Edit tour

Windows Analysis Report
AztyGMg4jw.dll

Overview

General Information

Sample name:	AztyGMg4jw.dll renamed because original name is a hash value
Original sample name:	05ebae760340fe44362ab7c8f70b2d89d6c9ba9b9ee8a9f747b2f19d326c3431.dll
Analysis ID:	1543071
MD5:	f74cec233a9609461e7518dd4c90207b
SHA1:	92408a8233567f8b10f30f83dfcdd98effe96dca
SHA256:	05ebae760340fe44362ab7c8f70b2d89d6c9ba9b9ee8a9f747b2f19d326c3431
Tags:	BlackBastadlluser-JAMESWT_MHT
Infos:

Detection

BlackBasta

Score:	92
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found ransom note / readme

Multi AV Scanner detection for submitted file

Yara detected BlackBasta ransomware

AI detected suspicious sample

Drops a file containing file decryption instructions (likely related to ransomware)

Drops executable to a common third party application directory

Found Tor onion address

Infects executable files (exe, dll, sys, html)

Potential evasive VBS script found (sleep loop)

Writes a notice file (html or txt) to demand a ransom

Abnormal high CPU Usage

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

May sleep (evasive loops) to hinder dynamic analysis

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: PowerShell Module File Created By Non-PowerShell Process

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 716 cmdline: loaddll32.exe "C:\Users\user\Desktop\AztyGMg4jw.dll" MD5: 51E6071F9CBA48E79F10C84515AAE618)

conhost.exe (PID: 4900 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 1924 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\AztyGMg4jw.dll",#1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

rundll32.exe (PID: 4508 cmdline: rundll32.exe "C:\Users\user\Desktop\AztyGMg4jw.dll",#1 MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 2736 cmdline: rundll32.exe C:\Users\user\Desktop\AztyGMg4jw.dll,VisibleEntry MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 5692 cmdline: rundll32.exe "C:\Users\user\Desktop\AztyGMg4jw.dll",VisibleEntry MD5: 889B99C52A60DD49227C5E485A016679)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Black Basta	"Black Basta" is a new ransomware strain discovered during April 2022 - looks in dev since at least early February 2022 - and due to their ability to quickly amass new victims and the style of their negotiations, this is likely not a new operation but rather a rebrand of a previous top-tier ransomware gang that brought along their affiliates.	No Attribution	https://assets.sentinelone.com/sentinellabs22/sentinellabs-blackbasta https://cloud.google.com/blog/topics/threat-intelligence/unc4393-goes-gently-into-silentnight https://gbhackers.com/black-basta-ransomware/ https://mandiant.widen.net/s/pkffwrbjlz/m-trends-2023 https://noticeofpleadings.com/crackedcobaltstrike/files/ComplaintAndSummons/1%20-Microsoft%20Cobalt%20Strike%20-%20Complaint(907040021.9).pdf	https://malpedia.caad.fkie.fraunhofer.de/details/win.blackbasta

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
AztyGMg4jw.dll	JoeSecurity_BlackBasta	Yara detected BlackBasta ransomware	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: rundll32.exe PID: 4508	JoeSecurity_BlackBasta	Yara detected BlackBasta ransomware	Joe Security
Process Memory Space: rundll32.exe PID: 5692	JoeSecurity_BlackBasta	Yara detected BlackBasta ransomware	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
4.2.rundll32.exe.6d160000.0.unpack	JoeSecurity_BlackBasta	Yara detected BlackBasta ransomware	Joe Security
6.2.rundll32.exe.6d160000.0.unpack	JoeSecurity_BlackBasta	Yara detected BlackBasta ransomware	Joe Security

Sigma Signatures

Sigma detected: PowerShell Module File Created By Non-PowerShell Process

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\SysWOW64\rundll32.exe, ProcessId: 2736, TargetFilename: C:\Program Files\WindowsPowerShell\Modules\instructions_read_me.txt

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: AztyGMg4jw.dll	ReversingLabs: Detection: 65%
Source: AztyGMg4jw.dll	Virustotal: Detection: 77%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 97.5% probability

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D192EF0 CryptAcquireContextA,CryptAcquireContextA,GetLastError,CryptAcquireContextA,CryptAcquireContextA,SetLastError,CryptAcquireContextA,___std_exception_copy,	4_2_6D192EF0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D1934F0 CryptReleaseContext,	4_2_6D1934F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D193600 CryptGenRandom,CryptReleaseContext,	4_2_6D193600
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D1F6F30 CryptReleaseContext,	4_2_6D1F6F30
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D193420 CryptReleaseContext,	4_2_6D193420
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D193460 CryptGenRandom,	4_2_6D193460
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D193050 CryptAcquireContextA,GetLastError,CryptReleaseContext,	4_2_6D193050

Source: AztyGMg4jw.dll

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL

Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\7-Zip\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Google\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Internet Explorer\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Microsoft\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Microsoft Office 15\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Mozilla Firefox\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\MSBuild\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Reference Assemblies\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Uninstall Information\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Defender\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Defender Advanced Threat Protection\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Mail\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Media Player\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Multimedia Platform\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows NT\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Photo Viewer\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Portable Devices\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Security\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\7-Zip\Lang\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\Adobe\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\Services\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\System\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Google\Chrome\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Internet Explorer\en-GB\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Internet Explorer\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Internet Explorer\images\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Internet Explorer\SIGNUP\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Microsoft\OneDrive\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Microsoft Office 15\ClientX64\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Mozilla Firefox\browser\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Mozilla Firefox\defaults\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Mozilla Firefox\fonts\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Mozilla Firefox\gmp-clearkey\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Mozilla Firefox\uninstall\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\MSBuild\Microsoft\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Reference Assemblies\Microsoft\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Defender\en-GB\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Defender\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Defender\Offline\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Defender\Platform\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Defender Advanced Threat Protection\en-GB\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Media Player\en-GB\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Media Player\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Media Player\Media Renderer\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Media Player\Network Sharing\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Media Player\Skins\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Media Player\Visualizations\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows NT\Accessories\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows NT\TableTextService\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Photo Viewer\en-GB\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Security\BrowserCore\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Esl\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Resource\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\Adobe\Acrobat\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\Adobe\HelpCfg\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ClickToRun\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\MSInfo\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\Stationery\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\TextConv\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\Triedit\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\VGX\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\System\ado\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\System\en-GB\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\System\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\System\msadc\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\System\Ole DB\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Google\Chrome\Application\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Microsoft\OneDrive\ListSync\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Mozilla Firefox\browser\features\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Mozilla Firefox\browser\VisualElements\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Mozilla Firefox\defaults\pref\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Reference Assemblies\Microsoft\Framework\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows NT\Accessories\en-GB\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows NT\Accessories\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows NT\TableTextService\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Security\BrowserCore\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\PackageManagement\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\Pester\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\PSReadline\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Air\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Assets\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocTemplates\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\HostedServicesTemplates\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\IDTemplates\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Javascripts\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Locale\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\RdrApp\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Sequences\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Tracker\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\UIThemes\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Resource\CMap\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Resource\Font\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Resource\SaslPrep\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Resource\TypeSupport\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\Adobe\Acrobat\DC\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\Adobe\Acrobat\Setup\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\Adobe\Acrobat\Setup Files\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\Adobe\HelpCfg\en_US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ClickToRun\OnlineInteraction\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\ar-SA\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\bg-BG\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\da-DK\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\de-DE\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\el-GR\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\en-GB\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\es-ES\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\es-MX\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\et-EE\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fi-FI\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fr-CA\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fr-FR\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\he-IL\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\hr-HR\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\hu-HU\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\it-IT\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\ja-JP\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\ko-KR\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\lt-LT\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\lv-LV\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\nb-NO\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\nl-NL\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\pl-PL\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\pt-BR\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\pt-PT\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\ro-RO\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\ru-RU\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\sk-SK\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\sl-SI\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\sv-SE\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\th-TH\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\tr-TR\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\uk-UA\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\zh-CN\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\zh-TW\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\MSInfo\en-GB\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\TextConv\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\Triedit\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\System\ado\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\System\msadc\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\System\Ole DB\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Google\Chrome\Application\SetupMetrics\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Microsoft\OneDrive\ListSync\settings\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\locales\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\swiftshader\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\locales\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\swiftshader\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocTemplates\ENU\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\HostedServicesTemplates\ENU\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\IDTemplates\ENU\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ar_AE\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\cs_CZ\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\da_DK\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\de_DE\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\el_GR\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ENU\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\en_AE\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\en_GB\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\en_IL\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\en_US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\es_ES\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fi_FI\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fr_FR\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fr_MA\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\he_IL\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\hu_HU\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\it_IT\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ja_JP\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ko_KR\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\nb_NO\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\nl_NL\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\pl_PL\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\pt_BR\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ru_RU\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\sk_SK\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\sl_SI\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\sv_SE\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\tr_TR\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\uk_UA\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\zh_CN\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\zh_TW\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Locale\en_US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\AcroForm\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Multimedia\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\prc\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\RdrApp\ENU\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Sequences\ENU\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Resource\Font\Pfm\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Resource\TypeSupport\Unicode\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\Adobe\Acrobat\DC\Linguistics\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\Adobe\Acrobat\Setup Files\{AC76BA86-1033-1033-7760-BC15014EA700}\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\default_apps\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Extensions\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Installer\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Locales\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\MEIPreload\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\VisualElements\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\WidevineCdm\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\en\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Examples\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\en\instructions_read_me.txt	Jump to behavior

Source: AztyGMg4jw.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: d:\dbs\el\omr\target\x86\ship\licensing\x-none\ospprearm.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: OSPPREARM.EXE.3.dr
Source:	Binary string: pingsender.pdb source: pingsender.exe.3.dr
Source:	Binary string: mavinject32.pdbGCTL source: MavInject32.exe.3.dr
Source:	Binary string: AppVISVSubsystems32.pdb source: AppvIsvSubsystems32.dll.3.dr
Source:	Binary string: d:\dbs\el\omr\target\x86\ship\licensing\x-none\ospprearm.pdb source: OSPPREARM.EXE.3.dr
Source:	Binary string: msvcr120.amd64.pdb source: msvcr120.dll.3.dr
Source:	Binary string: AppVISVSubsystems32.pdbGCTL source: AppvIsvSubsystems32.dll.3.dr
Source:	Binary string: mavinject32.pdb source: MavInject32.exe.3.dr
Source:	Binary string: softokn3.pdb source: softokn3.dll.3.dr

Spreading

Infects executable files (exe, dll, sys, html)

Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\7-Zip\7-zip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\mozglue.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\7-Zip\7z.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\7-Zip\7-zip32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\notificationserver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\ipcclientcerts.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\AccessibleMarshal.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\freebl3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\libEGL.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\mozwer.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\7-Zip\7zFM.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\nssckbi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\7-Zip\7z.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\lgpllibs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\osclientcerts.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\gkcodecs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\nss3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\libGLESv2.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\msvcp140.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\qipcap64.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\7-Zip\7zG.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\mozavutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\softokn3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\vcruntime140.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\mozavcodec.dll	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D1E571F FindFirstFileExW,		4_2_6D1E571F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D165790 FindFirstFileW,lstrcmpW,FindNextFileW,GetLastError,FindClose,__alldvrm,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,__Xtime_get_ticks,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,__Mtx_unlock,std::_Throw_Cpp_error,std::_Throw_Cpp_error,		4_2_6D165790

