118A697F9BF
        Malicious:true
        Preview:.<`e{........+.5.....E.#[/[..C.*..wn.!..H._..L.T)..~...q}H.da...O...........wu....[.5A.J.af._~&.7t-.KA.lg.0...8Q....4..).. -.uSHwG...34.7.bCz.....<`.w..... D...g....U^..W..........T.s.QzE.h.y...f.}m.j,)....F.Fo..AG.4...q...@....D....+A........x..s.I`/.Q5&I..s.!.;5.t....d..d.9..2N.....MvX....; ...!\Rj&..Am.\_...*.]..4.J.....+.....0K7.}T...9./-.Q...H-.e..*.g..l..eS...q.).r'.\.......N.d+s....>............T<.bH....'..kq....S...L.p.....L.iN.T.....'!.vM.B...x-,.(.y...4..B......7._.n......F.>..+&."h...D....F.%.Z..K..(B.\..^.....9...D...u.1a..fl........hH....8....$~m.]...<...*....|=..jp....G?S...?d...<.....e.;..A.......rz.c...&.6L.d. ..pYe...{.Z...e.W.M....T.*Y.....#c...zM&S^.......T...4.P...*.....jwc..1..*.<XD...`m.1..0..m.v.3'.#xI....n.._U"X...r.S.L.L...-cINB...3...z....../X.|.._.u1B..)$7.3....D..;r;.M`.f....~..tc.L."u.`..#.......qK.....e...........[X.&!..N.w.6..*G..%........Ck..y.[.*......_Da........h.w=......<....M.FqG._...X...S.

        C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.app.json.rhysida

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:data
        Category:dropped
        Size (bytes):113085
        Entropy (8bit):7.998396872470061
        Encrypted:true
        SSDEEP:3072:CVhK1G1iP4iHXYgGmgXWrB/2YubjgY188HRFB:AQ1G1iPdUXWrdHubjX88xFB
        MD5:A68BFAECA9459C099F2C93763093E7F9
        SHA1:D68D5A5FF5455E635FAED45C89758139899EE49B
        SHA-256:742F6C5EC677F81A02009F0BB09489A0819DDAB79E75EAB2CFFF351353CBB385
        SHA-512:4F374873DCCDFAE1E2D48D4EE3BC303A0AFC43FCAA7868FBD35B9843152CB0FC85C070D8C87C51D6CD37B1320C416770167588EBD378631A3431FF9BAB7B9B3A
        Malicious:true
        Preview:......O...+.Sd..iP#....L...?...3..S.p..~...OM.....E...$...k.E.......).1.....l....I....\..TF.Is2....r'9.mX.7-...)......I..96q.h.N).......(.i.7,....Fku._9...O..CB..k.h...Lbk..i43...p.d...5..#'A...p$....2an...._3.J.jJp%.5.!.[..@....o.X.x.\.R..!>..>n..O.`...5...../..Di.Fcvsf....T..y....9..va...C...Q...G:......Js.9......u.L._O.H`.V0$<I8K......+.|.|]...D..!..,.hL. ...yj..w.,..Q.....dk.<V?.%YR.R...w .bu_...5..I.`C..=...YV.`...........I.n3.a..D.^..3.......>..\||(.....J..\..m.\.:.n..g...P..hy..J.{..].(`..V.zu$...P...tJ......E.S.U">..5.m...W.O..r...i....Z..-.S0.h....r..i.....]..C.Fa.A5./.............Lo.........z^&..Y....)^.G.f2.O.8.j(2v.b..7.....7..%w..b......Z2$o.>.p..dYF..#.\..`.~7N.....dE.(....Nxn...5.\..d........a.s7.uga.0...0......]G0?B........`..>......k.P.q.o..S...IzLuJ...p.>..$.....\!.c.`......39.R..Ms.........]7..,.Q..(..z.V.L}r-.5.]4.......=(4.Vem...... M....|/n.^;0...?L....ikP..........0..?@..e..N.O..D......F.A:._[....w^.H_.

        C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.cert.json.rhysida

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:data
        Category:dropped
        Size (bytes):3759
        Entropy (8bit):7.947953537014408
        Encrypted:false
        SSDEEP:96:7BwPhH8aCfpwHhJM66o/BcECeCI2LaBSrRNvN:7BsH8a0Mhf/BrBSVNvN
        MD5:92874D912747AD24CD4D5DCE77E207A3
        SHA1:5B1FD5ECEB03626671B591D9A77F868167D24318
        SHA-256:01D36480AEB4A89548F9C9055CF2818BE8EB57E01B51619E15123BFD4848676B
        SHA-512:5AC1FA585E411E7E185CB22F8D028BB0B5D9E1B83FC1CB13636B789A3F4308A7B3801C69AA69D1216EEB51058BCD3A40266B3E96F6F6A088EFBB90D65D0F8024
        Malicious:false
        Preview:9....c.W.F....Q.@...Q.........7o.z..>....h.z......c\......1y..>.ZHn..y.......B(...X....D.~.e..H...i...P...*yh..Qa..Y...`..Dm.S..)Z.....7..4....s.s....n.....V..Wlt..GG...=F._L.7.....v\L.bx.=.G..5....N......,.z7@..5.-K...pQN...F....Q...o..*U|>.._..>....C.x....{.........v.n....i..'*.x.."..j.r@.h.._).RO.........H.B.H...>6..2.......u}-.\..O.3..sh.8..N.#}....i.X...m..r~Fp....7G...0.(..KKa..HCrR..*k...mPd.6..Y~...l..9.......W.~M.P-.....2..z..q..u^E.O.n......]U......."..8...l{......;..3.Y-.=.|..wx.d......o..........w.Q.>.z.f6NN..L.c+5.`F.y...........G...6\.....i..N~B...q..../"..B...........|qy}...-W.Uz...S...1{.....c..Zz..ixG...:..]u...${~.0h......Q.~...$........w..ai=.......2..z....,..+......].;.^9....).Bc...^...%n...ml.i.,.Gl...~y.......%v...s..b}w....J\ $.....3........&.Sh..0g.6.%!...,.....l...mS\.!`.o]AU.8./>d.*.AK,j...H)#S......|/..B.vv...(. ....e..h[...9.....;.2..r.......$bWlB..E..{......X.%.x1.......q.Oe.P)..4.....LVV......^\...

        C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.privacy.json.rhysida

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:data
        Category:dropped
        Size (bytes):2149980
        Entropy (8bit):7.995579335769924
        Encrypted:true
        SSDEEP:49152:/hBTeKI4jkgs7jEcm1pEY0orDQW0snG/h7d5bm:be3ekfQcsEY0IQW0OG/h7/m
        MD5:34493BF4C109040B1DF59E9951A32CEA
        SHA1:E805CC546321355CFD2AA2CD3C28C3C6F892D405
        SHA-256:1FEE356817934F16DBF6D476A125CE4F9BA43527DDC3C9EF9D82A8A43EACFC40
        SHA-512:281D6228CBAB6735A83CE136F7B25345E39F73C0C678A97896C9D20DC944958A2D1EA595BE3E7E81BA6076CC0A07B1066A4015F319CFCE2AE905BD179F790C18
        Malicious:true
        Preview:.H..%.. ..W....Ii......y.Cu.....'.......}.~.......L!.Z...x.*.GX..#B._...[G.S.....\...D.)Le.W..XW-.;Lw.lL/.rD......[%...=V...Cs...`h.{kTY..u2J.......Z....n......9.=...3p...[...N...d..Q.F.m\...;.R.D7.[....u.E.......#=...#.N..pZ.CZ\.x.6.*.vR.H..3Z6.y.(! B.!....V.U....H....}..:.q.:.h.....,...f..&*.a.J..$..PB.Y.k....R.0;..o..i.T_.[.z.9h..N.G~.V..+9..1..s.4]....0..F`.0.......Ux8...Qb....4+.|...,.b$.;.A....K..P..I.9..i..g..QC<.&...^j..1*..W..}].D.....*..w(._.m..1......@....t$.=pV.?..6.>.a......97....k.xU...z.....VW.W.%..t....o.]2..>9..................m..K7...T.3.+.BZHR..7.....|...X.{Il..R...X.!X+?c.....+../b..X.....w....f}...k...i70..=,...K..Y.E.r..4c..:....a.....l]O.S..!zv..P......Fp...f...` ^l...r.%Epa..).F....w.....U.g8..vW{..h,-.9Q.......Px.5...Z.4a..._#.".I.h./..K.........l.c/..y^.......H._........ ._..=....G.<7..~.][..#E..6...pEh...k.M...b......zK.H..b.1.5U T.."......g....=...+g.....JN...0..(...$d....../.>..y.~~%tl'm...b.\(5..6.....

        C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.tracing.json.bk.rhysida

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:data
        Category:dropped
        Size (bytes):1064
        Entropy (8bit):7.81647213599897
        Encrypted:false
        SSDEEP:24:8llxHCeV/zPea2Jd0ux4GgwGD7GclxNYK3Sc+BJTpKM3bzEHwaz/:OlxDzmxd9x5/GD77NYKCLzTpKM33EQg/
        MD5:C39AF68C715BCD54A486451F0C345A05
        SHA1:F5142C7A384F2277F71115A0251DB471526CE53D
        SHA-256:363C66BE951AF8D195C5B178F7738E1830F40B225668050BAF8997E46AC3C241
        SHA-512:21E182206EB9392AD613E52240E2D02D7601C4ACD2E9986CE398D7A27C519093F45F8C17807A069DD86A56185AD66ECD2F2F299868F49C1B9C88B35D381CDB32
        Malicious:false
        Preview:.....=.....J............Z;.6>Ke...n.dC....+..r?j..6.[...3.'.ZO7.Qus.3Bm.?....B...A..`=`T..D.......E.a..D9.......d?x..z..V.6.;.h.:...I.d..^.>.Q...@... ..e(..F.I.#...V:g.9iv.{....jF...\h.q8....LN...|..E..(4xO?:.....?....'(........9.....D.z....p"..^..OT.H7..t.z:0I.f/j.....N3......E....F.*o>.aS..v...y&b.R;m...PT....be.oQ...)..;...!....J..,w=...<....\...q.y,Y9PZ.?..~x.(P..[.W..{>...uJ.~D...#JJ}.R........:..+.~~......'....W.@w....Q.s.ut...O....Q....U.4.2/..G..eXiO....P...3-..z.,..j....WFq.x< eW+....bm.T.].......F.u....-Z.41.T.i.....Fo.....G.1.........:.N.{t..diM...N;+..o}....,.wx.......C..2...W.m#v.........%6......Z...c../...~.7.iC.....D..a....,o...N......1u.[Hs...!.......m....B.Q...X'...!..].T._..G.o~.n.#..u..wt..#.#..'..q....p...C.E.T.L.C-..CVA..#}.pY@.z.z.0.-.F^Z...R.@y...8&.3.?.Hap..A..M..'@Km..:.. ....,.N.@..a....$....]..wC.......3...?....+.......".b..?.<m-0M0..a#uW...ww.;x8......~Q:..0=...gK.+.h..].a./".<M. <..*..H)..s3s.'........v.j

        C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.tracing.json.rhysida

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:data
        Category:dropped
        Size (bytes):1077
        Entropy (8bit):7.816589682367138
        Encrypted:false
        SSDEEP:24:nqNttb5dDyfF2eXiJ9ADFoq48SP4SmfUwUwdbgRDPsSns:qNttrDyA0iguPyswUwBgRDEb
        MD5:F2AFB5D0672EC89BCC085E5FE46525CF
        SHA1:56F9B5B1DAE27F60DD1A6A9DB70D967E6E48ECD9
        SHA-256:734BB9F4170E81AD8BCC4EB5ED02962C497382FF212694BBCE45F4A6045FD246
        SHA-512:98D37BD796C34F026EA60AC40C58CB174C11ADD459C02232BE09B15944F81F2F867618D686D1458EF4768C0D59C6736786ABBEC83CD2B120D4F1B21C4FE9DF62
        Malicious:false
        Preview:.,.. Ia8o.._....Y../b.....le.....=E.....8....Kv...L :..$M....]...p.E[.......2......z.......d..K6$u..xf.m....z...4...&I~.....=.nf .d!..-..." ....( .Q...2.....8..p.'.6.....^.T..F.BY...a.%>..{...U....c...q"...'..5?u...H.U!lH.2. .J..s.S.M.c..%..W..b.j..nC..3....X.....>...}...O....`.~.....r..*.Z.+%m...?..(.s.f.o...b\9.".,....7=I...1J.....8.(N....B..lj....R."`8_.^.F..y..-`.Y7.GT<!.}....T.V8K>/ck...12.F.1.....(..{&....W.r..;.kr........91.G........(.].....|.M8j~i...6.X......ZK.^'.d~..t.L.<..t.H.1d..)c.x~..p........-.'..|o.jZ.....h.{....:.R....R..?..ctelz.u........0g.JBHQ.~.i..i..#.Ww}...CL..Xq.G5~.a..|&..Y:...O.x.S.S...a..~..B@I....!..HP..y.(...&%.Z.5...;!...q....3K..8...svG.w*,=.n...5...,D.faB...K..:...bi.B^.q....a..7...K..,......^...'.......\.L#....._.......v..k.^.$......%.W..B.6......P.o.*A.d..m.....j..m.V....B...0./......"...|m.'x..k*....[*i..Y.sB....$...rL......qH".&.J.@.fs......l.0X.M.-S>..|.O5L...;...Q.n...5[].Y..r.U..1V..[=...=.^.4.f..

        C:\ProgramData\Microsoft\Diagnosis\ETLLogs\Autologger\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Diagnosis\ETLLogs\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Diagnosis\ETLLogs\ScenarioShutdownLogger\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Diagnosis\ETLLogs\ShutdownLogger\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Diagnosis\EventStore.db.rhysida

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:data
        Category:dropped
        Size (bytes):107532
        Entropy (8bit):7.998280549120219
        Encrypted:true
        SSDEEP:1536:1p3qojafhqGZm4iYpETJoc9x300/yN41Ika7m5vzX2eyM7ACTL973Hl5eiJkQ59L:GoihvgJR0eika7gvzXxBhJf9L
        MD5:F49973FB032C4856E73E1AC78095F596
        SHA1:D366A26565B4F67475E9FB5CA173658E93211EB7
        SHA-256:3A09C619657BAFBE4E23B7AF8BEE309FFC2764EBF0652C0AD1310F88413D254D
        SHA-512:C1E2D651C67B3B841BD6536597107293AAF551BBB25334DC30383E2F98A0C471DEBBE6F1F638590C197BADA491A94CDE3330870707B46E484E0885B76E01421F
        Malicious:true
        Preview:..m.P@Y%.}.].|!G...ZO..8,.1h.......~..[9.....j.^VA....&u.}[.l..G.l;.02'/.o.).>..Fh....P.X..}......F...m.$..1.>...ODh.a.....|G..J...e.O..e......4._0...0rH..U..h.%..7..z}q...P........DlE.....n.b.....U....n...NyrW...vd...&../...B.U.x0.V.,.....8.D..{-....<...w..1w...+ .D.......e.U.....;..n.FW.~@.w...R6..<B..S..6:J.xG..*......j.C+......c....I.!.5.e"..hE..~tb3..>]...`w.M....E5H..l......i...P...x..b6.N.n.#WP....*.)..(2...l.6)......B`0....H-J.XD.......a..1.D3S.j..Kh..p..p.'=].i:..y.......[f..K....0.,f ....)a.:.\.U...+G.......yL=.....? ..V..|..Uo...G....o..&x.z .Y...^....*_^..%.d4......q..&..J2*.VL....~.Y..G..1...h'l4..<7N.5..q....>(.A.=l..L].n..i..9t.O.&....E.>.1U>...4.....3T.._exe....]..P....u.j`....Cn..f.s2...6Gb..k/.r]..H.}.N.....u.k.....)O9.Y....S..W.....d..;....?..K.P...........4...A..R.....-0.P.a.3v.GH.0.^....~.../..A.Jl.z,|<.e....q>\.....^C.^q....>..`v)..X=.7~z.........._....(.c.......?k..]Uu..n.4.;.VTn...!.m{..v.d.!....{...I...

        C:\ProgramData\Microsoft\Diagnosis\EventTranscript\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Diagnosis\FeedbackHub\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Diagnosis\LocalTraceStore\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Diagnosis\ScenariosSqlStore\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Diagnosis\ScenariosSqlStore\EventStore.db.rhysida

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:data
        Category:dropped
        Size (bytes):33804
        Entropy (8bit):7.994877202575274
        Encrypted:true
        SSDEEP:768:pejuHQjbko4mbIp9fEj0m1GcALXyGywgskdU041D1ztenzX23qO:2PjbknqIp98j7AAHdU041Dunzm1
        MD5:170E4FD9E4A878DAE7301E0D532618AF
        SHA1:866027A92AEECEFDBD4A23ADABB56474A0D8DFE5
        SHA-256:A9DF8B4437CE31E9916E220ADE950CA2A7721A70EE526B2A6088B9BA9892E8BC
        SHA-512:9C363399B20C0298514C7CDB9B8801C6B3DDFD9A8670A956EBE6E8FC040DE900B22A0A27B3021884F644BAAAAB3A173958CB58515963DFE4EB40499A43BE5571
        Malicious:true
        Preview:.MSB..E......:....a.....^.fW<.R{"/..'.l..jf..kz`....EWb.F.V.8..D_.\i..........{Z3.@.....".P.I:.........P..*....#t.G...b..1...C.~k......U..C2.....-.+...5..>..=..b..!...b....+.5..).#L. ..y..PX...L..=...g7..*...pg^/......N7,4.Bp.(..[)...'-E~........2w..F...\..8.$X.O.e.2.Cv0w..)....Pn.!....&:.....v.....(=.p.e....AF.... ..Q+..^.+...PC....h..$r....R...2.c).rW-.......<k..z.Q.[.+^....a....zr.f..:.;.c..<k;..4..."dh..b$.y,iDK.C..|[..R...~....OA...)..h.FP....!.*0.Q<y1.........u.O.{..X...S9..T&<...c...$!.......(.?..;...z..#..D<.}.y-....g.......U...."..H`d_}5....r.....w...P.{].....c.".......6xv.PP.H..'......x.d ...[...9.4..%.k..[....8%..%z_..y.iy...~............!...C.....p0.X.$..8.;..^..*..}E.O..1...L."....<..ls.Jbt$..v..&e....F..A.......u.=m.k..)`.."I.5..oT.q.hbPR..;..qe..R..&.~.;...O......G[.C.]...L...H...9...U.w3....0n...{...4X.O.0Y.o.}'p.F.....[.a.5.K.pC..f(.t..V....-..........&uF..~.......=6.Y...; .V.:..@......{#W........8I..F_...i&.F...D...LK1.+..S9.

        C:\ProgramData\Microsoft\Diagnosis\Sideload\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Diagnosis\Siufloc\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Diagnosis\SoftLandingStage\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Diagnosis\SoftLanding\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Diagnosis\Temp\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Diagnosis\Temp\DiagTrackTraceSlot_alternativeTrace\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Diagnosis\Temp\DiagTrackTraceSlot_aot\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Diagnosis\Temp\DiagTrackTraceSlot_diag\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Diagnosis\Temp\DiagTrackTraceSlot_miniTrace\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Diagnosis\TenantStorage\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Diagnosis\TenantStorage\P-ARIA\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Diagnosis\TenantStorage\P-ARIA\EventStore.db.rhysida

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:data
        Category:dropped
        Size (bytes):29708
        Entropy (8bit):7.994739823980105
        Encrypted:true
        SSDEEP:768:7KC5A7x1l75yav2WmJglY/bW8JaEPFrMXew+DN:6xr7YavWJglWf+puN
        MD5:B404E17A1678A17CB7C331D6F5D202C9
        SHA1:4FD93BB9AA173EAC050A00C36624D631FB4FF96C
        SHA-256:C7329AD359530F3B2DF2FB1ED66CC4298A064A211194885E3BB9C05EDB4866B2
        SHA-512:3D7D576F619D5A218DC274C27512E7BE47D71EA3DCE697FD42D509C115EC1F5C23BB01CA749A6D37630D06C2EA3CB89C260D2DB17865CCB546A3BDF4BAF0BB28
        Malicious:true
        Preview:.......> c6jYH...gCs...'........_..v...Hh...oS<....dw@.^t]..t.h...W..9|...*.*...V9...W....1......XlB~....::.........%.<.).y.0i.u.saje0nx...O...]1.n..A.h. C.N.].....jSB....8.[......R........:.8..../"Il.....}.nEc.6].W..gMot.......#..<..-W.-!.N.....|.gq)eq=.....v..G......#CI..Z0}.E..%..o..k.P.s....*.....n.)I..]!........{.B)E...bJU..VL`-.oa.%.:.<TBZGs.....a.>.R...c.b..@h.....?..s.2..A~}4.K..H.T.|!:*.B:<.....M.o.{............3...V..|s\.}..)'%S....T...;....T#.kS.,...v..D!.T......_(..wo....GM7..w..P..<V..u-..D....y.. ./"..$.=..u@..,.E...;...d.1K..._W'..k.....n.....huoC.N.F^....-.gz..M5.3...]J...U]@H.@..(.x..J.Ri....j.D....>.a..Z=.{'..cA.(..Bf...].x.e........6.X.l.r....`.65...kh.p.P`..x.<....x2|O.....|.F.{.I_.-..+s.>.&`tu.....q..Z......o..H"o.n....90p.Z.f.x..wm..E...N...">....z........'.d....H1+.J..ccrp..i....S.|.83.".d"hNp..i.<...........pg..Y...&.*a=e....uRI.q......7\.9.\6fO...RZ|..............."..a.K-...].......<......r..&.k"......w.Uh...

        C:\ProgramData\Microsoft\Diagnosis\TimeTravelDebuggingStorage\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Diagnosis\osver.txt.rhysida

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:data
        Category:dropped
        Size (bytes):1046
        Entropy (8bit):7.826549501050616
        Encrypted:false
        SSDEEP:24:MfbZZv3QJKmGozaOlJnYW2xnfqEovWyE6U6ILhzJ:Mfb73i/mqJ9PWyTUnLh9
        MD5:414965CF1F257371D1D17EF72FC19798
        SHA1:90CFB7FDB2DF69254F9B715DECF48DB761C11BAA
        SHA-256:84C78964A61796C9037D28878CB7AE7D91BC60C862C2EB5265ED576ADF35B239
        SHA-512:52644521FBBE5F03D3BA225A113CAFEEAE689E18C7D7343E626C011DB305A29A9D26616DB102CF9E164DB1BFDEFDA1501141CE77F533A58AC0542FDAFEC768FF
        Malicious:false
        Preview:.Z .=.I..+.%8.]T..... }.n.T.a.G...D=..6..4N...x$$m...F....z.I.7V.K..<..ELK..}..../......o..+.......o.J....s..ap0..F/.>wh.......d..>..L;..}G...".m..T.........g..{!>.]:.^..W.......r..g5..2.K...s...4...........o....;.R.Q.1..{z...c..t..x&j].......8.....K..$.D.=... ...a...W.....m....VS5....P..9.!&H+.9 .O......&..b....S..rE.E7....y..s%.0n=..7P...I..fDi.B.....G..]...L...Wb.U<..1G.Y6.....*ZB1Hd}~.R.%5j.?..!..6..N...0..p.I.6..&tV1Y..j' .c3e}.......(a.A...J.L..."..D.uv..5;R.7..\..H..}.3.M.QX..j.........4....:A..(..nw.b..o[.....].O;...-.gZ....."...8mXa..l..0.s....NZ...X...Q..a......Sc6.7.id.!...S8.O...P.d.v.\.P.!..s...@.j..a...*Z.2L.....[j3o.........A2M..<.p.!\WF./h|<...D.!.Q./(V.M.4P.`&o..H_..b....Y.P....aEc.6....+.;.......6.@.PdvmgJ;..W:~..)"....YA........2i.. ....+...b......0.[i......^....D.....0>!....b.C^.[.p..wz...G<.<.TSB...3k!dxJ..>O.S..8....~.....\...K.e.....:...:L`...#...;`j.7..A......O.....,.,|.%/.<}.;.....)..rs.....*.Md|cn.~....

        C:\ProgramData\Microsoft\DiagnosticLogCSP\Channels\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\DiagnosticLogCSP\Collectors\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\DiagnosticLogCSP\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\DiagnosticLogCSP\DeviceStateData\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\EdgeUpdate\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\EdgeUpdate\Log\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log.rhysida

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:data
        Category:dropped
        Size (bytes):398118
        Entropy (8bit):7.999528915005141
        Encrypted:true
        SSDEEP:6144:+g2YRTEuwLhu/+t7Z/1v/lQg6FH0w5g89lyivM23uLdARFiGgS1sa3t4nDmHQ3:ceTfVG7Zt/9M93bp13eqMHSua9+yu
        MD5:EAB31E815DE03EAE7F49E31A780C9DC0
        SHA1:ABD16CC1691156DAA7188695DD112031F0FDEBFB
        SHA-256:650C9D44A3117CA210FB85FC3BB63DBF789AC678E096AD86421A0BB9CBF4B8EE
        SHA-512:6ECD98AF44906B79491FFAEEBB901F0A9277D00F8B5E351C671830BCEBD8F255DE53807144BFD4FFA9E9BB7C2ED310305E4FFA401FD03FD5DCE6BAA591CFEF0F
        Malicious:true
        Preview:_...9.d.`......[..).<....v....F9..w~....^..O9.5v...j....0.m......+.....ji..@.oj...o..k.3FD@):..?1..4....G..rU........*7F..C.....;...-.s..2/.........K.;........M..s.e.C.....B+.......8]..Y.3...N.D.r.l.<0..TTS.ku~.J[..Z|.1..`.....-...5.R7I?..^...).F....}.$..NW.3B.A.<.=........x.l..G.. z.Df...e.;.g..*U..p.~h...........W.yc......T...=...f~..S..../...n.F=u|._.....;...g.D.f.S..q|O.9.DY..sP..#r"........}di4..^5sY^Yw^..[.%.g........%Aj.R....-6g.=l..w.....)....X.P....p.M\...&3.#.g..,*%.P.hQ..b...6D.....-..u(}............v.....bf..D...+.3..U..\..'AL..D.'.#P.....xB...iS5G1.....a&......>.8s.....qe...K4|.9.-V..S.@.E@.Vb.j.m..2u8....Q.V...$0.\J..\.!Kxg.....C....5..8j)...v...j\._h*..u...%..=..\:....(.)1..yh9.Sh..Tl6.".q...b..+%.FL.;....r"3..E...C..%F...!........m...@.5l.j...T0..t......?...ydt..Im..(>..y...s.P.R....<~...6'&9..0+vp!k.kt.!.....t..0.....]...>y.<.p..M.x...2.{.s7<.%.I..QA|...'.v...a...s8.&.A...@(n..9A.y;.u...d.{.....J.G...wci'...UR

        C:\ProgramData\Microsoft\IdentityCRL\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\IdentityCRL\INT\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\IdentityCRL\INT\wlidsvcconfig.xml.rhysida

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:data
        Category:dropped
        Size (bytes):14011
        Entropy (8bit):7.987761993723591
        Encrypted:false
        SSDEEP:384:FgjcWCOXfkxu9lv4IB9je3VTHSz07TSLofhL3+6l16:FgjcW/8xubAojUVPBiu6
        MD5:040B07226F72182618A386568B1E99E2
        SHA1:CDDF1BBEDD6C8BED068DBB6092448BC7EFC5B1F8
        SHA-256:755EAC5EBEC6E47B03F368DBC0F91F8D410E5EFFF026236FAA275D3144266F88
        SHA-512:4CC9FAB517A69E6BA1FDA3CE457BC31B3DE793694A804320D318286FE06A0FDD66522790B24200C8E872E8D3AD018B25AB184D653337F5323735B7A66279D88B
        Malicious:false
        Preview:n".a...3C.Z.3k....PF.{.6.......+V..n*...0e...........\.M.}...Z'....... .J......5P.....O.#.J7....!........o..~l':\...&...Y{.-)x...!{...M..{V...B4.....d.....a.;N..1...MjP./.'..Fhi.q.S._........O..K..9..-...!..}(x..C[.).}.U.[..6H...gS.a..9.q...0.`.....`..%=I'...B..u.<e.#HX.].l._@/.._..*6.-....IP....aHw|.'8J........\u..!.tc...x....X..g:..y.....y.C.p....r..R5..k..?.@Id...k%..D..X.X3.I@g!...=B..t........8.Yw7......>!<Y&,Mv...9...n.!..1.p.....J.H0..-m.JSJ9)..GlF.t...Le.h..udn..1T~....o.V?%..M.8...W.'D.Tnj.r.u7`.9.Y3f-;............XcPDtC..$x.N....sD..I...r..j......|-.A.]QX.c....~.m... pm..d..^....q..<..w8^.Q...b 08....W.IA............%.J...Lc.D...Qn....kJ.....XZ.!.....83."..g. ....(#h.sW...~..i,!.I.[..;..6.B!...x/.R.....#B=.4.P....8.d.*d.wy.f..g|,^Y.3;Wm.q.^..\......Q.>..k...mP.@...Dk|..}..%..6._.i..z.=.*J@..Q...|..u.5..q,.gw..n3HQju...!..b.i...5.F0.N.b../.5J.z.V.....p.....N.P..k.oT......u.C..f7...........+..;...-..X).1..G>....o7...7...A.

