IOC Report
Tb3mfWybe6.exe

loading gif

Files

File Path
Type
Category
Malicious
Tb3mfWybe6.exe
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
initial sample
 malicious
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\desktop.ini.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\desktop.ini.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\desktop.ini.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\desktop.ini.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\desktop.ini.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\desktop.ini.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1003\desktop.ini.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1003\desktop.ini.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\.curlrc.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\3D Objects\desktop.ini.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\.curlrc.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\000003.log.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\CURRENT.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\data_0.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\data_1.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\data_2.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\data_3.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\index.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\05349744be1ad4ad_0.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0786087c3c360803_0.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0998db3a32ab3f41_0.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0f25049d69125b1e_0.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\230e5fe3e6f82b2c_0.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2798067b152b83c7_0.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2a426f11fd8ebe18_0.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\4a0e94571d979b3c_0.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\4ca3cb58378aaa3f_0.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\560e9c8bff5008d8_0.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\56c4cd218555ae2b_0.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\6fb6d030c4ebbc21_0.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\7120c35b509b0fae_0.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\71febec55d5c75cd_0.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\72d9f526d2e2e7c8_0.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\78bff3512887b83d_0.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\86b8040b7132b608_0.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8c159cc5880890bc_0.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8c84d92a9dbce3e0_0.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8e417e79df3bf0e9_0.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\91cec06bb2836fa5_0.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\927a1596c37ebe5e_0.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\92c56fa2a6c4d5ba_0.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\946896ee27df7947_0.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\983b7a3da8f39a46_0.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\aba6710fde0876af_0.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\b6d5deb4812ac6e9_0.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\bba29d2e6197e2f4_0.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\bf8eae3dcaf681ca_0.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\cf3e34002cde7e9c_0.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\d5dedf551f4d1592_0.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f0cf6dfa8a1afa3d_0.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f941376b2efdd6e6_0.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f971b7eda7fa05c3_0.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\fd17b2d8331c91e8_0.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\febb41df4ea2b63a_0.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\the-real-index.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm\index-dir\the-real-index.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm\index.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\LOCK.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\LOG.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\000003.log.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\CURRENT.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOCK.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\MANIFEST-000001.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\LocalPrefs.json.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\MANIFEST-000001.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Network\Cookies-journal.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Network\Cookies.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Network\NetworkDataMigrated.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Network\Reporting and NEL-journal.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Network\Reporting and NEL.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\CURRENT.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOCK.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\2585558601.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\2669049752.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\2843307863.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\3024948866.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\3322604653.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\3476888679.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\3643399760.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\4478492829.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\4736274156.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\4941266003.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\4965367024.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\5064077962.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\5281104033.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\5491630718.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\5622580005.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\5713452101.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\5809130301.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\6092905029.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\6109303877.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\6183211589.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\6213653276.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\6329227256.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\6422942404.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\6750529025.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\7011884383.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\7155756679.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\7216804956.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\7245361316.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\7457734050.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\7676687441.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\8182259827.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\8200946536.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\8351801105.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\8492240360.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\8552718761.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\8886835349.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\8975065801.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\9217021447.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\9275373402.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\9329238007.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\9422479677.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\9655434068.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\9659692161.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\9925478147.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\AdobeARM.log.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\user.bmp.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\chrome.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\cv_debug.log.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\dbghelp.dll.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\jones.bmp.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\jusched.log.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\offline.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\symsrv.dll.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\tmpDD17.tmp.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\wct1834.tmp.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\wct42C5.tmp.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\wct4B1.tmp.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\wctB04C.tmp.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\wmsetup.log.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\_curlrc.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\UnistoreDB\USS.jcp.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\UnistoreDB\USS.jtx.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\UnistoreDB\USSres00001.jrs.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\UnistoreDB\USSres00002.jrs.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\UnistoreDB\USStmp.jtx.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\UnistoreDB\store.jfm.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\UnistoreDB\store.vol.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\Unistore\data\AggregateCache.uca.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\ConnectedDevicesPlatform\L.user.cdp.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\DIPS.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\LOCK.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\LOG.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\First Run.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Last Browser.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Last Version.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Variations.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\container.dat.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\desktop.ini.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\CLR_v4.0\ngen.log.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\CLR_v4.0_32\ngen.log.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\LOCK.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\LOG.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\First Run.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Last Browser.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Last Version.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Local State.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Variations.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\OTele\excel.exe.db.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Sidebar\settings.ini.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WebCache\V01.chk.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WebCache\V01tmp.log.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\.ses.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\0164771190.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\0196354653.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\0409654664.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\0450125302.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\0518291756.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\0653671941.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\0982390758.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\1033868256.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\1141274626.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\1206337459.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\1237160943.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\1239919175.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\1287572840.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\1422339599.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\1927994670.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\2103954313.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\2168651637.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\2265332024.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\2385760553.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\2585558601.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\2669049752.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\2843307863.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\3024948866.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\3322604653.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\3476888679.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\3643399760.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\4478492829.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\4736274156.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\4941266003.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\4965367024.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\5064077962.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\5281104033.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\5491630718.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\5622580005.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\5713452101.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\5809130301.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\6092905029.