Networking

Found Tor onion address

Source: rundll32.exe	String found in binary or memory: ATTENTION! Your network has been breached and all data was encrypted. Please contact us at: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0 ! To access .onion websites downlo
Source: rundll32.exe	String found in binary or memory: ATTENTION!Your network has been breached and all data was encrypted. Please contact us at:https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0! To access .onion websites downlo
Source: rundll32.exe, 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Source: rundll32.exe, 00000006.00000002.2241540711.000000006D21C000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Source: AztyGMg4jw.dll	String found in binary or memory: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Source: instructions_read_me.txt105.3.dr	String found in binary or memory: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Source: instructions_read_me.txt148.3.dr	String found in binary or memory: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Source: instructions_read_me.txt56.3.dr	String found in binary or memory: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Source: instructions_read_me.txt57.3.dr	String found in binary or memory: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Source: instructions_read_me.txt133.3.dr	String found in binary or memory: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Source: instructions_read_me.txt191.3.dr	String found in binary or memory: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Source: instructions_read_me.txt217.3.dr	String found in binary or memory: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/

Source: omni.ja0.3.dr	String found in binary or memory: http://127.0.0.1:
Source: pingsender.exe.3.dr, softokn3.dll.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: pingsender.exe.3.dr, qipcap64.dll.3.dr, icucnv67.dll.3.dr, softokn3.dll.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: pingsender.exe.3.dr, softokn3.dll.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: icucnv67.dll.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: pingsender.exe.3.dr, qipcap64.dll.3.dr, softokn3.dll.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: pingsender.exe.3.dr, qipcap64.dll.3.dr, icucnv67.dll.3.dr, softokn3.dll.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: Au3Check.exe.3.dr	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: Au3Check.exe.3.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: Au3Check.exe.3.dr	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: api-ms-win-crt-utility-l1-1-0.dll.3.dr	String found in binary or memory: http://crl.microsg
Source: pingsender.exe.3.dr, icucnv67.dll.3.dr, softokn3.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: pingsender.exe.3.dr, qipcap64.dll.3.dr, softokn3.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: icucnv67.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: pingsender.exe.3.dr, icucnv67.dll.3.dr, softokn3.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: icucnv67.dll.3.dr, softokn3.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: qipcap64.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/Do
Source: pingsender.exe.3.dr, qipcap64.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: pingsender.exe.3.dr, qipcap64.dll.3.dr, softokn3.dll.3.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: icucnv67.dll.3.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0=
Source: pingsender.exe.3.dr, qipcap64.dll.3.dr, softokn3.dll.3.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: omni.ja0.3.dr	String found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: omni.ja0.3.dr	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: omni.ja0.3.dr	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: omni.ja0.3.dr	String found in binary or memory: http://dev.w3.org/html5/spec/rendering.html#rendering
Source: omni.ja0.3.dr	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.addEventListener
Source: omni.ja0.3.dr	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.removeEventListener
Source: AppvIsvSubsystems32.dll.3.dr	String found in binary or memory: http://file://sftldr.dllsftldr_wow64.dllIsProcessHookedAppVEntSubsystems32.dllAppVIsvSubsystems32.wK
Source: omni.ja0.3.dr	String found in binary or memory: http://jsperf.com/code-review-1480
Source: omni.ja0.3.dr	String found in binary or memory: http://mozilla.or
Source: omni.ja0.3.dr	String found in binary or memory: http://mozilla.org
Source: omni.ja0.3.dr	String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: icucnv67.dll.3.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: pingsender.exe.3.dr, qipcap64.dll.3.dr, icucnv67.dll.3.dr, softokn3.dll.3.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: pingsender.exe.3.dr, qipcap64.dll.3.dr, icucnv67.dll.3.dr, softokn3.dll.3.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: pingsender.exe.3.dr, softokn3.dll.3.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: pingsender.exe.3.dr, qipcap64.dll.3.dr, softokn3.dll.3.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: Au3Check.exe.3.dr	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: Au3Check.exe.3.dr	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: Au3Check.exe.3.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: Au3Check.exe.3.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: Au3Check.exe.3.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: pingsender.exe.3.dr, qipcap64.dll.3.dr, icucnv67.dll.3.dr, softokn3.dll.3.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: omni.ja0.3.dr	String found in binary or memory: http://www.ethiopic.org/Collation/OrderedLists.html.
Source: omni.ja0.3.dr	String found in binary or memory: http://www.mozilla.org/key
Source: omni.ja0.3.dr	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: omni.ja0.3.dr	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul);
Source: omni.ja0.3.dr	String found in binary or memory: http://www.mozilla.org/newlayout/xml/parsererror.xml);
Source: omni.ja0.3.dr	String found in binary or memory: https://%LOCALE%.malware-error.mozilla.com/?url=
Source: omni.ja0.3.dr	String found in binary or memory: https://%LOCALE%.phish-error.mozilla.com/?url=
Source: omni.ja0.3.dr	String found in binary or memory: https://%LOCALE%.phish-report.mozilla.com/?url=
Source: omni.ja0.3.dr	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/
Source: omni.ja0.3.dr	String found in binary or memory: https://api.accounts.firefox.com/v1
Source: omni.ja0.3.dr	String found in binary or memory: https://aus5.mozilla.org/update/3/GMP/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VER
Source: rundll32.exe, rundll32.exe, 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmp, rundll32.exe, 00000006.00000002.2241540711.000000006D21C000.00000004.00000001.01000000.00000003.sdmp, AztyGMg4jw.dll, instructions_read_me.txt105.3.dr, instructions_read_me.txt148.3.dr, instructions_read_me.txt56.3.dr, instructions_read_me.txt57.3.dr, instructions_read_me.txt133.3.dr, instructions_read_me.txt191.3.dr, instructions_read_me.txt217.3.dr	String found in binary or memory: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Source: omni.ja0.3.dr	String found in binary or memory: https://blocked.cdn.mozilla.net/
Source: omni.ja0.3.dr	String found in binary or memory: https://blocked.cdn.mozilla.net/%blockID%.html
Source: omni.ja0.3.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1403293
Source: omni.ja0.3.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1539075
Source: omni.ja0.3.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1584464
Source: omni.ja0.3.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1592344
Source: omni.ja0.3.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1607439
Source: omni.ja0.3.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1616739
Source: omni.ja0.3.dr	String found in binary or memory: https://crbug.com/993268
Source: omni.ja0.3.dr	String found in binary or memory: https://dap-02.api.divviup.org
Source: omni.ja0.3.dr	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc7515#section-4.1.5
Source: omni.ja0.3.dr	String found in binary or memory: https://design.firefox.com/photon/components/message-bars.html#type-specific-style
Source: omni.ja0.3.dr	String found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTab
Source: omni.ja0.3.dr	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapture
Source: omni.ja0.3.dr	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCapture
Source: omni.ja0.3.dr	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#E
Source: omni.ja0.3.dr	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryption
Source: omni.ja0.3.dr	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsing
Source: omni.ja0.3.dr	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Mozilla/Tech/Places/Frecency_algorithm
Source: omni.ja0.3.dr	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/ElementCSSInlineStyle/style#setting_styles)
Source: formautofill@mozilla.org.xpi.3.dr	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/CSS/visibility#Values
Source: omni.ja0.3.dr	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/for-await...of
Source: omni.ja0.3.dr	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl
Source: omni.ja0.3.dr	String found in binary or memory: https://developers.google.c
Source: omni.ja0.3.dr	String found in binary or memory: https://developers.google.cB
Source: omni.ja0.3.dr	String found in binary or memory: https://developers.google.com/safe-browsing/v4/advisory
Source: omni.ja0.3.dr	String found in binary or memory: https://drafts.csswg.org/css-lists-3/#ua-stylesheet
Source: omni.ja0.3.dr	String found in binary or memory: https://drafts.csswg.org/css-scoping/#slots-in-shadow-tree
Source: omni.ja0.3.dr	String found in binary or memory: https://extensionworkshop.com/documentation/publish/self-distribution/
Source: omni.ja0.3.dr	String found in binary or memory: https://firefox-source-docs.mozilla.org/performance/scroll-linked_effects.html
Source: omni.ja0.3.dr	String found in binary or memory: https://github.com/google/closure-compiler/issues/3177
Source: omni.ja0.3.dr	String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query-all.ts
Source: omni.ja0.3.dr	String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query.ts
Source: omni.ja0.3.dr	String found in binary or memory: https://github.com/lit/lit/issues/1266
Source: omni.ja0.3.dr	String found in binary or memory: https://github.com/microsoft/TypeScript/issues/338).
Source: omni.ja0.3.dr	String found in binary or memory: https://github.com/mozilla-services/autograph/blob/main/signer/contentsignaturepki/README.md
Source: omni.ja0.3.dr	String found in binary or memory: https://github.com/stylelint/stylelint/issues/6834
Source: omni.ja0.3.dr	String found in binary or memory: https://github.com/w3c/csswg-drafts/blob/master/css-grid-2/MASONRY-EXPLAINER.md
Source: omni.ja0.3.dr	String found in binary or memory: https://github.com/w3c/csswg-drafts/issues/1072
Source: omni.ja0.3.dr	String found in binary or memory: https://github.com/w3c/csswg-drafts/issues/4650
Source: omni.ja0.3.dr	String found in binary or memory: https://github.com/whatwg/html/issues/8610
Source: omni.ja0.3.dr	String found in binary or memory: https://gpuweb.github.io/gpuweb/
Source: omni.ja0.3.dr	String found in binary or memory: https://helper1.dap.cloudflareresearch.com/v02
Source: omni.ja0.3.dr	String found in binary or memory: https://html.spec.whatwg.org/#bidi-rendering
Source: omni.ja0.3.dr	String found in binary or memory: https://html.spec.whatwg.org/#flow-content-3
Source: omni.ja0.3.dr	String found in binary or memory: https://html.spec.whatwg.org/#hidden-elements
Source: omni.ja0.3.dr	String found in binary or memory: https://html.spec.whatwg.org/#the-details-and-summary-elements
Source: omni.ja0.3.dr	String found in binary or memory: https://html.spec.whatwg.org/#the-hr-element-2
Source: omni.ja0.3.dr	String found in binary or memory: https://incoming.telemetry.mozilla.org
Source: omni.ja0.3.dr	String found in binary or memory: https://infra.spec.whatwg.org/#ascii-whitespace
Source: omni.ja0.3.dr	String found in binary or memory: https://lit.dev/docs/libraries/standalone-templates/#rendering-lit-html-templates
Source: omni.ja0.3.dr	String found in binary or memory: https://lit.dev/docs/templates/directives/#stylemap
Source: omni.ja0.3.dr	String found in binary or memory: https://lit.dev/docs/templates/expressions/#child-expressions)
Source: omni.ja0.3.dr	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%
Source: omni.ja0.3.dr	String found in binary or memory: https://mathiasbynens.be/
Source: omni.ja0.3.dr	String found in binary or memory: https://mathiasbynens.be/notes/javascript-encoding#surrogate-formulae
Source: omni.ja0.3.dr	String found in binary or memory: https://mathiasbynens.be/notes/javascript-escapes#single
Source: omni.ja0.3.dr	String found in binary or memory: https://mozilla-ohttp-fakespot.fastly-edge.com/
Source: pingsender.exe.3.dr, qipcap64.dll.3.dr	String found in binary or memory: https://mozilla.org0/
Source: omni.ja0.3.dr	String found in binary or memory: https://prod.ohtc
Source: omni.ja0.3.dr	String found in binary or memory: https://profiler.firefox.com
Source: omni.ja0.3.dr	String found in binary or memory: https://relay.firefox.com/accounts/profile/?utm_medium=firefox-desktop&utm_source=modal&utm_campaign
Source: omni.ja0.3.dr	String found in binary or memory: https://relay.firefox.com/api/v1/
Source: omni.ja0.3.dr	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/diagnostic?site=
Source: omni.ja0.3.dr	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%
Source: omni.ja0.3.dr	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&p
Source: omni.ja0.3.dr	String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=%GOOGLE_SAFEBR
Source: omni.ja0.3.dr	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatHits?$ct=application/x-protobuf&key=%GOOGLE_SAFEBROWSIN
Source: omni.ja0.3.dr	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=%GOOGL
Source: omni.ja0.3.dr	String found in binary or memory: https://sb-ssl.google.com/safebrowsing/clientreport/download?key=%GOOGLE_SAFEBROWSING_API_KEY%
Source: omni.ja0.3.dr	String found in binary or memory: https://services.addons.mozilla.o
Source: omni.ja0.3.dr	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon/
Source: omni.ja0.3.dr	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: omni.ja0.3.dr	String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: omni.ja0.3.dr	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration
Source: omni.ja0.3.dr	String found in binary or memory: https://support.mozilla.org/kb/captive-portal
Source: omni.ja0.3.dr	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windows
Source: omni.ja0.3.dr	String found in binary or memory: https://tc39.github.io/ecma262/#sec-typeof-operator
Source: omni.ja0.3.dr	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2
Source: omni.ja0.3.dr	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-3.1
Source: omni.ja0.3.dr	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4
Source: omni.ja0.3.dr	String found in binary or memory: https://tools.ietf.org/html/rfc7515#appendix-C)
Source: omni.ja0.3.dr	String found in binary or memory: https://w3c.github.io/mathml-core/#dfn-maction
Source: omni.ja0.3.dr	String found in binary or memory: https://w3c.github.io/mathml-core/#the-mathvariant-attribute
Source: omni.ja0.3.dr	String found in binary or memory: https://webcompat.com/issues/new
Source: omni.ja0.3.dr	String found in binary or memory: https://webextensions.settings.services.mozilla.com/v1
Source: omni.ja0.3.dr	String found in binary or memory: https://wicg.github.io/construct-stylesheets/#using-constructed-stylesheets).
Source: Au3Check.exe.3.dr	String found in binary or memory: https://www.autoitscript.com/autoit3/
Source: qipcap64.dll.3.dr, softokn3.dll.3.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: Au3Check.exe.3.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: omni.ja0.3.dr	String found in binary or memory: https://www.googleapis.com/geolocation/v1/geolocate?key=%GOOGLE_LOCATION_SERVICE_API_KEY%
Source: omni.ja0.3.dr	String found in binary or memory: https://www.mozilla.org/
Source: omni.ja0.3.dr	String found in binary or memory: https://www.mozilla.org/%LOCALE%/privacy/subscription-services/
Source: omni.ja0.3.dr	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#health-report
Source: omni.ja0.3.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: rundll32.exe, 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmp, rundll32.exe, 00000006.00000002.2241540711.000000006D21C000.00000004.00000001.01000000.00000003.sdmp, AztyGMg4jw.dll, instructions_read_me.txt105.3.dr, instructions_read_me.txt148.3.dr, instructions_read_me.txt56.3.dr, instructions_read_me.txt57.3.dr, instructions_read_me.txt133.3.dr, instructions_read_me.txt191.3.dr, instructions_read_me.txt217.3.dr	String found in binary or memory: https://www.torproject.org/
Source: omni.ja0.3.dr	String found in binary or memory: https://xhr.spec.whatwg.org/#sync-warning