        C:\ProgramData\Microsoft\IdentityCRL\production\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\IdentityCRL\production\wlidsvcconfig.xml.rhysida

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:data
        Category:dropped
        Size (bytes):15277
        Entropy (8bit):7.9883981816377165
        Encrypted:false
        SSDEEP:384:Ica79vmXQje9Kl9EMXGr0NCATXAEgyEfGHSMtnCQuQHA9zbaUaPBFEbj:TaZvmXee4l9EYrTwEgygGpHA90Bi
        MD5:AB197EE6A3A2BF3A60B73DF0AFACE874
        SHA1:C1F28D8B71245062182AA56758219B2262163876
        SHA-256:5640C3A0B8049CE718F070ED3D0EEFA4C4B0C757C6D5051321663A9532175C55
        SHA-512:DFE20DD85BA37BFC6A1B2D250CB3F3CFF64CB29E87E140F68078C7D33E7DF5FFDB00D3DF9C4B3B0533B7E27C089361F7D67F569260D6788266B35891ADC569B2
        Malicious:false
        Preview:..eC..!.Q'.y.I|..(M.U&.@..dIR..1K...[{........5...?.s.|...G.=.i...UG..z..Q..6...K.x....?...p.u*..j...f...m..~.E...|..{^K?].....S.Mnv9We.uS...../.z.=7Z.Z..M.?../.mG...+..v...#.a.g...c.N.c.A.<....-......[.F...Q$.p.h..(Z.m..H.[zv.......,=}|8@5*.f../\...F.FEY.0.#...W..D.K..}r`.D...V.A[.VW....Q...........O.^..a..\.Om...e....0...&...b..V?=u..V......".|T...}...f*w.....Y..%..`XN......es.g?!........f.^.yK6...c...m..;...'.u.m.....xi....j..oq.4.Yh!|Z.O....*."".}.Ds...8'.....[..1.d.+..MT*?H.3..Y.A3j.~_.....nB|...p$.^0..T....o#.K....K`.c.P.-V?....l..h.....!...q..9...;....(C...%?...]#...{v.#$.K.JUa.Kr...\....>.5...P...{e.G..7...e..Wc.c.?....V7..N.@.#...+...7VY...z.o...O.. H....4!f...6.cN".%....z..@xb....0{<\K.sVct.3...|..w.0m.y..&.LY...(b[.{..;.@]..J.f...'....%.{E.W.K..<...Rp.....\.N..(..he.$k..X...Z0........l;W...+.JCo..&-..FT;=.N..i..Q{_...Q.[.b4..n.(P..>[._..".o...rv..(E..;..*dF...`.5.e..7...x.f.kOi.y}....N..gl...p..n.A*.Z.P..T.M...%?.~..*...j(

        C:\ProgramData\Microsoft\MF\Active.GRL.rhysida

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:data
        Category:dropped
        Size (bytes):16008
        Entropy (8bit):7.989031062718862
        Encrypted:false
        SSDEEP:384:K6nekOCD2yj8sTvzMpdqAMA4xHQNYABe+i9obr9nsd:L2BsvqOxee85sd
        MD5:1B968D4AD5F5E8637289441CDD85B91F
        SHA1:537A9346A536DBBCA49BB844AFD1C24BC0DB21EC
        SHA-256:63E3F7475044C74D006A2CF114487918ED7B4D01B518571F00A66C0C9D2511DC
        SHA-512:BEC642FE5C90B7E367D456450DB1E74FFCE1E5028C74F1D44B4E261694515B675D00402451B42912BE3AC4CBBC7542BE28FCAC019DB7A0AFBF0414216E24804F
        Malicious:false
        Preview:.`.@p...!R..w...N.9.'.......%...$`...qi.......K@..S.b.....~.@.L.51.L.t_..v....i..%...tH..,7v.y..m.....!3.7..D\HD..@.H[p(..z.].....`.....l..{.!...............+.,....5..w4.|..E..C'#....-X$a. q.....z..a..;...|...4.W.o.8b...|......t.^..^...:.IP.?=.....U...cQ.^&~..z9.../.1.*,....H9+f.l.@.Qe.b..B.`! p&...x..;i..4].Y...[Q.g1........../"!..s..b...v....... O....._..I.G\..Y...q...U..~.b..O]b..;Z.E.,28u-#F........#R a...LG..r.:B...*=....&...Y... -.....z..U>..=>.y@,(..X.pw..<.R.<R\.F..j.........?..A.<c.....r._...T..%.Z..+..Qn..g<.....d.@YK$......6...*.5...i;B....U9.>...../..\]...../..xSV...3...0I"8kF..(...M.D.....].M.g.&..yQL{.7.sN...zB..t..3,..m.(..Y.fe...u#..kFb<9...T.......J<...RR......-....h.!.......<...4.N......M...t..b.0F..wb.W.!....L.W.)..U..F....+J.@}..4.N1.VPWb..s....x..h6B.5..Z...)........jG.O..P..O@.m..|k.@b...e@g...=7......Ce.z...N......A!.Zw.^....i..5...~.r..]..cH.Ej....<B^...>;.C..?T..S/.eze.;...Y.v_/..d.\-...;.:....h,...6..9\]V.......?`.

        C:\ProgramData\Microsoft\MF\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\MF\Pending.GRL.rhysida

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:data
        Category:dropped
        Size (bytes):16008
        Entropy (8bit):7.988475806338507
        Encrypted:false
        SSDEEP:384:YbQAxzt3j84vEVXZmob2PIQ56hcFqB4rhrU3BDh99:YjxZ3Tv6XZR2LF9rgBf9
        MD5:D41AACA3E9B294BCD49DD00706283688
        SHA1:1F5EB4F9F2F4B2394CA0124CEC23B880320085B1
        SHA-256:47B85D33838586B274838E34922800ACE474CE1BCB4066C16497B1B43D40CB2B
        SHA-512:6A8F079D415B100613177145D3ABABA675974537FF9DEBF77C08B4FDB80FA8CF455F6229DAB26A783275AC5FE9E0A4613648BCD23EF65BAD167AE4DCF264450C
        Malicious:false
        Preview:..g.:..y......T..z.Yip|.].j.0...E.W.L.B8d._.Y<.Y...C.:.-.0z.r...f..D.m7..e....p.vP..sW{.DGV.2....2.E...1.^.R`\.=.Y...%0.>.Y.!F.........>{.wh..5j.a~s....:..o......w.].=X_......K...p@+.3...7..C.E].$.jXZ...a..)...*...e.:.M...Uzl..........}..x..,Y...=...].i....m....".D...|.JP.T.W...in.~@m...i.J...Q.a.Sd\.w....eX..t....h....SG...G.c..xZ.../.8%~ExE.r..o..Q.+..!...~t........+/7.qn.s..d.....hT3..H......8.*iPy..H4.............^.~..W.D..v.".......2....+;..ES=]......."....wgx....&.H3..G..uZy....UZ..EU..n|.,..T.-.:U,.(..)q..8....N,&.F_..r.u.v4.4...e:./..=mU....]...n.....g..<..B)(.....&.;,.....M.a+....>....:...-....T{D-...b8S,v.....q;.%9.../....-.........6.}=.vB=Y...S:..3........IV........[-....0[-..ZV.A.]{g....Z..H..p.@...>....]....c..G-.@..W)..!.. VZ^.)E.=..|@.C.2...:l.V.......h...r)3..QQ......+.y.=.tCc...;.Jl.J...I......ff..........T6..:m#.N...p4...OTU\.,.g....+.`.Ew3...z-...FX..b........U$.=.Om.^.u.<.....uI.B...&Y.F....>c.BJ.. ....OP

        C:\ProgramData\Microsoft\MapData\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\NetFramework\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Network\Connections\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Network\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Network\Downloader\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Network\Downloader\edb.chk.rhysida

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:data
        Category:dropped
        Size (bytes):9228
        Entropy (8bit):7.977722961510038
        Encrypted:false
        SSDEEP:192:tWN3Q3nxjNBJDtbMfs++hGU4cjSwpD7GflfjRsQBZDCpeA0JBPqbF:tW1QBjNBJDtQf+FHZF7aBKwDWZ0Ja
        MD5:81F8BA25DF74609D529937E8A50FE9C6
        SHA1:91A738AA00D980FD0C86FF2990520661CF03D07D
        SHA-256:D352E7848E05371C96E70DF4E1572979082D941EEFE3A0FFBC48BC16CFEE6F14
        SHA-512:024C54DEF84AA9A59A80CB43EC29F067686776C4BA063BB4048DE76624C086B890B528547C01F7F5E014236DE14185F500FB130BE598C1F7F35F21BD531EF893
        Malicious:false
        Preview:T.[>xZE.S. L......e._.>..".4o'a..5.k..5;.~.u. ..J.=...ZbnG.S]+...)....3S..k!,.(.(7.F.CS.}.....$.8.uT.x.wS..A...@TcJH.?bY.SNf..#......q.SF..........n}.(..;.;.Rb..q...Z.....U..t....L.......`......~.0,...6.......P.Xw.,....;..w.&..tN86.....tQ^.#K........W..8.21.H.ko.XX..[.N...4..$........2........W.y.|.M6..o# =.=.%JRlv&...C...Hw...."wj=...Y#Z....}..P.D/!,.F..........E...us.A.........+4..Y..T.c..[HW..;e.,.l.P5...e..._...M...[..q..OV..h....H...sH..9............J.S'i.J.*.. ..%....y.o3.Z..s.2..O..DR...%......._H...W..k..I.trk."..<.......kl|yF.^...v....N;d..;.....*..n.yB4....V....lSbX..ukf,.....Jh..P&.e.%o07.5..vQ...7...K ._NX.z.z(.Y....J\..{..7......(?.*..H3..J$........?c...j.,..b).T..P...@H..3...a...../..k..<.p.8.w/^}...P~...\.X.STS>:..H&%.'.$>..k.Q....>.9..+...H@.pf...U.X{t..g...[l.....V..."..&T.vH.z3.MBe..#....dg.A~........q0.F...A`..i.23m.4......-.a.....^....`].y...I.d.e.|..^.z3...v5."%..a?..D/.]{.TJ.L/....=.M..8..6U...... .s.e

        C:\ProgramData\Microsoft\Network\Downloader\edb.log.rhysida

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:data
        Category:dropped
        Size (bytes):1311756
        Entropy (8bit):7.099417629081462
        Encrypted:false
        SSDEEP:24576:rmKrp1ZhvcIQDo14e4lN3T3eQMiz2DRP0S7FbkFJkE:66p1ZeI/1IeQMVcSJbOWE
        MD5:019D60DE5039CBA989FB9EB41AB30762
        SHA1:BF44A75D796CCB44C09879B9C2626CCC0EB102DA
        SHA-256:2C0D9BB55D9B73712D0C9F96CF9AC1A4E301572EC18EC01682991AC5E7B4B047
        SHA-512:5AAAC9D40D260D9D18134DB84888B9A910B320762A354D2A11B8ED2028F581585FFEAE5E9DFA8471190C825783F4FB8D86D115DD1603E6016068C4F6EFF98467
        Malicious:false
        Preview:...7..#...(G.....`.z......$...TR.....C.o}.Y.b..F..c..H?.w.5.i..E...c.[.w.F)..4eK(.".e.-.z..0.A..L..V.x..b..,.G.;#...K"..g....`...S....z..pG...)!.w!.{w..r.^V..+..l8.$.p>....$'.U..}.9O..8....<..r..@./+^MC......p... .c.d..|..T........3..O...TvV1.y.M......;.V..y%..zd..k..N'f,.0...Bx....S.}.|.I...q..0aAUW=......{...7./h.1..Q........@`.E.v.L.<..}.....A....58.s.T..v.....T.../.B..C|....4..].N.aI..R.J^[...|.A...Q.zLB.....^(<.x....hZ..c_A....p$....;..z..,.m.....$.v.J.1..@l.f...$Hk.x..I ..|)].t@...=.pI;-X .......C\u.[N.N..]p....|-......UG....E.......k..%...j.L..K...Y....3c_.E...C......#.:mX..cD...W5A.F[.M;.E..0.q.[..k..B.....U....[&.<\...in.H6.u..3."`.t.....D%-p.w.........[.~T...Id.z~Hqk...."..z..KU^..A.VF...].%.......K.&....Y.ET'RZ......t..Z......].f......RM..Z.........@.({..>.. .h..[.Q..U.y.(....)s.D&../t....o..Y......e1.B.;.....]\)EvU..HV/..#....`...\...y+.....L..)......e.U..I...!n(..K.d].S.'.......f..x..N*r.....K.8\..c.....

        C:\ProgramData\Microsoft\Network\Downloader\edb00001.log.rhysida

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:data
        Category:dropped
        Size (bytes):1311756
        Entropy (8bit):7.264881847306841
        Encrypted:false
        SSDEEP:12288:6KjJK4CFt8tszHWV5WOb6RMs+OL5dfwtnmF+s0F4UKraOuZ9+hPyedUkXkzL86uE:fjJK4oQM+odmm2F4U6g9Oxks62COa5aY
        MD5:EC375A6DAAFC01F7415BD7A6F3777CAE
        SHA1:5FCD03770C553CE5BDE653F3C09FAEE32E7858DA
        SHA-256:175758441F7D1AD2AC61F1AACBE15CFC7D02E2CEA6342A32AE0C49F263D2CC5A
        SHA-512:52825264F695DA526755EB8255EE4E8783D2924C148A769C4D3854DF1005DB83CBB6A86DE3F7490DB6F1BEFFE7DB3D48EE0FB83F5C46A6EC2CB1DD1902B153D5
        Malicious:false
        Preview:(....*-S..$L5.y..#.<.2....0C.q...eF.!^5.^BO.....#_..y`W..H||[8..f.a..ayh.6...r...A.K.c...9.D.....|....\.......-.^m=.z*6.h7O.7/my.........a.,..7...........<i...L.^~...ax%.D0...[.Z.n%~.....n......x5.b2P.|..|'.3.....7)v:g.{^V.u..c......=.U.L....W~k....}B2...=J...F....(.{r.D...........~6..R.X{...}...../.[..Y.c{._}...[x.....e..}..X.BK.CW........6L....vK.....&...<...N...i.kK..E.....7>.J:.2..qR..^._....JO}9.Z.K..O.Kj%.....#...D.9...3..J..v.....H*]........Y..._..$.E).t.E....B.[.0V......A....;.{...../....-.G...;.....Ra.,4AN..?..*F....Q../..'..(..z..B.....|.N.nuy.?..*P.i1.a#.x..-..~'.Ie..F[C[.6.........$*.i..h{}.-.$i.....1..A4.._..\U8.d.CL.d.~..M....\.x 0:.......<q..B'r.;R3.N.%..zW...n7...].^...c#...I.j-....H......7.XZ.d01...=..&F.1...C..._../.#.f.n&n.vI.YF..X..`..>.&.:&.0..i...n...qL.....S..,..Lj....y=.q.4......fkU.\$..|..^3.C..,. [.,.B./S4.C.A}.94.j.X.......Z.*N%7. ...U..LyG|+JM.4k7.{...U.j".5...xSOK|...t....z........./ W.Y..X<?..w.

        C:\ProgramData\Microsoft\Network\Downloader\edbres00001.jrs.rhysida

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:data
        Category:dropped
        Size (bytes):1311756
        Entropy (8bit):7.0993792220531935
        Encrypted:false
        SSDEEP:24576:QJBb4PcS0939CWDkKhbDkOJCpAltR2Lxtg/F9RdVuHB:oB8B0jCWoKJ/xFKkFPda
        MD5:91ECEAFB454D4A3EAF3D5A7D10DA118B
        SHA1:F13F9EA7AD70DBEBF5BE6D82D604691686F414D1
        SHA-256:ECACD495614F6DCB32029D40C5CE167950F24F3CFBBA8F9670C10F8721473169
        SHA-512:2C1D51C7CA233BDF39DDE030669F0F912702CCA26190C3F2FA2914418F646522F80EA1CD160F8DAB7C395D100E8D208F2C3428EDD98536C7EC4A2CCFB9563D9C
        Malicious:false
        Preview:..N.)..~....{..oE.9..JW.......;B....=m...f.~&.$~.TzoO...o....L..T....[..,...<....r../....~.%.0w.Z..VJm.....>..G....'....*.W(.\x..-.&g5...Lc.u....mU.M..^...v#g...`{.!..FE...0..r..* xQ..zgnH..E*.r.....ar...4..I.../.?.!2WU..X.. V.p.).20k....T6.f.b....-...nnb....$!...B.1..'.E......@.a..iH0...i..t..+....=.e&.,..Gk.ng..L".D...!B.......H..s'.;.N..8...v.).:...#.8..:....@.7.....s......_.Q.m.Cg.1.~...!&../)..a.h.[..Qi&P.d..^.;...B..xm{.Y.?H.<3..b0.L....l24$...s7..q.....e...{8x.....G*.m.q.v..#E&&..7.=k.....b+..y...f....Qo.:?e..f~.....;.>.v.b..Q....B..V....%..*..s.:.op.6E?..GMp.....E..~'.....;0..-.......v.V...M!....'yb3...q...Oq.=f.L.._z.w..c...N,p.......s.".......X..'g....l...dY.....k.8.:.NE.........vN.j..Z...F..dg5...qC..,wk.#..........a.Z.B.B..C./.......?......n.|....c^.D .I0....bA.z.o...G..<tp_x...Y.i..O$.p..F......J.thO...SN}.>.V........G.....':.._c...?]Na...mnJ$..|..*.....q.....*DZ....U...1..P....>....W.t...D.x..u&.k...?K..^.....m.W.rkGU.&O.|..

        C:\ProgramData\Microsoft\Network\Downloader\edbres00002.jrs.rhysida

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:data
        Category:dropped
        Size (bytes):1311756
        Entropy (8bit):7.099657170204943
        Encrypted:false
        SSDEEP:24576:U3orOvukRgwedTcjyQgB9Lv7UD2VPT/tUl9GjKIl:LtOgXTA9o9LvpVr/Gly9l
        MD5:0D88FFA95E5C32CF950D50C760B08987
        SHA1:1C8C309C0445DE5D9722E709632956DA91B40196
        SHA-256:7B9B36B47A2E3749E82102C015D2B0D1841748B62BB51F3063085964694B47A6
        SHA-512:26D858D93365F10679178A623CADBE4B24487DCAA54364F175EDE83722148591356DF68CD7242D059E9BB8CB613849C63F7F180A3B2D00A041ECC35D6CDA3800
        Malicious:false
        Preview:..%........-...p...!.3..i.....H.6........&.HPz..W..^..........T.6.c....cz.#=N%`.^..OQJ.d.-...&N...@...V.3..\.ZVa..4...~i...4n.Qj=..!...7...#Q.W..g......jK[.....?I.=...}......W....j{........d..4+...K...P.o....ZC.<o..JD..C...v......}\>q..A=7i./..ODO/3.#...7...K.....o|.x..b...% ....|.`.AJc.1.p....Cq..%7.JS.X`aN.oo....+.R>@D......)..{\ih.5lq.-.@.c..*Y.Um.z...%.).......`.S.........Z[.....J;.Yl.4Is|...kk$hg...t....kT....JTLz7..5Fe.c(c....T.....H.Y.33.%..5.m.....K....-D....d,..d.T.@M...Ww..E~<.l..Gq.....J..+..^....WB.....N..i.O.0.F.i.t.[1.-..L........0.q......>.bW.A.....7.."o.9}=..~)@&.2>4e.Z..$8.T.@.0+e..w....`;..l......b.H.%.$<V n......$...&...........0im.s5.H........... ....y.r.J....[>....D..G*.<.].Y..D9G4...p...i.u..a.W....*b.Ys......~...dE.f..W@B......j..B.\zpU....+...K......."..`..J...g.`.......#v.w.|}.....9..jB.+t8...w..c........8...!.....kQ.........t...Gz.w,..2....Dd.............we..O0.>Y......`O..@p..6.......U.WR.B.N..N<...wr.iV...}../ 1;~

        C:\ProgramData\Microsoft\Network\Downloader\edbtmp.log.rhysida

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:data
        Category:dropped
        Size (bytes):1311756
        Entropy (8bit):7.099794981441385
        Encrypted:false
        SSDEEP:24576:8snJF4eXjHlJgAsAj9jO/KiXXsz/Khmc+ZKhserY0F25:bnJ33gSsKQXKKhmcuZ665
        MD5:9B65007426E9E458D20AF11CB5D8D16C
        SHA1:F72AC6FF457EF7BFDF3F52070A42BF9E5419278B
        SHA-256:8D5ECBFFE14DDDA730706A3F53D54483B9F4BEC37A608C871910AA32C067AE9A
        SHA-512:6695ED3BF827C0760ED81F00E69A389943D4BFE2C76A496C78B681EE5CB5731D3023EC10964E161A4A6134BDDEC511760835DA9E2E85E4987C5E42F3E7E4BF12
        Malicious:false
        Preview:.Q...4H..ht.w.v..e.u.2N.r...W...=9O.."m|q....X....z..UvO+......D...t...=2...k.m..o.dnb..R..3.MU.(p..(..D...|NG8.GZ..H.....Vt..Xm..v6E...Qir-..2T..&..4..vpz.9...=.4Mk.. .t\(..A...2.8>U.w7.i$...x..........=..6........A..T..@....;..`g.z.p..7...QU.. .9.]I.;...x..)..-_.|./.?..F....:2q.....fB7]...#...t.1.....K..2C....]..,..>.]....N.....\.....i.6}.9O..G.Y=...o....D~.w.M.<...T.....k...0pt....a.XH.K.......8....;......Cc......'y.9.Wkn.<.P6}.*..v.}.+..vo.)e.nn...{...@...#...............&..;.i.q.0...VmW...#/a. ..J......dE....??"G...1...L..L0.P^...-M.Pw...~ ..d.&.....v.........=.......J)F.f..KMK.t.j..2.3%q0.|(...@Oo..p64....%.s.}N$.B.,X._I.W.|5.P..#O(u5w~..'....l\.v.. q..|V%:|....t0.. )W...(..>..!...>.8.....I..2.MPc.z..pTB.rQz....Ab...5.)..."...?..~..,.....Te.k-....H.O5...a;'...._=f.g..c.2(.[.{.{.R...z...DTY..^${%..g.zg.c....G.'...XZJt[...*c>..?;..L.c...i#......5H..............+......... .(....d...P..N.?^W.Yh.n.)u...*...\..h;_F4..a.`.7>t2.=..n.

        C:\ProgramData\Microsoft\Network\Downloader\qmgr.db.rhysida

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:data
        Category:dropped
        Size (bytes):1311756
        Entropy (8bit):7.099953524785266
        Encrypted:false
        SSDEEP:24576:PS1S36FBaxaMPtlZWNhYj0Zjkt0V2kNBQCho1dd0Uy/ZOdvhB:P/qFBaNleNsWJQ2qCEd0tZ0
        MD5:94D6D163DD08615C554487ED267AFE1B
        SHA1:3DB7BE387C164A641B0789683B3CC12A3470D21C
        SHA-256:E8E8B9BF908948AFA490730ED59C0404C3AAA091FF2E8858FE5860D96CA341E2
        SHA-512:545E76735A65142205B2CF62F3439BD0F7CC2144728F12C4E237A2D70DB4F1B44CAF280BE37ECDDB2B032668D26C67D6391976149E2192A3605B7AC641763779
        Malicious:false
        Preview:%.*...l.dM....`.\.......q!.......8.z.Gp.Wn(.)u....O...a.OjMX\......`..xki0..jz.V.<~...3.Y.sB....~....W.9. ....cP#'.I....Zr.~..3.).......J...yo..^'....NC".|.J.x.....2..sB.-+......(q...K&.i....Fe ......M;....cf.....RZ..6.n]<U.A+..w..J...k...i9.*..K]..<..:.?....44.C.|.bR....g...0...R.Q.4&....a.".....U..L...c.~\.F.s..WW..t.YZ..-...U~6uG....~.<..............O..v.#.l..D.$...e.W.~..@...6ko.3....B7N...ngv...}..#9.a...`.,u.........gK.."...km..|t...6...GG.,..g....=...cOe.)X....W......1/..7;ly.JI1a..^.....y.;vGql$0..w.E."E.%....h..{...q........'.d.en........AH.y.R........DF.{.......v....q.....'8.0.)[.\..`.......{.o.W_._..@Lnp:...hB.'._|...0....Ew..].rzn..H.%D.|..Q.S..`dK...}..'.R.....??...rX.......Q7..O.N.f\.F^.^.....o2..Q 2?.....gy...pKf+. q.dw.l....U.A.,..~+.ai<.#.A..Xu..p*........&..#k.............T.g.9k-..}w.D.|.g..S+.D...SC.?k...PT..q..p.o.6...lc..t..oE..Z.y.....ee$W)..WX..">...8.P&k.a.M.k...9.Q..{6...Z;x..... ......2./...^..?IYH._L!.6.fG

        C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm.rhysida

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:data
        Category:dropped
        Size (bytes):17420
        Entropy (8bit):7.987658735676111
        Encrypted:false
        SSDEEP:384:QX+xxSXH18oubBgKgeYbOlcG6bAn0JtnMw5zsMYsjEm6L:QuWuo/eYccG6bA0JVMmzzxjG
        MD5:170952CED0E7D02BECE70BD7BBA17DFC
        SHA1:23129882C7C224C43A38EBFFCB2810C92A52F0AC
        SHA-256:A9B0F7BA3E28E220147F215DDAB7570BCCEB513FB12583A4B9D6EC14BB500EF6
        SHA-512:7709F428685F4C47DCE71F36F732FC8AD0DA7F06712038FC8F074C605AB7D52F1912AE993880BDE3756D9FD0E4D01C8559CD2BA6A47D7F98D33FD3DBC9B6DB7D
        Malicious:false
        Preview:.#..J,.s..)..>@..8.2I.^.3{-.gn..b..y...^X..M....I..Y...r..Q.[.p..#.Wq....u8.Y).Uj.QaJ.|.+.....S*<O.a+..3.fo..|?|t%.'=k.]D.9O...E{z....Pl..~b.#..Z'M...)=..U7..g..U}.k..._u}x.n......L..d.J...iR.K#[.cG)U>....0.....G.Q.....f.>#.0oH....hS-...}...Y...P....x.....|...s.t....V.w...8E..:..N.V0.k..'..?(.....i..{...l..eM.H...k......O.mx..t.=+-E.....p....7>.../!..F.n].........ev..B=.Q6..3.j...m5.%P.............@.fE.....;=.v....HO.Qx..Ed..Bu.Q..........N.y..J..dD.......d.....]{N;...S.e.t.G..?..(.....=]."i.If........F....?c.......XY....*..|.....!.Vf...A.t.@O".....L.!*..+..]<..9....~.P.!A:)Y..I.@.F.I ........!..D......u..v...6....+G.K1.@u.y.3..l.....C..Ir.9.&.^e.U.......!?......T..i...$.$...@......x$....!x.u..]it"3b.r..1C..'..r..`...G...<..?.=..}.g4.[...........9Y..,.=..c.p.y .F4...=N.XT[.].*4........!(..T..v.'..!......4)j6._......T.6.~.4.v{.....p0....~|.Lb&..#..3[.]o....+@..%....y;...x.xR...._......[['&.jd...Y.....*...y.kL....`..*..v........|.........<8

        C:\ProgramData\Microsoft\Office\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Provisioning\AssetCache\CellularUx\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Provisioning\AssetCache\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Provisioning\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Search\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Search\Data\Applications\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Search\Data\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Search\Data\Temp\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Settings\Accounts\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Settings\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\SmsRouter\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\SmsRouter\MessageStore\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db.rhysida

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:data
        Category:dropped
        Size (bytes):197644
        Entropy (8bit):7.999075914052611
        Encrypted:true
        SSDEEP:3072:y/MPk4AQpTRmHRdP2BADzh5osxutn44S2bqpfyVwZOdsccndhJo8TXW4tDfbGtS6:Rk4AscHPqSVnutn44hCyBsLXjW4tyS3q
        MD5:407E42AEAB4B0F3A6A967C64721A87BD
        SHA1:F9F371086B8B6BFFD61244C6E86CFF6B6EB8A92B
        SHA-256:A638009AA3BD231EBAC984625FFC4F9CF26B4440F1C6A43FFE7C7E663A3C4988
        SHA-512:EBCCDE2FD159C009A3BBAA4798F3491A8A5BC443036958FF55C014761B0DACA67CE4F350E992F13CD77D03A606E02E0A418319BF0E7FE05C78D16EC7AC8C9AA9
        Malicious:true
        Preview:.,.Mb...^_.c.V.7$f...j.L.......EI...s.{.V...4.V>..I......&)#..4^N.|.....h.9..Z.i..$R....9.....U...X..X.}I.2.W{{.....U.#...o3t..<.D.-%.....@\..YE,..&..M../6T..?,.I....DX..%.[..G.H..%..G..#...F..GJ...._(....jv..8..5.A..".....K.....). .....P.o.NT....Gs...b.+.+~....3.m0..F.....X..C.(..8.....s....6]. .......~.9A.W.mTd.6......"._..`.#\......W.7.2H.....e.m.QA.?S....2..Z..@....M...i.....6....."..g.r.F....0..R...W[..~.....m.k....4.a.../A..f.3....~Cp.I..o~..1p^d...m..u+.#..B.....W.%...@....]#+"j .......Q.+..'[#mf..P.j.=...p^j...1L.H}.Y.#.\.t'.q.(J.P.....O?W...O.o.f.....r....a%.....)..t...+.`..-7.......]<r...|Kt~O...|.b.A.d=rSm....9..:#EUK....#.`^.B...]...h.n.>...C.[....U.=n...h..j4..m[!(....Nv.Q.mlo.2C.$"rk.....r.X....g..N.X.>...s...%..``9.?I..J......7....#Z.....N?.P.P..t...5.zo.nU.Z...ZI..-G...].:....Xh...@).L..U.!h.......R.&6.K..^}."wxqr.3..Z8^F.DjY...$<....$.......G.F..Yx..I.c],".."..t5e.>.r.....=..:.t..=3.&.H....;nM......'*.V'f....O.R...F..I

        C:\ProgramData\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.jfm.rhysida

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:data
        Category:dropped
        Size (bytes):17420
        Entropy (8bit):7.989169387245403
        Encrypted:false
        SSDEEP:384:BWYCrX5gaL7RZVujEjGTUzX0f21bxWBFvQwxgXlZwlB7P2A6Dn:BCKa/nVtzy21VMvUX8lNP27Dn
        MD5:4766B74D6889E112E403A3EFCD96E718
        SHA1:DA75453162F51A3ED14BC6D8011D83C6DC796CA5
        SHA-256:7337E38CE10468E26ACCB63CD6D61AD5A1048720F383368158517D3B6D01F114
        SHA-512:BACAB9A8714471ADD4A63C01C4056CD80F5ED4C20B77763277B04249D897C22B0CDC8C6EE91963CEBFC7BA00224BA28219533032A0FC71B28D1D7FED3AE8EF21
        Malicious:false
        Preview:......a]Q.....|wl..g...uj...#@3..e.2...R..J...Y....[G..Y=..+E.[.WF..'....Zc.\t_.4e.....+.-....j..X;...z.?.s...[..?./.Y).(.'7 X..+E..U.Zfv.%...h...!./...nT...g....P.o~..r....g.%.....z..*.;3..^|.~.6.vb.........0.zYg.6_C:k....$.X.2...........%t.X....;.w?....\.Im...D..X.... WY.3{..t...X.......LuM.Rs.\&8u....D....f....h..._..gf8....M......Cz...L.g.... =.b1 R...l.B.....#.A'cQ...._".f...C.2E%...VJ"...D..:......H..%..j..3....)...iB.Y...e.'.)0..A..x.V.Et;.*....(...<Z.B.G.q.:....%KzUl.h....K.$........"...df..5.n,.n....L..q8Db.2.P.@o.8.\....,...(.)t.j.C.4....t*....v.....T. ..h..^..&H..5..-....uG...E..P..X...............%;...t(..!..=.......:......`.j.'k...C.`B.O.....>3.c-..*.c.....@q.T.uM.7.....;".1N..!..P.Txw...8....j.. .I!..z...V...Y..3..t..il.....\..c..#|.x._../.q.9.%8......(O..H..f...%.E.p*......._.....`.hlU[.m/..mPurh9.De.....Pn..8~..g/m..[%#..>q...4M.....e.R,\...\...{...6..7.nOnX.c.|.Y..A...?..Oa....]..b..g........ .Y.C`..2^....T.$U.q...~A.....