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\6109303877.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\6183211589.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\6213653276.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\6329227256.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\6422942404.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\6750529025.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\7011884383.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\7155756679.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\7216804956.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\7245361316.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\7457734050.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\7676687441.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\8182259827.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\8200946536.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\8351801105.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\8492240360.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\8552718761.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\8886835349.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\8975065801.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\9217021447.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\9275373402.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\9329238007.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\9422479677.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\9655434068.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\9659692161.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\9925478147.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\user-PC-20231004-1445.log.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\user-PC-20231004-1445a.log.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\user-PC-20231004-1546.log.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\user-PC-20231004-1547.log.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\user-PC-20231004-1550.log.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\AdobeARM.log.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\JSAMSIProvider64.dll.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\pingme.txt.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\acrobat_sbx\acroNGLLog.txt.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\chrome_installer.log.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\cv_debug.log.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\jusched.log.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\msedge_installer.log.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\offline.session64.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\wmsetup.log.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\Unistore\data\AggregateCache.uca.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\ConnectedDevicesPlatform\CDPGlobalSettings.cdp.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\ConnectedDevicesPlatform\L.user.cdp.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\ConnectedDevicesPlatform\L.user.cdpresource.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Crashpad\metadata.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Crashpad\settings.dat.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Affiliation Database.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\BrowsingTopicsSiteData.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\BrowsingTopicsState.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\BudgetDatabase\LOCK.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\BudgetDatabase\LOG.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Code Cache\js\index.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Code Cache\wasm\index.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\DIPS-journal.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\DawnCache\data_0.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\DawnCache\data_1.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\DawnCache\data_2.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\DawnCache\data_3.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\DawnCache\index.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Rules\CURRENT.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\coupon_db\LOCK.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\coupon_db\LOG.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\databases\Databases.db.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\16.0\excel.exe_Rules\rule240009v3.xml.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\16.0\excel.exe_Rules\rule240010v2.xml.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\16.0\excel.exe_Rules\rule240012v1.xml.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\16.0\excel.exe_Rules\rule240013v1.xml.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\16.0\excel.exe_Rules\rule240014v1.xml.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\16.0\excel.exe_Rules\rule240015v1.xml.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\16.0\excel.exe_Rules\rule240016v0.xml.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\16.0\excel.exe_Rules\rule240018v0.xml.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\16.0\excel.exe_Rules\rule240020v0.xml.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\16.0\excel.exe_Rules\rule240021v1.xml.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\16.0\excel.exe_Rules\rule240025v1.xml.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\16.0\excel.exe_Rules\rule240026v0.xml.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\16.0\excel.exe_Rules\rule240029v0.xml.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\16.0\excel.exe_Rules\rule240030v0.xml.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\16.0\excel.exe_Rules\rule240031v0.xml.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\16.0\excel.exe_Rules\rule240032v0.xml.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\16.0\excel.exe_Rules\rule240033v0.xml.exe (copy)
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\.curlrc.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\3D Objects\desktop.ini.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\.curlrc.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\000003.log.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\CURRENT.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\data_0.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\data_1.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\data_2.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\data_3.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\index.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\05349744be1ad4ad_0.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0786087c3c360803_0.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0998db3a32ab3f41_0.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0f25049d69125b1e_0.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\230e5fe3e6f82b2c_0.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2798067b152b83c7_0.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2a426f11fd8ebe18_0.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\4a0e94571d979b3c_0.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\4ca3cb58378aaa3f_0.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\560e9c8bff5008d8_0.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\56c4cd218555ae2b_0.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\6fb6d030c4ebbc21_0.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\7120c35b509b0fae_0.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\71febec55d5c75cd_0.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\72d9f526d2e2e7c8_0.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\78bff3512887b83d_0.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\86b8040b7132b608_0.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8c159cc5880890bc_0.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8c84d92a9dbce3e0_0.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8e417e79df3bf0e9_0.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\91cec06bb2836fa5_0.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\927a1596c37ebe5e_0.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\92c56fa2a6c4d5ba_0.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\946896ee27df7947_0.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\983b7a3da8f39a46_0.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\aba6710fde0876af_0.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\b6d5deb4812ac6e9_0.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\bba29d2e6197e2f4_0.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\bf8eae3dcaf681ca_0.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\cf3e34002cde7e9c_0.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\d5dedf551f4d1592_0.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f0cf6dfa8a1afa3d_0.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f941376b2efdd6e6_0.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f971b7eda7fa05c3_0.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\fd17b2d8331c91e8_0.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\febb41df4ea2b63a_0.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\the-real-index.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm\index-dir\the-real-index.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm\index.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\LOCK.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\LOG.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\000003.log.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\CURRENT.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOCK.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\MANIFEST-000001.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\LocalPrefs.json.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\MANIFEST-000001.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Network\Cookies-journal.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Network\Cookies.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Network\NetworkDataMigrated.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Network\Reporting and NEL-journal.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Network\Reporting and NEL.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\CURRENT.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOCK.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Comms\UnistoreDB\USS.jcp.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Comms\UnistoreDB\USS.jtx.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Comms\UnistoreDB\USSres00001.jrs.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Comms\UnistoreDB\USSres00002.jrs.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Comms\UnistoreDB\USStmp.jtx.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Comms\UnistoreDB\store.jfm.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Comms\UnistoreDB\store.vol.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Comms\Unistore\data\AggregateCache.uca.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Comms\Unistore\data\AggregateCache.uca.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\ConnectedDevicesPlatform\CDPGlobalSettings.cdp.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user.cdp.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user.cdp.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user.cdpresource.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user\ActivitiesCache.db.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\metadata.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Affiliation Database.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsSiteData.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\LOCK.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\LOG.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\DIPS-journal.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\DIPS.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_0.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_2.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_3.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\DawnCache\index.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\CURRENT.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\LOCK.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\LOG.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\coupon_db\LOCK.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\coupon_db\LOG.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases\Databases.db.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Google\Chrome\User Data\First Run.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Google\Chrome\User Data\Last Browser.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Google\Chrome\User Data\Last Version.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Google\Chrome\User Data\Variations.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\ngen.log.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\ngen.log.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\LOCK.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\LOG.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Edge\User Data\First Run.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\GameDVR\KnownGameList.bin.