Spam, unwanted Advertisements and Ransom Demands

Found ransom note / readme

Source: C:\instructions_read_me.txt

Dropped file: ATTENTION!Your network has been breached and all data was encrypted. Please contact us at:https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0*!* To access .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us)*!* To restore all your PCs and get your network working again, follow these instructions:- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.Please follow these simple rules to avoid data corruption:- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. - Do not hire a recovery company. They can't decrypt without the key. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail. So speak for yourself.Waiting you in a chat.

Jump to dropped file

Yara detected BlackBasta ransomware

Source: Yara match	File source: AztyGMg4jw.dll, type: SAMPLE
Source: Yara match	File source: 4.2.rundll32.exe.6d160000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.6d160000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 4508, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 5692, type: MEMORYSTR

Drops a file containing file decryption instructions (likely related to ransomware)

Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\$WinREAgent\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\PerfLogs\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Program Files\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Program Files (x86)\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\ProgramData\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Users\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\$WinREAgent\Scratch\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Program Files\7-Zip\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Program Files\Adobe\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Program Files\Common Files\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Program Files\Google\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Program Files\Internet Explorer\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Program Files\Microsoft\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Program Files\Microsoft Office 15\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Program Files\Mozilla Firefox\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Program Files\MSBuild\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Program Files\Reference Assemblies\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Program Files\Uninstall Information\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Program Files\Windows Defender\instructions_read_me.txt	Jump to behavior

Writes a notice file (html or txt) to demand a ransom

Source: C:\Windows\SysWOW64\rundll32.exe	File dropped: C:\instructions_read_me.txt -> decrypt or rename the files will lead to its fatal corruption. it doesn't matter, who are trying to do this, either it will be your it guys or a recovery agency.please follow these simple rules to avoid data corruption:- do not modify, rename or delete files. any attempts to modify, decrypt or rename the files will lead to its fatal corruption. - do not hire a recovery company. they can't decrypt without the key. they also don't care about your business. they believe that they are good negotiators, but it is not. they usually fail. so speak for yourself.waiting you in a chat.	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File dropped: C:\$WinREAgent\instructions_read_me.txt -> decrypt or rename the files will lead to its fatal corruption. it doesn't matter, who are trying to do this, either it will be your it guys or a recovery agency.please follow these simple rules to avoid data corruption:- do not modify, rename or delete files. any attempts to modify, decrypt or rename the files will lead to its fatal corruption. - do not hire a recovery company. they can't decrypt without the key. they also don't care about your business. they believe that they are good negotiators, but it is not. they usually fail. so speak for yourself.waiting you in a chat.	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File dropped: C:\PerfLogs\instructions_read_me.txt -> decrypt or rename the files will lead to its fatal corruption. it doesn't matter, who are trying to do this, either it will be your it guys or a recovery agency.please follow these simple rules to avoid data corruption:- do not modify, rename or delete files. any attempts to modify, decrypt or rename the files will lead to its fatal corruption. - do not hire a recovery company. they can't decrypt without the key. they also don't care about your business. they believe that they are good negotiators, but it is not. they usually fail. so speak for yourself.waiting you in a chat.	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File dropped: C:\Program Files\instructions_read_me.txt -> decrypt or rename the files will lead to its fatal corruption. it doesn't matter, who are trying to do this, either it will be your it guys or a recovery agency.please follow these simple rules to avoid data corruption:- do not modify, rename or delete files. any attempts to modify, decrypt or rename the files will lead to its fatal corruption. - do not hire a recovery company. they can't decrypt without the key. they also don't care about your business. they believe that they are good negotiators, but it is not. they usually fail. so speak for yourself.waiting you in a chat.	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File dropped: C:\Program Files (x86)\instructions_read_me.txt -> decrypt or rename the files will lead to its fatal corruption. it doesn't matter, who are trying to do this, either it will be your it guys or a recovery agency.please follow these simple rules to avoid data corruption:- do not modify, rename or delete files. any attempts to modify, decrypt or rename the files will lead to its fatal corruption. - do not hire a recovery company. they can't decrypt without the key. they also don't care about your business. they believe that they are good negotiators, but it is not. they usually fail. so speak for yourself.waiting you in a chat.	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File dropped: C:\ProgramData\instructions_read_me.txt -> decrypt or rename the files will lead to its fatal corruption. it doesn't matter, who are trying to do this, either it will be your it guys or a recovery agency.please follow these simple rules to avoid data corruption:- do not modify, rename or delete files. any attempts to modify, decrypt or rename the files will lead to its fatal corruption. - do not hire a recovery company. they can't decrypt without the key. they also don't care about your business. they believe that they are good negotiators, but it is not. they usually fail. so speak for yourself.waiting you in a chat.	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File dropped: C:\Users\instructions_read_me.txt -> decrypt or rename the files will lead to its fatal corruption. it doesn't matter, who are trying to do this, either it will be your it guys or a recovery agency.please follow these simple rules to avoid data corruption:- do not modify, rename or delete files. any attempts to modify, decrypt or rename the files will lead to its fatal corruption. - do not hire a recovery company. they can't decrypt without the key. they also don't care about your business. they believe that they are good negotiators, but it is not. they usually fail. so speak for yourself.waiting you in a chat.	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File dropped: C:\$WinREAgent\Scratch\instructions_read_me.txt -> decrypt or rename the files will lead to its fatal corruption. it doesn't matter, who are trying to do this, either it will be your it guys or a recovery agency.please follow these simple rules to avoid data corruption:- do not modify, rename or delete files. any attempts to modify, decrypt or rename the files will lead to its fatal corruption. - do not hire a recovery company. they can't decrypt without the key. they also don't care about your business. they believe that they are good negotiators, but it is not. they usually fail. so speak for yourself.waiting you in a chat.	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File dropped: C:\Program Files\7-Zip\instructions_read_me.txt -> decrypt or rename the files will lead to its fatal corruption. it doesn't matter, who are trying to do this, either it will be your it guys or a recovery agency.please follow these simple rules to avoid data corruption:- do not modify, rename or delete files. any attempts to modify, decrypt or rename the files will lead to its fatal corruption. - do not hire a recovery company. they can't decrypt without the key. they also don't care about your business. they believe that they are good negotiators, but it is not. they usually fail. so speak for yourself.waiting you in a chat.	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File dropped: C:\Program Files (x86)\Windows Photo Viewer\en-GB\instructions_read_me.txt -> decrypt or rename the files will lead to its fatal corruption. it doesn't matter, who are trying to do this, either it will be your it guys or a recovery agency.please follow these simple rules to avoid data corruption:- do not modify, rename or delete files. any attempts to modify, decrypt or rename the files will lead to its fatal corruption. - do not hire a recovery company. they can't decrypt without the key. they also don't care about your business. they believe that they are good negotiators, but it is not. they usually fail. so speak for yourself.waiting you in a chat.	Jump to dropped file