        C:\ProgramData\Microsoft\SmsRouter\MessageStore\edb.chk.rhysida

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:data
        Category:dropped
        Size (bytes):9228
        Entropy (8bit):7.980167604333812
        Encrypted:false
        SSDEEP:192:vRMViyPe3EjMuCcjARab8w8iXC1OBscOamB/7Gs5o3mJj+HsJusX+c:pZHcjARAFEOOyVmJjxusXR
        MD5:7C62DC588D37B31E6ACF421C8553DC95
        SHA1:ABB975EA7037DDC6C3ADFEFCB099CB45125420E4
        SHA-256:23722AFBD67F9411045A37AB82126F0E54D78D7D1BC3FFBE31FE749DCE3D949E
        SHA-512:E688592C18862A1B0275C1BE99E6CDAB4FD0021B09BAF7A004A9843FADCEC82C7206CB7C71E50BE4C3842FCFE9860A7992C8736BCAAE1F54E7416ECB85929F34
        Malicious:false
        Preview:_/#.y.3@.i...x.|q....U.q.(.....u.5..5.Py..W..~..@.A....u|~......[..zQ.~..n,`.:D...j..&..7.v......4.w.iU.#.R.....6...(..).&..&.*..sqI.}}6=........i.u9.q.$.vRpY....ju.$...Q..6..F..i....6..@....y....y...P...F.:....s.3.."...n..|....8..{3.;......].-..;..0.[G.cn..........4..V5N.o...DJ%6....$..P.....u.}...4.....#..K.y..Z....o..6.......c.1Z{.g:5....f.04........Af7........,u#.....3B.K.....Q^....pt...........5....'.d..........4...7.M..{!&C.,......B.oWsT...~.:....._.....p$.......]}.>...]5?a)..!.Xc.....f...~.U.A..\(G>..|..Ib]..)-.....bu....Lr"..8j2.FdI^J.r..'S.......t-.q....(e..].TC*\f?3'G..........\.-...Tk'[9..R{..c{r...ZV...u..i.9....p..+rA..n....E..q2...w.m.....E].......~..X..2Y.@....d..i..5...r.4s.....y;...&}.9a.I"..>.7..(....{.4.....J...../....EKEIc......t......2....n.Y?.!O:.C..w/...4...J...D7<@..Kt#.t.6.w...?.?..d......I...W...p.Z.-Av.Ae.bAc......ZVg...._.....J..^.e...g......O..C. .6.).X.Nz.*d.d.PX..W.d..e.q...0.;.t......!.~

        C:\ProgramData\Microsoft\SmsRouter\MessageStore\edb.log.rhysida

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:data
        Category:dropped
        Size (bytes):66572
        Entropy (8bit):7.996889579727939
        Encrypted:true
        SSDEEP:1536:XP3DsBeust1vKzkCSvy6Ii4P4FzXZl/IK2P3u8WXq8EJlUFb:XPgBeuyvKYCSbzd/yPEq8EX6b
        MD5:340F556B796A2CC8B96E6B7FC968D79B
        SHA1:641FCC55D716A9AA4B55DBE55B61F7EFB8B03CE4
        SHA-256:E21B6EF7F3AC295BED06CD9B59C2F6A5DC0F0F8AA6DB6FA857A8F2EF7A73C43A
        SHA-512:26DD7AFBA2062E1D7F1933B056A1C57F6FC09B5323F8CD39618124C04A239B40712086353AFAD441C7DCBD91CAB3FE1781BBD8918513BEF68AF9AD357BC8221F
        Malicious:true
        Preview:l..-5....E||"\....+..j...N....v....ob..(...g..*...LU....<I...N.M..%.2...?./....p...XM.&.}..%o..Ws.Y.Q=K....T.IW....u.W....5Hs.r.k..t..v.S..J,g....-_(7&.!.......0.......m.......zg...-bF|.....z...l..j....n.x6.6.p.... ..H.,[.....)j.Y..>...7W..........lO[.%v*.6>P..m.>.4.o;.-.S....V.]%.eH.<......(..@ .....=...NB/G..:.ON.k(..l+{i"....W..n a.4<!.l..:.4-g~....K.!...Pb..E..6.ly...^..1..... ......L.\z.$.~.(W=K..`......%.."'i[.29.8....V...I%(.=f,.._V......}..#<$....Q....7.+J......"...gty...e6{r....9.].{XF _.-..zk%...Vv..?.&..p...z..Xj.k]..4..>.u+.m.n.SC...>,*.2\....*.dJ7w2.....ZH Q.~......m.a.......}..A\.H9.T.=l...0.....5....R..R.\l."~.F.9...=.K...@M.F...v..<..,..yp...^.../..1.K*........t9.q.O.'r~r.%....DX...%...*..8G..l.......)G...H$H....E...-..Z.B....q.&$....=83d^G2.RVv...<2.0..>...II#..>c.9..h.3...a.]~.Nq.p.0?jj's._Rns0..*j..9'.......A.(..r..M.q.L1..H..W.....X....$../ !e..j..ps*W...j%...Z......v.04.?X!......z.m.;S..0....l$...........U

        C:\ProgramData\Microsoft\SmsRouter\MessageStore\edb00001.log.rhysida

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:data
        Category:dropped
        Size (bytes):66572
        Entropy (8bit):7.997188491977311
        Encrypted:true
        SSDEEP:1536:BkvFEiiQxkIh2vel40xObW84zl2xg9AlHmZ7jQ7E1:BeBAM2veLqS2y9osQ7S
        MD5:5A6CA60F7402C2D65E46F68546D4EE23
        SHA1:CDB7662665DA691CD4DD8082AD308C3E6A7179EF
        SHA-256:232C9F1D8D78937A37F56047BF7EE4B7D15B7BD3714D91D3F496DB66BDBC8D3F
        SHA-512:3C87F4C0F26B677FD89FBE6F7072FD3E9D207F5D539DD83EB605025C31E44DD36863F8A52C1F11372A0003B5AED2D814AB1C4D25ED8E077757A6A18D9EC00A4D
        Malicious:true
        Preview:\$.....Dz^.?.(N.@x......d..M.{.......2..A.a....?l..bG.W.c.....-Ef..N_...HW.K...J..4cc.(...............x|sA.....{F.s>'e.................0..y......L.Q.zdb.<..w_rM.{....Ky.\5...P....,.C...l.....w&...G.u*.q..A....FRA......R!.o.....P.......c.0@.#<.'.0....y~..j.B..;...2.M.}.r.N.>.^..r_...^.l......?......O...W3.3.z.M5....Z...8..<...SK.p..l......_E].r.^{....>.z.Wrw.....Go.....0..D?...dK......K>*..$.[u5..~.zV`+..J<..4..q*..U.`H.sX...8.W..d..55W..).a.y...rq.%.\..tA......s..\.Y.....~r..a..+..b....).....].b.....P..w.V.%I{.M.Z_(..B....m...k..."...v1n1...S}............Qp4.".t.W.Lj...V.Y92.D.:..3...Zw..iv....;(.tv.3....{.....Z...L.Y...8.l.C..F..V.........?'.`.a.....X..H. ......u....+.....X].-UYq..u..zo...#.I...[7.[Nrk.G<.4....^..........?.h.T.#..+......... hg....d.P.@$9.@r.6...3.R.4O...C.]..KX0q.......s.........dmuy@...;.OxDd....nJfV..J|S.b3..[=.W..r.%+... O.m..Z...fL?._.f.p.?...c........PL.5d.@.{.....2.p.sds~A..o.3.....HlH.7P.W$.kY..O....Mu...?....q.._P......W

        C:\ProgramData\Microsoft\SmsRouter\MessageStore\edb00002.log.rhysida

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:data
        Category:dropped
        Size (bytes):66572
        Entropy (8bit):7.997156999898491
        Encrypted:true
        SSDEEP:1536:ftspwuqWomfY28DjnE7GToUgCi8KKkbhQx0AdkMqgWD:70oVzE77bjswhPAyMMD
        MD5:7876A9C9D8CD38793B4A42D825BF33A6
        SHA1:4FE3F610A98CC484B82A9225138C7515CA3FB993
        SHA-256:385A60F835AAC688E980B4A0CF737431E00A439A3A5A25EF52BFB390E686D31C
        SHA-512:167D60BD3FE8E55C88BB4ADA922D8B1A4A3704F7D21479BDB8029A62C6E1B5E2253FEED44CAEC5CD0485764E6E1D2B5A46607E2D3610F99B54E3042100FDD864
        Malicious:true
        Preview:d1r.(...2.<.>@#.l..H.!R.x.^=.....-.... {{.......7.........zF).....j.nD....\..2Y.._[../H....5.....x..v....+..l......X-.V..Ryp....xN<.+..........$l..<..."...5R.......S...!;_.p..dYR@......(.B9.M.t....*....hy&..'fI...<..R.L...R.L..s....1...F...+....C.'@Z.?.C.M......:.I<..Xz.....HD....:....$@o...!&..<]x.a%..z/..~.?.....Q..\..=....>.;\.. .r...$?.Q3g|.".Qe...WS.r.....*wME..Pt..dY...}.9....p.@a..R.Cq[A....O./d.....4.w.7...J.....=..}I..[..N..0.....|......Q...-..i..~..*.-..b....t.7..a.}..VOz.5...e}..)..x..uv{'.J..D.Y.e.E.. 3...&.G.X.xS....u...U....h.....5Z..;...e`V/...Jmx8.M...C.P.s.)........J....p.~.~v....+.&W7.h.}.E..\r/o*.....h...p.....).3.io..d`.O..*..!D.@......<.4.}.A........*%..7+...F.=..%W.....uu.x.{6d.q{.#5.E...7.ru.WUPC..Z.V.......-....d0}.';(..1!.*s......S......J.(.P...E.....A..@.J-..*x...XU~.2.)%.....e6......_D..9y..^.....#Wj*.......;.k..#6..._...i....K|.8....R.......j4..Jo*PL..x..-H..3S......9..L......ah...Y..%E. ...<....X.u..n|....3;.7.

        C:\ProgramData\Microsoft\SmsRouter\MessageStore\edb00003.log.rhysida

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:data
        Category:dropped
        Size (bytes):66572
        Entropy (8bit):7.996793668125057
        Encrypted:true
        SSDEEP:1536:cOxe65gZLq0jGkDfOmt+lvg9nD8EoyVSKIUx:d55gZRGgdt+O94EpHZ
        MD5:F0FD81BB0DC15CA8DCCF8B806BFA901B
        SHA1:B6ABB016BBF808A804578ABCE5A9832673AAE58A
        SHA-256:A9A3C42B906AF94EEC6DB1A9B7850FD87BDAD271E68BD223BE2E5F52C301B0E1
        SHA-512:D5A08B4E0E6B0B6CD8D7E0161F6F991A10D71BE9F4B649E8F957A078B3CE7826896986AB8C0BB5FBC07E5CBFB46ECAD872792EC3045115755533551D1F6CA8EA
        Malicious:true
        Preview:...!.e.z..5!+......\.@..U.e.D..,7u.......1..i(@4..`5...S........1Z..,...60LX$..TS.~}%]."...7_.E.. ......5..M=.{..)..T..S.{ar...J.W."...drm.+.X.+....z..k...p.~.%I.%.X9......./.qe.....u+k.Uc.%[.|8..2.....QW...j..F.u.&8....iQ....+.R.a..ocz......V&.<;.s.6.K..y.......${A.+C"..~T\D.(..I.O..Sm3R..5$.i.`....D,.91..AE....j...$Q........u.}p....x.#..(9Z..c.v.:_....."e...D...>.>..U.Z.C...C.H........B.d...{.Y{.4.x].]H7..b.>1^Y.U.L.qM-=..1.)OF.A6_}.<....-.B.../e .+..>%.o.r.yM3N i.2.....N..`.m../>8..q.:..5.z.Pn.M....x.."...W.>.v..X^.Ea..1.C!......g.....a0......`....k..EN...1G.0.8l.<..V..k....U_..D..M..5E.$.Rly.z..?$..DL.X2..hVK..A...Ci.rl.....Jf.....P.P.B$Ck...../.*...2...{TG..x..H.]d...O..A..T.B".kXu.I.N.hR....b+t]...g...H.x.X.<...k9*.W../n....}R...w..TH....q.U8.so>e..'..T..w.....Q...8L.m..H..Y..l......8.\e...F.....+^4r.M.?.K.p..T.2.T0..s...J...I..|..JT.=...oj...'...A.u..r....U.|.}h@.R5G.j..I{...7i.4..lp_P......L..M.m..@_..s.. ...H74......Kr...a......

        C:\ProgramData\Microsoft\SmsRouter\MessageStore\edbres00001.jrs.rhysida

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:data
        Category:dropped
        Size (bytes):66572
        Entropy (8bit):7.9969211738249095
        Encrypted:true
        SSDEEP:1536:gSlGo/VPsWLskDsOpyxpxv75aaV6in2I3HRM7NAMukegfA:TlJVEWIOhpyJtTsS3H+7O1afA
        MD5:1261360B7A6A76002B3CD0926A5DAAEE
        SHA1:C5E5B77E692DA670BEE3F23D7AF0D3CD1A599B51
        SHA-256:098B00782F23E0F7F96199C38B51E8EDAEE99E3F20D557E1BD1DC1FF88A2952D
        SHA-512:222787B08C5A3458EA2BD77DF0D80D8E6AD69A13F5F2C7025E18870D80CEE7E0F1F1AC055D570DC702ACAB9CDDA127B93D52E852B0D4A429875D7915F157C0BB
        Malicious:true
        Preview:O..c..V.|..1..Z.n.z.}.4J.....s@P_..8.....C...Q.|.j......... .DcA.U....@..._t..h.....d......:[t... 9D....:.i.4f.>.>.)[_.1,...+.YY.v..?.pdl...k...e.2.5.i.J........x......0y6-..x....fj.]!....*-..O..0..S.I....c.E...%...d..&......go........N.l....../.y.......B...iw.-j\~~..}.........$G..M.)Z....w.2R..sj:..@_@Z...../....<9.1.....~UH..H..(.kb..RG...S..Hd9}.!.+..I.B.%.+x.....Y.w.pH.+...{.KPQ..Ky?(:..M..`]..L...t..!..m.H......(2b....V.x....vM'.$+.. .3....;.....u.'.-...z0..|...U.......4. v....u.n3.V.m..6'H..p'~A..3.w.rXk.1..9..c_V/.>U.+.....g..m.hG..T(.DG....%.N.......]....j...A?....#.i.A.....e.h!.>.Q.%.?b>$....TKw.G.A........^i..V.2..9...9k..R+..W.0..GhC.J.:....I..&.x...M.E.=6;%;.....j."...M.....*...y..0}..S..{X`.L.....%..~~...lx..#Y...;s[-...z.H...Jl%....=...4...0............i.........IzQ..?.T..K .....e(@..:....*..R.."...C.m...._.....{/.....c|K.....z...u..S.H..E}jr...m....D.j`.Z.../.Y...O....~.~..n..k$..R]t.7..X.o..N.3...p.....@.....,.E

        C:\ProgramData\Microsoft\SmsRouter\MessageStore\edbres00002.jrs.rhysida

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:data
        Category:dropped
        Size (bytes):66572
        Entropy (8bit):7.997603293960808
        Encrypted:true
        SSDEEP:1536:DilVApHj8BeNwSBpDSRhGuDq832f4KaaQWym9+6bdxOw:DEApqeNNHSpmfpyE+ydxOw
        MD5:1C2AF8D2C603F1AA80B795298661F307
        SHA1:E38D68063673E27E7C9672B542F5B54BE9FEF950
        SHA-256:6D0328D6D491127CBEFE83927E50F76C0CDECE9E33431C402371C5BDB0133174
        SHA-512:8B476E727A66241772CF0AA796AE05035F7C56C1BCB264F3B04BF273D1CDC150C17AEFA69D1DAD014E29E719BCE9799C96D7FF680FB00C485FD3B4BE402141F9
        Malicious:true
        Preview:..)9....O.)t.2..*P.1qn......,..o..m)..$...P..K$..A6....E5r..5"......-....;...n.n...........$-..o'!X..fJ;.a....R'L...~..6.ql.&x`.;.w....cM...o...p.KJ..d.o.......d..^..sCV....3:m.f...7^..d..eG..3..)83. ^A;..*S(.Z..:...ey.U...3..[....F.B\.U.].x...hwJ(.7.7......\r.n..wCu=... .v.6sw...W.....]..........*..nGZ3..'.s.eO%^|,.d.p.YBO.C...!.M..6.t..A...7@..^Q.G.mWM.<..D.Zx.Y.A...i.W..(...@...~)i.>..c.@$...&.....!.`...0...=?%.(.l..$......U.6Qw.K..P..{..E.A...-...r..N..!.HM.o..Z.M...ES$ ...#...[......a..N...^dK.e[.4S,........t,M..{..^.M...a....mW$..[...Z.PF..O|...6{.Mh.,j5."#.S.......'....a...m.X.1'...:.-..+sG......'w...[1...c.oQ.Kd{.{#~_.....K.%).. ...u...D..[...Ma'b.....qe....tM......'.....w.z.QF...k,.Rt....j...7..p......>.0m..1..L.`.[Es.....;SA.....$..Gn.f8<1..x..\L~9D...s.a.T...Cd....0T.\..M.f.Ng.*Vc.8k..P.....'.}.i...&..n...z.X.&..28.5.b.......x3.3..r#I... ....f.=95c[r.'.O..{.6..N.&G.....i..x*......MI.!.Y ..J..0.........plc+T...e..$.......O.2.U.A.|.

        C:\ProgramData\Microsoft\SmsRouter\MessageStore\edbtmp.log.rhysida

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:data
        Category:dropped
        Size (bytes):66572
        Entropy (8bit):7.997588903249972
        Encrypted:true
        SSDEEP:1536://xUQxX3MD6yglRW0zzPetseRRusAenaIxjK4MZa/MQ9IH/tEC:CQdM+yAwqPAVVxjKN2C
        MD5:E3B69A8707DAFC887F4EA2E90742197E
        SHA1:A0DF95A17841BA8BF581AFA8F2124AD468761ECA
        SHA-256:44AE385D49C166E6773AEE586CC74FD1D20352C9DC5782B0FA2067CB36F6B312
        SHA-512:5005C60F1FFDD1648AE2F2BABA9AFBE27DFC819BB3EE0D44B7F8C6030F91460ECD401C96BB47505DCBEAD945FABD68C516964DFBFF9FBDDBDBF5558EB410CEFD
        Malicious:true
        Preview:S!..).B.|.Q)]..Op......7.V1.J.u.a=..c..D...{e..._&..h.?<....T...>g..C.5v{...\F.MF..m..S~..t....,Y#....!v..-..J.....q~l.......}............fr.M.`.{[..Lo......q.2..`..tG...& @.N.....!...o.....U..d.i.S.(.....5.Pu.z...?...$!@...P:...k....."..."..Z.tw.h5~D.....Z.;.+......[.....:...MW....x.z.}.=.M!.....j.c#...\2..-...d.......$.Y......C.....[..@...(.ley{..h...H8...w+..(..F..oi ......?...).;[..<...8..A.y..@....K:.i.).}.....r......B0.'..3..*>uuS:.X.o.B.....)x|P?...?Y.VK.2...f.'q.e;....O..k'.45:..[;?...o.."U2...:..6RT..c....O....>..f......-...W./.-]Q...YWUD..@.hN?...P<..|v....-._Kr.P.a.j....I...v..._ab_...I.NE.....b...o.+*..*...........G#...+..<..l..'.v.G.....K..|Q....\..f...kP...y....6t..}...L.j.oK;8H.WN.\..k.R....".....T..~.V`...'..~G.v.......<......i..*`.....A.l..k....O@}....y....V .6.([....HLq..7>..c.......Y..b{..,..:K..3...{..V.,?..:s...bpf.../.B.9C...dm.T......i..{..{Gp.+v..'....w.U.y.'B......y.`.y.w...1.....N3.M..m.....@..F.'.....".IC]x

        C:\ProgramData\Microsoft\Spectrum\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Speech_OneCore\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Storage Health\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\UEV\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\UEV\InboxTemplates\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\UEV\Scripts\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\UEV\Templates\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\User Account Pictures\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\User Account Pictures\guest.bmp.rhysida

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:data
        Category:dropped
        Size (bytes):603204
        Entropy (8bit):7.9997145838345345
        Encrypted:true
        SSDEEP:12288:VWxiIqaYRRigqR0DU5pRmV6Y2nbXZ8OGYFW7iroLp7WRAUiwJpPt9G2f4rSu:H3aURLqR3mKt8OvF7Wp7WGUBvfDgrb
        MD5:837E24D3BA90DA766B627A0F0C660B94
        SHA1:730022106BF8ADF881362E8286D9A5080AB0511D
        SHA-256:039C3325D29F595A9F6D47097B85186BA24638949998083F42BFF100F8BEE5CB
        SHA-512:4FB4BE136169BD7B49B551E0769C30ACEA533545A539837B51E918622D80FBD7FDD12DD81FFC452C01FDE07FC1E5CF720E998BE1E5204AB418F2BD462967937A
        Malicious:true
        Preview:.4.D.v".`)f..J.:.J.3..'.....nR$...;.l.8.L.E......J....h..&.x.../6..l.r.M............K.R...TC..M...f.Yn........!.....Z.. wk.5.O....V.G@.U..2..W.~..ao....%.Gq.....X...CK...P3.T"...........x.........rI....q.ousR.Z..\..|<.....+b..#ap.Bt.dm..Q...+M...JA..G.x.. }..h.f|v...kG..`.xdcf.p..|.H...u%U5.}.$...v..$._}...m...:71=.TW.j\......X.A%D..@...znP.{.%9.8R..s.L},.o...... >..#.h....@.bJ...R..).*.f....F..'.q.8....L..B.v.gWe.. `......i......q...&......Z.vd...4....4.."}be......W_{D.j.Us[..[.,Mx...O2Gc...w..0Hh.C...r.....>E.+A....O5......7).E.LW..Y!..SC.....BR.l%h.8.j/._.,..c.....A.k..........DK....w...C.5Md....3...N.O..a>.u..^Y.8.\.... ..A...Tb....`#...`..C.i........!.<...._7A2.._.35..R..g........2.x.*z..X..b;..9.x......}z..{.~BI.bh.....Ng....@..S...L`E4..s.............Cm.l....Mq..9.1a&~xo....=&!Q^.vk;..:.^.u..~.J..%..&D.E......j.`......x.....{....Qt..&5. ..M. G.+S.,-...}o...)....g.4.....qp........Q).n4.r..0...u..2"...]|....WK.P..qdr...NW<`.ZI../...

        C:\ProgramData\Microsoft\User Account Pictures\guest.png.rhysida

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:data
        Category:dropped
        Size (bytes):7089
        Entropy (8bit):7.97172371521611
        Encrypted:false
        SSDEEP:192:1rNjldRigsGLVv/kMY9hhi9+aEhjikrDK8D:XjldYqdcb9hhi9Odru8D
        MD5:1B95135D7AFDBC69563F1BBB9F25DD28
        SHA1:6FD22DD564F9E1C4288B452D2AA53AC63BAD3484
        SHA-256:1BD473B30A68A56932D9212C08FF0D8F440323C59ADA1D32699EB8BB13EA6F03
        SHA-512:0BB606EF8F36F5239D03CA981DDD147EA41915B02598BF26D75C4020AF96FF40906C0D6579ED0BA16634A61079443B3D1567AEA009296B49F6D63A7B5A214836
        Malicious:false
        Preview:.>.........39..:u{......T,.s..!.....M.._wp9?.|......(..O......@J..u;3...R..j...q..,....3..0..%.......L=....K..1.........(9.4......o)(.M..V}0..$.v.=..Z.....|..../.M.gM9&...........g.f.q..c...>...f...j...v..(..$.C.`GA-j....".G....?H.!.;....m..!...~.......r.Y|NG..q.f...W..X...JV:.\.....U....K.Ri..}.G..sy.}..\.o&l.@.[.l7k."..[..>.7oW..X...Y.L\.b..*.y..(... .../.g.u#.>...*y>_...;!..1-.rb...w..~o..R..N._SZ("h.=..L4>.n..NV..Z.o.F....F..<.......~...2...wz....z.....u..|..`..R.|..d..{.T`.'U.....]m.<.N)....7H....XFY.43...)..~.......>.^s{.....8+.fF....[3......E{g{...)..a.....TD8.IZ....w..u....:..@..:...GX.@'E...6.".&&!#..Z..Ppz../k...C.+2...".o9M.{|..%.=.....g...b.G.t....:..v...K....d2*.l7....c.r..x...g.>e..:...z.v8.9...j..@...'/?.[.~..3.C..Y..g.o..100W-.G...F.NP.....[?0....p...h(r..=..,1G..V.w@... <Ag<.....4{Ya.'..Y.v.q.v| )fg.....T...D~....~X...s.....r...1?<...-...o..=.IY...".e.1.\..c..(.i..+D)d.{.Q......E.......2f.-K......N].7$*.K+.8.p....hQ/.|

        C:\ProgramData\Microsoft\User Account Pictures\user-192.png.rhysida

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:data
        Category:dropped
        Size (bytes):3428
        Entropy (8bit):7.948183180151853
        Encrypted:false
        SSDEEP:96:1i6mAj/4+JDaP0J0nxQaqWUZcmcoGkUWH:Ag/4+2q+St
        MD5:F10D0F9CA84196FEC22206A845F42A03
        SHA1:8DC4F9B06C03B20A94797B7741B65C79F3D4AB39
        SHA-256:0E519A40348C34E0E7DD75EECA56C6FF190A765F585089D3D6EE8428FB5A069F
        SHA-512:627E9BFDF8F9AFFA785A0BD365C250F2B096AE785716E991A420FDEA19B828B07AFFA8530F6E5F037619590DAE010D7B82067E0342489146EBDB6F4EB1D7C967
        Malicious:false
        Preview:..E.u1.T.8;.....bL.m.:...U...4.x..Ou}.&p0.......*.P..=.tQ..1....%....L..'...I*...nSIS...m..w"...d .k.v..ki}.3V....Y!...T.X....RWD.0..<...q.?..wv...0y.y....O.Sn 4.E!'\..R?.x..9...c\..........pN.......l.b.......~....b=...7}n9..$^..P....Ro..v._+.n.I..4L.X....G....kp..xo.'Y.Z....s..O..*..=.P.i...>."..-P....G..=..^..1....x.Rih.....LYG..r+#4.X.UR.y8.......c.[.d3.c.-.G.`H........v9I.hh....|...L...{.#{%k].r..'..w{bzsh...8...4..!e....:%.-"%10.*.....M..qk,.a...-7..|.....}..8{.Eg.d3.3pr...."t..:{.D,..Y.s-...A..(......FZf...o.#..;b.0....G..[..I.V..........4.....J.b.....14..........*....[.....z.zu...1'..D.$D...L...c.n.oh...a.G..S..x.x.^.d<.._..REG...w^\[....?.....b.V ......n_Y..F...&.m..,Y....Z.!......4n[...ge.-&.w.E#"NJ.>..E...C...\....]...gmUj.K.&....^g....1]..[!>...i......;N&j.........=...l...QW.$.....^..*.2j...%jY. ..'+..s..,.............=;.K...:D./....z2.fX...>...A1oeF.~b.7O,>.PW<$V....r;.......h..qC.cP.J..T."..~e......+..,.T\..l.k..\.I.. [....K

        C:\ProgramData\Microsoft\User Account Pictures\user-32.png.rhysida

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:data
        Category:dropped
        Size (bytes):1477
        Entropy (8bit):7.877552347061077
        Encrypted:false
        SSDEEP:24:9hUzIlo3V94DF8FoRPWHY1XWY9qluICP91up6lXcfM1Qh20hdClKqVotdK:9hUT9tFwPW410u3P9QechhBhdClKqVv
        MD5:80A6C50511930CDC5ED47A6F4B943C16
        SHA1:6D80F583900850652D435FD895D0F82AD52A1D6D
        SHA-256:D0405CA9A3371F5D4F00B38F023D43E2549C4A2D9BD8C0ACE82B2B2F531A0A2B
        SHA-512:1B1E9D106A982CB2C7B07D76F68247174B7BFF187EDA60265077C349DCCEFB7290C875C562AF87DB783572925A03C277464FDC78731EE25D4BDA11044B60DA79
        Malicious:false
        Preview:.yx.~....A..jB.d..4Q.yf...Ku...X....?s...`1.b...J..R......3..$.0.L....H.;...h....7gh...G~..i..Q...F...tZt/......,.....!P..S.L...f${..k...J@.8.&....x?aG...C......|`.........N.b.Gf..*K...;.,.sk..{...7!.jgu....'......-...Z..A....u.~...[z....n.\'......|.tU].iB...Q-`7.n........LO5O..suU...1V..r...n.Hn.[....A.../|^..\..>..e.^.PJ.....1.kE".ys79.n...}...qR9u1{.D.V.!.`.....1.F.w.:.VX.qV^su..EK./.a>....%.......?./>.o.e.k..^..z....5e>.....!.V....g2..$(.`.o..........P.. .,.4.i...S..H....XC.8..\....2..CU.|........B..:..y.l........-.....FKh..v{.)X......_..hZ7.M.....9......Y..i].....x..Qd....I..m1.U.'.S...h...I..g...:.yd.J..y4.V.H...-..EmT.D.....pl.c..........n(...f...?..4..vHs......!o.....3.....ov..}....T...[..........z.{c.%W.*>h.F.N.@.*bG.........l..n..W...$....ptY.0^%.T..cj...O......."........y.....@.PS.;....6...eJ..N...*[..n..P.....[....XG......I...g....!}..*eP\...om 6.(..KR..{.i3......B.. |..a!.:.....ex.K..oUl}.....#.r.....M.[.Z..i....E\T...W

        C:\ProgramData\Microsoft\User Account Pictures\user-40.png.rhysida

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:data
        Category:dropped
        Size (bytes):1561
        Entropy (8bit):7.877790008113483
        Encrypted:false
        SSDEEP:24:B4+IqJL30YME4b8g26loCmRllcon/qdnxyVwpv1x+g+zkTwz7BWhUHp/:B/vFCE4b816lx8V/yIVgvv+p7QCHR
        MD5:85B952F3A44EFA22432168A0A800D0D0
        SHA1:5EC8FEB3269371024F581337B6FEEFF26D8BA358
        SHA-256:72813490BFEDAB1E80162818075C8F7F8B332294734A0471DB3DF4CC16954331
        SHA-512:6F6CF5F96D581FAF8897A73A5FADC30397812A3BC19E010DDDB8DECA95004A7ED8C14E6D5A7BB2EE0169252A86C2A360EDAEF6B22BBEE1CDB561556EF54D63E0
        Malicious:false
        Preview:G...........d......G.a....;...9(.*..Fo4/.^R7.T.(..:..W.j.)....Z...).....Cb....H.;.t...4mZ..g.'v"f..?=.L...v.pm.r.K/...e......".r.x.....v?..-..3I..1.d..]dL.)....9)_.._..@..Y.H......c...'......5...4....q.~......x..!...Y_S..|m...l.b.{.#L+...1...ki.C......k..Ug...$.qk..>$.Yh...x.2...xPO7.hCV.3Kh5...q..0:..D....}X..p.nx.1..3>..2v.sU.w.. i.A.b..4>.W...;&P l......\P.;.c...."..+L..1.Q...aF...[..K6.@X......4.:]..4]#...i\..,=w3.-^.|?.pl.%~....4....fE.ex.t...L0g...9]..]B=..jc~{..u...".('e.aq}q..t.N..xc.....-....P................p.S....Mx....m.-&>..=.a'.M)..Q.S3..z..e..FP.K@...h{.9...{.....9$N..Z..q0....H~.b....e(...Z...|.[.dY,.&..7. Y.....44..FT{'..Mgn...S.;...'.......=.......hF.4....!.R.n.....?N{1...8.f.........y....s].4../..S.......d?."2|k...~v.+......Q.....i.Z.:..1.|!U=..+I.......Y......#>|. .*..s.......5.9.o.>X...-..+Z.^.F...]..q....bDE.O..VY...._ts..7..m...r.&...-..u.1HL.\.....zGz..C...tQ.....$sn}G.......G..H. ...v.-.V.*.r.Uc.w..K.Q%.