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11210v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11264v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11265v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11289v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11300v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11302v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11369v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11370v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11381v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11464v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11498v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11499v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11500v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11502v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11504v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11659v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11701v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11705v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11710v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11767v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11768v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11769v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11770v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11793v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11794v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11834v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11882v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11890v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11930v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11931v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11932v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11933v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11939v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11950v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11981v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11989v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120100v3.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120107v6.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120110v4.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120112v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120119v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120120v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120125v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120126v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120126v8.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120127v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120128v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule12019v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120201v14.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120205v11.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120300v3.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120304v5.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120305v3.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120307v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule12035v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120402v21.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120600v4.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120601v3.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120602v8.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120603v8.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120604v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120605v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120607v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120608v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120609v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120610v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120611v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120612v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120613v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120614v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120615v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120616v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120617v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120618v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120619v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120620v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120621v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120622v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120623v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120624v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120625v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120626v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120627v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120628v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120629v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120630v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120631v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120632v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120633v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120634v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120635v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120636v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120637v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120638v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120639v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120640v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120641v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120642v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120643v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120644v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240009v3.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240010v2.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240012v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240013v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240014v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240015v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240016v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240018v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240020v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240021v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240025v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240026v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240029v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240030v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240031v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240032v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240033v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240034v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240038v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240039v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule241000v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule241001v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule241002v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270000v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270001v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270002v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270003v2.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270004v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270005v4.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270006v3.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270007v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270009v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270010v3.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270011v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270012v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270013v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270014v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270015v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270016v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270017v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270018v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270019v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule310000v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320001v2.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320002v5.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320003v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320004v6.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320005v4.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320006v2.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320007v2.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320009v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320016v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320021v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320022v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320029v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320032v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320033v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320034v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320035v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule322001v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule322004v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule322006v5.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324001v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324002v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324002v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324002v2.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324003v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324003v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324003v2.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324004v3.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324005v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324006v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324007v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324008v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324008v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324009v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324009v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324010v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324010v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324011v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324011v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324012v3.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324012v3.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324013v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324013v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324014v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324014v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324015v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324015v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule325000v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule325001v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule325001v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule325002v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule325002v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule360000v2.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule360000v2.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule360001v2.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule360001v2.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370000v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370000v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370001v2.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370001v2.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370002v2.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370005v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370005v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370006v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370006v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370007v3.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370007v3.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370009v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370009v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370011v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370011v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370012v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370012v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule390004v3.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule390004v3.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule390005v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule390005v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440000v3.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440000v3.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440002v9.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440004v3.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440004v3.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440005v3.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440005v3.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440007v3.