Source: C:\Windows\SysWOW64\rundll32.exe

Process Stats: CPU usage > 49%

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D164B00	4_2_6D164B00
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D16B1A9	4_2_6D16B1A9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D1A0D90	4_2_6D1A0D90
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D1A2ED0	4_2_6D1A2ED0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D1C4ED0	4_2_6D1C4ED0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D196960	4_2_6D196960
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D1689A0	4_2_6D1689A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D182B70	4_2_6D182B70
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D172B90	4_2_6D172B90
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D17EBD0	4_2_6D17EBD0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D1D6A4C	4_2_6D1D6A4C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D1D8A80	4_2_6D1D8A80
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D1D4440	4_2_6D1D4440
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D1DC7B2	4_2_6D1DC7B2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D1AA690	4_2_6D1AA690
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D1A42B0	4_2_6D1A42B0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D177DD0	4_2_6D177DD0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D1A3C40	4_2_6D1A3C40
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D17FCE0	4_2_6D17FCE0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D17DF00	4_2_6D17DF00
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D1C7E58	4_2_6D1C7E58
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D19BE40	4_2_6D19BE40
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D1A3E64	4_2_6D1A3E64
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D1EB929	4_2_6D1EB929
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D1AB9A0	4_2_6D1AB9A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D1D1825	4_2_6D1D1825
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D1D1B67	4_2_6D1D1B67
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D199BD0	4_2_6D199BD0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D19DBE0	4_2_6D19DBE0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D1E95E5	4_2_6D1E95E5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D179450	4_2_6D179450
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D199470	4_2_6D199470
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D1AB4B0	4_2_6D1AB4B0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D165790	4_2_6D165790
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D1C97DE	4_2_6D1C97DE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D1757C0	4_2_6D1757C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D1A3620	4_2_6D1A3620
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D197000	4_2_6D197000

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6D1C2A18 appears 57 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6D1C38F5 appears 73 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6D1C39A0 appears 64 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6D16D840 appears 40 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6D1C38C2 appears 98 times

Source: AztyGMg4jw.dll

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL

Source: AppvIsvSubsystems32.dll.3.dr

Binary string: for %1% in name mapper. Error: %2%related_name_resolver::initFailed to map NT object name for %1% in name mapper.related_name_resolver::get_name_by_handle\Device\\logfiles\HostDriverStoreWow64 mapper detected process running under wow64.wow64_name_mapper::initWow64DisableWow64FsRedirection\driverstoreWow64RevertWow64FsRedirectionFailed tU

Source: classification engine

Classification label: mal92.rans.spre.evad.winDLL@10/951@0/0

Source: C:\Windows\SysWOW64\rundll32.exe

File created: C:\Program Files\instructions_read_me.txt

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

File created: C:\Users\instructions_read_me.txt

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4900:120:WilError_03
Source: C:\Windows\SysWOW64\rundll32.exe	Mutant created: \Sessions\1\BaseNamedObjects\ofijweiuhuewhcsaxs.mutex

Source: C:\Windows\SysWOW64\rundll32.exe

File created: C:\Users\user\AppData\Local\Temp\fkdjsadasd.ico

Jump to behavior

Source: AztyGMg4jw.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\rundll32.exe

File read: C:\Program Files\Mozilla Firefox\application.ini

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\AztyGMg4jw.dll,VisibleEntry

Source: softokn3.dll.3.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: softokn3.dll.3.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3.dll.3.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3.dll.3.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %ssig_%s_%08x_%08xupd_%s_%s
Source: softokn3.dll.3.dr	Binary or memory string: SELECT ALL id FROM %s;
Source: softokn3.dll.3.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3.dll.3.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3.dll.3.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: softokn3.dll.3.dr	Binary or memory string: updateDir=libraryDescription=slotDescription=cryptoSlotDescription=dbSlotDescription=FIPSSlotDescription=tokenDescription=cryptoTokenDescription=updateTokenDescription=dbTokenDescription=FIPSTokenDescription=minPWLen=secmod=manufacturerID=updateID=DROP TABLE IF EXISTS metaData;SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;PRAGMA table_info(%s);PKCS 110000000000000000Mozilla Rules the World through NSS! AND NSS Application Token %08x NSS FIPS 140-2 Certificate DB NSS Internal Crypto Services NSS Generic Crypto Services NSS 3
Source: softokn3.dll.3.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: softokn3.dll.3.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: AztyGMg4jw.dll	ReversingLabs: Detection: 65%
Source: AztyGMg4jw.dll	Virustotal: Detection: 77%

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\AztyGMg4jw.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\AztyGMg4jw.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\AztyGMg4jw.dll,VisibleEntry
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\AztyGMg4jw.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\AztyGMg4jw.dll",VisibleEntry
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\AztyGMg4jw.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\AztyGMg4jw.dll,VisibleEntry	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\AztyGMg4jw.dll",VisibleEntry	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\AztyGMg4jw.dll",#1	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

File written: C:\Program Files\Mozilla Firefox\application.ini

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\7-Zip\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Google\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Internet Explorer\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Microsoft\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Microsoft Office 15\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Mozilla Firefox\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\MSBuild\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Reference Assemblies\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Uninstall Information\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Defender\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Defender Advanced Threat Protection\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Mail\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Media Player\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Multimedia Platform\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows NT\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Photo Viewer\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Portable Devices\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Security\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\7-Zip\Lang\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\Adobe\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\Services\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\System\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Google\Chrome\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Internet Explorer\en-GB\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Internet Explorer\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Internet Explorer\images\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Internet Explorer\SIGNUP\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Microsoft\OneDrive\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Microsoft Office 15\ClientX64\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Mozilla Firefox\browser\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Mozilla Firefox\defaults\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Mozilla Firefox\fonts\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Mozilla Firefox\gmp-clearkey\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Mozilla Firefox\uninstall\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\MSBuild\Microsoft\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Reference Assemblies\Microsoft\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Defender\en-GB\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Defender\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Defender\Offline\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Defender\Platform\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Defender Advanced Threat Protection\en-GB\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Media Player\en-GB\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Media Player\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Media Player\Media Renderer\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Media Player\Network Sharing\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Media Player\Skins\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Media Player\Visualizations\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows NT\Accessories\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows NT\TableTextService\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Photo Viewer\en-GB\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Security\BrowserCore\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Esl\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Resource\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\Adobe\Acrobat\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\Adobe\HelpCfg\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ClickToRun\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\MSInfo\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\Stationery\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\TextConv\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\Triedit\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\VGX\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\System\ado\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\System\en-GB\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\System\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\System\msadc\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\System\Ole DB\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Google\Chrome\Application\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Microsoft\OneDrive\ListSync\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Mozilla Firefox\browser\features\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Mozilla Firefox\browser\VisualElements\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Mozilla Firefox\defaults\pref\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Reference Assemblies\Microsoft\Framework\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows NT\Accessories\en-GB\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows NT\Accessories\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows NT\TableTextService\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Windows Security\BrowserCore\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\PackageManagement\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\Pester\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\PSReadline\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Air\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Assets\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocTemplates\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\HostedServicesTemplates\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\IDTemplates\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Javascripts\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Locale\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\RdrApp\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Sequences\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Tracker\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\UIThemes\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Resource\CMap\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Resource\Font\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Resource\SaslPrep\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Resource\TypeSupport\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\Adobe\Acrobat\DC\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\Adobe\Acrobat\Setup\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\Adobe\Acrobat\Setup Files\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\Adobe\HelpCfg\en_US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ClickToRun\OnlineInteraction\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\ar-SA\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\bg-BG\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\da-DK\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\de-DE\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\el-GR\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\en-GB\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\es-ES\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\es-MX\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\et-EE\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fi-FI\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fr-CA\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fr-FR\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\he-IL\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\hr-HR\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\hu-HU\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\it-IT\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\ja-JP\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\ko-KR\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\lt-LT\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\lv-LV\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\nb-NO\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\nl-NL\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\pl-PL\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\pt-BR\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\pt-PT\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\ro-RO\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\ru-RU\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\sk-SK\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\sl-SI\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\sv-SE\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\th-TH\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\tr-TR\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\uk-UA\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\zh-CN\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\zh-TW\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\MSInfo\en-GB\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\TextConv\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\Triedit\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\System\ado\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\System\msadc\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\System\Ole DB\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Google\Chrome\Application\SetupMetrics\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Microsoft\OneDrive\ListSync\settings\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\locales\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\swiftshader\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\locales\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\swiftshader\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocTemplates\ENU\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\HostedServicesTemplates\ENU\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\IDTemplates\ENU\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ar_AE\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\cs_CZ\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\da_DK\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\de_DE\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\el_GR\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ENU\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\en_AE\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\en_GB\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\en_IL\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\en_US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\es_ES\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fi_FI\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fr_FR\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fr_MA\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\he_IL\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\hu_HU\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\it_IT\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ja_JP\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ko_KR\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\nb_NO\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\nl_NL\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\pl_PL\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\pt_BR\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ru_RU\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\sk_SK\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\sl_SI\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\sv_SE\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\tr_TR\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\uk_UA\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\zh_CN\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\zh_TW\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Locale\en_US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\AcroForm\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Multimedia\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\prc\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\RdrApp\ENU\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Sequences\ENU\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Resource\Font\Pfm\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\Resource\TypeSupport\Unicode\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\Adobe\Acrobat\DC\Linguistics\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\Adobe\Acrobat\Setup Files\{AC76BA86-1033-1033-7760-BC15014EA700}\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\default_apps\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Extensions\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Installer\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\Locales\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\MEIPreload\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\VisualElements\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Google\Chrome\Application\117.0.5938.134\WidevineCdm\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\en\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Examples\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\en\instructions_read_me.txt	Jump to behavior

Source: AztyGMg4jw.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: AztyGMg4jw.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: AztyGMg4jw.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: AztyGMg4jw.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: AztyGMg4jw.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: AztyGMg4jw.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: AztyGMg4jw.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source: AztyGMg4jw.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: d:\dbs\el\omr\target\x86\ship\licensing\x-none\ospprearm.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: OSPPREARM.EXE.3.dr
Source:	Binary string: pingsender.pdb source: pingsender.exe.3.dr
Source:	Binary string: mavinject32.pdbGCTL source: MavInject32.exe.3.dr
Source:	Binary string: AppVISVSubsystems32.pdb source: AppvIsvSubsystems32.dll.3.dr
Source:	Binary string: d:\dbs\el\omr\target\x86\ship\licensing\x-none\ospprearm.pdb source: OSPPREARM.EXE.3.dr
Source:	Binary string: msvcr120.amd64.pdb source: msvcr120.dll.3.dr
Source:	Binary string: AppVISVSubsystems32.pdbGCTL source: AppvIsvSubsystems32.dll.3.dr
Source:	Binary string: mavinject32.pdb source: MavInject32.exe.3.dr
Source:	Binary string: softokn3.pdb source: softokn3.dll.3.dr

Source: AztyGMg4jw.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: AztyGMg4jw.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: AztyGMg4jw.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: AztyGMg4jw.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: AztyGMg4jw.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_6D1C389F push ecx; ret

4_2_6D1C38B2

Persistence and Installation Behavior

Drops executable to a common third party application directory

Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\AccessibleMarshal.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\AccessibleMarshal.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\AccessibleMarshal.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\AccessibleMarshal.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\freebl3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\freebl3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\freebl3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\freebl3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\freebl3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\gkcodecs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\gkcodecs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\gkcodecs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\gkcodecs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\gkcodecs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\ipcclientcerts.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\ipcclientcerts.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\ipcclientcerts.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\ipcclientcerts.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\ipcclientcerts.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\libGLESv2.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\libGLESv2.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\libGLESv2.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\lgpllibs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\libEGL.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\lgpllibs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\lgpllibs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\libEGL.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\libEGL.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\libGLESv2.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\libGLESv2.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\libEGL.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\libEGL.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\lgpllibs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\lgpllibs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\mozavcodec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\mozavcodec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\mozavcodec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\mozavcodec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\mozavcodec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\mozglue.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\mozglue.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\mozglue.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\mozwer.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\mozwer.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\mozwer.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\mozglue.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\mozglue.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\mozwer.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\mozwer.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\msvcp140.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\msvcp140.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\msvcp140.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\mozavutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\mozavutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\mozavutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\msvcp140.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\msvcp140.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\mozavutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\mozavutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\nss3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\nss3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\nss3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\nss3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\nss3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\notificationserver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\notificationserver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\notificationserver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\notificationserver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\notificationserver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\nssckbi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\nssckbi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\nssckbi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\nssckbi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\nssckbi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\osclientcerts.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\osclientcerts.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\osclientcerts.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\osclientcerts.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\osclientcerts.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\qipcap64.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\qipcap64.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\qipcap64.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\qipcap64.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\qipcap64.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\softokn3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\softokn3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\softokn3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\softokn3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\softokn3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\vcruntime140.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\vcruntime140.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\vcruntime140.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\vcruntime140.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\vcruntime140.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File written: C:\Program Files\Mozilla Firefox\vcruntime140_1.dll	Jump to behavior