        C:\ProgramData\Microsoft\User Account Pictures\user-48.png.rhysida

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:data
        Category:dropped
        Size (bytes):1653
        Entropy (8bit):7.882011092788665
        Encrypted:false
        SSDEEP:48:TGXam9ILrbp3irW2KYg9OQyGtN++RaBDVdHGbeRem88K:Q1yrhtY9Q/L++CzdnK
        MD5:BC9EBA492F72609EA2615DC49D230BF4
        SHA1:093C51C351034F710F4AD4AFEE4162CFDCF7949C
        SHA-256:139156B8F2053CB475FE0CF2C3A00E3E3341984560CC7F99A268DDDDDE7BCF9A
        SHA-512:7AAFDD934FDB682097F62BBDD3E2606EC9533664014E350AD81FF7C3C00456A3FABF206A85E1D87FD0E109EB67C564F777EC96B54E992B506769DD56169B1F90
        Malicious:false
        Preview:J.q...E...f..../p...H..{/.Z7f%...X.....C...:... .......mh_.....K.Nb.3..@$3.?.jZp..BO[...........cM@...FGr.3.yk.. ..(.R ......~=..f...x.Z,.Q.\xo7....4...Hi.{J8..vB..G...8n)Z+:Ax..._....ORP.l.........X.ze...]...s.T..].%.a4...Z.....`......Ub.=Ti....bJ..|..s...........EKe.....D.q......J?.~....2..O....&.KD.......6.W.Qk...O.....j..:......W..0..|.}...Pv.[P..2K._....G...tv.-).5....V....b@_#......M...j$ ..........R...|...n.6z...(X.]c...)m.Ce6.El..:[=.@.4..L...IT..l.b.&.Q.........[......D...2}..l...#...cB.._K'.1.ZZC....H@.=.`T...]......m..I9..r/.5K.....C...=@.m.q...p.K<Q...:R:....I..T..l`....._/.}..O7hg......:.9.......hq..D.+...at.~!...0.`...qx.W+{+...r^..+`......u...^...2..5..U.3...f.kNS.h.....i...=M..}..'.....+Z.....G.r. l?.5..m..H.w...-d......&.>.\..;1.u..&Uo........i....p.n......|ba.x..Pj:1..krh...v..O.>...Z.*.).@0q......C-..#...{...D.y..e..z+......9p.N.GHA.N..#.......w...w._..q.c.L.`.S...,J.W.K.U..3..Ye...t......^.\..U9..?.UK..M....l.9.~.....&

        C:\ProgramData\Microsoft\User Account Pictures\user.bmp.rhysida

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:data
        Category:dropped
        Size (bytes):603204
        Entropy (8bit):7.999696986940129
        Encrypted:true
        SSDEEP:12288:ePW4hstA9H8mSTROVPi+3HdYViKCraATV3BrEEoM8vm0I:R4hmA9HoYVddYwKCuATV3ddgS
        MD5:A208ED79E2CDB1DF4B040FC07260007E
        SHA1:CCE9176542FF2CB863852C97787CFB12DF4D9C35
        SHA-256:40F75DAC2C71193F5EE919344F6F111A2C4E6344F3DDDF5B404B5B9676184EDB
        SHA-512:EE75CFDA50800DD32C1EC7032019115B272913AB3949C8BBDF943A9913092E6E6D71A0A907E168F317711A42DA6CDA97CCECCF76A2E88FD3C7393B1362FD596F
        Malicious:true
        Preview:.o.2..o.".&..Q..1.2m.....{\Dh......%...........(..6:F}5...r0t.M.|D.....a.xn;A../....f.B;{Ea....2...RX.."X.DiQ.............gA..1.'..S....f........T/.ZU`.a.....B....f8..J2..jM.VN....1...Q.&...o@#.+|-@..]...._B~)...._.w........5..t>TW..~.4f`F.D........u`z...v....K..-=..Ib.@.....4.D.....)r....J\._.x..;..%=.#...'}5.}.{.V.!...fa....o]....{...y{..h.Z./....g.:..V.X....a ........@(.........f...=.(..9.;:.y...H.?2R.4..Y.......N..)x5pA..^...}..r..d^.r?r....i.h.2....`.@+$.nM.j.U..........L....RW...+..#G..."9.V..6%4.l...~G...&'n.... v.....(...z.....J`..|$.X..*....5......*.l..4..T...US..6..E9...9J.d..[Kk....<......u..&.n....\bU.v.......g.z.'...'.S..F:...x.zP^.._.......+..}.=.".r.......Nh....Ei{.!f.w.C......r(V...*K.R0.z-z.hM.2.9.Wf.4.W=]..7D...1..L#....y2.(v.(G...~m........$..u..\....`.#8..ps.q..\.w_.[a..O<..0..!......5.U.>m@..?.5..d.H@.V......Q.o.9..8..gq...'V.Y..sr.1.`d....ZzQ...pH..i...T.l....kv.....:,<...;..jo...0A..4NQ...W..3UJ....;..!.g..

        C:\ProgramData\Microsoft\User Account Pictures\user.png.rhysida

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:data
        Category:dropped
        Size (bytes):7089
        Entropy (8bit):7.970263698362197
        Encrypted:false
        SSDEEP:192:tiIDbrhF8ryJlOTKRXwh8Y8mYITcgiO01T9:t73eqOGRwo3Sd01R
        MD5:C8D3A729768E2ED3CA483100E558B1A1
        SHA1:053BD73A78AFA0AC0AFD08F44E924010468831B1
        SHA-256:C7E18287E107E1656B74505BB505DE9FE63B5C8BC74DC746FBFAEA144C329FFB
        SHA-512:3CA5AAA4A89F0C43A7A268008FF868F3E4DA6B31397DF3C98DE944BB8317D6FED1F461B124430DE39192D0AB7EA9B90F2BBD46A4D725876595CAA844E9F187AF
        Malicious:false
        Preview:v.,...a_\jn........#....%F.*.{.....0.B.....l.-..`...y..(.<...1N...n.X..i@Q=.......e.`.....z.f.....S..1..7l.u..X.w...;r>.....&.0.6.PN%..=..]Klp6..8Q.U...>k...~gq+.6....i..#Y..j7..7e;.\....k...f...9..e.F...XaR...."Ue$^FD.n..t...j)fl./..iAL.2z.0...Ta.....&E..v.8"j.\x.{7l|h..n...j...#.V.....=k9A.y..W".D...#....R..+\!.V..g.<.W..H.m..K.....y<.[.n......@.6..Z#Zo<.Gb......S.}.e..z...<R.O..G...a..X.D.....|.3:.y....Bi.!.-........j..HJa.CK8.....H....CK.@/kM..........x?.......m..-#+.fBw.Aj.. ...9.`..o"1qj.d...g.%i...V...$..|..}:Dd_.a>5.>..2.^......`.81o.l..3q........#...:.w....V(6..f.97+.]..6(......a...._j.R..]......AlAe..V..+.KYZ...rh.t..^d.}>....d.Q.]j.B.NC...qA..VG......_......1.\..a.m.;.....C.\.h3......9^.h...\..H2Q........C...x..c..s.@U..........l...2..~.z.p.R.........T....l.|..5.......[k...u......%WT...]..K......v.3..i.XR..o...^C.:..].Lb<..[..&.9.2.6.....*.........y>%..HOq{.K.i..7N.v#6.L.u...,....wj...s4......Jo\.Y.ah...x.o...M..f...iJ...Z..J

        C:\ProgramData\Microsoft\Vault\AC658CB4-9126-49BD-B877-31EEDAB3F204\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Vault\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\WDF\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\WinMSIPC\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\WinMSIPC\Server\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Clean Store\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\DLPCache\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\DLPCache\FileEvidence\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\DLPCache\NetworkFilesMappingStubs\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Definition Updates\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Default\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Definition Updates\NisBackup\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Updates\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Features\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\LocalCopy\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Network Inspection System\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Network Inspection System\Support\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\af-ZA\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\am-ET\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ar-SA\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\as-IN\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\bg-BG\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\bn-IN\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ca-ES\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\cs-CZ\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\cy-GB\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\da-DK\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\de-DE\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\el-GR\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\en-GB\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\en-US\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\es-ES\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\es-MX\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\et-EE\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\eu-ES\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\fa-IR\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\fi-FI\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\fil-PH\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\fr-CA\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\fr-FR\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ga-IE\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\gd-GB\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\gl-ES\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\gu-IN\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\he-IL\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\hi-IN\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\hr-HR\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\hu-HU\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\id-ID\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\is-IS\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\it-IT\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ja-JP\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ka-GE\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\kk-KZ\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\km-KH\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\kn-IN\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ko-KR\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\kok-IN\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\lb-LU\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\lo-LA\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\lt-LT\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\lv-LV\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mi-NZ\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mk-MK\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ml-IN\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mr-IN\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ms-MY\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mt-MT\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\nb-NO\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ne-NP\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\nl-NL\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\nn-NO\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\or-IN\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\pa-IN\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\pl-PL\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\pt-BR\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\pt-PT\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\quz-PE\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ro-RO\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ru-RU\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\sk-SK\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\sl-SI\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\sq-AL\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\sv-SE\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ta-IN\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\te-IN\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\th-TH\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\tr-TR\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\tt-RU\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ug-CN\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\uk-UA\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ur-PK\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\vi-VN\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\zh-CN\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\zh-TW\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\af-ZA\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\am-ET\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ar-SA\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\as-IN\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\bg-BG\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\bn-IN\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ca-ES\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\cs-CZ\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\cy-GB\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\da-DK\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\de-DE\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\el-GR\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\en-GB\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\en-US\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\es-ES\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\es-MX\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\et-EE\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\eu-ES\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\fa-IR\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\fi-FI\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\fil-PH\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\fr-CA\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\fr-FR\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ga-IE\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\gd-GB\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\gl-ES\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\gu-IN\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\he-IL\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\hi-IN\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\hr-HR\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\hu-HU\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\id-ID\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\is-IS\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\it-IT\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ja-JP\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ka-GE\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\kk-KZ\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\km-KH\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\lv-LV\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\mk-MK\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ml-IN\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:modified
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Platform\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Quarantine\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Scans\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Scans\History\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Scans\RtSigs\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Snapshots\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Defender\Support\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows NT\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows NT\MSFax\ActivityLog\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows NT\MSFax\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows NT\MSFax\Inbox\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows NT\MSFax\Queue\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows NT\MSFax\SentItems\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows NT\MSFax\VirtualInbox\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows NT\MSScan\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Security Health\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows Security Health\Logs\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows\Start Menu\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Extras\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Tools\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\Windows\Templates\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Microsoft\WwanSvc\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Package Cache\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Packages\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Packages\Microsoft.Getstarted_8wekyb3d8bbwe\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\Packages\Microsoft.SkypeApp_kzf8qxf38zg5c\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\SoftwareDistribution\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\USOShared\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\USOShared\Logs\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\USOShared\Logs\User\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\WindowsHolographicDevices\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\WindowsHolographicDevices\SpatialStore\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\_curlrc.rhysida

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:DOS executable (COM)
        Category:dropped
        Size (bytes):1044
        Entropy (8bit):7.772631567699774
        Encrypted:false
        SSDEEP:24:mYKpR0edR6O56nujPImDGDkkkMqxrIPPFmRPlk21ZG:4p2edHpjP5gktAqlvi
        MD5:9558EF3B9D7ED014AF19E9EFE6805F68
        SHA1:A8DAE77492B44135E2A61EABAE511F238725A5B6
        SHA-256:18E4085E94C7B121095B603FB9BA912F009FD9E812E680D63019B6842AFE2A11
        SHA-512:7D7971B5931823392EF27577B734A5498469C2EB4D787A5B0A1006F55DDABD07CF16ED83F3263A1DC0615ABEA332016AC07C4DCEBA4550C89A75C1DEF8D72B7E
        Malicious:false
        Preview:.5.......L....K....p.....q....8....}...C..u..a.....s...\.;.RK.-.-yN...k.f..............U.........G..vB..Z...'...H.|=.C7...M........B.$+[.*qa..;..]..^..Gs)..<...M.4..G|..x...[......QQ..G.-A.pa...N..Jx|....{..!._U..-.1[.#&P.@..fK..y......I.~..D..?.d..D..Is8l..~K.H..V)*X..+...0...O....o..".giy..F1.h,.<6m..].l......d.vQ1..Ef&.G..*..../.:..v..........X.....).......xg\wF*|..2.H.7\.m....m...yQ@@...e..Y>.L..[W.A.D5..O L<. .H..i..E.....r..<......'aI.)..YO.S$.LU.I....O{...D.4...@.._g. o.....h.7_.G........a.G.!.lL.........h.?...X.KP..A.....{.....C.....C..K.%..S.o..[f..............$.n#.......w..r."..Rya./..n.J]..D..C....d.......%..KJ..1..<P;.'0..v.b.~|..n)..%b...A.9...6..O/5X.<E.B...X.G.._..0FDGf.N..._GO.......).?O...l..._..W*...g..r..%[F[+.D=.....~.?/.."..4me.N..w.....D#'.:.s..P...8p..-T..PZ....XN(..a.1.-<n'.j'B.|&.x..A.L....)_.s..*..^...z..G0'.-....z..(...w.:@......V...@.K....A\u.].....7..LN.!.-!...C:..."d..o....,.],....=7L.. .......+5mp.

        C:\ProgramData\dbg\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\regid.1991-06.com.microsoft\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\ProgramData\ssh\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\Users\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\Users\Public\Desktop\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\Users\Public\Documents\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\Users\Public\Music\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\Users\Public\Pictures\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\Users\Public\Videos\CriticalBreachDetected.pdf

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:PDF document, version 1.5
        Category:dropped
        Size (bytes):35839
        Entropy (8bit):7.992139084048633
        Encrypted:true
        SSDEEP:768:pIMJAOZaHxw8S50XzrnDSW775BSp/PXV5+5IDIZTvkeLiUM8H:RybS5EPh7gt5DqT8eHh
        MD5:1D46AD90F66560050686F1DDA381A6AF
        SHA1:399E868C010A0453FD19C39AB7DDBD0294258CA9
        SHA-256:D16FFFE21E66AE6B976C4EA7C8FCD37CA7B624961430144117EAA989E02FCED1
        SHA-512:96AF5ADECD5AEA2A38272C47FA4C256AD0E8986A7BAB34E9B132610DB8C90005D65984DCB7E93D24366C91C3F23442F623340DD14D4EBA3DE1FB0D7A737C9E6F
        Malicious:true
        Preview:%PDF-1.5.%.....5 0 obj.<<./Length 1574 ./Filter /FlateDecode.>>.stream.x.uWKs.6...W.Vj.fI....$...3...."!.1I(..X........'.....o.]]...5+Wm.V.Z.nW9.i]5...S...m..7..(.:1./9....[.&..H....:O..I.%c%...G.+.$m?H{X_.I=.E.mV.N.w.n....:m9.g..0.... &|.nxr..4.k8..rov..*...^.p.v.,.fu............A.G..#....,..i..f...o.8...6....U.H......3........e'..(g-.]..V.Y8.'..%{aq./.ee.Rhqu\..z6...r. .$;m.....E..{...0..2.._..l F=}....m.'F.m..U.y.XG.q..R@h.L"..-.vz...O.{........N...xppF, .....o...$}..{..K......M..Y.....$.....&1bThB..dIH~..!.V............\....V..W.........[P<.A.{ .....t.<-....>......LpB.........R#.;..t....D..........15..=].&.@.J.9r..U..m.K`7.8?..'F.f.#.9.......G..<.b'.3J.D)o...y...}A7.$..:...H..: ..r{.?.....xzJ_*...i.B..S.@'.%E..Jm.>.7....}.'.m......NQ..g...a8..^Z..B.....FZH.$...........;U...LY#M3..e.......d......|-..M7...g.......p....Z..^2;..&o.l.....{ ._..d.H.W..\-p.w...A.4}..........,9a.....^.5..8....g.....o/yP4m.T!.f..mg....J.#....7#gn.*\.`TUn.....~..W

        C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

        Download File
        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        File Type:data
        Category:dropped
        Size (bytes):64
        Entropy (8bit):1.1940658735648508
        Encrypted:false
        SSDEEP:3:Nlllul774/lL:NllUwt
        MD5:3BD40D4BDD7802424FE8F2DC2A41C196
        SHA1:88F355EA9D58C5A00B2EBB0DC3127C0C13052631
        SHA-256:FCF55501F03C9B5E24796B8FE3656143E97D7A5FD0300387C1960C226C74076A
        SHA-512:67734D54D327379C259DB7E0576BE2A4B597CB2F0B9E881AA1FC2B55F375BB5862122579B0B5EC7DED7A7875C2AC7668033355772CBB8311A8A86924153D59B2
        Malicious:false
        Preview:@...e................................................@..........

        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1gkj5h5u.wrr.psm1

        Download File
        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        File Type:ASCII text, with no line terminators
        Category:dropped
        Size (bytes):60
        Entropy (8bit):4.038920595031593
        Encrypted:false
        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
        MD5:D17FE0A3F47BE24A6453E9EF58C94641
        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
        Malicious:false
        Preview:# PowerShell test file to determine AppLocker lockdown mode

        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4mobtwgc.eow.ps1

        Download File
        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        File Type:ASCII text, with no line terminators
        Category:dropped
        Size (bytes):60
        Entropy (8bit):4.038920595031593
        Encrypted:false
        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
        MD5:D17FE0A3F47BE24A6453E9EF58C94641
        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
        Malicious:false
        Preview:# PowerShell test file to determine AppLocker lockdown mode

        \Device\ConDrv

        Download File
        Process:C:\Users\user\Desktop\JIar3KCVf6.exe
        File Type:ASCII text, with very long lines (551), with CRLF line terminators
        Category:dropped
        Size (bytes):12009594
        Entropy (8bit):4.923102559377395
        Encrypted:false
        SSDEEP:12288:X6Qm28Ux8Qn+5HnArEa8wNDwwQhmEs4ZQFXi:X6Qm28Ux8Qn+5HnAX8wNDdQhmEhZQFXi
        MD5:EE7F8488EAC7D20653591EACEF2619D4
        SHA1:21D6D6DFA0DC51623B2E88F6F4B9D151565A0B90
        SHA-256:045BC2F6CC91C65CBF490AFDE9161392EF7C359B277758DC0FAA945AA63F1D28
        SHA-512:4DA444BB4F4EC6B2AFE006B2D0F7CCD6449E602DFC4BA2D3ED9D2EB56ABBFAF162E4AE4FAD478F56B57C655216E8E6A139180820CDF061958554DEEA71D15A5B
        Malicious:true
        Yara Hits:
        • Rule: JoeSecurity_rhysida, Description: Yara detected Rhysida Ransomware, Source: \Device\ConDrv, Author: Joe Security
        Preview:Number of procs 4..Program: C:\Users\user\Desktop\JIar3KCVf6.exe..Directory: ..Start processing A:/..---..Start processing B:/..---..Directory C:/ entries 14..Start processing C:/..---..Current dir entry $Recycle.Bin..Current dir entry $WinREAgent..Directory C:/$WinREAgent entries 1..Current dir entry Scratch..Directory C:/$WinREAgent/Scratch entries 0..Current dir entry Documents and Settings..Current dir entry DumpStack.log.tmp..Current dir entry pagefile.sys..Current dir entry PerfLogs..Current dir entry Program Files..Current dir entry Program Files (x86)..Current dir entry ProgramData..Current dir entry Recovery..Current dir entry swapfile.sys..Current dir entry System Volume Information..Current dir entry Users..Directory C:/Users entries 6..Current dir entry All Users..ERROR rename file C:/DumpStack.log.tmp to C:/DumpStack.log.tmp.rhysida -1..Directory C:/Users/All Users entries 20..Current dir entry .curlrc..Current dir entry Adobe..Directory C:/Users/All Users/Adobe entrie

        Static File Info

        General

        File type:PE32+ executable (console) x86-64, for MS Windows
        Entropy (8bit):6.196268711864384
        TrID:
        • Win64 Executable Console (202006/5) 92.65%
        • Win64 Executable (generic) (12005/4) 5.51%
        • Generic Win/DOS Executable (2004/3) 0.92%
        • DOS Executable Generic (2002/1) 0.92%
        • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
        File name:JIar3KCVf6.exe
        File size:1'261'752 bytes
        MD5:54416fc42afa9b09ea7e8d8e318f4891
        SHA1:8c924431049191e763a14503517a9583f070fdeb
        SHA256:9097ab2b2b71f3ea0cf8c9271224b6227e9aa2545ae23d4621f122bdb99c77b8
        SHA512:1ce45889054522a9277ebbd012f20dfe4039feafe5e25a0c9c5293dce867aa06e5550606191a8ce876a6307ffbdba3af41013f1c546cf3c4560827b99a98873a
        SSDEEP:24576:RtP7hdO1s6Ekgcec1SgnyN9HPFCCNhQI6GOfaFVIVrYwcMavDiZn3m75/J7:XLO18kgcec0gnyN9HPFCCNSI6GOfaFVp
        TLSH:1A458E84F742FCFDD59A42B406D7131793BAF480A719FB272650FE38091AB906EA3B15
        File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...F.bd..........'...........................@.............................. ............`... ............................

        File Icon

        Icon Hash:00928e8e8686b000

        Static PE Info

        General

        Entrypoint:0x401500
        Entrypoint Section:.text
        Digitally signed:false
        Imagebase:0x400000
        Subsystem:windows cui
        Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LARGE_ADDRESS_AWARE
        DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
        Time Stamp:0x6462C046 [Mon May 15 23:29:10 2023 UTC]
        TLS Callbacks:0x447fd0
        CLR (.Net) Version:
        OS Version Major:4
        OS Version Minor:0
        File Version Major:4
        File Version Minor:0
        Subsystem Version Major:4
        Subsystem Version Minor:0
        Import Hash:3681f41e2f8bca6149144439ef4fa098

        Entrypoint Preview

        Instruction
        dec eax
        sub esp, 28h
        dec eax
        mov eax, dword ptr [000621C5h]
        mov dword ptr [eax], 00000000h
        call 00007F255501AE1Fh
        call 00007F2554FD420Ah
        nop
        nop
        dec eax
        add esp, 28h
        ret
        nop
        nop
        nop
        nop
        nop
        nop
        nop
        nop
        nop
        nop
        nop
        nop
        nop
        nop
        push ebp
        dec eax
        mov ebp, esp
        dec eax
        lea ecx, dword ptr [00000015h]
        pop ebp
        jmp 00007F255501ACE4h
        nop dword ptr [eax+eax+00h]
        nop word ptr [eax+eax+00000000h]
        push ebp
        dec eax
        mov ebp, esp
        pop ebp
        ret
        nop
        nop
        nop
        nop
        nop
        nop
        nop
        nop
        nop
        nop
        push ebp
        dec eax
        mov ebp, esp
        dec eax
        mov dword ptr [ebp+10h], ecx
        dec eax
        mov eax, dword ptr [ebp+10h]
        mov edx, dword ptr [eax+08h]
        dec eax
        mov eax, dword ptr [ebp+10h]
        mov eax, dword ptr [eax+0Ch]
        cmp edx, eax
        jl 00007F2554FD4579h
        mov eax, 00000000h
        jmp 00007F2554FD4592h
        dec eax
        mov eax, dword ptr [ebp+10h]
        dec esp
        mov eax, dword ptr [eax]
        dec eax
        mov eax, dword ptr [ebp+10h]
        mov eax, dword ptr [eax+08h]
        lea ecx, dword ptr [eax+01h]
        dec eax
        mov edx, dword ptr [ebp+10h]
        mov dword ptr [edx+08h], ecx
        dec eax
        cwde
        dec esp
        add eax, eax
        movzx eax, byte ptr [eax]
        pop ebp
        ret
        push ebp
        dec eax
        mov ebp, esp
        dec eax
        mov dword ptr [ebp+10h], ecx
        dec eax
        mov eax, dword ptr [ebp+10h]
        mov edx, dword ptr [eax+08h]
        dec eax
        mov eax, dword ptr [ebp+10h]
        mov eax, dword ptr [eax+0Ch]
        cmp edx, eax
        jl 00007F2554FD4579h
        mov eax, 00000000h
        jmp 00007F2554FD4588h
        dec eax
        mov eax, dword ptr [ebp+10h]

        Data Directories

        NameVirtual AddressVirtual Size Is in Section
        IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
        IMAGE_DIRECTORY_ENTRY_IMPORT0x750000x1394.idata
        IMAGE_DIRECTORY_ENTRY_RESOURCE0x00x0
        IMAGE_DIRECTORY_ENTRY_EXCEPTION0x660000x2310.pdata
        IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
        IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
        IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
        IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
        IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
        IMAGE_DIRECTORY_ENTRY_TLS0x780200x28.tls
        IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
        IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
        IMAGE_DIRECTORY_ENTRY_IAT0x00x0
        IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
        IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
        IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

        Sections

        NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
        .text0x10000x4a6880x4a800417fbb093bb32db018c08107c49fe5d1False0.4711586356963087data6.371690598245521IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
        .data0x4c0000x9b000x9c00b9c9c60ce74393e3d8f9e630584f4c50False0.9690004006410257dBase III DBT, version number 0, next free block index 10, 1st item "\322:\327\373y\242\303x\233\024\023"7.9457274363081245IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
        .rdata0x560000xf6f00xf800d01264c654202109e59424c3761067b7False0.2981823336693548data5.773235321220095IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
        .pdata0x660000x23100x24007dfddf5f2821319113a1e90598fe8a09False0.4753689236111111data5.5680817572012415IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
        .xdata0x690000x22580x240008aeb1c6e39513a702f32c5415cf25f5False0.18153211805555555data4.277841357557861IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
        .bss0x6c0000x84080x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
        .idata0x750000x13940x1400c1402eb246c1ca699fa6b05d9bcb8eafFalse0.265234375data4.021542255043253IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
        .CRT0x770000x700x2006713fcf80becff8104815af49d36817aFalse0.080078125data0.3349738039007212IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
        .tls0x780000x680x200305633068d687db166328320b3735decFalse0.0625data0.2108262677871819IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
        /40x790000x9400xa000438b5214e3433de586ca1aada6bd494False0.2203125data1.8429038289929374IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
        /190x7a0000x7f19d0x7f200c1c270ea5a9f8bee3ff66d36607f05feFalse0.3122810656342183data6.0325528895459595IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
        /310xfa0000x54930x5600f705bbbbaeafb72979aff70159cd9db3False0.16501635174418605data4.639885742896004IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
        /450x1000000x93bb0x9400c9c5b0e52fbe19116d6ec306898e5d77False0.42031777871621623data5.896610752886389IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
        /570x10a0000x54c00x56008f267feb3468a72cf0378111e75af716False0.2551780523255814data4.43422960996741IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
        /700x1100000x19000x1a00381f051f800a658d737f81931f1506c7False0.34119591346153844data4.629381144337958IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
        /810x1120000xd87a0xda008eb3ece02c83e497a57307f44912559eFalse0.20979071100917432data2.519698275331675IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
        /920x1200000x13200x1400728bb5abf4b6685dc46557e7ca624299False0.208984375data1.6698167570464377IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

        Imports

        DLLImport
        KERNEL32.DLLAddVectoredExceptionHandler, CloseHandle, CreateEventA, CreateSemaphoreA, DeleteCriticalSection, DuplicateHandle, EnterCriticalSection, GetCurrentProcess, GetCurrentProcessId, GetCurrentThread, GetCurrentThreadId, GetFileAttributesA, GetHandleInformation, GetLastError, GetModuleFileNameW, GetProcessAffinityMask, GetStartupInfoA, GetSystemInfo, GetSystemTimeAsFileTime, GetThreadContext, GetThreadPriority, GetTickCount, InitializeCriticalSection, IsDebuggerPresent, LeaveCriticalSection, OutputDebugStringA, QueryPerformanceCounter, RaiseException, ReleaseSemaphore, RemoveVectoredExceptionHandler, ResetEvent, ResumeThread, RtlAddFunctionTable, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, SetEvent, SetLastError, SetProcessAffinityMask, SetThreadContext, SetThreadPriority, SetUnhandledExceptionFilter, Sleep, SuspendThread, TerminateProcess, TlsAlloc, TlsGetValue, TlsSetValue, TryEnterCriticalSection, UnhandledExceptionFilter, VirtualProtect, VirtualQuery, WaitForMultipleObjects, WaitForSingleObject
        ADVAPI32.dllCryptAcquireContextA, CryptGenRandom
        msvcrt.dll__C_specific_handler, __dllonexit, __doserrno, __getmainargs, __initenv, __iob_func, __lconv_init, __pioinfo, __set_app_type, __setusermatherr, _acmdln, _amsg_exit, _beginthreadex, _cexit, _endthreadex, _errno, _exit, _filelengthi64, _fileno, _findclose, _findfirst64, _fmode, _fullpath, _initterm, _lock, _lseeki64, _onexit, _setjmp, _stat64, _ultoa, _unlock, _write, abort, acos, calloc, exit, fclose, fflush, fgetpos, fopen, fprintf, fread, free, frexp, fseek, fsetpos, ftell, fwprintf, fwrite, malloc, memcmp, memcpy, memmove, memset, printf, puts, raise, rand, realloc, rename, signal, sprintf, srand, strcat, strcmp, strcpy, strerror, strlen, strncmp, strncpy, system, vfprintf, wcscpy, _time64, _snwprintf, _findnext64, longjmp, _strdup, _getcwd, _chdir
        USER32.dllMessageBoxW

        Network Behavior

        UDP Packets

        TimestampSource PortDest PortSource IPDest IP
        Oct 2, 2024 18:10:23.732414961 CEST5356460162.159.36.2192.168.2.6
        Oct 2, 2024 18:10:24.259583950 CEST53564271.1.1.1192.168.2.6

        Statistics

        CPU Usage

        Click to jump to process

        Memory Usage

        Click to jump to process

        High Level Behavior Distribution

        Click to dive into process behavior distribution

        Behavior

        Click to jump to process

        System Behavior

        General

        Target ID:0
        Start time:12:09:36
        Start date:02/10/2024
        Path:C:\Users\user\Desktop\JIar3KCVf6.exe
        Wow64 process (32bit):false
        Commandline:"C:\Users\user\Desktop\JIar3KCVf6.exe"
        Imagebase:0x400000
        File size:1'261'752 bytes
        MD5 hash:54416FC42AFA9B09EA7E8D8E318F4891
        Has elevated privileges:true
        Has administrator privileges:true
        Programmed in:C, C++ or other language
        Reputation:low
        Has exited:true