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule460008v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule460008v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule460009v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule460009v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490002v13.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490002v13.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490003v7.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490003v7.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490004v5.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490004v5.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490005v3.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490005v3.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490009v5.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490009v5.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490010v7.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490010v7.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490011v4.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490011v4.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490014v2.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490014v2.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490015v2.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490015v2.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490015v3.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490015v3.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490015v4.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490015v4.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490015v5.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490015v5.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490018v3.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490018v3.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490020v3.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490020v3.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490023v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490023v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490024v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490024v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490025v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490025v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490027v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490027v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490028v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490028v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490029v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490029v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490030v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490030v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490031v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490031v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500000v2.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500000v2.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500001v2.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500001v2.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500002v2.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500002v2.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500003v2.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500003v2.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500004v2.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500004v2.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500005v2.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500005v2.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500006v2.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500006v2.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500007v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500007v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500008v2.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500008v2.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500009v4.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500009v4.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500022v4.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500022v4.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500023v4.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500023v4.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500024v2.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500024v2.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510000v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510000v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510005v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510005v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510006v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510006v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510008v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510008v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510009v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510009v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510010v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510010v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510012v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510012v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510015v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510015v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510016v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510016v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510017v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510017v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510018v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510018v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510046v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510046v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510047v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510047v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510062v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510062v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510063v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510063v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63028v4.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63028v4.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63030v2.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63030v2.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63038v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63038v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63040v2.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63040v2.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63041v2.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63041v2.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63042v3.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63042v3.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63046v10.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63046v10.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63048v6.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63048v6.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63049v2.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63049v2.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63051v5.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63051v5.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63052v3.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63052v3.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63053v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63053v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63054v5.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63054v5.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63056v9.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63056v9.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63057v3.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63057v3.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63058v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63058v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63059v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63059v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63063v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63063v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63066v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63066v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63067v3.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63067v3.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63069v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63069v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63070v5.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63070v5.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63071v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63071v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63077v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63077v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63078v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63078v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule65136v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule65136v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule65137v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule65137v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule65138v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule65138v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule65139v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68000v3.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68000v3.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68001v2.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68001v2.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68002v11.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68002v11.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68003v12.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68003v12.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68004v16.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68004v16.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68006v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68006v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68008v4.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68008v4.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68009v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68009v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68010v2.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68010v2.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68011v4.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68011v4.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68012v2.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68012v2.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68013v9.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68013v9.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68014v8.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68014v8.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68015v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68015v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68016v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68016v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68017v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68017v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68018v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68018v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68019v2.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68019v2.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68020v3.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68020v3.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68022v8.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68022v8.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68023v2.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68023v2.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68024v2.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68024v2.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68025v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68025v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68026v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68026v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68027v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68027v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68028v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68028v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68029v2.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68029v2.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68030v6.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68030v6.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68031v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68031v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68038v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68038v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68039v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68039v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68040v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68040v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule69600v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule69600v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700000v2.