Infects executable files (exe, dll, sys, html)

Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\7-Zip\7-zip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\mozglue.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\7-Zip\7z.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\7-Zip\7-zip32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\notificationserver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\ipcclientcerts.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\AccessibleMarshal.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\freebl3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\libEGL.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\mozwer.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\7-Zip\7zFM.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\nssckbi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\7-Zip\7z.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\lgpllibs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\osclientcerts.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\gkcodecs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\nss3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\libGLESv2.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\msvcp140.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\qipcap64.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\7-Zip\7zG.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\mozavutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\softokn3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\vcruntime140.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	System file written: C:\Program Files\Mozilla Firefox\mozavcodec.dll	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Potential evasive VBS script found (sleep loop)

Source: C:\Windows\SysWOW64\rundll32.exe	Dropped file: Do While objScriptExec.Status = 0 WScript.Sleep 100	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	Dropped file: Do While objScriptExec.Status = 0 WScript.Sleep 100	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	Dropped file: Do While objScriptExec.Status = 0 WScript.Sleep 100	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	Dropped file: Do While objScriptExec.Status = 0 WScript.Sleep 100	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	Dropped file: Do While objScriptExec.Status = 0 WScript.Sleep 100	Jump to dropped file

Source: C:\Windows\SysWOW64\rundll32.exe

Window / User API: threadDelayed 2159

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

API coverage: 5.7 %

Source: C:\Windows\SysWOW64\rundll32.exe TID: 6208	Thread sleep count: 256 > 30			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 3532	Thread sleep count: 2159 > 30			Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D1E571F FindFirstFileExW,		4_2_6D1E571F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D165790 FindFirstFileW,lstrcmpW,FindNextFileW,GetLastError,FindClose,__alldvrm,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,__Xtime_get_ticks,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,__Mtx_unlock,std::_Throw_Cpp_error,std::_Throw_Cpp_error,		4_2_6D165790

Source: C:\Windows\System32\loaddll32.exe

Thread delayed: delay time: 120000

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_6D1CE243 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

4_2_6D1CE243

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_6D1E6985 GetProcessHeap,

4_2_6D1E6985

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D1CE243 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_6D1CE243
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D1C39F5 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_6D1C39F5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D1C3B18 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_6D1C3B18

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\AztyGMg4jw.dll",#1

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_6D1C34F1 cpuid

4_2_6D1C34F1

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	4_2_6D1E8C68
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	4_2_6D1DEFA2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	4_2_6D1E8963
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	4_2_6D1E8B92
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,	4_2_6D1DEA1F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	4_2_6D1E8A8C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,	4_2_6D1E859F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,	4_2_6D1E85EA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	4_2_6D1E84F8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	4_2_6D1E8710
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,	4_2_6D1E8685
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoEx,	4_2_6D1C2229
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	4_2_6D1E82F3

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_6D1C3D15 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

4_2_6D1C3D15

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_6D1E4FC3 GetTimeZoneInformation,

4_2_6D1E4FC3

Source: C:\Windows\System32\loaddll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	11 Process Injection	13 Masquerading	OS Credential Dumping	2 System Time Discovery	1 Taint Shared Content	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	2 Data Encrypted for Impact
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	11 Virtualization/Sandbox Evasion	LSASS Memory	2 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Proxy	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	11 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	3 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Rundll32	Cached Domain Credentials	23 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
AztyGMg4jw.dll	66%	ReversingLabs	Win32.Ransomware.Basta
AztyGMg4jw.dll	78%	Virustotal		Browse

Source	Detection	Scanner	Label
https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl	0%	URL Reputation	safe
https://xhr.spec.whatwg.org/#sync-warning	0%	URL Reputation	safe
https://services.addons.mozilla.org/api/v4/addons/addon/	0%	URL Reputation	safe
https://mozilla.org0/	0%	URL Reputation	safe
https://api.accounts.firefox.com/v1	0%	URL Reputation	safe
http://detectportal.firefox.com/canonical.html	0%	URL Reputation	safe
https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapture	0%	URL Reputation	safe
https://bugzilla.mozilla.org/show_bug.cgi?id=1584464	0%	URL Reputation	safe
https://safebrowsing.google.com/safebrowsing/diagnostic?site=	0%	URL Reputation	safe
https://infra.spec.whatwg.org/#ascii-whitespace	0%	URL Reputation	safe
https://blocked.cdn.mozilla.net/	0%	URL Reputation	safe
http://developer.mozilla.org/en/docs/DOM:element.addEventListener	0%	URL Reputation	safe
https://profiler.firefox.com	0%	URL Reputation	safe
https://mathiasbynens.be/	0%	URL Reputation	safe
https://gpuweb.github.io/gpuweb/	0%	URL Reputation	safe
https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4	0%	URL Reputation	safe
https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2	0%	URL Reputation	safe
https://lit.dev/docs/templates/directives/#stylemap	0%	URL Reputation	safe
https://webextensions.settings.services.mozilla.com/v1	0%	URL Reputation	safe