        General

        Target ID:2
        Start time:12:09:36
        Start date:02/10/2024
        Path:C:\Windows\System32\conhost.exe
        Wow64 process (32bit):false
        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        Imagebase:0x7ff66e660000
        File size:862'208 bytes
        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
        Has elevated privileges:true
        Has administrator privileges:true
        Programmed in:C, C++ or other language
        Reputation:high
        Has exited:true

        General

        Target ID:10
        Start time:12:12:58
        Start date:02/10/2024
        Path:C:\Windows\System32\cmd.exe
        Wow64 process (32bit):false
        Commandline:C:\Windows\system32\cmd.exe /c cmd.exe /c reg delete "HKCU\Conttol Panel\Desktop" /v Wallpaper /f
        Imagebase:0x7ff708e20000
        File size:289'792 bytes
        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
        Has elevated privileges:true
        Has administrator privileges:true
        Programmed in:C, C++ or other language
        Reputation:high
        Has exited:true

        General

        Target ID:11
        Start time:12:12:58
        Start date:02/10/2024
        Path:C:\Windows\System32\cmd.exe
        Wow64 process (32bit):false
        Commandline:cmd.exe /c reg delete "HKCU\Conttol Panel\Desktop" /v Wallpaper /f
        Imagebase:0x7ff708e20000
        File size:289'792 bytes
        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
        Has elevated privileges:true
        Has administrator privileges:true
        Programmed in:C, C++ or other language
        Reputation:high
        Has exited:true

        General

        Target ID:12
        Start time:12:12:58
        Start date:02/10/2024
        Path:C:\Windows\System32\reg.exe
        Wow64 process (32bit):false
        Commandline:reg delete "HKCU\Conttol Panel\Desktop" /v Wallpaper /f
        Imagebase:0x7ff7d48e0000
        File size:77'312 bytes
        MD5 hash:227F63E1D9008B36BDBCC4B397780BE4
        Has elevated privileges:true
        Has administrator privileges:true
        Programmed in:C, C++ or other language
        Reputation:moderate
        Has exited:true

        General

        Target ID:13
        Start time:12:12:58
        Start date:02/10/2024
        Path:C:\Windows\System32\cmd.exe
        Wow64 process (32bit):false
        Commandline:C:\Windows\system32\cmd.exe /c cmd.exe /c reg delete "HKCU\Conttol Panel\Desktop" /v WallpaperStyle /f
        Imagebase:0x7ff708e20000
        File size:289'792 bytes
        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
        Has elevated privileges:true
        Has administrator privileges:true
        Programmed in:C, C++ or other language
        Reputation:high
        Has exited:true

        General

        Target ID:14
        Start time:12:12:58
        Start date:02/10/2024
        Path:C:\Windows\System32\cmd.exe
        Wow64 process (32bit):false
        Commandline:cmd.exe /c reg delete "HKCU\Conttol Panel\Desktop" /v WallpaperStyle /f
        Imagebase:0x7ff708e20000
        File size:289'792 bytes
        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
        Has elevated privileges:true
        Has administrator privileges:true
        Programmed in:C, C++ or other language
        Reputation:high
        Has exited:true

        General

        Target ID:15
        Start time:12:12:58
        Start date:02/10/2024
        Path:C:\Windows\System32\reg.exe
        Wow64 process (32bit):false
        Commandline:reg delete "HKCU\Conttol Panel\Desktop" /v WallpaperStyle /f
        Imagebase:0x7ff7c2520000
        File size:77'312 bytes
        MD5 hash:227F63E1D9008B36BDBCC4B397780BE4
        Has elevated privileges:true
        Has administrator privileges:true
        Programmed in:C, C++ or other language
        Reputation:moderate
        Has exited:true

        General

        Target ID:16
        Start time:12:12:58
        Start date:02/10/2024
        Path:C:\Windows\System32\cmd.exe
        Wow64 process (32bit):false
        Commandline:C:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f
        Imagebase:0x7ff708e20000
        File size:289'792 bytes
        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
        Has elevated privileges:true
        Has administrator privileges:true
        Programmed in:C, C++ or other language
        Reputation:high
        Has exited:true

        General

        Target ID:17
        Start time:12:12:58
        Start date:02/10/2024
        Path:C:\Windows\System32\cmd.exe
        Wow64 process (32bit):false
        Commandline:cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f
        Imagebase:0x7ff708e20000
        File size:289'792 bytes
        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
        Has elevated privileges:true
        Has administrator privileges:true
        Programmed in:C, C++ or other language
        Reputation:high
        Has exited:true

        General

        Target ID:18
        Start time:12:12:59
        Start date:02/10/2024
        Path:C:\Windows\System32\reg.exe
        Wow64 process (32bit):false
        Commandline:reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f
        Imagebase:0x7ff7c2520000
        File size:77'312 bytes
        MD5 hash:227F63E1D9008B36BDBCC4B397780BE4
        Has elevated privileges:true
        Has administrator privileges:true
        Programmed in:C, C++ or other language
        Reputation:moderate
        Has exited:true

        General

        Target ID:19
        Start time:12:12:59
        Start date:02/10/2024
        Path:C:\Windows\System32\cmd.exe
        Wow64 process (32bit):false
        Commandline:C:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f
        Imagebase:0x7ff708e20000
        File size:289'792 bytes
        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
        Has elevated privileges:true
        Has administrator privileges:true
        Programmed in:C, C++ or other language
        Reputation:high
        Has exited:true

        General

        Target ID:20
        Start time:12:12:59
        Start date:02/10/2024
        Path:C:\Windows\System32\cmd.exe
        Wow64 process (32bit):false
        Commandline:cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f
        Imagebase:0x7ff708e20000
        File size:289'792 bytes
        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
        Has elevated privileges:true
        Has administrator privileges:true
        Programmed in:C, C++ or other language
        Reputation:high
        Has exited:true

        General

        Target ID:21
        Start time:12:12:59
        Start date:02/10/2024
        Path:C:\Windows\System32\reg.exe
        Wow64 process (32bit):false
        Commandline:reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f
        Imagebase:0x7ff7c2520000
        File size:77'312 bytes
        MD5 hash:227F63E1D9008B36BDBCC4B397780BE4
        Has elevated privileges:true
        Has administrator privileges:true
        Programmed in:C, C++ or other language
        Has exited:true

        General

        Target ID:22
        Start time:12:13:00
        Start date:02/10/2024
        Path:C:\Windows\System32\cmd.exe
        Wow64 process (32bit):false
        Commandline:C:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f
        Imagebase:0x7ff708e20000
        File size:289'792 bytes
        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
        Has elevated privileges:true
        Has administrator privileges:true
        Programmed in:C, C++ or other language
        Has exited:true

        General

        Target ID:23
        Start time:12:13:00
        Start date:02/10/2024
        Path:C:\Windows\System32\cmd.exe
        Wow64 process (32bit):false
        Commandline:cmd.exe /c reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f
        Imagebase:0x7ff708e20000
        File size:289'792 bytes
        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
        Has elevated privileges:true
        Has administrator privileges:true
        Programmed in:C, C++ or other language
        Has exited:true

        General

        Target ID:24
        Start time:12:13:00
        Start date:02/10/2024
        Path:C:\Windows\System32\reg.exe
        Wow64 process (32bit):false
        Commandline:reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f
        Imagebase:0x7ff7c2520000
        File size:77'312 bytes
        MD5 hash:227F63E1D9008B36BDBCC4B397780BE4
        Has elevated privileges:true
        Has administrator privileges:true
        Programmed in:C, C++ or other language
        Has exited:true

        General

        Target ID:25
        Start time:12:13:00
        Start date:02/10/2024
        Path:C:\Windows\System32\cmd.exe
        Wow64 process (32bit):false
        Commandline:C:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f
        Imagebase:0x7ff708e20000
        File size:289'792 bytes
        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
        Has elevated privileges:true
        Has administrator privileges:true
        Programmed in:C, C++ or other language
        Has exited:true

        General

        Target ID:26
        Start time:12:13:00
        Start date:02/10/2024
        Path:C:\Windows\System32\cmd.exe
        Wow64 process (32bit):false
        Commandline:cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f
        Imagebase:0x7ff708e20000
        File size:289'792 bytes
        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
        Has elevated privileges:true
        Has administrator privileges:true
        Programmed in:C, C++ or other language
        Has exited:true

        General

        Target ID:27
        Start time:12:13:00
        Start date:02/10/2024
        Path:C:\Windows\System32\reg.exe
        Wow64 process (32bit):false
        Commandline:reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f
        Imagebase:0x7ff7c2520000
        File size:77'312 bytes
        MD5 hash:227F63E1D9008B36BDBCC4B397780BE4
        Has elevated privileges:true
        Has administrator privileges:true
        Programmed in:C, C++ or other language
        Has exited:true

        General

        Target ID:28
        Start time:12:13:00
        Start date:02/10/2024
        Path:C:\Windows\System32\cmd.exe
        Wow64 process (32bit):false
        Commandline:C:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v WallpaperStyle /t REG_SZ /d 2 /f
        Imagebase:0x7ff708e20000
        File size:289'792 bytes
        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
        Has elevated privileges:true
        Has administrator privileges:true
        Programmed in:C, C++ or other language
        Has exited:true

        General

        Target ID:29
        Start time:12:13:00
        Start date:02/10/2024
        Path:C:\Windows\System32\cmd.exe
        Wow64 process (32bit):false
        Commandline:cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v WallpaperStyle /t REG_SZ /d 2 /f
        Imagebase:0x7ff708e20000
        File size:289'792 bytes
        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
        Has elevated privileges:true
        Has administrator privileges:true
        Programmed in:C, C++ or other language
        Has exited:true

        General

        Target ID:30
        Start time:12:13:00
        Start date:02/10/2024
        Path:C:\Windows\System32\reg.exe
        Wow64 process (32bit):false
        Commandline:reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v WallpaperStyle /t REG_SZ /d 2 /f
        Imagebase:0x7ff7c2520000
        File size:77'312 bytes
        MD5 hash:227F63E1D9008B36BDBCC4B397780BE4
        Has elevated privileges:true
        Has administrator privileges:true
        Programmed in:C, C++ or other language
        Has exited:true

        General

        Target ID:31
        Start time:12:13:00
        Start date:02/10/2024
        Path:C:\Windows\System32\cmd.exe
        Wow64 process (32bit):false
        Commandline:C:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d 2 /f
        Imagebase:0x7ff708e20000
        File size:289'792 bytes
        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
        Has elevated privileges:true
        Has administrator privileges:true
        Programmed in:C, C++ or other language
        Has exited:true

        General

        Target ID:32
        Start time:12:13:00
        Start date:02/10/2024
        Path:C:\Windows\System32\cmd.exe
        Wow64 process (32bit):false
        Commandline:cmd.exe /c reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d 2 /f
        Imagebase:0x7ff708e20000
        File size:289'792 bytes
        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
        Has elevated privileges:true
        Has administrator privileges:true
        Programmed in:C, C++ or other language
        Has exited:true

        General

        Target ID:33
        Start time:12:13:00
        Start date:02/10/2024
        Path:C:\Windows\System32\reg.exe
        Wow64 process (32bit):false
        Commandline:reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d 2 /f
        Imagebase:0x7ff7c2520000
        File size:77'312 bytes
        MD5 hash:227F63E1D9008B36BDBCC4B397780BE4
        Has elevated privileges:true
        Has administrator privileges:true
        Programmed in:C, C++ or other language
        Has exited:true

        General

        Target ID:34
        Start time:12:13:00
        Start date:02/10/2024
        Path:C:\Windows\System32\cmd.exe
        Wow64 process (32bit):false
        Commandline:C:\Windows\system32\cmd.exe /c rundll32.exe user32.dll,UpdatePerUserSystemParameters
        Imagebase:0x7ff708e20000
        File size:289'792 bytes
        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
        Has elevated privileges:true
        Has administrator privileges:true
        Programmed in:C, C++ or other language
        Has exited:true

        General

        Target ID:35
        Start time:12:13:00
        Start date:02/10/2024
        Path:C:\Windows\System32\rundll32.exe
        Wow64 process (32bit):false
        Commandline:rundll32.exe user32.dll,UpdatePerUserSystemParameters
        Imagebase:0x7ff73cef0000
        File size:71'680 bytes
        MD5 hash:EF3179D498793BF4234F708D3BE28633
        Has elevated privileges:true
        Has administrator privileges:true
        Programmed in:C, C++ or other language
        Has exited:true

        General

        Target ID:36
        Start time:12:13:00
        Start date:02/10/2024
        Path:C:\Windows\System32\cmd.exe
        Wow64 process (32bit):false
        Commandline:C:\Windows\system32\cmd.exe /c cmd.exe /c start powershell.exe -WindowStyle Hidden -Command Sleep -Milliseconds 500; Remove-Item -Force -Path "C:\Users\user\Desktop\C:\Users\user\Desktop\JIar3KCVf6.exe" -ErrorAction SilentlyContinue;
        Imagebase:0x7ff708e20000
        File size:289'792 bytes
        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
        Has elevated privileges:true
        Has administrator privileges:true
        Programmed in:C, C++ or other language
        Has exited:true

        General

        Target ID:37
        Start time:12:13:00
        Start date:02/10/2024
        Path:C:\Windows\System32\cmd.exe
        Wow64 process (32bit):false
        Commandline:cmd.exe /c start powershell.exe -WindowStyle Hidden -Command Sleep -Milliseconds 500; Remove-Item -Force -Path "C:\Users\user\Desktop\C:\Users\user\Desktop\JIar3KCVf6.exe" -ErrorAction SilentlyContinue;
        Imagebase:0x7ff708e20000
        File size:289'792 bytes
        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
        Has elevated privileges:true
        Has administrator privileges:true
        Programmed in:C, C++ or other language
        Has exited:true

        General

        Target ID:38
        Start time:12:13:01
        Start date:02/10/2024
        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        Wow64 process (32bit):false
        Commandline:powershell.exe -WindowStyle Hidden -Command Sleep -Milliseconds 500; Remove-Item -Force -Path "C:\Users\user\Desktop\C:\Users\user\Desktop\JIar3KCVf6.exe" -ErrorAction SilentlyContinue;
        Imagebase:0x7ff6e3d50000
        File size:452'608 bytes
        MD5 hash:04029E121A0CFA5991749937DD22A1D9
        Has elevated privileges:true
        Has administrator privileges:true
        Programmed in:C, C++ or other language
        Has exited:true

        General

        Target ID:39
        Start time:12:13:01
        Start date:02/10/2024
        Path:C:\Windows\System32\conhost.exe
        Wow64 process (32bit):false
        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        Imagebase:0x7ff66e660000
        File size:862'208 bytes
        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
        Has elevated privileges:true
        Has administrator privileges:true
        Programmed in:C, C++ or other language
        Has exited:true

        Disassembly

        Reset < >

          Execution Graph

          Execution Coverage:4.4%
          Dynamic/Decrypted Code Coverage:0%
          Signature Coverage:0.6%
          Total number of Nodes:356
          Total number of Limit Nodes:39
          execution_graph 21269 447640 45 API calls 21350 444740 00007FFDB2414880 00007FFDB240C110 00007FFDB2414880 00007FFDB24560F0 21351 40334f 00007FFDB240DF20 00007FFDB41FB290 00007FFDB2BC9C80 00007FFDB2BC9C80 00007FFDB2C0DE50 21352 448b55 00007FFDB43BFAA0 00007FFDB43BF230 21274 445c50 10 API calls 21354 444b50 27 API calls 21356 444d50 8 API calls 21040 444460 21061 4432d0 21040->21061 21042 44447b 21043 4432d0 6 API calls 21042->21043 21044 44448b 21043->21044 21045 444499 00007FFDB2405B90 00007FFDB2405550 21044->21045 21091 443f60 13 API calls 21044->21091 21075 4435a0 21045->21075 21048 4444be 21050 4432d0 6 API calls 21048->21050 21056 4444e5 21048->21056 21049 4435a0 00007FFDB2405550 00007FFDB2414A80 21049->21056 21050->21056 21051 4432d0 6 API calls 21051->21056 21052 444506 00007FFDB24148E0 21052->21056 21054 443740 00007FFDB24148E0 21054->21056 21055 444605 00007FFDB2405B90 21055->21056 21056->21049 21056->21051 21056->21052 21056->21054 21056->21055 21058 444559 00007FFDB240ADA0 21056->21058 21059 444569 00007FFDB2BEAF80 21056->21059 21081 417a84 21056->21081 21092 444160 45 API calls 21056->21092 21093 443c80 6 API calls 21056->21093 21058->21056 21059->21056 21063 4432e5 21061->21063 21062 4432f2 21064 443322 00007FFDB2405550 21062->21064 21065 4432f9 21062->21065 21063->21062 21066 443347 21063->21066 21067 443390 00007FFDB2405550 21063->21067 21068 443314 21063->21068 21064->21042 21065->21042 21069 4433c0 00007FFDB2414930 21066->21069 21070 44334e 21066->21070 21067->21065 21067->21066 21068->21042 21071 4433f1 00007FFDB2405BF0 21069->21071 21072 4433d8 21069->21072 21070->21062 21074 443367 00007FFDB2414AD0 21070->21074 21072->21070 21073 4433e6 00007FFDB24148E0 21072->21073 21073->21070 21074->21065 21074->21070 21076 4435b2 21075->21076 21077 4435fb 00007FFDB2405550 21076->21077 21079 4435c6 21076->21079 21080 4435bb 21076->21080 21077->21079 21077->21080 21078 443630 00007FFDB2414A80 21078->21079 21079->21048 21080->21078 21080->21079 21083 417a8f 21081->21083 21082 417d0f 21085 44b2c0 00007FFDB2BF8B50 21082->21085 21083->21082 21084 4432d0 6 API calls 21083->21084 21089 4435a0 2 API calls 21083->21089 21094 417d3e 21083->21094 21084->21083 21086 417d26 21085->21086 21211 444dd0 51 API calls 21086->21211 21089->21083 21091->21045 21092->21056 21099 417d4c 21094->21099 21095 417e81 21097 44b2c0 00007FFDB2BF8B50 21095->21097 21096 417ec6 21212 44b338 00007FFDB2BF7AA0 21096->21212 21155 417eaa 21097->21155 21099->21095 21099->21096 21100 417f1e 21101 44a000 00007FFDB2BFCC30 00007FFDB2BF72B0 21100->21101 21104 417f38 21101->21104 21103 417edc 21103->21100 21105 44b2c0 00007FFDB2BF8B50 21103->21105 21106 44a480 00007FFDB2BFCC30 21104->21106 21108 417f19 00007FFDB2BF8B50 21105->21108 21109 417f47 21106->21109 21107 418da7 21215 420360 00007FFDB2BECF40 00007FFDB2BF74B0 21107->21215 21108->21100 21111 44a000 00007FFDB2BFCC30 00007FFDB2BF72B0 21109->21111 21114 417f67 21111->21114 21112 418d7c 21112->21107 21115 44b2c0 00007FFDB2BF8B50 21112->21115 21113 418dbb 21216 420360 00007FFDB2BECF40 00007FFDB2BF74B0 21113->21216 21117 44b2c0 00007FFDB2BF8B50 21114->21117 21115->21107 21120 417f7b 21117->21120 21118 418dcf 21217 420360 00007FFDB2BECF40 00007FFDB2BF74B0 21118->21217 21121 418d34 21120->21121 21122 417f88 21120->21122 21124 44b2c0 00007FFDB2BF8B50 21121->21124 21123 4432d0 6 API calls 21122->21123 21126 417fa1 21123->21126 21125 418d48 21124->21125 21127 44b350 00007FFDB2BFCA10 21125->21127 21129 4248e0 00007FFDB2BECF40 00007FFDB2BF74B0 21126->21129 21127->21155 21128 418de3 21128->21083 21130 417fd4 21129->21130 21131 4248e0 00007FFDB2BECF40 00007FFDB2BF74B0 21130->21131 21132 418007 21131->21132 21133 420e80 00007FFDB2BECF40 00007FFDB2BF74B0 21132->21133 21134 418047 21133->21134 21135 418086 21134->21135 21136 418056 21134->21136 21138 420dc0 00007FFDB2BECF40 00007FFDB2C243C0 00007FFDB2BF74B0 21135->21138 21137 4435a0 00007FFDB2405550 00007FFDB2414A80 21136->21137 21139 418065 21137->21139 21142 4180a4 21138->21142 21143 44b2c0 00007FFDB2BF8B50 21139->21143 21140 4180cf 21141 4234e0 00007FFDB2BC9C80 00007FFDB2BECF40 00007FFDB2C24680 00007FFDB2C243C0 00007FFDB2BF74B0 21140->21141 21148 41816d 21141->21148 21142->21140 21144 44b2c0 00007FFDB2BF8B50 21142->21144 21143->21155 21144->21140 21145 418198 21146 4181af 21145->21146 21147 418cfe 21145->21147 21150 44a000 00007FFDB2BFCC30 00007FFDB2BF72B0 21146->21150 21149 4435a0 00007FFDB2405550 00007FFDB2414A80 21147->21149 21148->21145 21151 44b2c0 00007FFDB2BF8B50 21148->21151 21152 418d0d 21149->21152 21153 4181c9 21150->21153 21151->21145 21154 44b350 00007FFDB2BFCA10 21152->21154 21156 418c94 21153->21156 21157 41820c 21153->21157 21154->21155 21214 420430 00007FFDB2BECF40 00007FFDB2BF74B0 21155->21214 21158 4435a0 00007FFDB2405550 00007FFDB2414A80 21156->21158 21161 4234e0 00007FFDB2BC9C80 00007FFDB2BECF40 00007FFDB2C24680 00007FFDB2C243C0 00007FFDB2BF74B0 21157->21161 21159 418ca3 21158->21159 21160 44b2c0 00007FFDB2BF8B50 21159->21160 21162 418cc0 21160->21162 21166 4182d1 21161->21166 21163 44b350 00007FFDB2BFCA10 21162->21163 21163->21155 21164 4182fc 21165 4435a0 00007FFDB2405550 00007FFDB2414A80 21164->21165 21167 418315 21165->21167 21166->21164 21168 44b2c0 00007FFDB2BF8B50 21166->21168 21169 418c6a 21167->21169 21174 418322 21167->21174 21168->21164 21170 44b350 00007FFDB2BFCA10 21169->21170 21170->21155 21171 418c0c 21172 44b2c0 00007FFDB2BF8B50 21171->21172 21173 418c29 21172->21173 21175 44b350 00007FFDB2BFCA10 21173->21175 21174->21171 21176 41867c 21174->21176 21203 4183c2 21174->21203 21175->21155 21177 418677 21176->21177 21178 44a000 00007FFDB2BFCC30 00007FFDB2BF72B0 21176->21178 21179 418bf8 21177->21179 21182 44b2c0 00007FFDB2BF8B50 21177->21182 21181 4186c2 21178->21181 21180 44b350 00007FFDB2BFCA10 21179->21180 21183 418c07 00007FFDB2BFCA10 21180->21183 21184 44b328 00007FFDB2BFD990 21181->21184 21182->21179 21183->21171 21185 4186ea 21184->21185 21186 44a000 00007FFDB2BFCC30 00007FFDB2BF72B0 21185->21186 21188 41871f 21186->21188 21187 44a000 00007FFDB2BFCC30 00007FFDB2BF72B0 21187->21203 21189 44b328 00007FFDB2BFD990 21188->21189 21190 418747 21189->21190 21191 418b8f 21190->21191 21194 418786 21190->21194 21193 44b2c0 00007FFDB2BF8B50 21191->21193 21192 44b328 00007FFDB2BFD990 21192->21203 21193->21177 21195 44a000 00007FFDB2BFCC30 00007FFDB2BF72B0 21194->21195 21197 4187bf 21195->21197 21196 44b2c0 00007FFDB2BF8B50 21196->21203 21198 44b328 00007FFDB2BFD990 21197->21198 21199 4187e7 21198->21199 21200 418b76 21199->21200 21209 41882c 21199->21209 21202 44b2c0 00007FFDB2BF8B50 21200->21202 21201 420490 00007FFDB2BECF40 00007FFDB2BF74B0 21201->21203 21202->21177 21203->21177 21203->21187 21203->21192 21203->21196 21203->21201 21204 420360 00007FFDB2BECF40 00007FFDB2BF74B0 21203->21204 21204->21203 21205 44a000 00007FFDB2BFCC30 00007FFDB2BF72B0 21205->21209 21206 44b328 00007FFDB2BFD990 21206->21209 21207 44b2c0 00007FFDB2BF8B50 21207->21209 21208 420490 00007FFDB2BECF40 00007FFDB2BF74B0 21208->21209 21209->21177 21209->21205 21209->21206 21209->21207 21209->21208 21210 420360 00007FFDB2BECF40 00007FFDB2BF74B0 21209->21210 21210->21209 21213 47579e 21212->21213 21214->21112 21215->21113 21216->21118 21217->21128 21363 446560 10 API calls 21281 424a70 00007FFDB2C0CDF0 00007FFDB2BECF40 00007FFDB2BF74B0 21282 444a70 61 API calls 20923 401500 20928 447dc0 20923->20928 20925 401516 20932 4011b0 20925->20932 20927 40151b 20929 447e00 00007FFDB2407B80 00007FFDB2414890 00007FFDB2405550 00007FFDB2405640 00007FFDB2405C10 20928->20929 20930 447de9 20928->20930 20931 447e5b 20929->20931 20930->20925 20931->20925 20933 401490 00007FFDB2411960 20932->20933 20934 4011e4 20932->20934 20936 4013f8 20933->20936 20935 40120c 00007FFDB240ADA0 20934->20935 20937 401221 20934->20937 20935->20934 20951 40140c 20936->20951 21035 44b358 00007FFDB2BEA7D0 20936->21035 20937->20936 20952 4483b0 20937->20952 20939 40127c 00007FFDB240FE00 20962 448820 20939->20962 20947 401298 20947->20936 20949 4013b2 20947->20949 20966 44b2d8 00007FFDB2C243C0 20947->20966 20967 41979b 20949->20967 20951->20927 20953 4483d2 20952->20953 20959 4483e3 20952->20959 20953->20939 20954 44850d 20954->20953 20960 448555 00007FFDB240BC70 20954->20960 20956 448638 21037 4481d0 00007FFDB240C1A0 00007FFDB240BC70 00007FFDB2405BF0 00007FFDB240BC70 00007FFDB2C243C0 20956->21037 20957 4485f0 21036 4481d0 00007FFDB240C1A0 00007FFDB240BC70 00007FFDB2405BF0 00007FFDB240BC70 00007FFDB2C243C0 20957->21036 20959->20953 20959->20954 20959->20956 20959->20957 20960->20954 20961 44867a 20961->20939 20964 44882f 20962->20964 20963 44885c 20963->20947 20964->20963 20965 4488f0 00007FFDB24113A0 20964->20965 20965->20963 20968 4197c0 20967->20968 21038 44b2c0 00007FFDB2BF8B50 20968->21038 20970 416556 00007FFDB2C0D0D0 00007FFDB2BFE470 20971 419aae 20970->20971 20972 44b2c0 00007FFDB2BF8B50 20971->20972 20973 419af6 20972->20973 20974 44b2c0 00007FFDB2BF8B50 20973->20974 20976 419b47 20974->20976 20975 41981d 20975->20970 20977 419653 00007FFDB2BECF40 00007FFDB2BF74B0 20976->20977 20978 419b82 20977->20978 20979 419b86 20978->20979 20985 419b97 20978->20985 20980 44b2b8 00007FFDB2BFE470 20979->20980 20995 419b92 20980->20995 20981 419c0e 20982 423bd0 00007FFDB2BC9C80 00007FFDB2BECF40 00007FFDB2C24680 00007FFDB2C243C0 00007FFDB2BF74B0 20981->20982 20984 419c2c 20982->20984 20983 419653 00007FFDB2BECF40 00007FFDB2BF74B0 20983->20985 20986 419c41 20984->20986 20987 419c30 20984->20987 20985->20981 20985->20983 20988 419be5 20985->20988 20990 41fb90 00007FFDB2BECF40 00007FFDB2BF74B0 20986->20990 20989 44b2b8 00007FFDB2BFE470 20987->20989 20991 44b2b8 00007FFDB2BFE470 20988->20991 20989->20995 20992 419c4d 20990->20992 20991->20995 20993 419c7d 20992->20993 20994 419c5c 20992->20994 20996 41f8c0 00007FFDB2BECF40 00007FFDB2C0D0D0 00007FFDB2BF74B0 20993->20996 21001 44b2c0 00007FFDB2BF8B50 20994->21001 20998 443740 00007FFDB24148E0 20995->20998 21019 41a479 20995->21019 20997 419c89 20996->20997 20999 419cb3 20997->20999 21000 419ca2 20997->21000 20998->20995 21003 41fe60 00007FFDB2BECF40 00007FFDB2BF74B0 20999->21003 21002 44b2b8 00007FFDB2BFE470 21000->21002 21001->20995 21002->20995 21004 419cbf 21003->21004 21005 419cef 21004->21005 21006 419cce 21004->21006 21007 41e380 00007FFDB2BECF40 00007FFDB2C0D0D0 00007FFDB2BF74B0 21005->21007 21009 44b2c0 00007FFDB2BF8B50 21006->21009 21008 419cff 21007->21008 21010 419d2f 21008->21010 21011 419d0e 21008->21011 21009->20995 21012 41fa10 00007FFDB2BECF40 00007FFDB2C0D0D0 00007FFDB2BF74B0 21010->21012 21014 44b2c0 00007FFDB2BF8B50 21011->21014 21013 419d3b 21012->21013 21015 419d65 21013->21015 21016 419d54 21013->21016 21014->20995 21018 41b890 00007FFDB2BECF40 00007FFDB2BF74B0 21015->21018 21017 44b2b8 00007FFDB2BFE470 21016->21017 21017->20995 21020 419d78 21018->21020 21022 443740 00007FFDB24148E0 21019->21022 21021 419d87 21020->21021 21034 419da8 21020->21034 21023 44b2c0 00007FFDB2BF8B50 21021->21023 21026 41a595 21022->21026 21023->20995 21024 445670 36 API calls 21024->21034 21025 445b40 15 API calls 21025->21034 21027 418f18 9 API calls 21026->21027 21030 41a681 21027->21030 21028 417673 11 API calls 21028->21034 21029 44b2b8 00007FFDB2BFE470 21029->21034 21030->20936 21031 4432d0 6 API calls 21031->21034 21032 4435a0 00007FFDB2405550 00007FFDB2414A80 21032->21034 21033 44b2c0 00007FFDB2BF8B50 21033->21034 21034->20995 21034->21024 21034->21025 21034->21028 21034->21029 21034->21031 21034->21032 21034->21033 21036->20956 21037->20961 21039 47584c 21038->21039 21290 446610 11 API calls 21373 446310 00007FFDB2405550 00007FFDB2405550 00007FFDB2BF8B50 21375 446f10 34 API calls 21292 40301c 6 API calls 21293 44b619 00007FFDB24148F0 21296 447a20 54 API calls 21302 443a30 00007FFDB2405550 00007FFDB2414A80 21303 444630 11 API calls 21379 446930 34 API calls 21304 44b631 00007FFDB2414930 21384 4225c0 00007FFDB2BC9C80 00007FFDB2BECF40 00007FFDB2C24680 00007FFDB2C243C0 00007FFDB2BF74B0 21387 4447c0 62 API calls 21309 41d6d0 00007FFDB2C0CDF0 00007FFDB2BECF40 00007FFDB2C0D0D0 00007FFDB2C243C0 00007FFDB2BF74B0 21390 42d7d0 00007FFDB2C24680 21311 449cd0 00007FFDB2405BF0 21391 4463d0 54 API calls 21396 4145df 8 API calls 21316 4478e0 51 API calls 21317 4458e0 29 API calls 21399 448be0 00007FFDB43BFAA0 00007FFDB43BF230 00007FFDB43BF230 21400 446de0 00007FFDB2405550 00007FFDB2405550 00007FFDB2BF74B0 21319 44b4e2 00007FFDB2410780 21322 444cf0 25 API calls 21323 4446f0 00007FFDB2414880 00007FFDB240C110 21402 44b5f1 00007FFDB2405550 21218 444280 21219 4442a0 21218->21219 21220 44428a 21218->21220 21222 444410 00007FFDB44116C0 21219->21222 21223 4442a9 21219->21223 21221 444293 21220->21221 21224 444360 00007FFDB44120C0 21220->21224 21226 444430 21222->21226 21223->21221 21225 4442b9 00007FFDB2405540 21223->21225 21224->21221 21225->21221 21227 4442c7 21225->21227 21264 444160 45 API calls 21226->21264 21229 444380 21227->21229 21230 4442d1 21227->21230 21232 4443e0 21229->21232 21233 44438e 21229->21233 21230->21226 21234 4442e1 21230->21234 21231 444399 21240 4443bb 21231->21240 21265 444160 45 API calls 21231->21265 21238 4443e5 00007FFDB24148E0 21232->21238 21239 4443eb 21232->21239 21233->21231 21235 444393 00007FFDB24148E0 21233->21235 21236 4442fe 21234->21236 21237 4442ea 00007FFDB24148E0 21234->21237 21235->21231 21256 443740 00007FFDB24148E0 21236->21256 21237->21236 21241 4442fc 00007FFDB24148E0 21237->21241 21238->21239 21263 443740 00007FFDB24148E0 21239->21263 21240->21239 21244 4443c1 21240->21244 21241->21236 21244->21236 21248 4443d4 00007FFDB24148E0 21244->21248 21245 444317 21257 443ea0 21245->21257 21247 4443fc 21251 443ea0 3 API calls 21247->21251 21248->21236 21251->21221 21252 444450 21266 443c80 6 API calls 21252->21266 21253 44432e 00007FFDB2405B90 21256->21245 21258 443eb2 21257->21258 21259 443ebc 21257->21259 21258->21259 21260 443ece 00007FFDB2405550 00007FFDB2BB2970 21258->21260 21259->21252 21259->21253 21261 443f13 21260->21261 21262 443f49 00007FFDB24142D0 21261->21262 21262->21261 21263->21247 21264->21231 21265->21240 21333 44b48a 00007FFDB2414AD0 21411 445590 26 API calls 21412 446d90 00007FFDB2BECF40 21413 41ad9d 00007FFDB2C243C0 21336 43e4a1 00007FFDB3727160 00007FFDB3727A50 00007FFDB3727160 21337 42d6a0 00007FFDB2C24680 00007FFDB2C243C0 21338 447ea0 7 API calls 21416 4451a0 34 API calls 21417 447fa0 00007FFDB43A0FC0 00007FFDB43F14B0 21419 4115ab 7 API calls 21340 41b0b0 00007FFDB2BECF40 00007FFDB2BF74B0 21344 4480b0 00007FFDB2BF74B0 21345 4466b0 00007FFDB2405550 00007FFDB2414A80 00007FFDB2405550 00007FFDB2405550 00007FFDB24148E0 21346 44b4b3 00007FFDB242B9D0