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700000v2.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700001v2.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700001v2.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70002v3.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70002v3.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70003v3.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70003v3.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700050v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700050v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700051v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700051v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70006v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70006v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700100v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700100v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700101v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700101v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700150v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700150v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700151v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700151v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700200v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700200v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700201v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700201v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700250v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700250v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700251v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700251v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70025v2.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70025v2.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70027v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70027v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70028v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70028v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70029v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70029v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700300v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700300v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700301v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700301v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70030v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70030v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70031v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70031v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700350v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700350v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700351v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700351v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70036v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70036v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70037v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70037v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700400v2.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700400v2.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700401v2.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700401v2.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700450v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700450v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700451v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700451v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700500v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700500v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700501v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700501v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700550v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700550v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700551v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700551v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700600v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700600v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700601v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700601v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700650v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700650v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700651v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700651v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700700v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700700v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700701v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700701v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700750v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700750v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700751v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700751v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700850v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700850v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700851v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700851v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700900v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700900v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700901v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700901v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700950v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700950v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700951v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700951v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701050v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701050v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701051v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701051v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701100v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701100v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701101v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701101v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701150v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701150v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701151v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701151v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701200v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701200v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701201v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701201v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701250v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701250v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701251v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701251v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701300v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701300v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701301v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701301v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701350v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701350v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701351v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701351v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701400v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701400v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701401v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701401v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701500v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701500v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701501v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701501v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701550v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701550v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701551v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701551v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701650v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701650v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701651v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701651v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701700v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701700v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701701v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701701v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701750v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701750v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701751v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701751v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701800v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701800v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701801v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701801v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701850v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701850v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701851v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701851v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701900v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701900v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701901v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701901v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701950v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701950v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701951v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701951v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702000v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702000v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702001v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702050v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702051v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702100v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702101v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702150v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702151v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702200v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702201v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702250v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702251v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702300v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702301v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702350v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702351v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702400v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702401v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702450v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702451v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702500v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702501v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702550v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702551v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702600v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702601v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702650v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702651v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702700v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702701v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702750v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702751v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702800v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702801v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702850v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702851v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702900v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702901v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702950v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702951v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule703000v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule703001v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule703050v3.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule703051v3.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule703100v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule703101v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule703150v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule703151v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule703200v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule703201v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule703250v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule703251v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule703300v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule703301v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule703350v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule703351v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule703400v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule703401v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule703450v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule703451v1.