Name	Source	Malicious	Antivirus Detection	Reputation
https://html.spec.whatwg.org/#flow-content-3	omni.ja0.3.dr	false		unknown
http://developer.mozilla.org/en/docs/DOM:element.removeEventListener	omni.ja0.3.dr	false		unknown
https://w3c.github.io/mathml-core/#dfn-maction	omni.ja0.3.dr	false		unknown
https://developers.google.com/safe-browsing/v4/advisory	omni.ja0.3.dr	false		unknown
https://design.firefox.com/photon/components/message-bars.html#type-specific-style	omni.ja0.3.dr	false		unknown
https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl	omni.ja0.3.dr	false	URL Reputation: safe	unknown
https://www.torproject.org/	rundll32.exe, 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmp, rundll32.exe, 00000006.00000002.2241540711.000000006D21C000.00000004.00000001.01000000.00000003.sdmp, AztyGMg4jw.dll, instructions_read_me.txt105.3.dr, instructions_read_me.txt148.3.dr, instructions_read_me.txt56.3.dr, instructions_read_me.txt57.3.dr, instructions_read_me.txt133.3.dr, instructions_read_me.txt191.3.dr, instructions_read_me.txt217.3.dr	true		unknown
https://www.autoitscript.com/autoit3/	Au3Check.exe.3.dr	false		unknown
http://dev.w3.org/html5/spec/rendering.html#rendering	omni.ja0.3.dr	false		unknown
https://blocked.cdn.mozilla.net/%blockID%.html	omni.ja0.3.dr	false		unknown
https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windows	omni.ja0.3.dr	false		unknown
https://mathiasbynens.be/notes/javascript-escapes#single	omni.ja0.3.dr	false		unknown
http://crl.microsg	api-ms-win-crt-utility-l1-1-0.dll.3.dr	false		unknown
https://github.com/whatwg/html/issues/8610	omni.ja0.3.dr	false		unknown
https://github.com/lit/lit/issues/1266	omni.ja0.3.dr	false		unknown
https://services.addons.mozilla.o	omni.ja0.3.dr	false		unknown
https://github.com/w3c/csswg-drafts/issues/4650	omni.ja0.3.dr	false		unknown
https://xhr.spec.whatwg.org/#sync-warning	omni.ja0.3.dr	false	URL Reputation: safe	unknown
https://firefox-source-docs.mozilla.org/performance/scroll-linked_effects.html	omni.ja0.3.dr	false		unknown
https://developer.mozilla.org/en-US/docs/Web/API/ElementCSSInlineStyle/style#setting_styles)	omni.ja0.3.dr	false		unknown
https://mozilla-ohttp-fakespot.fastly-edge.com/	omni.ja0.3.dr	false		unknown
https://html.spec.whatwg.org/#the-hr-element-2	omni.ja0.3.dr	false		unknown
https://w3c.github.io/mathml-core/#the-mathvariant-attribute	omni.ja0.3.dr	false		unknown
https://services.addons.mozilla.org/api/v4/addons/addon/	omni.ja0.3.dr	false	URL Reputation: safe	unknown
https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTab	omni.ja0.3.dr	false		unknown
https://drafts.csswg.org/css-lists-3/#ua-stylesheet	omni.ja0.3.dr	false		unknown
https://developers.google.cB	omni.ja0.3.dr	false		unknown
https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsing	omni.ja0.3.dr	false		unknown
https://mozilla.org0/	pingsender.exe.3.dr, qipcap64.dll.3.dr	false	URL Reputation: safe	unknown
https://sb-ssl.google.com/safebrowsing/clientreport/download?key=%GOOGLE_SAFEBROWSING_API_KEY%	omni.ja0.3.dr	false		unknown
https://api.accounts.firefox.com/v1	omni.ja0.3.dr	false	URL Reputation: safe	unknown
https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/	rundll32.exe, rundll32.exe, 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmp, rundll32.exe, 00000006.00000002.2241540711.000000006D21C000.00000004.00000001.01000000.00000003.sdmp, AztyGMg4jw.dll, instructions_read_me.txt105.3.dr, instructions_read_me.txt148.3.dr, instructions_read_me.txt56.3.dr, instructions_read_me.txt57.3.dr, instructions_read_me.txt133.3.dr, instructions_read_me.txt191.3.dr, instructions_read_me.txt217.3.dr	true		unknown
https://tc39.github.io/ecma262/#sec-typeof-operator	omni.ja0.3.dr	false		unknown
https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/	omni.ja0.3.dr	false		unknown
http://jsperf.com/code-review-1480	omni.ja0.3.dr	false		unknown
https://%LOCALE%.malware-error.mozilla.com/?url=	omni.ja0.3.dr	false		unknown
https://relay.firefox.com/accounts/profile/?utm_medium=firefox-desktop&utm_source=modal&utm_campaign	omni.ja0.3.dr	false		unknown
https://%LOCALE%.phish-report.mozilla.com/?url=	omni.ja0.3.dr	false		unknown
http://127.0.0.1:	omni.ja0.3.dr	false		unknown
https://bugzilla.mozilla.org/show_bug.cgi?id=1607439	omni.ja0.3.dr	false		unknown
https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&p	omni.ja0.3.dr	false		unknown
http://detectportal.firefox.com/canonical.html	omni.ja0.3.dr	false	URL Reputation: safe	unknown
https://developers.google.c	omni.ja0.3.dr	false		unknown
https://github.com/microsoft/TypeScript/issues/338).	omni.ja0.3.dr	false		unknown
https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapture	omni.ja0.3.dr	false	URL Reputation: safe	unknown
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/for-await...of	omni.ja0.3.dr	false		unknown
https://dap-02.api.divviup.org	omni.ja0.3.dr	false		unknown
https://wicg.github.io/construct-stylesheets/#using-constructed-stylesheets).	omni.ja0.3.dr	false		unknown
https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2	omni.ja0.3.dr	false		unknown
https://bugzilla.mozilla.org/show_bug.cgi?id=1403293	omni.ja0.3.dr	false		unknown
http://www.ethiopic.org/Collation/OrderedLists.html.	omni.ja0.3.dr	false		unknown
https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#E	omni.ja0.3.dr	false		unknown
https://extensionworkshop.com/documentation/publish/self-distribution/	omni.ja0.3.dr	false		unknown
https://bugzilla.mozilla.org/show_bug.cgi?id=1584464	omni.ja0.3.dr	false	URL Reputation: safe	unknown
https://html.spec.whatwg.org/#the-details-and-summary-elements	omni.ja0.3.dr	false		unknown
https://safebrowsing.google.com/safebrowsing/diagnostic?site=	omni.ja0.3.dr	false	URL Reputation: safe	unknown
https://crbug.com/993268	omni.ja0.3.dr	false		unknown
https://webcompat.com/issues/new	omni.ja0.3.dr	false		unknown
https://developer.mozilla.org/en-US/docs/Web/CSS/visibility#Values	formautofill@mozilla.org.xpi.3.dr	false		unknown
http://mozilla.org/MPL/2.0/.	omni.ja0.3.dr	false		unknown
https://helper1.dap.cloudflareresearch.com/v02	omni.ja0.3.dr	false		unknown
http://file://sftldr.dllsftldr_wow64.dllIsProcessHookedAppVEntSubsystems32.dllAppVIsvSubsystems32.wK	AppvIsvSubsystems32.dll.3.dr	false		unknown
https://%LOCALE%.phish-error.mozilla.com/?url=	omni.ja0.3.dr	false		unknown
https://infra.spec.whatwg.org/#ascii-whitespace	omni.ja0.3.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/captive-portal	omni.ja0.3.dr	false		unknown
https://blocked.cdn.mozilla.net/	omni.ja0.3.dr	false	URL Reputation: safe	unknown
http://developer.mozilla.org/en/docs/DOM:element.addEventListener	omni.ja0.3.dr	false	URL Reputation: safe	unknown
https://profiler.firefox.com	omni.ja0.3.dr	false	URL Reputation: safe	unknown
https://github.com/w3c/csswg-drafts/issues/1072	omni.ja0.3.dr	false		unknown
https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2	omni.ja0.3.dr	false		unknown
https://developer.mozilla.org/en-US/docs/Mozilla/Tech/Places/Frecency_algorithm	omni.ja0.3.dr	false		unknown
https://tools.ietf.org/html/rfc7515#appendix-C)	omni.ja0.3.dr	false		unknown
https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-3.1	omni.ja0.3.dr	false		unknown
https://mathiasbynens.be/	omni.ja0.3.dr	false	URL Reputation: safe	unknown
http://mozilla.or	omni.ja0.3.dr	false		unknown
https://bugzilla.mozilla.org/show_bug.cgi?id=1592344	omni.ja0.3.dr	false		unknown
https://mathiasbynens.be/notes/javascript-encoding#surrogate-formulae	omni.ja0.3.dr	false		unknown
https://gpuweb.github.io/gpuweb/	omni.ja0.3.dr	false	URL Reputation: safe	unknown
https://relay.firefox.com/api/v1/	omni.ja0.3.dr	false		unknown
https://html.spec.whatwg.org/#bidi-rendering	omni.ja0.3.dr	false		unknown
https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%	omni.ja0.3.dr	false		unknown
https://bugzilla.mozilla.org/show_bug.cgi?id=1539075	omni.ja0.3.dr	false		unknown
https://datatracker.ietf.org/doc/html/rfc7515#section-4.1.5	omni.ja0.3.dr	false		unknown
https://drafts.csswg.org/css-scoping/#slots-in-shadow-tree	omni.ja0.3.dr	false		unknown
https://html.spec.whatwg.org/#hidden-elements	omni.ja0.3.dr	false		unknown
https://lit.dev/docs/libraries/standalone-templates/#rendering-lit-html-templates	omni.ja0.3.dr	false		unknown
http://mozilla.org	omni.ja0.3.dr	false		unknown
https://prod.ohtc	omni.ja0.3.dr	false		unknown
http://detectportal.firefox.com/success.txt?ipv6	omni.ja0.3.dr	false		unknown
https://github.com/mozilla-services/autograph/blob/main/signer/contentsignaturepki/README.md	omni.ja0.3.dr	false		unknown
https://developer.mozilla.org/docs/Web/API/Element/setPointerCapture	omni.ja0.3.dr	false		unknown
https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4	omni.ja0.3.dr	false	URL Reputation: safe	unknown
https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2	omni.ja0.3.dr	false	URL Reputation: safe	unknown
https://github.com/google/closure-compiler/issues/3177	omni.ja0.3.dr	false		unknown
https://github.com/stylelint/stylelint/issues/6834	omni.ja0.3.dr	false		unknown
https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryption	omni.ja0.3.dr	false		unknown
https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query.ts	omni.ja0.3.dr	false		unknown
https://lit.dev/docs/templates/directives/#stylemap	omni.ja0.3.dr	false	URL Reputation: safe	unknown
https://webextensions.settings.services.mozilla.com/v1	omni.ja0.3.dr	false	URL Reputation: safe	unknown
https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query-all.ts	omni.ja0.3.dr	false		unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1543071
Start date and time:	2024-10-27 07:47:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	AztyGMg4jw.dll renamed because original name is a hash value
Original Sample Name:	05ebae760340fe44362ab7c8f70b2d89d6c9ba9b9ee8a9f747b2f19d326c3431.dll
Detection:	MAL
Classification:	mal92.rans.spre.evad.winDLL@10/951@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 96% Number of executed functions: 14 Number of non-executed functions: 170
Cookbook Comments:	Found application associated with file extension: .dll Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
02:48:19	API Interceptor	1x Sleep call for process: loaddll32.exe modified

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	true
Reputation:	low
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\$WinREAgent\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	true
Reputation:	low
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\PerfLogs\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	true
Reputation:	low
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\AutoIt3\Au3Check.dat

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	13412
Entropy (8bit):	7.091245282048936
Encrypted:	false
SSDEEP:	192:UjbMwpXMArgkXQzTsgi6Qm1E7QVyZUyMt2sQgkpTIPAtIW7SGv6O66lI72i2N1:UFpWzTw6aMUiYgkmAtIWmgda2D
MD5:	9C5316882F762C17E5B29039D2668D87
SHA1:	50E5DC7BBB78A231FF3219F9EF03DB9116C5D1FF
SHA-256:	C201D9C7F3621B12CA229A108D6ADAA12C207BC0772DA2CC1CEA31C1DD9FD50F
SHA-512:	ED973A540FB9DAB797C3DF3371C33424FD508C0FFAE6C9363D3B01C856D5765549A2B60EEEA08091FBBCA6E10F5651B26DFE7D23486EA969A466BCD831DBA0BB
Malicious:	false
Reputation:	low
Preview:	)j.O........#....}..KU). .o.I.}2.=RJ.b...L.......L..fE.V.V..Kw........N.Xu.e:..q\|.nXx.)i.@.Sr%..>y.G..C...#...Y.\t}.._T S....x..M..!..u/..sY.H]N.....hE"..T$!.~.K.;..K...C.....Z}ed.I.l.B...]..0..eGd..h4.4...\|..E....zk.J...Q.g.wk......6`.D_.U...3e.\|.....f4L.9M..W...w..s^........V....G)....o.R_.V...d=....].^..E-/s...D2..~`.&.........ln........J~.........N...i....a"..l..W.:...3y..3..x.+Q.`{l....[.....#[....m.<. .;......+.Gb\|.3.r.....'R.M...z.....6..........1.E)L.P.3Ur..d/.w QV.-.A..S#..q.].6.1..}..1.p.'..i].7K..!.............p.BQy.~.9..XYd.y... Z........../S8!..C.M.R...cy...?J...;.aO..$._n...G"..._b.Z..~.(.KK.......c.O.!......l.S..>.R....K?.H3n....z...Y..m.B..5ap.8,w.....T.<.3..T.}.s..^..b....F....'.x.......z..F\|..A...N~...7....$......o....Z....e..R..X_...x....N..1.>.a8.O#.&.`;..k....t....-/.........@.4d.@g,.....y./.MD..=..Q...+Y.V..R:..w5(A...]....4f....W<..:,.O....K!..}z.......v..oe...F:q.....a..2y%KD..m.6..y./..K,......c`.O....(.I... .g

C:\Program Files (x86)\AutoIt3\Au3Check.exe

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	234415
Entropy (8bit):	6.616703197570506
Encrypted:	false
SSDEEP:	3072:NuetWV9PBjMf50VkHD8QC2mCAgickSNSayEp6w9TJDJEyAuGjIMVUGHYrXc:t0MqV4HiRfayc6wU9jvBCc
MD5:	84F1A5F292D4AF0B264341B9F7EA7FDF
SHA1:	7BFA6C746A5CAFC6FD134DA23CB8D7DD071AE80C
SHA-256:	5E1DC8BB94321776CC689803C55123553235ADF2F01F82155A0DE8AAEC22A1AB
SHA-512:	BB9B173A1E8C2425E740C70D1BAFBB4C47DF560BF3ACAB59519C569070CBFA51DEEFC6E9084E62D7D2EDB06DBC2EF34F0C8BBFF29A2ABADBF0D7FE93ED7B16AF
Malicious:	false
Reputation:	low
Preview:	......>+.Y.....~....s...:.m.!$s?=....Wn..R/.~gq..).!..g..i.).C.....w.1K.(8nPo......U..]H.=.D.J.....x.G.~...5..c.N.I....o.s...8....`^.lo..N7..K(...%2.%..g..d.]j.&.f....+.s....UR}.o..a..\.$..'..IHKi....m....\|..[+6rF.w.q.(.h...O.Im...1.........h..D._.......LfL...l.7..M....u...s......ce.A..}.K...x..j.I...=._..G.h..Z..#3...f@........y._..fD...............j.e.....I....^.'.......-?.r...&..>..`..T.q.2..A....v}.W\|=...Zhq.9((..\|.c..)..I..Z........h.'9.._{. ..........Q....}.pU..n=.zN.uS6p...C.m..IU@........#.}d.,]L...p....b.4............o.C.a`e.....?....f.c..............!2y;.6.........\|...(X.e_..o.9.x.. .N....-....62..x\|yw..)....8^.M.*......`a".....PF[b....T..4/....h4Y.a.j..:..A...e..>x....^............K}g'...} #.l..$...31q.>.5..,S)y....x...(....y<=..=..?.D....-.Q.._.c.t..A..1..E..H.7j.O@....>N..)w`..3l.7.N.WU\,?.9.,.,.....91...9(....S.".@...V.C.y.5..M{_....E.)z..%...q.N....h.MG.9}...!".Ab.7...O......`.n....vO....q..$..xx..mM. -...8}.]M.W.....F.....j