          Executed Functions

          Function 0041E423 Relevance: 7.5, Strings: 5, Instructions: 1267COMMON
          Download Yara Rule
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.4329195548.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.4328850847.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329444698.000000000044C000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329590454.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329729812.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.0000000000475000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330183105.0000000000479000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_JIar3KCVf6.jbxd
          Similarity
          • API ID:
          • String ID: a != NULL$b != NULL$c != NULL$d != NULL$src/math/ltm_desc.c
          • API String ID: 0-3993888377
          • Opcode ID: 34226f18ee9fddbb846f065dcfae28f389e2f1ba89d080fa429ff396cdfb2332
          • Instruction ID: 74d8d2854d2de852cbc41fd23fdc9643b31d4b395deaa10ab3f0d8e238aebabe
          • Opcode Fuzzy Hash: 34226f18ee9fddbb846f065dcfae28f389e2f1ba89d080fa429ff396cdfb2332
          • Instruction Fuzzy Hash: 21A2F5B8701901C2FE14A7A6DD613E92210AB89395FD4463BDD1D83BE2DB2CD5CB871E
          Function 00425D30 Relevance: 5.8, Strings: 4, Instructions: 798COMMON
          Download Yara Rule
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.4329195548.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.4328850847.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329444698.000000000044C000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329590454.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329729812.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.0000000000475000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330183105.0000000000479000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_JIar3KCVf6.jbxd
          Similarity
          • API ID:
          • String ID: msg != NULL$out != NULL$outlen != NULL$src/pk/pkcs1/pkcs_1_oaep_encode.c
          • API String ID: 0-719391365
          • Opcode ID: 31549cd2205a8526b9644de1f614b1aa1036387cfdb263193332783673a1fbf0
          • Instruction ID: 39f41267b787a92ceaff9266021acdd9645f97cc09fb342b6915f10bece58789
          • Opcode Fuzzy Hash: 31549cd2205a8526b9644de1f614b1aa1036387cfdb263193332783673a1fbf0
          • Instruction Fuzzy Hash: 0672F3B2208AE042C3128B2DA019B7E7F65FB85784F8B8256DFC60B746EB3EC555D705
          Function 00445670 Relevance: 16.7, APIs: 11, Instructions: 151COMMON
          Download Yara Rule

          Control-flow Graph

          • Executed
          • Not Executed
          control_flow_graph 514 445670-445695 call 443de0 517 445881-445894 514->517 518 44569b-44569e 514->518 519 4456a0-4456a7 518->519 520 4456ab-4456df 518->520 519->520 521 4456e2-4456f8 00007FFDB2414930 520->521 522 445720-445753 call 443ea0 521->522 523 4456fa-4456fd 521->523 529 445862-445865 522->529 530 445759-44575c 522->530 524 445711-445716 00007FFDB240ADA0 523->524 525 4456ff-44570a 00007FFDB240ADA0 523->525 527 44570c-44570f 524->527 525->522 525->527 527->521 533 445867 529->533 534 44586f-445877 529->534 531 4458d0 530->531 532 445762-44576e 530->532 536 445774-4457ad 00007FFDB2BEAE30 532->536 537 4458b0-4458bd call 443ff0 532->537 533->534 534->517 535 445879-44587c call 443c80 534->535 535->517 540 445832-445839 536->540 541 4457b3-4457c1 536->541 537->531 545 445841-44585a call 443740 call 443ea0 540->545 546 44583b 00007FFDB24148E0 540->546 542 4457e2-4457f9 00007FFDB240B5F0 00007FFDB2414A70 541->542 543 4457c3-4457cb 541->543 548 445895-4458a2 00007FFDB240E0C0 542->548 549 4457ff-445813 00007FFDB240E0C0 00007FFDB24148E0 542->549 543->542 547 4457cd-4457d5 543->547 545->529 546->545 547->542 551 4457d7-4457df 547->551 552 445819-445831 00007FFDB240ADA0 548->552 549->552 551->542
          APIs
          • 00007FFDB2414930.KERNEL32(0046E860,?,?,?,?,00419E7E), ref: 004456EF
          • 00007FFDB240ADA0.KERNEL32(?,00419E7E), ref: 00445704
          • 00007FFDB240ADA0.KERNEL32(?,00419E7E), ref: 00445713
          Memory Dump Source
          • Source File: 00000000.00000002.4329195548.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.4328850847.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329444698.000000000044C000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329590454.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329729812.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.0000000000475000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330183105.0000000000479000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_JIar3KCVf6.jbxd
          Similarity
          • API ID: 00007$B240$B2414930
          • String ID:
          • API String ID: 211710804-0
          • Opcode ID: 75342974d02b34505babe38c001b1b4c02b9b7d8b389653b5f0e5ce14a5eacef
          • Instruction ID: c5714570296888cb3ceecdac6e1eac0df21975fc450c3de9b3f1f525e02af9f6
          • Opcode Fuzzy Hash: 75342974d02b34505babe38c001b1b4c02b9b7d8b389653b5f0e5ce14a5eacef
          • Instruction Fuzzy Hash: C0518E72605A5086FB24AF35E94475E33A5F744BA8F284326DE294B3D9CF788886C348
          Function 00444280 Relevance: 13.6, APIs: 9, Instructions: 100COMMON
          Download Yara Rule

          Control-flow Graph

          • Executed
          • Not Executed
          control_flow_graph 687 444280-444288 688 4442a0-4442a3 687->688 689 44428a-44428d 687->689 692 444410-444422 00007FFDB44116C0 688->692 693 4442a9-4442ac 688->693 690 444350-44435a 689->690 691 444293-44429e 689->691 690->691 694 444360-444371 00007FFDB44120C0 690->694 697 444430-444435 call 444160 692->697 693->691 695 4442ae-4442b7 693->695 694->691 695->691 696 4442b9-4442c5 00007FFDB2405540 695->696 696->691 698 4442c7-4442cb 696->698 710 444440-444445 call 444160 697->710 700 444380-44438c 698->700 701 4442d1-4442db 698->701 703 4443e0-4443e3 700->703 704 44438e-444391 700->704 701->697 705 4442e1-4442e8 701->705 711 4443e5 00007FFDB24148E0 703->711 712 4443eb 703->712 706 444393 00007FFDB24148E0 704->706 707 444399-4443b5 704->707 708 44430e-444328 call 443740 call 443ea0 705->708 709 4442ea-4442fa 00007FFDB24148E0 705->709 706->707 707->710 713 4443bb-4443bf 707->713 729 444450-444453 call 443c80 708->729 730 44432e-444347 00007FFDB2405B90 708->730 714 4442fc 00007FFDB24148E0 709->714 715 4442fe 709->715 710->713 711->712 718 4443f3-444405 call 443740 call 443ea0 712->718 713->718 719 4443c1-4443ce 713->719 714->715 720 444306 715->720 718->691 719->720 725 4443d4-4443da 00007FFDB24148E0 719->725 720->708 725->720 733 444458 729->733 733->733
          APIs
          Memory Dump Source
          • Source File: 00000000.00000002.4329195548.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.4328850847.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329444698.000000000044C000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329590454.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329729812.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.0000000000475000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330183105.0000000000479000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_JIar3KCVf6.jbxd
          Similarity
          • API ID: 00007$B24148$B2405B2405540B44120
          • String ID:
          • API String ID: 3703592719-0
          • Opcode ID: 021c7f2a5cb6022c3c3c30e5030f2e2dd0f1d3c6827a6e25197aa5d86cdb9b65
          • Instruction ID: 0ef600f1122afe530d91a2b7768cd605120874d62fa1e2a56711f0e1493fb462
          • Opcode Fuzzy Hash: 021c7f2a5cb6022c3c3c30e5030f2e2dd0f1d3c6827a6e25197aa5d86cdb9b65
          • Instruction Fuzzy Hash: FE41AE75706A0081FB29DF61E89436E2364FBD4F4DF584127DE0A46758DFBC8885C359
          Function 004011B0 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 199COMMON
          Download Yara Rule

          Control-flow Graph

          • Executed
          • Not Executed
          control_flow_graph 734 4011b0-4011de 735 401490-401493 00007FFDB2411960 734->735 736 4011e4-401201 734->736 738 4014a0-4014b9 call 44b3b8 735->738 737 401214-40121f 736->737 739 401221-40122f 737->739 740 401203-401206 737->740 752 4014be 738->752 744 401235-401239 739->744 745 401448-401457 call 44b410 739->745 741 401431-401442 740->741 742 40120c-401211 00007FFDB240ADA0 740->742 741->744 741->745 742->737 744->738 747 40123f-40124e 744->747 749 401254-401256 745->749 750 40145d-401478 call 44b3b8 745->750 747->749 747->750 753 401480-401485 749->753 754 40125c-401269 749->754 750->754 759 40147e 750->759 760 4014c6-4014f1 call 44b358 call 447dc0 call 4011b0 752->760 753->754 757 401277-4012c7 call 4483b0 00007FFDB240FE00 call 448820 call 44b470 call 4481a0 754->757 758 40126b-401273 754->758 775 401327-40132d 757->775 776 4012c9-4012cb 757->776 758->757 759->753 777 401348-401370 call 44b2e8 775->777 778 40132f-401342 775->778 779 4012e2-4012e8 776->779 777->752 787 401376-401378 777->787 778->777 781 4012d0-4012d2 779->781 782 4012ea-4012f8 779->782 784 401300-401302 781->784 785 4012d4-4012d7 781->785 786 4012de 782->786 789 401304 784->789 790 401315-40131e 784->790 785->784 788 4012d9 785->788 786->779 793 401380-4013b0 call 44b258 call 44b2e8 call 44b2d8 787->793 788->786 791 401320 789->791 790->791 792 401310-401313 790->792 791->775 792->790 792->791 800 4013b2-4013f3 call 447d80 call 41979b 793->800 804 4013f8-401406 800->804 804->760 805 40140c-401414 804->805 806 401421-401430 805->806 807 401416-40141b call 44b400 805->807 807->806
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.4329195548.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.4328850847.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329444698.000000000044C000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329590454.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329729812.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.0000000000475000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330183105.0000000000479000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_JIar3KCVf6.jbxd
          Similarity
          • API ID: 00007$B240$B2411960
          • String ID: 0.F$0pG$VG
          • API String ID: 1178040099-956089272
          • Opcode ID: 777c61f64e0a407aec7f11807009c86143642a60ca503a2c85f8d919ba9bb032
          • Instruction ID: 83b4569b932a934316cee29d98ee3e216d953c17bcf9719a2d93526338b429d3
          • Opcode Fuzzy Hash: 777c61f64e0a407aec7f11807009c86143642a60ca503a2c85f8d919ba9bb032
          • Instruction Fuzzy Hash: 5A71B1B170178486FB14AF56E89172A3361F746B89F84402BDE49977A1EF3EC841C74A
          Function 00444460 Relevance: 9.1, APIs: 6, Instructions: 104COMMON
          Download Yara Rule

          Control-flow Graph

          APIs
          • 00007FFDB2405B90.KERNEL32 ref: 004444A3
          • 00007FFDB2405550.KERNEL32 ref: 004444A9
          • 00007FFDB24148E0.KERNEL32 ref: 00444506
          • 00007FFDB240ADA0.KERNEL32 ref: 0044455B
          • 00007FFDB2BEAF80.MSVCRT ref: 0044456B
          • 00007FFDB2405B90.KERNEL32 ref: 0044460D
            • Part of subcall function 00443F60: 00007FFDB2BECF40.MSVCRT ref: 00443F91
          Memory Dump Source
          • Source File: 00000000.00000002.4329195548.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.4328850847.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329444698.000000000044C000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329590454.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329729812.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.0000000000475000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330183105.0000000000479000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_JIar3KCVf6.jbxd
          Similarity
          • API ID: 00007$B2405$B240B2405550B24148
          • String ID:
          • API String ID: 2328414486-0
          • Opcode ID: 38630d0449843b04f1c2dacedb48a4093553d8ed49942b957e1f78d8b6b47d5d
          • Instruction ID: 99b9178c61aed83151a52fa92e54fb43299df22a48e59b7931e8f237171b49a8
          • Opcode Fuzzy Hash: 38630d0449843b04f1c2dacedb48a4093553d8ed49942b957e1f78d8b6b47d5d
          • Instruction Fuzzy Hash: 83414C65201E0196FF14EF62E8913A93760E788FA9F495227DE0E47B65DF3CC985C348
          Function 004499B0 Relevance: 1.6, APIs: 1, Instructions: 126COMMON
          Download Yara Rule

          Control-flow Graph

          • Executed
          • Not Executed
          control_flow_graph 2127 4499b0-4499cc call 44b3f0 2130 4499d2-4499da 2127->2130 2131 449bbd-449bc8 call 44b3f0 2127->2131 2133 4499e0-4499e5 2130->2133 2134 449b5e 2130->2134 2137 449a94-449a9e call 44b3c8 2133->2137 2138 4499eb-4499ff call 44b218 2133->2138 2135 449b60-449b6b 2134->2135 2141 449aa3-449aaa 2137->2141 2145 449b05-449b30 2138->2145 2146 449a05-449a46 call 44b248 2138->2146 2143 449b70-449bad 2141->2143 2144 449ab0-449b00 call 44b248 2141->2144 2143->2135 2155 449a63-449a93 call 44b258 call 44b268 2144->2155 2148 449b33-449b3c 00007FFDB2405BF0 2145->2148 2146->2148 2157 449a4c-449a5d 2146->2157 2151 449bb0-449bbb call 44b3f0 2148->2151 2152 449b3e-449b45 call 44b3d0 2148->2152 2151->2152 2160 449b4a-449b58 2152->2160 2157->2134 2157->2155 2160->2134
          APIs
          Memory Dump Source
          • Source File: 00000000.00000002.4329195548.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.4328850847.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329444698.000000000044C000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329590454.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329729812.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.0000000000475000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330183105.0000000000479000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_JIar3KCVf6.jbxd
          Similarity
          • API ID: 00007B2405
          • String ID:
          • API String ID: 1126133561-0
          • Opcode ID: 05a36a3e10a7987ea5a53e151d38a985a762d55be1231398b254ac94b305bc4d
          • Instruction ID: 0db848f82bc4e64e0d3f20f5b822e733ceec230d701e6b860f4b54edc51abcfe
          • Opcode Fuzzy Hash: 05a36a3e10a7987ea5a53e151d38a985a762d55be1231398b254ac94b305bc4d
          • Instruction Fuzzy Hash: A6511972204B8486EB509F3AE84439A73A0F748BA8F544326DFAD8B7D8DB78C591C754
          Function 00449810 Relevance: 1.6, APIs: 1, Instructions: 105COMMON
          Download Yara Rule

          Control-flow Graph

          • Executed
          • Not Executed
          control_flow_graph 2164 449810-44982c call 44b3f0 2167 449832-449835 2164->2167 2168 44999c-4499a7 call 44b3f0 2164->2168 2170 449964-44997f call 44b3f0 2167->2170 2171 44983b-449847 00007FFDB2414D30 2167->2171 2177 449955-449963 2168->2177 2174 449980-44998d call 44b3f0 2171->2174 2175 44984d-44984f 2171->2175 2174->2177 2175->2170 2179 449855-449869 call 44b3c0 2175->2179 2182 44986e-449883 2179->2182 2182->2182 2183 449885-4498ac call 44b2e8 2182->2183 2185 4498b1-4498b7 2183->2185 2186 4498bd-4498e0 call 44b2d8 2185->2186 2187 44998f-44999a call 44b3f0 2185->2187 2192 449900-44994f 2186->2192 2193 4498e2-4498ec 2186->2193 2187->2177 2192->2177 2193->2192 2194 4498ee-4498f0 2193->2194 2194->2192 2195 4498f2-4498fd 2194->2195 2195->2192
          APIs
          Memory Dump Source
          • Source File: 00000000.00000002.4329195548.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.4328850847.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329444698.000000000044C000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329590454.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329729812.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.0000000000475000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330183105.0000000000479000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_JIar3KCVf6.jbxd
          Similarity
          • API ID: 00007B2414
          • String ID:
          • API String ID: 755199726-0
          • Opcode ID: c2663df3cc5b6f7b79ffeadbdf76a4a2f0b4e9f384e63a5754851fdf3a98870a
          • Instruction ID: 01b6032455e5011ae46c915d4747c354ef61d45f8f517007f66f323fb5a685e0
          • Opcode Fuzzy Hash: c2663df3cc5b6f7b79ffeadbdf76a4a2f0b4e9f384e63a5754851fdf3a98870a
          • Instruction Fuzzy Hash: 6531D3B220068486FB159F3AD80439F2751EB45BA8F88823ADF6D4B3C5DB3CC986D754
          Function 0041678A Relevance: 1.6, APIs: 1, Instructions: 52COMMON
          Download Yara Rule

          Control-flow Graph

          • Executed
          • Not Executed
          control_flow_graph 2196 41678a-4167ad 00007FFDB2BB87B0 2197 4167b9-4167ca 2196->2197 2198 4167af-4167b4 2196->2198 2200 4167d3-4167e4 2197->2200 2201 4167cc-4167d1 2197->2201 2199 416840-416845 2198->2199 2202 4167e6-4167eb 2200->2202 2203 4167ed-4167fe 2200->2203 2201->2199 2202->2199 2204 416800-416805 2203->2204 2205 416807-416818 2203->2205 2204->2199 2206 416821-416832 2205->2206 2207 41681a-41681f 2205->2207 2208 416834-416839 2206->2208 2209 41683b 2206->2209 2207->2199 2208->2199 2209->2199
          APIs
          • 00007FFDB2BB87B0.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,0041688B,?,?,?,00417869), ref: 004167A8
          Memory Dump Source
          • Source File: 00000000.00000002.4329195548.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.4328850847.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329444698.000000000044C000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329590454.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329729812.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.0000000000475000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330183105.0000000000479000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_JIar3KCVf6.jbxd
          Similarity
          • API ID: 00007
          • String ID:
          • API String ID: 3568877910-0
          • Opcode ID: ec2d18d737a6fda9fee15f9df34e27048b1b80b19133403c3103a8f831edb236
          • Instruction ID: 56ec2db0461c9ed002f57904c50abfbfdfa109e3f81c64f33c171520c2b17591
          • Opcode Fuzzy Hash: ec2d18d737a6fda9fee15f9df34e27048b1b80b19133403c3103a8f831edb236
          • Instruction Fuzzy Hash: 0111B166F0652488FB6057A5E4413FA21A4E31071DF210433FEAACABC4C91CC8D2E2AA