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule703500v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule703501v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule703550v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule703551v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule703600v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule703601v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule703650v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule703651v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule703700v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule703701v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule703750v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule703751v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule703800v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule703801v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule703850v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule703851v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule703900v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule703901v0.xml.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120682v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule222015v6.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule222042v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule222043v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule222049v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule222100v7.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule222101v3.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule222102v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule222200v5.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule224900v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule224901v11.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule224902v2.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule230104v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule230157v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule230166v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule230167v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule230168v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule230169v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule230170v1.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule230171v0.xml.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Office\OTele\excel.exe.db.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows Sidebar\settings.ini.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\WindowsApps\python.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\WindowsApps\python3.7.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\WindowsApps\python3.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\History\History.IE5\container.dat.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\History\desktop.ini.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG1.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG2.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\UsrClass.dat.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\WebCacheLock.dat.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01tmp.log.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\.ses.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\0164771190.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\0196354653.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\0409654664.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\0450125302.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\0518291756.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\0653671941.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\0982390758.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\1033868256.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\1141274626.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\1206337459.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\1237160943.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\1239919175.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\1287572840.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\1422339599.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\1927994670.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\2103954313.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\2168651637.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\2265332024.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\2385760553.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\2585558601.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\2585558601.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\2669049752.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\2669049752.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\2843307863.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\2843307863.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\3024948866.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\3024948866.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\3322604653.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\3322604653.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\3476888679.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\3476888679.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\3643399760.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\3643399760.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\4478492829.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\4478492829.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\4736274156.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\4736274156.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\4941266003.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\4941266003.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\4965367024.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\4965367024.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\5064077962.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\5064077962.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\5281104033.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\5281104033.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\5491630718.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\5491630718.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\5622580005.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\5622580005.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\5713452101.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\5713452101.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\5809130301.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\5809130301.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\6092905029.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\6092905029.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\6109303877.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\6109303877.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\6183211589.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\6183211589.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\6213653276.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\6213653276.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\6329227256.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\6329227256.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\6422942404.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\6422942404.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\6750529025.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\6750529025.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\7011884383.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\7011884383.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\7155756679.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\7155756679.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\7216804956.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\7216804956.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\7245361316.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\7245361316.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\7457734050.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\7457734050.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\7676687441.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\7676687441.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\8182259827.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\8182259827.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\8200946536.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\8200946536.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\8351801105.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\8351801105.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\8492240360.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\8492240360.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\8552718761.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\8552718761.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\8886835349.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\8886835349.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\8975065801.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\8975065801.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\9217021447.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\9217021447.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\9275373402.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\9275373402.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\9329238007.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\9329238007.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\9422479677.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\9422479677.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\9655434068.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\9655434068.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\9659692161.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\9659692161.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\9925478147.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\9925478147.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\user-PC-20231004-1445.log.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\user-PC-20231004-1445a.log.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\user-PC-20231004-1546.log.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\user-PC-20231004-1547.log.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\user-PC-20231004-1550.log.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\AdobeARM.log.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\AdobeARM.log.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\JSAMSIProvider32.dll.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\JSAMSIProvider64.dll.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\Symbols\pingme.txt.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\user.bmp.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\chrome.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\chrome_installer.log.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\cv_debug.log.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\cv_debug.log.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\dbghelp.dll.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\jones.bmp.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\jusched.log.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\jusched.log.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\msedge_installer.log.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\offline.session64.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\offline.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\symsrv.dll.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\tmpDD17.tmp.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\wct1834.tmp.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\wct42C5.tmp.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\wct4B1.tmp.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\wctB04C.tmp.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\wmsetup.log.exe.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\Temp\wmsetup.log.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
C:\Users\user\AppData\Local\_curlrc.tmp
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
dropped
 malicious
There are 1328 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\Tb3mfWybe6.exe
"C:\Users\user\Desktop\Tb3mfWybe6.exe"
 malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
2270000
heap
page read and write
BDE000
heap
page read and write
510000
heap
page read and write
19D000
stack
page read and write
59A000
heap
page read and write
409000
unkown
page write copy
2278000
heap
page read and write
2273000
heap
page read and write
BDB000
heap
page read and write
401000
unkown
page execute and write copy
403000
unkown
page execute and read and write
2285000
heap
page read and write
409000
unkown
page write copy
400000
unkown
page readonly
9C000
stack
page read and write
400000
unkown
page readonly
4E0000
heap
page read and write
59E000
heap
page read and write
406000
unkown
page execute and write copy
590000
heap
page read and write
BD0000
heap
page read and write
580000
heap
page read and write
5AB000
heap
page read and write
406000
unkown
page execute and write copy
1F0000
heap
page read and write
401000
unkown
page execute and write copy
There are 16 hidden memdumps, click here to show them.