C:\Program Files (x86)\AutoIt3\Au3Info.exe

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	176559
Entropy (8bit):	6.868519708759999
Encrypted:	false
SSDEEP:	3072:fbXiki7/GEaZr6GPYaKgu0cJ6lRe/1jF6yo1t+ByN9NB2uSLMF2BUyrxGHBE0MLr:fbXikuCZV1KguA/zibxGHhM/n
MD5:	626738C651EA6C9312DF08BB228F8867
SHA1:	20D2E8762961CB1CC3BCEE6282EB9D9127B855C1
SHA-256:	3515CFDEA83B8B2E5FDDD200589E0E1209BD2EE83D8F4D29A5DD2C54EC153BDE
SHA-512:	0D348F64CA0DC8B05B988CFD03ED4B9EBB9DA6941DBBDAB193DFCCAFE86BFE59FBE1A3DA19CF2381C9DFE98894188DA0D80CA51E995B24466C500CD2FE5F4DEE
Malicious:	false
Preview:	..&..@...@..%. .rl_".s..[.Ns:m.F..:~$..<.e.d.....)3.....?..M.V.J..-.i....>.~^.....(..~...~...(.#......d....O.@..m,..}7..;~..:....3a....7:,.J........&....d.2.?.....B...6.Kw...V.w...k1.M5...../...'....i&k..W)J.7.,.R....A..?..61.....a..y_...hA..F[...!.R......]...K......wD?W.no...E.E.\|....D.2.4........_.u.C.ea.hT$.ywJZ.k.!...-/x8g......"._..9..Ey..B./.`.".cr&......Qu..c..(..-.\+1g..8.0."e{..e..(....oQ..\O....../..\..ot]....e..<...%.(w..)vhe+.-,.G..:..`..............#.+3Z...........m..<Mu$~P.!Q...q....w.....q9........t...G...6...^..cV..H...........9....f..W....u..X.8...>..<.9z.k.b..#6..%...].i......Y......!..L.N.qN.i....).=.eD.r;..6..c.]#.........G$...x...k..i.V.##.b..3k..5~[..G........83.... ......JD.....]....C..K........+......[H!..-$:....F..t....9U+&./..(.l?%;..@j+p'.....e..N..9..Ut.c[..W.......^.]Ki............_.x...+.Y.2O.+..2N/./}..J.GR.....q0...C...../(....#...s.f.z.4n.Z.1..}...H%....F.J........$....-t1&.q..Y.}... .kw.

C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	196015
Entropy (8bit):	6.674785238257644
Encrypted:	false
SSDEEP:	3072:gwBi8SQySGgMdY0pWLbbUTwxR6GqsMN/k2ywQTOxBHuZ3QUZweYbQdm:dBG/Wf+wXHO01TbZg3eBdm
MD5:	0ABD4AC5C4DC38EE15755D87E2A0995F
SHA1:	CE059A80FD314356E8EF67AEA2F86BB987D74131
SHA-256:	3ABC23F38ABAB66F728C02194E8486CA6FCCE039A9E7C28EDB1D90345F0803BF
SHA-512:	98F8809784A45DE01BDD1EC684957DB4FAFA221C23AEE48E243AC499A6B6FA2DA199D8C8808B4F8A1CD5281B23C8725060D613EBF654CE1B95838FDF2E27C01B
Malicious:	false
Preview:	..,.Q.z.dj1n..`........j........._...w....qB.u...&...w)gZ.n.XB9..i.)=Z_.I&x..#c.........%..%\|@../.R.z.).D+.(;.....T..xR=.F.t..T....d%.a..).".m.-.)O....13.....P+`JU8...b...w.A...yS..[...k.y.=....T~.&..q..._?.=..o....n.Z.P.Q..6.....rf..\p......7pi....F.T.[...A..6&....x..s.:3...u..im.o..]..q..W....q......N.^..z...?e!t.TL1.M..^......9I+}...........v(%.\..@4U..bi~62"7...}\|a.u.2hb.j.Oz.gE...:....2..zUV...?.k......up.. .x......i.........n...0.^.4.k..q.K.^..Y...@...x..q.X.0...............I.3.Bg..X...g.:CK....? ..=.....1}9....o[.-=z.......,A"...#.V\|.M%....-q..mM..b.6..u......Q\....j.....0..uF>j.=..M....HKn.........T.b.].....@^.I..].....L.,1(..Q.G....n.aYN....#..l....7 \|UG......W.,....Bq........J.......$..d.....~ek.l...9..Pg.tf...zv.;.2<#.. .....\|gO.h...f..bX..i..6UR.l...w.L.FfMM....c\9`W.7......\.....2..m.I...@3..%.b.....31.~.K."...U.-j.CP.....\...O.D....~...R....I.G&......./1...T.Y.i..;..../*U..6Op.I.#.<.,N..xJ....y....k.6...;..;..&J....Z.t

C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1634727
Entropy (8bit):	7.556668282919047
Encrypted:	false
SSDEEP:	24576:9CV+3fqsf9yhgp7LnOjOPC4ZDsHODOkPZ2SNbqrTxSgL3:W87kmxo50DjDOgt0rTxSgb
MD5:	C0D3EF52C4E43B21A8A95EB4660BBEB8
SHA1:	91E26959ABEB89A6A6547A0EE5F5F0E316D5A5C5
SHA-256:	09D220111C9C538B9DA49EF7C265A69B29D1C11A24A7951B2296D01EB9CE1231
SHA-512:	91BE45A087236124B91A8D721C2AB61F3CFF0FBA973A487DB2AE197428205AECA3F904B12177D807F9032329A0DC0DCF8DC2542D715EC2D6525A6C77010753FB
Malicious:	false
Preview:	~...e..+.....&o..A..'..T....n5}5d2.d.}.....p#=...&.S`q..wAePe.Z.%.l/`P['>...n.1?.....P.L...qAb5.K.P1K..j.....%..".....R9..y.H..z.<O.\|.)..s....jO.Fb.....t...usO.%<V.I.m.j..DL.!.........7.1=B..?z.~X.....!Q..6.M..8,..ki....1.vA)...(...%..oar.....[..o.....d.Mi..32?.8=.....?)qX.adQ..Nw..v...f.......Z.....6...Y.kV.$.z.N..D........V...9Y$...9...n..&...J......r.....@.d..w...G3.O.f9&.Xx-..a.6........r.5..n..$-...0L~.c.T.H..b..}..).1t../.\|X..x.......J.0...3..:I..z.k.=._..#.1U..0Qs.:.z....w...`.\....%@q..K...[..5;........9...\.Z../e\%...5...O.&X.9..E....7.X.....x...m/..B%..m.f.p....z...0=+..`.c....).N'o..f@0c.3.#._.......o.4...R.....@..9.:....t.+...6)Y8.`o..9.[.D..F.2.1.9..........Xmb%...lB.\.....{.UL+.aW....f0./u.)...k.`.!z..1..d.p.......p..S../d..T...,.... #.s.z...x.e..........:".....IU....8.a.n$..a.....q.bS.`)_F>y2..O`&.g.......d..Btx6\|...!.$....._....:..".....h..+F........g/.}P.~."..;C.FN.x5.5;E.U.._..._X.* .(..T.(V....f..j.S......:....

C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1800615
Entropy (8bit):	7.4612743995592625
Encrypted:	false
SSDEEP:	24576:xTgKhrCW59cwiO/jc/p3JF8ESFJiEBr9D9zrM+fwRB2dhOijHJaqcPL/oZUEE:fremESFcM991IH2eiDwqaoZUEE
MD5:	AE48622C61DB57377CB5607AD9EF36C5
SHA1:	37900DE9B433ADF11D11DF94A3B05CDF73D0D4C6
SHA-256:	3D2CBD43A8EF9E2CBA910963C2928A023DC6B1646609EED4A1D66C4D6C21C8CA
SHA-512:	9FA2536E7B3F6E26EA42A5A849C1610D14D4EC160D91DD740ACD1255E8846414F6259E21B0C6220EFFA2DEBED9E94F8DF8DDA95E26866A5ACC9F1DB4401FBCC3
Malicious:	false
Preview:	..Ok...l.W.{.~.+...Ds..+.... .+c.+.......XR...Rt.U.!. .B...[..8.........@P4.B.us....@...>#.J.......p..z..2..zs..Y.+........F.\..Unw>d..t...-oGZ..k..[.,.}.B......6.$:.d.U.1...`.4...~.6t...%.d.....S....."EOa...cQp./j.>?u.zXTZ.U."No....(~......2/.6.s^......../:..hci.......D..o....(8v>9.K.4_..~3..:%}... ......R..f.w..Lj........w.....xmQ^.]_.2..-..^{..H.H..&w0..r?Y,.\.."gRwWe/........q.[2A.%R1Z4c...........$-5.p.,....~]......Q.e..c..0...(......h..5.....vo\|..u...W.....1;....y..~,+.,..........u..mxFY..f=......:J._..w.......<......A1.4,(eU)....U...y. ....f...L...lH.P......A{..Q..u.P..r...<.w2.v..j..w.....I.8/.f...'....Sg......%..H3..=Vv.7..M.H.O......h..[..]..? ...=...U.#...c\#:...e.w,..h}.)..@....jK}T...o/V./.R...^..#.A."#..E..S....(.S.[..]...n(...R=.u.+w.O{S...h.>~(.....T.7~...}.TZ...4...#.9..X.-.8......$.....i..S! ,.../.0...5.D.....VA.P........OQ.v.'..h?..J.L.......#..=XL...O..3v..c{Y.Q.>..@2%.Y....P...=.<.z,..@.$d.......A.]+...O.*N

C:\Program Files (x86)\AutoIt3\Aut2Exe\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	305479
Entropy (8bit):	7.996558501973404
Encrypted:	true
SSDEEP:	6144:iwOtc2q8Dra7wo7KWbGfkSSiVmpYUYJy5LDO8e05ydgnVmN6BLIFHlDlCMAVFa3j:iwOtdS7iWyftVUaaLxe2PVq6BLIf7AVi
MD5:	6EB0A7C26C38C212535C1864F821A8E0
SHA1:	24E4D759F272259EBF060E5FE8D29D82599C66C6
SHA-256:	4B2740F89AD4D297A6B728B75B21114758C5378262C11C7382FB253CF0CFE753
SHA-512:	090428510EF14691E1CE87B669C85943FB7D0FF5642CB86FA6480F2A29481E9060B013C5667B83734D2B60C7B2C45808FFCD78A07DC8FB87ED7710EE7DDA5E15
Malicious:	false
Preview:	1.f..t.-..._D.;,~....dB.......,.;.I...E..z.I....+.0F..v..6..)jf'.-.........c .I[ (.Z...QB.=..2.8..2..UYng.`....Y..!..P....be..-.+.n4u.s....JJW....?...l....\|..:......j.cY........&P.1..T..c;......,...-.Ky.Y...c....?..8..s..&s..>Y.]...Z..>.`.v.@B....P..J...'.8.U.J.....W....QE.Cx...K.i0..H.._.s;./..g..O3..~....E.5....U......8.h..a...,n.L%.......?.+H?g...$...@...F'.B...z...z..4.zy?...Or..Z^YA.H]C..b>../.Qnb.t.$.7..J...h....n...........V.68c..O.............G.ET......l.........G...lD...........?)...=........':.9)23../.$.7Y..c...#..Z.r!........J..$...Ps.....0..O7.o-.).N.+w..z}..:.X-z.K1...9..2.h.W.r.}..uO....,.........8d.L......jp.y..-I4...=J.N.#../......t..... 8...*.<.?.p.......8.3/....-O....0.mp.H.\|Ks.\.w%.k<q.W.1...d.b.......r..6...i.. ...q6.-...a..A.x...X..O{ee..CF..r.2......#.....:..\|.e!...f:1Z......5.[T..!.#b......B.../Oh...N"..Lc.%.9/..3...oW. .y.1.u.))....n.p.i..u!).;..'h...!._$\|..G...KU.df.I.."...^.....J.Ur.Mq...b.~hTj