          Non-executed Functions

          Function 004253F0 Relevance: 13.4, Strings: 10, Instructions: 949COMMON
          Download Yara Rule
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.4329195548.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.4328850847.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329444698.000000000044C000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329590454.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329729812.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.0000000000475000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330183105.0000000000479000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_JIar3KCVf6.jbxd
          Similarity
          • API ID:
          • String ID: @$@$@@@$in != NULL$out != NULL$out != NULL$src/stream/chacha/chacha_crypt.c$src/stream/chacha/chacha_keystream.c$st != NULL$st->ivlen != 0
          • API String ID: 0-3539777657
          • Opcode ID: 75423c9bfd5ea47e9508cb279d643a5af92dbc6fee323047eff201b75de6c665
          • Instruction ID: c0ebf5c1653c6d145527c09ae6c2ba719db8235b14a6056ef863f8dd6fd30f0a
          • Opcode Fuzzy Hash: 75423c9bfd5ea47e9508cb279d643a5af92dbc6fee323047eff201b75de6c665
          • Instruction Fuzzy Hash: FDA2BB336196E08AD3728F25A454B9FBB65F789784F459216EFCA53B09CB3CCA54CB00
          Function 00424A70 Relevance: 10.3, Strings: 8, Instructions: 300COMMON
          Download Yara Rule
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.4329195548.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.4328850847.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329444698.000000000044C000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329590454.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329729812.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.0000000000475000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330183105.0000000000479000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_JIar3KCVf6.jbxd
          Similarity
          • API ID:
          • String ID: 1$2$CHACHA-PRNG$in != NULL$out != NULL$outlen != NULL$prng != NULL$src/prngs/chacha20.c
          • API String ID: 0-2138151014
          • Opcode ID: b6c181d10d8b38644aafbfd55b423d42bf676cfd4987f9656f33d07f9ee30355
          • Instruction ID: ba14c82fcca9f0f379f9a96ad82d9f5319f70d9fce0ee35aba74c0a4574eb76b
          • Opcode Fuzzy Hash: b6c181d10d8b38644aafbfd55b423d42bf676cfd4987f9656f33d07f9ee30355
          • Instruction Fuzzy Hash: 6AC123733186E485E721CB29F414B9FBB65E782788F848219EF8147E49E73DD518CB08
          Function 0041C5C0 Relevance: 8.4, Strings: 6, Instructions: 852COMMON
          Download Yara Rule
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.4329195548.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.4328850847.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329444698.000000000044C000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329590454.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329729812.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.0000000000475000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330183105.0000000000479000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_JIar3KCVf6.jbxd
          Similarity
          • API ID:
          • String ID: ct != NULL$key != NULL$keysize != NULL$pt != NULL$skey != NULL$src/ciphers/aes/aes.c
          • API String ID: 0-3759532648
          • Opcode ID: 0e057b84dce3377e4b709e3ebd4a8f9f5e1262439fc442e48f6ff54b881d097f
          • Instruction ID: ad451fbd3a3095fa2e153c4c07f8461d5838cf80340a03d848693d3aba1428ed
          • Opcode Fuzzy Hash: 0e057b84dce3377e4b709e3ebd4a8f9f5e1262439fc442e48f6ff54b881d097f
          • Instruction Fuzzy Hash: 2672CEB35202A48BE3A0CF2AC95876F7BA5F388785F51A60AEF4643354D739E911CF50
          Function 0041B480 Relevance: 7.8, Strings: 6, Instructions: 258COMMON
          Download Yara Rule
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.4329195548.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.4328850847.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329444698.000000000044C000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329590454.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329729812.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.0000000000475000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330183105.0000000000479000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_JIar3KCVf6.jbxd
          Similarity
          • API ID:
          • String ID: AES Encrypt$`F$ct != NULL$pt != NULL$skey != NULL$src/ciphers/aes/aes.c
          • API String ID: 0-3967662191
          • Opcode ID: 378267a70f5f6b40a8226412dbbd86700feb8e4f3d3c4c14976d1e1dadf22658
          • Instruction ID: f02d36920afe9e5a6fc840b6161c453201e38d3218564ea8ef5bee603a9e82dd
          • Opcode Fuzzy Hash: 378267a70f5f6b40a8226412dbbd86700feb8e4f3d3c4c14976d1e1dadf22658
          • Instruction Fuzzy Hash: ECB1ED735146808FD364CF1AE944B6BBBB0F348749F559229EB8A03B99DB39E911CF10
          Function 0041B0B0 Relevance: 7.7, Strings: 6, Instructions: 243COMMON
          Download Yara Rule
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.4329195548.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.4328850847.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329444698.000000000044C000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329590454.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329729812.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.0000000000475000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330183105.0000000000479000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_JIar3KCVf6.jbxd
          Similarity
          • API ID:
          • String ID: AES Encrypt$`F$ct != NULL$pt != NULL$skey != NULL$src/ciphers/aes/aes.c
          • API String ID: 0-3967662191
          • Opcode ID: a6b80467ef454164b750d16680bfbe19d805567f49fc0f9710b12e76149c865b
          • Instruction ID: ad1c17cc98b19c4b2f2ca8f0560a6b96a2727f9ddf056d271bac92a52dc1f1ca
          • Opcode Fuzzy Hash: a6b80467ef454164b750d16680bfbe19d805567f49fc0f9710b12e76149c865b
          • Instruction Fuzzy Hash: 44B187B31149908FD760CF2AE94475BB7A1F38C789F51961AEB8A43798D738E915CF00
          Function 00426C30 Relevance: 6.6, Strings: 5, Instructions: 367COMMON
          Download Yara Rule
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.4329195548.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.4328850847.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329444698.000000000044C000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329590454.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329729812.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.0000000000475000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330183105.0000000000479000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_JIar3KCVf6.jbxd
          Similarity
          • API ID:
          • String ID: @$@$@@@$key != NULL$src/pk/rsa/rsa_free.c
          • API String ID: 0-2093675991
          • Opcode ID: 25cd090bdebd40d055baf804e1594d85ca957965d514989a43741a3ae03caee0
          • Instruction ID: 718d020910b66d4c5aca3e35f84b6d2cfbc318ba0c0a19fd15697ca445333ce5
          • Opcode Fuzzy Hash: 25cd090bdebd40d055baf804e1594d85ca957965d514989a43741a3ae03caee0
          • Instruction Fuzzy Hash: 5BF15876A28AD08BD3718F15E441B9AB774F7C8788F01A219EF8953B49DB39D949CF00
          Function 00424560 Relevance: 6.5, Strings: 5, Instructions: 224COMMON
          Download Yara Rule
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.4329195548.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.4328850847.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329444698.000000000044C000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329590454.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329729812.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.0000000000475000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330183105.0000000000479000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_JIar3KCVf6.jbxd
          Similarity
          • API ID:
          • String ID: CHACHA-PRNG$in != NULL$inlen > 0$prng != NULL$src/prngs/chacha20.c
          • API String ID: 0-2025711577
          • Opcode ID: 2983135557e07b32510dcb1e2faa7470f20a8902d5aaf31705bccb9ba6726f1f
          • Instruction ID: 5be53dca8987487b9ba3fd5854d0615c89b9afa6c488ac5b9cc1865192f7baae
          • Opcode Fuzzy Hash: 2983135557e07b32510dcb1e2faa7470f20a8902d5aaf31705bccb9ba6726f1f
          • Instruction Fuzzy Hash: 558107737252F446D724CB69B801B9EBA62E382788FC94329DB8587F09C63DE915CF04
          Function 0042C770 Relevance: 5.4, Strings: 4, Instructions: 388COMMON
          Download Yara Rule
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.4329195548.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.4328850847.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329444698.000000000044C000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329590454.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329729812.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.0000000000475000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330183105.0000000000479000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_JIar3KCVf6.jbxd
          Similarity
          • API ID:
          • String ID: in != NULL$outlen != NULL$src/pk/asn1/der/object_identifier/der_decode_object_identifier.c$words != NULL
          • API String ID: 0-1913770635
          • Opcode ID: 619e0f2595409ee6bd85479ef76f8d279f44d0bf0d5b9528eb6c5e316482e675
          • Instruction ID: 67fee30eb4b8091eaa3ae154020750f4513685adc9beb032dd08466a68df32f6
          • Opcode Fuzzy Hash: 619e0f2595409ee6bd85479ef76f8d279f44d0bf0d5b9528eb6c5e316482e675
          • Instruction Fuzzy Hash: 2FC17BF3B042B84BD7125E6DA8C035EBB91F385785F898136DF4687310D279AE4AD788
          Function 0042BF10 Relevance: 5.2, Strings: 4, Instructions: 230COMMON
          Download Yara Rule
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.4329195548.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.4328850847.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329444698.000000000044C000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329590454.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329729812.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.0000000000475000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330183105.0000000000479000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_JIar3KCVf6.jbxd
          Similarity
          • API ID:
          • String ID: in != NULL$out != NULL$outlen != NULL$src/pk/asn1/der/ia5/der_decode_ia5_string.c
          • API String ID: 0-3733553005
          • Opcode ID: b078df66bed31af2b94bd68d082bd06a57dff0cf22276607fb3f26b49ad159e6
          • Instruction ID: 30bbd7e075bfe1ea6c80a340e61af9d3a9386ab2779cd252f719782a2806e0c0
          • Opcode Fuzzy Hash: b078df66bed31af2b94bd68d082bd06a57dff0cf22276607fb3f26b49ad159e6
          • Instruction Fuzzy Hash: 917167337141A0C6D72A8F68B88437E7A52E342395FCA8157EA5543392C73DCD49C7E9
          Function 00428F60 Relevance: 5.2, Strings: 4, Instructions: 223COMMON
          Download Yara Rule
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.4329195548.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.4328850847.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329444698.000000000044C000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329590454.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329729812.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.0000000000475000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330183105.0000000000479000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_JIar3KCVf6.jbxd
          Similarity
          • API ID:
          • String ID: in != NULL$out != NULL$outlen != NULL$src/pk/asn1/der/teletex_string/der_decode_teletex_string.c
          • API String ID: 0-2688822737
          • Opcode ID: 4f5e82a876445503dbad42e980b14438ef75e15063305373af73d4c4d83a8ab3
          • Instruction ID: 393813ab6e6ee486a79b6f0418081407d2480f5ba0fa9c4ebee19a79d877c7a7
          • Opcode Fuzzy Hash: 4f5e82a876445503dbad42e980b14438ef75e15063305373af73d4c4d83a8ab3
          • Instruction Fuzzy Hash: 2E7167737141B4D6EB29CF29B4083BE7A52E742355FCA8217EA6543391C33D8D89C369
          Function 0042D0D0 Relevance: 5.2, Strings: 4, Instructions: 222COMMON
          Download Yara Rule
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.4329195548.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.4328850847.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329444698.000000000044C000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329590454.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329729812.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.0000000000475000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330183105.0000000000479000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_JIar3KCVf6.jbxd
          Similarity
          • API ID:
          • String ID: in != NULL$out != NULL$outlen != NULL$src/pk/asn1/der/printable_string/der_decode_printable_string.c
          • API String ID: 0-126367437
          • Opcode ID: 22869d26f97f51de15121a9734f97310549c0434bba946511d2f37572cbebb17
          • Instruction ID: 3562fabcc20bebbf30f826504d48c981b50e099e19b701539900259a15aa6aae
          • Opcode Fuzzy Hash: 22869d26f97f51de15121a9734f97310549c0434bba946511d2f37572cbebb17
          • Instruction Fuzzy Hash: 28715333B141A0CAD729CF28B50436A7A12E352356FDA8257EE6643391C33DDD8AC35A
          Function 00429D60 Relevance: 4.3, Strings: 3, Instructions: 590COMMON
          Download Yara Rule
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.4329195548.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.4328850847.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329444698.000000000044C000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329590454.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329729812.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.0000000000475000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330183105.0000000000479000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_JIar3KCVf6.jbxd
          Similarity
          • API ID:
          • String ID: in != NULL$outlen != NULL$src/pk/asn1/der/utf8/der_length_utf8_string.c
          • API String ID: 0-1243452194
          • Opcode ID: 26ea93fc9c1cc2035086596e1d539ab6706ad21caf64030cff586a52eec9ee6a
          • Instruction ID: 838807f09d308ab80126cb3a3d3cafd7dfc79623c7dd27fe756064cf46ee5ece
          • Opcode Fuzzy Hash: 26ea93fc9c1cc2035086596e1d539ab6706ad21caf64030cff586a52eec9ee6a
          • Instruction Fuzzy Hash: 9322402AF343E456F3235639B4033B96610AF733C5F459323BE4561A62FB1A8753928D
          Function 0040E5F2 Relevance: 3.7, Strings: 2, Instructions: 1221COMMON
          Download Yara Rule
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.4329195548.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.4328850847.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329444698.000000000044C000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329590454.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329729812.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.0000000000475000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330183105.0000000000479000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_JIar3KCVf6.jbxd
          Similarity
          • API ID:
          • String ID: ./stb/stb_truetype.h$i != 0
          • API String ID: 0-13121079
          • Opcode ID: 05ed0276bf3f312bf5b29c9411e501a2f272d2fa24e4207cdce923fa1b3fd4c4
          • Instruction ID: 5b71b93a43b484bef199ab4dc345bee8c5028dfca2b052c53f48c468ccc026c5
          • Opcode Fuzzy Hash: 05ed0276bf3f312bf5b29c9411e501a2f272d2fa24e4207cdce923fa1b3fd4c4
          • Instruction Fuzzy Hash: EAD2F1739106C88EC776CF7B89813D8B361EF5D348F18CB12A6447AA69E73466C99F00
          Function 0043F530 Relevance: 2.9, Strings: 1, Instructions: 1694COMMON
          Download Yara Rule
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.4329195548.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.4328850847.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329444698.000000000044C000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329590454.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329729812.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.0000000000475000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330183105.0000000000479000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_JIar3KCVf6.jbxd
          Similarity
          • API ID:
          • String ID: VUUU
          • API String ID: 0-2040033107
          • Opcode ID: 4418ae21bc0cf5e2f114b0712eb773339447ae305d04ec9907109ecfb793c549
          • Instruction ID: 130f8c52f0110a159ce49b1f64126e5c1f78d569f230c1cfe4f4157eb541cf52
          • Opcode Fuzzy Hash: 4418ae21bc0cf5e2f114b0712eb773339447ae305d04ec9907109ecfb793c549
          • Instruction Fuzzy Hash: BDF20273A24F8082DB218F19E40466EB721F799B88F456313DF9A43B25DF39D9A6C704
          Function 00430080 Relevance: 2.8, Strings: 2, Instructions: 273COMMON
          Download Yara Rule
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.4329195548.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.4328850847.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329444698.000000000044C000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329590454.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329729812.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.0000000000475000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330183105.0000000000479000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_JIar3KCVf6.jbxd
          Similarity
          • API ID:
          • String ID: ;$<
          • API String ID: 0-167267906
          • Opcode ID: c23873a3f154147f1abd3c9b70b7254ac7b8141937bdc8c585fb615caca34d95
          • Instruction ID: 5d91632be94950f89cfac6133cf6376af270f15cd8b097738dbbf6019f395403
          • Opcode Fuzzy Hash: c23873a3f154147f1abd3c9b70b7254ac7b8141937bdc8c585fb615caca34d95
          • Instruction Fuzzy Hash: 71710AA3360B94874E1C8E37B8D50EA6992A7AAFD1749E139CE095B395CD38CC45C344
          Function 00433F70 Relevance: 1.7, Strings: 1, Instructions: 455COMMON
          Download Yara Rule
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.4329195548.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.4328850847.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329444698.000000000044C000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329590454.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329729812.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.0000000000475000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330183105.0000000000479000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_JIar3KCVf6.jbxd
          Similarity
          • API ID:
          • String ID: ?
          • API String ID: 0-1684325040
          • Opcode ID: 98d8da4a8fc36a9189d3a5a8204fd7f71db2ac61699b6e42cbf27aa38c2c57be
          • Instruction ID: fd3a3a4cce1ea4081c5212f03d96aed2b0ad05b8b53e6339cf2ee52db2b452a6
          • Opcode Fuzzy Hash: 98d8da4a8fc36a9189d3a5a8204fd7f71db2ac61699b6e42cbf27aa38c2c57be
          • Instruction Fuzzy Hash: 77F1A32231D2C086E761CE66A5047EF6F61E3EABC4F48A153EF8603B49D67CD942C709
          Function 0044A6B0 Relevance: 1.6, Strings: 1, Instructions: 319COMMON
          Download Yara Rule
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.4329195548.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.4328850847.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329444698.000000000044C000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329590454.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329729812.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.0000000000475000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330183105.0000000000479000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_JIar3KCVf6.jbxd
          Similarity
          • API ID:
          • String ID: pow
          • API String ID: 0-2276729525
          • Opcode ID: 660e95983277ab3072e8212d9c39dcedd04d2acdbab0cd2455516df3ed50a62e
          • Instruction ID: f3ab54e2d83cce6566794e1ef99d7af2c5926567cf26ed6b242455e520839016
          • Opcode Fuzzy Hash: 660e95983277ab3072e8212d9c39dcedd04d2acdbab0cd2455516df3ed50a62e
          • Instruction Fuzzy Hash: C8C14B626A4F8486F7225B35981036BA764EF963C5F109307FFC136664EF2DC4A3860B
          Function 0044AD70 Relevance: 1.4, Strings: 1, Instructions: 173COMMON
          Download Yara Rule
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.4329195548.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.4328850847.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329444698.000000000044C000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329590454.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329729812.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.0000000000475000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330183105.0000000000479000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_JIar3KCVf6.jbxd
          Similarity
          • API ID:
          • String ID: __powi
          • API String ID: 0-2331859415
          • Opcode ID: 1330c08b10c0cb3e80ecd3570cab57044675fabbefa82b284e7810d38ae7e224
          • Instruction ID: dafa203ca629b55db5ba368c17bf7dd373edd2691fc4f383e09dacd03ed2123b
          • Opcode Fuzzy Hash: 1330c08b10c0cb3e80ecd3570cab57044675fabbefa82b284e7810d38ae7e224
          • Instruction Fuzzy Hash: D6512661AD0A4149F7178B399811363B355AFAB3C9F24C317EE1276624EB1ECC67410B
          Function 00442680 Relevance: 1.4, Strings: 1, Instructions: 165COMMON
          Download Yara Rule
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.4329195548.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.4328850847.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329444698.000000000044C000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329590454.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329729812.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.0000000000475000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330183105.0000000000479000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_JIar3KCVf6.jbxd
          Similarity
          • API ID:
          • String ID: 8
          • API String ID: 0-806996323
          • Opcode ID: 27436e8818f1ff261e184caa5f4e822f2eaeb5183be0a948dcfcfafe1f659a3f
          • Instruction ID: 115ff445f6305c0f7500cc765ed5537348b52bb764491164a16f0c412ad6d20e
          • Opcode Fuzzy Hash: 27436e8818f1ff261e184caa5f4e822f2eaeb5183be0a948dcfcfafe1f659a3f
          • Instruction Fuzzy Hash: 6C415CB27344904BEB2D8A366A01B6656426395BC8FC8E135FD0B97F94E97CDD00C740
          Function 0042D7A0 Relevance: 1.0, Instructions: 977COMMON
          Download Yara Rule
          Memory Dump Source
          • Source File: 00000000.00000002.4329195548.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.4328850847.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329444698.000000000044C000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329590454.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329729812.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.0000000000475000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330183105.0000000000479000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_JIar3KCVf6.jbxd
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: e35b857cac3af034f984884b459392bf1861d6244502776c5fdae9591ea685da
          • Instruction ID: 7d5235c861f508e2fc952f57890fa05d2295b34d5a1dfbdd683e7d8e6e486bd7
          • Opcode Fuzzy Hash: e35b857cac3af034f984884b459392bf1861d6244502776c5fdae9591ea685da
          • Instruction Fuzzy Hash: A0626BB2B20A7083CB29CF06A4147BA7B52FB50B99F85D627EE5707340EA3DD955C309
          Function 00431930 Relevance: .9, Instructions: 859COMMON
          Download Yara Rule
          Memory Dump Source
          • Source File: 00000000.00000002.4329195548.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.4328850847.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329444698.000000000044C000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329590454.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329729812.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.0000000000475000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330183105.0000000000479000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_JIar3KCVf6.jbxd
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: ef8892b2463b680909a4ae86c574e8fa8d27781d258ce84b611bc6160af58840
          • Instruction ID: f1188b1ea3ce508364264ed2e6d030fc32bf4ae996304925ed79ec0e6898f730
          • Opcode Fuzzy Hash: ef8892b2463b680909a4ae86c574e8fa8d27781d258ce84b611bc6160af58840
          • Instruction Fuzzy Hash: 9F6299B3B10BA882CB118F1AE805B4E7768F308BD8F599226EF5D67754DA3CD596C304
          Function 00436DF0 Relevance: .7, Instructions: 651COMMON
          Download Yara Rule
          Memory Dump Source
          • Source File: 00000000.00000002.4329195548.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.4328850847.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329444698.000000000044C000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329590454.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329729812.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.0000000000475000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330183105.0000000000479000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_JIar3KCVf6.jbxd
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: 5b035d110812bfd79224b97196fae84813883215a092d90cadda867322c67e15
          • Instruction ID: 10991665ef57fd1ff1288690e90fcaf1825ddc8138b82ec075224e3f26a6a27f
          • Opcode Fuzzy Hash: 5b035d110812bfd79224b97196fae84813883215a092d90cadda867322c67e15
          • Instruction Fuzzy Hash: 332204F3B20F9487CA108F9998485EA7B61F71DFC87A89217DF192B311DA39C956C305
          Function 0042D7C0 Relevance: .6, Instructions: 625COMMON
          Download Yara Rule
          Memory Dump Source
          • Source File: 00000000.00000002.4329195548.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.4328850847.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329444698.000000000044C000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329590454.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329729812.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.0000000000475000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330183105.0000000000479000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_JIar3KCVf6.jbxd
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: 6f093c98d1338e89b53d104afc4c3d9511e71a74e8975ba7db7f954e3224f6a0
          • Instruction ID: c7493f02807ab922b995619241f1eaee41655237b4e3965428a4f0452662f4b1
          • Opcode Fuzzy Hash: 6f093c98d1338e89b53d104afc4c3d9511e71a74e8975ba7db7f954e3224f6a0
          • Instruction Fuzzy Hash: 771238B236071587CB348F15A84566B6A11F70C7EAF45B32BEE6E87380E97DD885C309
          Function 00438AD0 Relevance: .6, Instructions: 555COMMON
          Download Yara Rule
          Memory Dump Source
          • Source File: 00000000.00000002.4329195548.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.4328850847.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329444698.000000000044C000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329590454.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329729812.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.0000000000475000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330183105.0000000000479000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_JIar3KCVf6.jbxd
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: e4bd308b67cd3dddfa38abf2c297df669019dbe062bafb407787cbcfb514842c
          • Instruction ID: de1e81bb1500118aa22daf27ffb6b51476f4a994d2f4ff2bb6c48c5051b3cfaf
          • Opcode Fuzzy Hash: e4bd308b67cd3dddfa38abf2c297df669019dbe062bafb407787cbcfb514842c
          • Instruction Fuzzy Hash: 7D320FB3A14F8482D7258F19E44066EBB60F399B88F516316EF9A13B21DB7DD582C704
          Function 0043E8F0 Relevance: .5, Instructions: 493COMMON
          Download Yara Rule
          Memory Dump Source
          • Source File: 00000000.00000002.4329195548.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.4328850847.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329444698.000000000044C000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329590454.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329729812.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.0000000000475000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330183105.0000000000479000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_JIar3KCVf6.jbxd
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: bfbb346b4041219c164c170b68f751b773908ec23a0e384af68668d5c18635a2
          • Instruction ID: b8c81d6d521b88e89863bf68b1b327ff1a8dc99d59198378b182f4c54c3cb5d0
          • Opcode Fuzzy Hash: bfbb346b4041219c164c170b68f751b773908ec23a0e384af68668d5c18635a2
          • Instruction Fuzzy Hash: 8D02D1B3B25BC582CB188F1AD80129DB765FB89798F05A316EF5E57765EB38C184C304
          Function 0043DDF0 Relevance: .3, Instructions: 349COMMON
          Download Yara Rule
          Memory Dump Source
          • Source File: 00000000.00000002.4329195548.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.4328850847.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329444698.000000000044C000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329590454.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329729812.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.0000000000475000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330183105.0000000000479000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_JIar3KCVf6.jbxd
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: 2ead59fe9895eafa2755e1eb93c391e3f4d2e1651a06b561ad1b71010e3378b2
          • Instruction ID: 4a36ec163425a8a9cab0ffda3b2a86a30d4707116a45e51630f9e71ccfa142b2
          • Opcode Fuzzy Hash: 2ead59fe9895eafa2755e1eb93c391e3f4d2e1651a06b561ad1b71010e3378b2
          • Instruction Fuzzy Hash: 8EC1EEB2F01A9987CB148F6ED804A9E7364F749BDDF568223EB0E67724DA38C546C700
          Function 0043D8F0 Relevance: .3, Instructions: 343COMMON
          Download Yara Rule
          Memory Dump Source
          • Source File: 00000000.00000002.4329195548.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.4328850847.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329444698.000000000044C000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329590454.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329729812.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.0000000000475000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330183105.0000000000479000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_JIar3KCVf6.jbxd
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: 49253631b7aa80c8176b38d66653f8beb5696efb05590bc5df8b9accc965d7e4
          • Instruction ID: 5e81f0d140a5a28077e001467ca6e08f95308c3e6430951ade3f22ead854fa53
          • Opcode Fuzzy Hash: 49253631b7aa80c8176b38d66653f8beb5696efb05590bc5df8b9accc965d7e4
          • Instruction Fuzzy Hash: F7C19DB2F10A9887CF148F69E804A9D6364FB49BDDF5A9222EB0E67724DA38C555C304
          Function 00438640 Relevance: .3, Instructions: 315COMMON
          Download Yara Rule
          Memory Dump Source
          • Source File: 00000000.00000002.4329195548.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.4328850847.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329444698.000000000044C000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329590454.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329729812.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.0000000000475000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330183105.0000000000479000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_JIar3KCVf6.jbxd
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: 7aa221ed77e7c0a7d38910bb5ebfbaa5aeecdcfd5e9f82f575dc76e54ebafa1b
          • Instruction ID: c46bbb40ff3f59a53a480b2ba7b6408a2e5de3a9225c4cf769f754f9c9987ac2
          • Opcode Fuzzy Hash: 7aa221ed77e7c0a7d38910bb5ebfbaa5aeecdcfd5e9f82f575dc76e54ebafa1b
          • Instruction Fuzzy Hash: 8FB102F3B20F6483CE40CF8998496A9BB66FB1CBC43959217DF092B321DA39C916C354
          Function 0043F0B0 Relevance: .3, Instructions: 312COMMON
          Download Yara Rule
          Memory Dump Source
          • Source File: 00000000.00000002.4329195548.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.4328850847.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329444698.000000000044C000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329590454.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329729812.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.0000000000475000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330183105.0000000000479000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_JIar3KCVf6.jbxd
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: 6f76bcd4d0e819341c889d8932e884d091c26589f47308d33bc83cc6a9ab453a
          • Instruction ID: de506162a80793f1779cd7cb38e4e7c020c9a716942166f6818701fd6bb3d06c
          • Opcode Fuzzy Hash: 6f76bcd4d0e819341c889d8932e884d091c26589f47308d33bc83cc6a9ab453a
          • Instruction Fuzzy Hash: DDB1DAF3730FD48AC6108FA994449EA7B60F31EF88BA85316DE1927311DE39CA56D305
          Function 0043D560 Relevance: .2, Instructions: 249COMMON
          Download Yara Rule
          Memory Dump Source
          • Source File: 00000000.00000002.4329195548.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.4328850847.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329444698.000000000044C000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329590454.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329729812.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.0000000000475000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330183105.0000000000479000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_JIar3KCVf6.jbxd
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: 3a2c4f6ee6824b1ec009a19beb09f8dce210161be14daa52d35717bdb18318da
          • Instruction ID: d7381d4b9a88f0f0eb3f4ca530fce4d77de73d2ae47b87c13261a52aae88835c
          • Opcode Fuzzy Hash: 3a2c4f6ee6824b1ec009a19beb09f8dce210161be14daa52d35717bdb18318da
          • Instruction Fuzzy Hash: 9491F3B2B44B9486CB509F26A80139EB7A5F78DFD8F44412AEF8C93B18DA3CE445C704
          Function 0041D290 Relevance: .2, Instructions: 230COMMON
          Download Yara Rule
          Memory Dump Source
          • Source File: 00000000.00000002.4329195548.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.4328850847.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329444698.000000000044C000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329590454.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329729812.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.0000000000475000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330183105.0000000000479000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_JIar3KCVf6.jbxd
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: e06cd1b3900a71accc9fbb5d8182bb95d6d8277c7c0bc08f68511659e6d5d045
          • Instruction ID: bb242fbb023d8f12226aa3a40addfc07092be5d9a9f8d00502ad99653d7898e7
          • Opcode Fuzzy Hash: e06cd1b3900a71accc9fbb5d8182bb95d6d8277c7c0bc08f68511659e6d5d045
          • Instruction Fuzzy Hash: F6B1F36260D6E449D3268F38D150BAFBF61F79B74DF699345DFCA1590AE328C980CB40
          Function 00442EC0 Relevance: .2, Instructions: 221COMMON
          Download Yara Rule
          Memory Dump Source
          • Source File: 00000000.00000002.4329195548.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.4328850847.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329444698.000000000044C000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329590454.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329729812.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.0000000000475000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330183105.0000000000479000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_JIar3KCVf6.jbxd
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: c6f9209c76463affb1fc64c073be9c53538476776f949b071625a0de9305ca22
          • Instruction ID: b52e4fc685dc290eab3deec7bfea4aac1b1056af89f697b75e67cc82b0b5b156
          • Opcode Fuzzy Hash: c6f9209c76463affb1fc64c073be9c53538476776f949b071625a0de9305ca22
          • Instruction Fuzzy Hash: CD71C0B2B0465482DA10CF16E90164EB365F788FF8F588326EFAD67B98DA3CD556C700
          Function 00442310 Relevance: .2, Instructions: 207COMMON
          Download Yara Rule
          Memory Dump Source
          • Source File: 00000000.00000002.4329195548.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.4328850847.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329444698.000000000044C000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329590454.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329729812.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.0000000000475000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330183105.0000000000479000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_JIar3KCVf6.jbxd
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: d518b21095839f62b4eb2f9c2836a65beaee3c86fc66049877aba67e5f0d52ac
          • Instruction ID: 6f9637240c4fc82a6e264f0c7939bee12327731c2a5b464b2d3c8e04234be936
          • Opcode Fuzzy Hash: d518b21095839f62b4eb2f9c2836a65beaee3c86fc66049877aba67e5f0d52ac
          • Instruction Fuzzy Hash: B671D2B3B51B8096DB20CF26EA1039E7765FB89BD4F844026EE8D67B58DA3CC541C705
          Function 00436E60 Relevance: .2, Instructions: 207COMMON
          Download Yara Rule
          Memory Dump Source
          • Source File: 00000000.00000002.4329195548.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.4328850847.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329444698.000000000044C000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329590454.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329729812.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.0000000000475000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330183105.0000000000479000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_JIar3KCVf6.jbxd
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: 83dc53c68d53fb978fee675c2b6bcc0f263afe825ad52d22be7341f643d327b1
          • Instruction ID: 8f074b852a10ed76cad8f793daf3c83c92ae0ac5dc59c960a4626c9b29a8c3a2
          • Opcode Fuzzy Hash: 83dc53c68d53fb978fee675c2b6bcc0f263afe825ad52d22be7341f643d327b1
          • Instruction Fuzzy Hash: 8371B3F372164482CB55CF29DA0C61DB76BE72C7D4B15D222CA584BB5CEA3EC848C390
          Function 0042DB70 Relevance: .2, Instructions: 205COMMON
          Download Yara Rule
          Memory Dump Source
          • Source File: 00000000.00000002.4329195548.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.4328850847.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329444698.000000000044C000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329590454.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329729812.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.0000000000475000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330183105.0000000000479000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_JIar3KCVf6.jbxd
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: 9e82690ed3c6a127f8a5cfd636323b52569de13bbefa8bb726cabbd2b91c10e7
          • Instruction ID: cb8edbd1a8840d1fe78edd79685ea583116594a30ff5d9af6506284d0d795d11
          • Opcode Fuzzy Hash: 9e82690ed3c6a127f8a5cfd636323b52569de13bbefa8bb726cabbd2b91c10e7
          • Instruction Fuzzy Hash: AC71ACB3F20B6083EB49DF52E82526C3760F798B90B818123DF5A63749DABCD956C705
          Function 0042FDB0 Relevance: .2, Instructions: 202COMMON
          Download Yara Rule
          Memory Dump Source
          • Source File: 00000000.00000002.4329195548.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.4328850847.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329444698.000000000044C000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329590454.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329729812.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.0000000000475000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330183105.0000000000479000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_JIar3KCVf6.jbxd
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: ffd21d5279826c4126d82bf87adf3ab2340137cae83e83d45d1716dcf0eb0e1c
          • Instruction ID: 6aa076050bee5f2ac73fd08deac89e9ff77eea1cc434c9959de327da71b866bb
          • Opcode Fuzzy Hash: ffd21d5279826c4126d82bf87adf3ab2340137cae83e83d45d1716dcf0eb0e1c
          • Instruction Fuzzy Hash: 845195BB330FE483D614CF5EAA45C8E2624F35ABC9BD26126CF2A17741C676C906D316
          Function 00431E50 Relevance: .2, Instructions: 190COMMON
          Download Yara Rule
          Memory Dump Source
          • Source File: 00000000.00000002.4329195548.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.4328850847.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329444698.000000000044C000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329590454.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329729812.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.0000000000475000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330183105.0000000000479000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_JIar3KCVf6.jbxd
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: 797930b3c767b3a5c50ff2ec3843067cc75f94f511a211020cbe68f559fd687a
          • Instruction ID: 0caeef0a636507be1ad47e3bfdd1494655cee35ce0ae6fbd22ab343264488bdf
          • Opcode Fuzzy Hash: 797930b3c767b3a5c50ff2ec3843067cc75f94f511a211020cbe68f559fd687a
          • Instruction Fuzzy Hash: 2151D1B3B80E3882C651CF2699049DA7B71F35DB88B88A103DE4997321DBB9CD07D305
          Function 00432350 Relevance: .1, Instructions: 147COMMON
          Download Yara Rule
          Memory Dump Source
          • Source File: 00000000.00000002.4329195548.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.4328850847.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329444698.000000000044C000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329590454.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329729812.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.0000000000475000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330183105.0000000000479000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_JIar3KCVf6.jbxd
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: bb3fd261df8f5334166460892f1ea2fbc46cb679a63e7ae8e11bb40e693214d3
          • Instruction ID: 1198a1d618d21597c7fdf784ef7830c075f42d11f25c42d46a28d1e500ab7a2a
          • Opcode Fuzzy Hash: bb3fd261df8f5334166460892f1ea2fbc46cb679a63e7ae8e11bb40e693214d3
          • Instruction Fuzzy Hash: 2C41E4B3B0174896DB118B6AEA05F4AB299F768FD8F058222EE0C97754DA3DD616C700
          Function 00436330 Relevance: .1, Instructions: 120COMMON
          Download Yara Rule
          Memory Dump Source
          • Source File: 00000000.00000002.4329195548.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.4328850847.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329444698.000000000044C000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329590454.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329729812.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.0000000000475000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330183105.0000000000479000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_JIar3KCVf6.jbxd
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: 7d557142c9674155e3f24b31631c14bd3846b68328ca37c70a74876762565fe9
          • Instruction ID: 4612be69f75045153b942a953fa686ac685094ffb65ae58637844b2f9cf83290
          • Opcode Fuzzy Hash: 7d557142c9674155e3f24b31631c14bd3846b68328ca37c70a74876762565fe9
          • Instruction Fuzzy Hash: AA3158B3B4172257CF1C0EB4DDA2F5A3A54E3A578170F503FCA1682700DE7C8594D208
          Function 004491C0 Relevance: .1, Instructions: 97COMMON
          Download Yara Rule
          Memory Dump Source
          • Source File: 00000000.00000002.4329195548.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.4328850847.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329444698.000000000044C000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329590454.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329729812.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.0000000000475000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330183105.0000000000479000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_JIar3KCVf6.jbxd
          Similarity
          • API ID:
          • String ID:
          • API String ID:
          • Opcode ID: 6ce3b95507de508f35ee10a53b679ed0df14292572262596aaea73e0a35a29a6
          • Instruction ID: 098958ad70eff0168eec2db00ce4451029b570123527c046867fe7d5d185cc65
          • Opcode Fuzzy Hash: 6ce3b95507de508f35ee10a53b679ed0df14292572262596aaea73e0a35a29a6
          • Instruction Fuzzy Hash: 27217C423252A413BF14857AA450FABB342B399FD0B44DC774E0D87F44E9AC8C82D708
          Function 00449D70 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 159COMMON
          Download Yara Rule
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.4329195548.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.4328850847.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329444698.000000000044C000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329590454.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329729812.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.0000000000475000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330183105.0000000000479000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_JIar3KCVf6.jbxd
          Similarity
          • API ID: 00007$B240B290
          • String ID: %ws$./stb/stb_truetype.h$<unknown>$Assertion failed!Program: %wsFile: %ws, Line %uExpression: %ws$MinGW Runtime Assertion$size < 0x40000000
          • API String ID: 1078228770-4136300296
          • Opcode ID: 2f4c14a0a52561adf94c567a4595c88fe317bdc6e339cc6270f64f670df872d6
          • Instruction ID: 6f8923242ed20f7163a1bf5d02607f53ae7df8d4d7352d314fae2a5e014cb53b
          • Opcode Fuzzy Hash: 2f4c14a0a52561adf94c567a4595c88fe317bdc6e339cc6270f64f670df872d6
          • Instruction Fuzzy Hash: 7D5127A3704A8496F7149F22A8513FF6760FB46B89F48412BEF494B741EF6CC916C349
          Function 004451A0 Relevance: 13.6, APIs: 9, Instructions: 123COMMON
          Download Yara Rule
          APIs
          Memory Dump Source
          • Source File: 00000000.00000002.4329195548.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.4328850847.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329444698.000000000044C000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329590454.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329729812.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.0000000000475000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330183105.0000000000479000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_JIar3KCVf6.jbxd
          Similarity
          • API ID: 00007$B2414B2414900
          • String ID:
          • API String ID: 1689323992-0
          • Opcode ID: 59180e584979c7d7f318680df699a9ab9b83a602b08bac20b8a7ac782c7669aa
          • Instruction ID: 35e44a6a588fb490f323e18639f5af53f3d3dff6b7962e792c6fc62c6283f247
          • Opcode Fuzzy Hash: 59180e584979c7d7f318680df699a9ab9b83a602b08bac20b8a7ac782c7669aa
          • Instruction Fuzzy Hash: C741F372605E408BFF259F3198013292B60FB95FA9F184217DE6E8B39ADF6DC4458708
          Function 00443FF0 Relevance: 13.6, APIs: 9, Instructions: 74COMMON
          Download Yara Rule
          APIs
          • 00007FFDB2405540.KERNEL32 ref: 0044400C
            • Part of subcall function 00443F60: 00007FFDB2BECF40.MSVCRT ref: 00443F91
          Memory Dump Source
          • Source File: 00000000.00000002.4329195548.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.4328850847.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329444698.000000000044C000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329590454.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329729812.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.0000000000475000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330183105.0000000000479000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_JIar3KCVf6.jbxd
          Similarity
          • API ID: 00007$B2405540
          • String ID:
          • API String ID: 105744335-0
          • Opcode ID: 97b0831e5a7769245da364ea2d2d55a7a2dff0437428789fbf55d3c943effd2c
          • Instruction ID: 84018c1aff3d9ca0e86307b8b4fea2f654cf6371522dc2f9a8567e51fa322494
          • Opcode Fuzzy Hash: 97b0831e5a7769245da364ea2d2d55a7a2dff0437428789fbf55d3c943effd2c
          • Instruction Fuzzy Hash: 9C3181B1605A408BFB209F32F81875A77A0F748BA5F08022ACB5D4B791DF7DD045C718
          Function 004481D0 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 142COMMON
          Download Yara Rule
          APIs
          Strings
          • Mingw-w64 runtime failure:, xrefs: 004481F7
          • VirtualProtect failed with code 0x%x, xrefs: 0044836D
          • Address %p has no image-section, xrefs: 00448247, 00448398
          • VirtualQuery failed for %d bytes at address %p, xrefs: 00448387
          Memory Dump Source
          • Source File: 00000000.00000002.4329195548.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.4328850847.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329444698.000000000044C000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329590454.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329729812.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.0000000000475000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330183105.0000000000479000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_JIar3KCVf6.jbxd
          Similarity
          • API ID: 00007B240
          • String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section$Mingw-w64 runtime failure:
          • API String ID: 2045518715-1534286854
          • Opcode ID: 5829d411d79bf2f04f4b86bd0e0eeea97607463f4adbecea34ea895fd0045103
          • Instruction ID: 1da23075647b31db25f0d955147035f4bcbd6cfe3dda3a48027729582f250441
          • Opcode Fuzzy Hash: 5829d411d79bf2f04f4b86bd0e0eeea97607463f4adbecea34ea895fd0045103
          • Instruction Fuzzy Hash: 9751C0B2304B8496EB109F52E84079E7764FB9ABD8F48812AEE4C07714EF7DC54AC748
          Function 00447010 Relevance: 12.2, APIs: 8, Instructions: 187COMMON
          Download Yara Rule
          APIs
          • 00007FFDB2414AB0.KERNEL32 ref: 00447059
          • 00007FFDB2414AD0.KERNEL32 ref: 00447093
          • 00007FFDB2414AD0.KERNEL32(?,?,?,?,?,?,00007FFDB43BF230,00007FFDB43BFAA0,00000068,?,0044734E,?,?,004475DF), ref: 004470F2
          • 00007FFDB2414AD0.KERNEL32(?,?,?,?,?,?,00007FFDB43BF230,00007FFDB43BFAA0,00000068,?,0044734E,?,?,004475DF), ref: 0044720A
          • 00007FFDB2414A70.KERNEL32 ref: 0044726D
          Memory Dump Source
          • Source File: 00000000.00000002.4329195548.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.4328850847.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329444698.000000000044C000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329590454.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329729812.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.0000000000475000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330183105.0000000000479000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_JIar3KCVf6.jbxd
          Similarity
          • API ID: 00007B2414
          • String ID:
          • API String ID: 755199726-0
          • Opcode ID: 00e90e24423ea1dc9ff3c28cdf7ae7811bf5e0b8483166b657f5eab604efea8b
          • Instruction ID: ef32bc6e99e114a94b1225b865deabad57c658c4cacf32569507bd4e5a9bef3b
          • Opcode Fuzzy Hash: 00e90e24423ea1dc9ff3c28cdf7ae7811bf5e0b8483166b657f5eab604efea8b
          • Instruction Fuzzy Hash: 3351F32230D90146FB315667BA4637B01067B84798F684567EF4A86790EFADCAC3C21F
          Function 00447380 Relevance: 12.1, APIs: 8, Instructions: 97COMMON
          Download Yara Rule
          APIs
            • Part of subcall function 004472E0: 00007FFDB43BFAA0.KERNEL32(00000120,?,00000068,00000000,?,?,004475DF,?,?,?,?,?,?,?,00000100,004467F9), ref: 0044730E
            • Part of subcall function 004472E0: 00007FFDB43BF230.KERNEL32(?,?,004475DF,?,?,?,?,?,?,?,00000100,004467F9,?,?,?,00000100), ref: 00447321
          • 00007FFDB43B07E0.KERNEL32 ref: 004473F7
          • 00007FFDB43BF230.KERNEL32 ref: 00447433
          Memory Dump Source
          • Source File: 00000000.00000002.4329195548.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.4328850847.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329444698.000000000044C000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329590454.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329729812.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.0000000000475000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330183105.0000000000479000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_JIar3KCVf6.jbxd
          Similarity
          • API ID: 00007$F230
          • String ID:
          • API String ID: 4009361889-0
          • Opcode ID: e90f9904c9570d7432689e729ef5ea443a6a4c0f43478121cca06f58c5d10f36
          • Instruction ID: 92a0d4216a57ccb5c4c36c9404e36f73cd5cd6856def24fae90015702daab2e8
          • Opcode Fuzzy Hash: e90f9904c9570d7432689e729ef5ea443a6a4c0f43478121cca06f58c5d10f36
          • Instruction Fuzzy Hash: BA31A132304A4485EB10AF36D9107A92350EB86BE8F8946379E2D9B3D5DF78D846D309
          Function 00446C30 Relevance: 10.6, APIs: 7, Instructions: 67COMMON
          Download Yara Rule
          APIs
          • 00007FFDB240BD80.KERNEL32(00000000,?,?,00446D88,?,?,?,?,00447899), ref: 00446C90
          • 00007FFDB240BD80.KERNEL32(?,00446D88,?,?,?,?,00447899), ref: 00446CA6
          • 00007FFDB43F14B0.KERNEL32(?,00446D88,?,?,?,?,00447899), ref: 00446CCB
          • 00007FFDB43F14B0.KERNEL32(?,00446D88,?,?,?,?,00447899), ref: 00446CD1
          • 00007FFDB43F14B0.KERNEL32(?,00446D88,?,?,?,?,00447899), ref: 00446CD7
          • 00007FFDB24148E0.KERNEL32 ref: 00446D00
          • 00007FFDB24148E0.KERNEL32 ref: 00446D15
          Memory Dump Source
          • Source File: 00000000.00000002.4329195548.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.4328850847.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329444698.000000000044C000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329590454.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329729812.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.0000000000475000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330183105.0000000000479000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_JIar3KCVf6.jbxd
          Similarity
          • API ID: 00007$B240B24148
          • String ID:
          • API String ID: 1217005959-0
          • Opcode ID: aee23c6344c7fb3add9ad12a43c092c0a28a2ea76157a4f3c4fd6174fc9aeece
          • Instruction ID: 85d91dcdd85cc778f47579e717691478c4e2607818c14c7b765887303b1ab9d6
          • Opcode Fuzzy Hash: aee23c6344c7fb3add9ad12a43c092c0a28a2ea76157a4f3c4fd6174fc9aeece
          • Instruction Fuzzy Hash: C3219F72701A4089FB249F36F55075A7691EB45B99F08813A8E1D4B3D8DF78C485C740
          Function 00447EA0 Relevance: 10.6, APIs: 7, Instructions: 50COMMON
          Download Yara Rule
          APIs
          Memory Dump Source
          • Source File: 00000000.00000002.4329195548.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.4328850847.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329444698.000000000044C000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329590454.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329729812.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.0000000000475000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330183105.0000000000479000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_JIar3KCVf6.jbxd
          Similarity
          • API ID: 00007$B240$B2410760B24146B2414880B242F1010
          • String ID:
          • API String ID: 1179197518-0
          • Opcode ID: deaf23483d9639601f314d615858b98b38ef3786b12cb113008194479eea6342
          • Instruction ID: fb2740c50672af815d0dc852a418e7d065a695ac5c913545edb84c3933d7b547
          • Opcode Fuzzy Hash: deaf23483d9639601f314d615858b98b38ef3786b12cb113008194479eea6342
          • Instruction Fuzzy Hash: F12107F5615F00A9FB009F61F84039937A4F709785F541126DE8E0B725EF79C509C749
          Function 00443410 Relevance: 9.1, APIs: 6, Instructions: 120COMMON
          Download Yara Rule
          Memory Dump Source
          • Source File: 00000000.00000002.4329195548.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.4328850847.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329444698.000000000044C000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329590454.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329729812.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.0000000000475000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330183105.0000000000479000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_JIar3KCVf6.jbxd
          Similarity
          • API ID: 00007B2407
          • String ID:
          • API String ID: 2903576085-0
          • Opcode ID: 01b45a55a69e125e66e8f9f759b5bdd697531d1c6a8d6738dadb556975b1f85d
          • Instruction ID: e13d3cdfbf082806ee20d7f7d895fa233f310e5791a8b968bd1d0b8ec42dda43
          • Opcode Fuzzy Hash: 01b45a55a69e125e66e8f9f759b5bdd697531d1c6a8d6738dadb556975b1f85d
          • Instruction Fuzzy Hash: 0F31A0727025018AFB269F75E9003AA6251A744FAAF5C8136CF198B384EF7CCE81C759
          Function 004432D0 Relevance: 9.1, APIs: 6, Instructions: 97COMMON
          Download Yara Rule
          APIs
          • 00007FFDB2405550.KERNEL32 ref: 00443322
          • 00007FFDB2414AD0.KERNEL32(-00000001,?,?,?,00443DF2,?,?,-00000001,?,0044568F,0046E860,?,?,?,?,00419E7E), ref: 0044336D
          Memory Dump Source
          • Source File: 00000000.00000002.4329195548.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.4328850847.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329444698.000000000044C000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329590454.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329729812.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.0000000000475000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330183105.0000000000479000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_JIar3KCVf6.jbxd
          Similarity
          • API ID: 00007$B2405550B2414
          • String ID:
          • API String ID: 3910939004-0
          • Opcode ID: 61fa215acfba8ef2c404a98a7a67f10f30f771d586b135d59bc6afabddeeb621
          • Instruction ID: 6d9df090a6a46d9521510297e6f6338699c86bcae1b0bf9c13b4fe18ed104bac
          • Opcode Fuzzy Hash: 61fa215acfba8ef2c404a98a7a67f10f30f771d586b135d59bc6afabddeeb621
          • Instruction Fuzzy Hash: 58319A727016018BFB268F35ED0171A2295FB80F9AF188036DE0D8A388EE7CCD81D758
          Function 00444DD0 Relevance: 9.1, APIs: 6, Instructions: 58COMMON
          Download Yara Rule
          APIs
            • Part of subcall function 00443FF0: 00007FFDB2405540.KERNEL32 ref: 0044400C
          • 00007FFDB2405540.KERNEL32 ref: 00444E0B
          • 00007FFDB24148E0.KERNEL32 ref: 00444E36
          • 00007FFDB2BEAF80.MSVCRT ref: 00444E4C
          • 00007FFDB24148E0.KERNEL32 ref: 00444E6D
          • 00007FFDB2405B90.KERNEL32 ref: 00444E8D
          • 00007FFDB24148E0.KERNEL32 ref: 00444EA4
          Memory Dump Source
          • Source File: 00000000.00000002.4329195548.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.4328850847.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329444698.000000000044C000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329590454.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329729812.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.0000000000475000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330183105.0000000000479000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_JIar3KCVf6.jbxd
          Similarity
          • API ID: 00007$B24148$B2405540$B2405
          • String ID:
          • API String ID: 1256241951-0
          • Opcode ID: 309275fb592f3a1f280712f478e6c214d8f45cd514e92d0524d8182ee6123551
          • Instruction ID: 97c3884ddb24a0a65286070f8090232e66e699ef44d473d24fde5009f4017561
          • Opcode Fuzzy Hash: 309275fb592f3a1f280712f478e6c214d8f45cd514e92d0524d8182ee6123551
          • Instruction Fuzzy Hash: 02211572605A4086FB25DF21D45836A7BA5FBC4F19F29812ACF0A5B394DF7CC889C358
          Function 0043E4A1 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 45COMMON
          Download Yara Rule
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.4329195548.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.4328850847.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329444698.000000000044C000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329590454.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329729812.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.0000000000475000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330183105.0000000000479000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_JIar3KCVf6.jbxd
          Similarity
          • API ID: 00007$B3727160$B3727
          • String ID: ($Microsoft Base Cryptographic Provider v1.0
          • API String ID: 4268273863-4046902070
          • Opcode ID: 3b29cd3144abd54a9fe93ac7177df76fe3ca41f284f799d6c0131ebe58efcd5f
          • Instruction ID: dff9379d9aeb68f4d65eaebfee51263ed842910cc259e58d3651997527c4fff5
          • Opcode Fuzzy Hash: 3b29cd3144abd54a9fe93ac7177df76fe3ca41f284f799d6c0131ebe58efcd5f
          • Instruction Fuzzy Hash: C701A7B1305B8094F720CF53BD1079A2611B799BD9F445221EE8E97794EF7DC586C704
          Function 004460D0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 34COMMON
          Download Yara Rule
          APIs
          Strings
          • (, xrefs: 00446137
          • Assertion failed: (%s), file %s, line %d, xrefs: 00446130
          • /build/mingw-w64-2TvZY_/mingw-w64-5.0.3/mingw-w64-libraries/winpthreads/src/rwlock.c, xrefs: 0044611E
          • (((rwlock_t *)*rwl)->valid == LIFE_RWLOCK) && (((rwlock_t *)*rwl)->busy > 0), xrefs: 00446129
          Memory Dump Source
          • Source File: 00000000.00000002.4329195548.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.4328850847.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329444698.000000000044C000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329590454.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329729812.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.0000000000475000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330183105.0000000000479000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_JIar3KCVf6.jbxd
          Similarity
          • API ID: 00007
          • String ID: ($(((rwlock_t *)*rwl)->valid == LIFE_RWLOCK) && (((rwlock_t *)*rwl)->busy > 0)$/build/mingw-w64-2TvZY_/mingw-w64-5.0.3/mingw-w64-libraries/winpthreads/src/rwlock.c$Assertion failed: (%s), file %s, line %d
          • API String ID: 3568877910-1623117014
          • Opcode ID: 36a0be86141b290ca433acaf7aefeb8e68fff5d20ef49425802d2c89b49bad39
          • Instruction ID: fc95514ca36dcc8db9f3c9fb21e7108aa1e6841972c35c626a2591644854ab43
          • Opcode Fuzzy Hash: 36a0be86141b290ca433acaf7aefeb8e68fff5d20ef49425802d2c89b49bad39
          • Instruction Fuzzy Hash: B5014472700E4E96EB009F25D85139D3764F796B59F858106DA0C97322DF7CC949C78A
          Function 004478E0 Relevance: 7.6, APIs: 5, Instructions: 86COMMON
          Download Yara Rule
          APIs
          • 00007FFDB43BFAA0.KERNEL32 ref: 004478F9
          • 00007FFDB43BF230.KERNEL32 ref: 0044790F
            • Part of subcall function 00446B90: 00007FFDB43BFAA0.KERNEL32 ref: 00446BA6
            • Part of subcall function 00446B90: 00007FFDB43BF230.KERNEL32 ref: 00446BC3
          • 00007FFDB43BF230.KERNEL32 ref: 00447973
          Memory Dump Source
          • Source File: 00000000.00000002.4329195548.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.4328850847.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329444698.000000000044C000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329590454.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329729812.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.0000000000475000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330183105.0000000000479000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_JIar3KCVf6.jbxd
          Similarity
          • API ID: 00007$F230
          • String ID:
          • API String ID: 4009361889-0
          • Opcode ID: 2ccab19053b1b12714afaeb83503c5d0cb9d571f1a7b1b8d306c5e5e998bb070
          • Instruction ID: 9d0fe79826df7e7d6f6f84d6e09cfa5fa187a15bd46eb1381e31ce1ef8ccca4f
          • Opcode Fuzzy Hash: 2ccab19053b1b12714afaeb83503c5d0cb9d571f1a7b1b8d306c5e5e998bb070
          • Instruction Fuzzy Hash: 9D3189B2608A40DEE7609F3AD44079E37A1F785F98F188226DE6A8B358DF78D446C714
          Function 00447DC0 Relevance: 7.6, APIs: 5, Instructions: 56COMMON
          Download Yara Rule
          APIs
          Memory Dump Source
          • Source File: 00000000.00000002.4329195548.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.4328850847.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329444698.000000000044C000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329590454.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329729812.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.0000000000475000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330183105.0000000000479000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_JIar3KCVf6.jbxd
          Similarity
          • API ID: 00007$B2405B2405550B2405640B2407B2414890
          • String ID:
          • API String ID: 1837951881-0
          • Opcode ID: 4d2caa82c9084d51a47e619ed5ec1031cc9785e95fc53dfd175d196aa46dc543
          • Instruction ID: 496aa30ea4125aad0cd7443dad336125ebc31e867b3d0941bab39503623945c0
          • Opcode Fuzzy Hash: 4d2caa82c9084d51a47e619ed5ec1031cc9785e95fc53dfd175d196aa46dc543
          • Instruction Fuzzy Hash: A41151A671AE0086FB114B25FD0431A62A1B7487F5F4817319E5D4BBA8DB7CD885C748
          Function 00446B90 Relevance: 7.6, APIs: 5, Instructions: 52COMMON
          Download Yara Rule
          APIs
          Memory Dump Source
          • Source File: 00000000.00000002.4329195548.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.4328850847.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329444698.000000000044C000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329590454.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329729812.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.0000000000475000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330183105.0000000000479000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_JIar3KCVf6.jbxd
          Similarity
          • API ID: 00007$F230
          • String ID:
          • API String ID: 4009361889-0
          • Opcode ID: e2338c202120ae0cc3b7c49ed0787e087481c203dfaba9d2d5f54f1d3679fc33
          • Instruction ID: 5d594948e4b21ad063528ea9e001934132a91d770c576122ef63413f604b2c49
          • Opcode Fuzzy Hash: e2338c202120ae0cc3b7c49ed0787e087481c203dfaba9d2d5f54f1d3679fc33
          • Instruction Fuzzy Hash: 63012B62B05A19DAF6244F57FD403257691DF96BE6F0981348F0E8E344EE3CC4868304
          Function 00443EA0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON
          Download Yara Rule
          APIs
          Strings
          • Error cleaning up spin_keys for thread , xrefs: 00443ED3
          Memory Dump Source
          • Source File: 00000000.00000002.4329195548.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.4328850847.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329444698.000000000044C000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329590454.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329729812.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.0000000000475000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330183105.0000000000479000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_JIar3KCVf6.jbxd
          Similarity
          • API ID: 00007$B2405550B24142B2970
          • String ID: Error cleaning up spin_keys for thread
          • API String ID: 1096297733-2906507043
          • Opcode ID: 222884eaf3811f5ec80d8797827842a497524c928a0e1f12c92d8d381daa54ef
          • Instruction ID: c7aa6c88578793606821b21e7c495e401435aff01a9435002dffad5c3b096794
          • Opcode Fuzzy Hash: 222884eaf3811f5ec80d8797827842a497524c928a0e1f12c92d8d381daa54ef
          • Instruction Fuzzy Hash: 55112962B08A40D5FB348F34E41432F5AA2E745B6AF580322DA5D4A3D8DF6CCA49C30A
          Function 00444630 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 48COMMON
          Download Yara Rule
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.4329195548.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.4328850847.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329444698.000000000044C000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329590454.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329729812.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.0000000000475000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330183105.0000000000479000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_JIar3KCVf6.jbxd
          Similarity
          • API ID: 00007B2405550
          • String ID: T%p %d %s$T%p %d V=%0X H=%p %s
          • API String ID: 501131442-2059990036
          • Opcode ID: 2ad06f354f5c412437ca9ab6f737cf8ba43d25a93ecbe29686d9d02af31affd3
          • Instruction ID: 1d07dc333d6cbd00b502a547409ccfaaa7b99f1326a401cc86a8b052a8f3fcd1
          • Opcode Fuzzy Hash: 2ad06f354f5c412437ca9ab6f737cf8ba43d25a93ecbe29686d9d02af31affd3
          • Instruction Fuzzy Hash: 2301CC32308A0486EA109F23F80435AA7A5B7C9BA4F480136AF4C87B10EE3CD485C744
          Function 00446310 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44COMMON
          Download Yara Rule
          APIs
          Strings
          • RWL%p %d V=%0X B=%d r=%ld w=%ld L=%p %s, xrefs: 0044633E
          • RWL%p %d %s, xrefs: 00446389
          Memory Dump Source
          • Source File: 00000000.00000002.4329195548.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.4328850847.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329444698.000000000044C000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329590454.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329729812.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.0000000000475000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330183105.0000000000479000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_JIar3KCVf6.jbxd
          Similarity
          • API ID: 00007B2405550
          • String ID: RWL%p %d %s$RWL%p %d V=%0X B=%d r=%ld w=%ld L=%p %s
          • API String ID: 501131442-1971217749
          • Opcode ID: a545a8c041ace7d00349a5ad169e407eeb8cc8dd2193bc2a4b4602a5a86523fb
          • Instruction ID: 7ef5f5a8c88491a5086f89d056cea9c2682e5b5cc1a923c95c95f35b5155c705
          • Opcode Fuzzy Hash: a545a8c041ace7d00349a5ad169e407eeb8cc8dd2193bc2a4b4602a5a86523fb
          • Instruction Fuzzy Hash: EE019AB2305A448AEB118F2AF84874A77A0B789B98F088025EE4C47754EB7DC445CB44
          Function 00446DE0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39COMMON
          Download Yara Rule
          APIs
          Strings
          Memory Dump Source
          • Source File: 00000000.00000002.4329195548.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.4328850847.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329444698.000000000044C000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329590454.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329729812.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.0000000000475000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330183105.0000000000479000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_JIar3KCVf6.jbxd
          Similarity
          • API ID: 00007B2405550
          • String ID: C%p %d %s$C%p %d V=%0X w=%ld %s
          • API String ID: 501131442-884133013
          • Opcode ID: a9913191a86b39be33ae8ff6cc16ab457f6748f682cb420c96b3c2fdc7fbad16
          • Instruction ID: 10c3e09eb426527b17a553e4bd91e1f5b01af3bad0fd1f217b9fbf2af97f44ba
          • Opcode Fuzzy Hash: a9913191a86b39be33ae8ff6cc16ab457f6748f682cb420c96b3c2fdc7fbad16
          • Instruction Fuzzy Hash: 97014FB6205B459AEA10DF2AF84075A37A0F789F98F549026DE8C47B14EF3CC546C74A
          Function 00445000 Relevance: 6.1, APIs: 4, Instructions: 94COMMON
          Download Yara Rule
          Memory Dump Source
          • Source File: 00000000.00000002.4329195548.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.4328850847.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329444698.000000000044C000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329590454.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329729812.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.0000000000475000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330183105.0000000000479000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_JIar3KCVf6.jbxd
          Similarity
          • API ID: 00007B2405540
          • String ID:
          • API String ID: 80058867-0
          • Opcode ID: ada112de7f2bce3db749c0e6021f537e6ebafbaa027e07ad9a8eccaf51c86e8a
          • Instruction ID: d23c4670032201a26d61ecc20d6b742a85e260c832dddc6d7b61f3bc738e32c3
          • Opcode Fuzzy Hash: ada112de7f2bce3db749c0e6021f537e6ebafbaa027e07ad9a8eccaf51c86e8a
          • Instruction Fuzzy Hash: 3A21EA26B0790047FE197F76785236A56506F84F6DF98422BEE194B387EF2CC9838349
          Function 004459E0 Relevance: 6.1, APIs: 4, Instructions: 90COMMON
          Download Yara Rule
          APIs
          Memory Dump Source
          • Source File: 00000000.00000002.4329195548.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.4328850847.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329444698.000000000044C000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329590454.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329729812.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.0000000000475000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330183105.0000000000479000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_JIar3KCVf6.jbxd
          Similarity
          • API ID: 00007B2414900
          • String ID:
          • API String ID: 3966757702-0
          • Opcode ID: 3b8846bc38d19114f72e991398a9ecd8b76f3cca14f5dc4296b9f433df5a8cb3
          • Instruction ID: aa7ea29f8cf2864dc6f4bc83eefc0dcdc70a67a8b3e325228edb57f0619914ed
          • Opcode Fuzzy Hash: 3b8846bc38d19114f72e991398a9ecd8b76f3cca14f5dc4296b9f433df5a8cb3
          • Instruction Fuzzy Hash: 96316E61311D4097FF11EF22E89136A2360AB84B89F8842379E0D97766EF3CCD82C358
          Function 00447640 Relevance: 6.1, APIs: 4, Instructions: 82COMMON
          Download Yara Rule
          APIs
          Memory Dump Source
          • Source File: 00000000.00000002.4329195548.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.4328850847.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329444698.000000000044C000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329590454.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329729812.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.0000000000475000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330183105.0000000000479000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_JIar3KCVf6.jbxd
          Similarity
          • API ID: 00007$F230
          • String ID:
          • API String ID: 4009361889-0
          • Opcode ID: d5cf6b2d950f978d7d8ca26e7868e7ec3e1bdca742e760934885e98a7428fb72
          • Instruction ID: 7b73f114deb46e439b42def4f7b7b63108f62cda63c6dff4bcfdd6f8fe764b30
          • Opcode Fuzzy Hash: d5cf6b2d950f978d7d8ca26e7868e7ec3e1bdca742e760934885e98a7428fb72
          • Instruction Fuzzy Hash: 1B31CA73708A40CAE714CF39D54076A73A2F744BA8F588626DE298B398D738C847CB55
          Function 00447510 Relevance: 6.1, APIs: 4, Instructions: 81COMMON
          Download Yara Rule
          APIs
          Memory Dump Source
          • Source File: 00000000.00000002.4329195548.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.4328850847.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329444698.000000000044C000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329590454.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329729812.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.0000000000475000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330183105.0000000000479000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_JIar3KCVf6.jbxd
          Similarity
          • API ID: 00007$F230
          • String ID:
          • API String ID: 4009361889-0
          • Opcode ID: 01e6fe57ebbae75f697767cce14e06d096eceb4fb5d7e5a314ea40d013e8f03f
          • Instruction ID: 3048c755bfc4faa0e3710c888d01944c07b6fd1b64fa0506df962aaa34b0ff91
          • Opcode Fuzzy Hash: 01e6fe57ebbae75f697767cce14e06d096eceb4fb5d7e5a314ea40d013e8f03f
          • Instruction Fuzzy Hash: F0318EB2608641DFEB14CF39D80075A33A1F744B68F588626DE198F758EB38C947CB54
          Function 004458E0 Relevance: 6.1, APIs: 4, Instructions: 68COMMON
          Download Yara Rule
          APIs
          Memory Dump Source
          • Source File: 00000000.00000002.4329195548.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.4328850847.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329444698.000000000044C000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329590454.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329729812.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.0000000000475000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330183105.0000000000479000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_JIar3KCVf6.jbxd
          Similarity
          • API ID: 00007$B24148$B2414B2414900
          • String ID:
          • API String ID: 410285048-0
          • Opcode ID: 9974461f49d1f39767c06146444ac8332d017d2e04ca338670966cc645e2826d
          • Instruction ID: b67e96114cd5a540a952b1807511927492dd0467bac6b1c7dd38caa207208185
          • Opcode Fuzzy Hash: 9974461f49d1f39767c06146444ac8332d017d2e04ca338670966cc645e2826d
          • Instruction Fuzzy Hash: E321AFA2301A50C6FF14AF22E84036A6364EB44FB9F4842279E5D87399EF38CD45C308
          Function 004472E0 Relevance: 6.1, APIs: 4, Instructions: 52COMMON
          Download Yara Rule
          APIs
          • 00007FFDB43BFAA0.KERNEL32(00000120,?,00000068,00000000,?,?,004475DF,?,?,?,?,?,?,?,00000100,004467F9), ref: 0044730E
          • 00007FFDB43BF230.KERNEL32(?,?,004475DF,?,?,?,?,?,?,?,00000100,004467F9,?,?,?,00000100), ref: 00447321
          • 00007FFDB43BFAA0.KERNEL32(?,?,004475DF,?,?,?,?,?,?,?,00000100,004467F9,?,?,?,00000100), ref: 00447355
          • 00007FFDB43BF230.KERNEL32(?,?,004475DF,?,?,?,?,?,?,?,00000100,004467F9,?,?,?,00000100), ref: 00447366
          Memory Dump Source
          • Source File: 00000000.00000002.4329195548.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.4328850847.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329444698.000000000044C000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329590454.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329729812.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.0000000000475000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330183105.0000000000479000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_JIar3KCVf6.jbxd
          Similarity
          • API ID: 00007$F230
          • String ID:
          • API String ID: 4009361889-0
          • Opcode ID: 25bf0ee171b2b44d4a71d4079201877117b32796d06812cb291d6a4d0aaf8243
          • Instruction ID: c67de82a4b2491743ac08eff9c92b9480a8beef6652de4e87c40278d6e5203c0
          • Opcode Fuzzy Hash: 25bf0ee171b2b44d4a71d4079201877117b32796d06812cb291d6a4d0aaf8243
          • Instruction Fuzzy Hash: EC018F237085549EE725DF33AC00B1A6790B789FD8F488422EE0947714EB3CC543DB05
          Function 00444740 Relevance: 6.0, APIs: 4, Instructions: 43COMMON
          Download Yara Rule
          APIs
          Memory Dump Source
          • Source File: 00000000.00000002.4329195548.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.4328850847.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329444698.000000000044C000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329590454.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329729812.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.0000000000475000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330183105.0000000000479000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_JIar3KCVf6.jbxd
          Similarity
          • API ID: 00007$B2414880$B240B24560C110
          • String ID:
          • API String ID: 2229783370-0
          • Opcode ID: e8fd45e3365c933e9f646874fbf14e82ea3bb7a90000efe14d28f1bef1d4586a
          • Instruction ID: 83755bbc554a87115134c815fbfe50ece8ab623ec291d1550b70b432446ed3ea
          • Opcode Fuzzy Hash: e8fd45e3365c933e9f646874fbf14e82ea3bb7a90000efe14d28f1bef1d4586a
          • Instruction Fuzzy Hash: 2DF0CDB3B08A4446FE219B6AB80439F5391BBC9B98F890035DF8C4B350EF7DC946C658
          Function 004483B0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 282COMMON
          Download Yara Rule
          Strings
          • Unknown pseudo relocation bit size %d., xrefs: 00448624
          • Unknown pseudo relocation protocol version %d., xrefs: 0044866E
          Memory Dump Source
          • Source File: 00000000.00000002.4329195548.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
          • Associated: 00000000.00000002.4328850847.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329444698.000000000044C000.00000008.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329590454.0000000000455000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4329729812.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.000000000046E000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330066487.0000000000475000.00000004.00000001.01000000.00000003.sdmpDownload File
          • Associated: 00000000.00000002.4330183105.0000000000479000.00000002.00000001.01000000.00000003.sdmpDownload File
          Joe Sandbox IDA Plugin
          • Snapshot File: hcaresult_0_2_400000_JIar3KCVf6.jbxd
          Similarity
          • API ID:
          • String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
          • API String ID: 0-395989641
          • Opcode ID: 049dfdcfcd5dd6d67f0012937bfeed957753d3a0fecae5b96953db940745bf2d
          • Instruction ID: f4beaab6bba04c9b23ad4b9b7bc719e1207e0cbcd898daf919b5dc9426c8e34b
          • Opcode Fuzzy Hash: 049dfdcfcd5dd6d67f0012937bfeed957753d3a0fecae5b96953db940745bf2d
          • Instruction Fuzzy Hash: 10913871B005404AFB24AB76D95036F6352BB95BA8F25801FCE5D87799EE3DC885C30D