C:\Program Files (x86)\AutoIt3\AutoIt v3 Website.url

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	531
Entropy (8bit):	6.7635722876730755
Encrypted:	false
SSDEEP:	12:5aCbT6+09/YRdIZteReM2bc/JlgcQImMjOMymW:5a7pMYtu24/JlgcrAmW
MD5:	6DAEF091A86F93CE99492D4CBC48CD62
SHA1:	37C801B7E3BE46064D80881DD03F9A2955A1499E
SHA-256:	CC9AF9CFA611EE262971C497C08037A553542053DC6060F460EDD46EFDBC8E25
SHA-512:	92B9DCC57FC1F8154860021E6228A9132B846DF0A695ED02C28CD6803237F237F3F6C13492D645D3A44C82DA0FA92A704160BA3F0AAD2DA90E7FE48DB52140D3
Malicious:	false
Preview:	.@..J....(U..h...\|. R.2..1.kJ[\8.@..`x.=....S.vP...e..O....zq...9....@e...E@... ......(.y>)n:H..!6^&3..&..$i.~t~8pb.LP.`.^.....a._...wYz.,..`.D.gN/.g.$.e..s$T.....<....K[K.3........C.Prop3=19,2.....t.B.../....0%....DI}...~T.3....w...K..%..y..q....\|.v..Z.g.....Z...i.TCc...N/J..{>WSK...i....c49^......}g..!..rd.W.B.....D.....;xE..1`.i.g....W....h...=..f..q..f.......3.mM.\.o._.&......*...=....................................................................................................Y@....czyzk0zzhil.

C:\Program Files (x86)\AutoIt3\AutoIt.chm

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	DOS executable (COM, 0x8C-variant)
Category:	dropped
Size (bytes):	7185968
Entropy (8bit):	7.991233526891163
Encrypted:	true
SSDEEP:	196608:QnVBbu20wXpdWoCl/most07JJ3rkePzRxhwU:2VJuK5El/vEsoAzyU
MD5:	C30D39C8B758390DCEA2AE241A4CBE98
SHA1:	20125A9BA3CEA38460D326F23E9BDE88B715568E
SHA-256:	8B1F0E28DCF20FA70E9BFEE771999644C10A6B31F897C1811FFF2FEB0901B8AA
SHA-512:	85117819078C6256BCE5B12EDE1DB0BCFCB910B37BD0E9C9DBE6A07CDCFDE6E3E63C35A44F5FF1D3AD6A026E9D15428DBA958BD6D8A7B892BBF4692C7FD91217
Malicious:	false
Preview:	..F..<.^=.sCW7D..TC..8bR-E.......s..[...?.:..a.Q. ....@..b.o..aW;..N....."\|%.[.as.[.~}:....!D..f..!.]vE....}.........N.5..y94...DRwI[44....;\{Y..i\|c.c...~..N=2.D...S.H..C......g.aT....n...e..^W.J..Wmp.....owF.)....3.xFk.q......@...\|.sB.......o...N..4#..0A.[.. ....3....\.....=...F...Fy......Q.k..N...:..<.........{.@..=..\|.>0.d.+..c....4C......ew!m\|..{........QV...2.S..?5..%5.n........>.....h'..8......g.....y....G.Y.....a.G...W%ef+iP...RSr...I.....S. .>-Q.,...l.$tY...r......0.1.....8.z#..:...aw[...#,.th..C...\F...a..sd!.(.......b............"..9..?......BW...._.F.y530.T..x>-%..~..#......n@....K....{I.UQ.].....m'......%..l.H.P.M.I..[.8.%..x'5.p.1.........-W..`.....J...3X...n.4.&Q.Z..^.j.?i)...u.\|d .....^eT..!...P..j.\.{..C..!...",...`rc.&5.....\K.....FU.-;.E.:...(3s2C<.d.\|.=..#p..~..0.&...n+>_U.m~/.&..c.s/..]h....3v^G..r..%.zZsX.......[....H.[..s.\|......~X.{.z%u..o..t....-.)?..6...T...DLp.,.N^...'..~.8l.}{..6Hyc... .r......%i.T.<......;>..

C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	124831
Entropy (8bit):	6.4012903405133965
Encrypted:	false
SSDEEP:	3072:ISbnRxjsYeVxvWPN+QmkrASHyg/8U5GcJqYTrHSjotyjzv9NvP:/bRxjsY0xvYbcGkIDl8nv9t
MD5:	4865F55C4AE290B7523CD4A232EE65A8
SHA1:	53B4326C3DE119F7906D27A38BBA13B7F17B1B0E
SHA-256:	F46C73883819DBD098BA5FEE9DFEEB47B62D2F6A939CFC6957E4C64B0FA5134E
SHA-512:	17FF06F0BE165D26CE5EDB80E9BD4040C0FE013F110BA07074F31FEE72CCC46F9F153A5EC2DA9FD30BCA26B96C88C1C16F6E920C09B46B5F379357B190DC3F65
Malicious:	false
Preview:	..[.....%.C.^..U.Id.......ae..2...U.g...........[...;..\|j .z..2i4..mv.{....hc..^....5?> yP.d.7......{Il....46G..pk..)...YG..d.....]...~.X;..PE..C.i..zA{<G....i.[~yP.\|.7...............B..W..<._.-6(....?.4...^...Bj.6=.MO..$0..{....f..{$..".>l;....=9F.../...1.Z=...'.... ...GE...g.>......t..n.g....^+.R..^...w.pz.S.^....;.SW.YSAXC4... ..Or..........w...'...V...`..w\|r..E..m7c.UvqY.P5{O../.i.r..k...J."....z..F,.\|...Y......P.N.....[wk.I...0...&.D..Q...g..}.Z.=Z.[.>5Z.e^.@(. ..L.!...s.gdcFb..........y{.....rc.\..d$.(.5....../M....y.#....<....n^L9.0=Gj.t..J.`h...\|.=....5a..Q.v...wT..".....s...G..]..y...k....(0...!.k.7..@. .."j.'Ja.&......F.-.5.~A{'..OjE...6...{.i...yEHLk..+}X..1?.A8c...w..C.s?$\.~.........8.Si.`.. .$b.E?.@........v;...q.dw.@.%D.6..c..0..!....D.. ......"..%s.......'{Fz..`..@~.j.....#9-...6....^....G.6..1d...\mC=&..M.C^w.L...Y..L0.;1.\k.C.:0,.)>'....`i..."X..4..A....w=.....yd.A..."i.....\...q..zM...m..>....P.......\|.&...m..5..Xq.^_..S9q.J.

C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1072031
Entropy (8bit):	6.692934658230966
Encrypted:	false
SSDEEP:	24576:5VPZ0fbnb1b32vG5lklkMpPulUVorSlU9xXqy9tn7e3QJSq+:59Z0DbJ32vG56lkMpPulkoWlU9xXqyW7
MD5:	4B6B046E114C760E6F4685150772B58E
SHA1:	B908B0F6E7B5D9A0533C59CCD7A278B057113CC3
SHA-256:	519551AA90F399E2B96900E689D20EEBD154427396C3BE8A12F4EA7F946F4D1C
SHA-512:	2CBD4D891278F7BDAE63F357ADDB6D2B61E240620A4321A832474DADF7C19D50BE60DE44E4D5F55B68FC445874D71F91EB2FA2C9D06876F5AA86083311B27F0C
Malicious:	false
Preview:	r...Oa....o.?...[..d.....6.d....e\.D.[......SD~..~~....K.p6M......a..}...V...t.!X.....{...A'..{.w...-..o5.<...Q.Q...3..P.G...a.m0L<.7.h..T.mr3..........o..h.g..^....\|IL...yj.......h.0)..tJ..=.?....t.1..k....S.G...D...q.{......P...H.\|.G.Nb<......0.\.^......prQ'.v.....Q..1I.h...VI..{...5..\.w`.Ef.HB...e...{.f.... ..o......%.Bp.u.s...lH..=....s.n.......p.....uJ...+ ....H...9<...O.....jp.$_C.=fV>I...#.?.2.tcH......`T,.%]..B.....O..;...).i.f.a.......7...e0lbMB...u......-.....,.}.....W.L...ozH......._.3.'.>..K.......7.Vd.z2\|....@.`..f.s.._J.P.)....PJ.....mH....lQ>L..J...fh?\|.~.&B.........\.Q.....{..g.T.W.%bYQ.cI......^...R..jH..^.'...qR.[..m.A.>.X........7?..r..!.C.>WuN.@.\|...4....D...D.........D..y.....6..". 5...E..=..P......B(.EiA..,...w..)F..k...(.iN.y..D........b..P.O0..c:.......9I.pg..._"..+..""\.x..8Q.......oya.Q..&:Q+gh+...................=k..M.v......a./.....E..?&....k.<V...=HJ.A..2........$.9.......^.+4#`b...oa,.....:..pz..

C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX.chm

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	200713
Entropy (8bit):	7.903246637278973
Encrypted:	false
SSDEEP:	6144:mr1tp4FmGIJuRvPh0YS0LlkiIlRiT26fm8Egx:mr3i0GguZPaYS0p+iT26fm6x
MD5:	9D218F9AFBB8B97196A198FB8E1460D4
SHA1:	1D610E9116FB0DDC89313C3F7AA4F34DDD2E824F
SHA-256:	537C08EBD959F20D9162A8F5D1E911610BB730E23F611F69A775D03002B49E65
SHA-512:	87D1BC3FA9838F496283428287711BD5D62431CEC59F0BCF78F9558BC8C4FFC1FFBF48D5C92A02A848EDDD758FD0D2AC87DCC019CE9EABA418A7EB590458F6CA
Malicious:	false
Preview:	..).5.X....o. Y.q.~...lw..w4'E+...y..w....]..K.:1..Jm.,......~?..(.).1.[.~..s...HB.~.K...8....J..UD.{C,5d..&.j.....5...}..;.x.j.U.y5./.?..C....S.2.=.....>6.,.....5.P....Z.T9......g(...8...A..17w.e...{.j.z.r...@.....7.T..-.'G...+......}..8..`....z5..{\|.T:kvm.' .vUU.2..X.fE..f...s.=z....i...8.M.1.d..%R....rN.%....}D......+...6/.y.-...!My...1.u[..#.M3.B4.G........~...No.bev1.&......`.t...fv.VT...b{.f..H2...r...0(.xd~...........Za.R.>......:.y.n..dI..0...i...}.6...,....pw..R7n...].o...t((~..65..p..Gj....[0....g.....a..e.>~/..@.HH.b..............m3<.....'.....Z.../..k2G?~....../...LV..^..;.z.9T...$......A.L}.sXF...wB...r.g#..~..>.Q.M\bE.....{.. ?.........'PT...f.hC.d\....n.y5..M......Q.....K.]..F.>.-...........F....<Y.t.....9.L...kX/#q.@...R J..{'..U.@.*)S.J..O..uQ....W..........M...#.1...u.G...$d-"..b.:.s....o9...5.~....).....z..\|D...B..xy.u..R...Y.wx).(_O.'.=.F.g....+..."..c....H.=.{] ..V.?\|.....}e...H.C....=...Ir.......y...V:......jbxD@I

C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX.psd1

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	33781
Entropy (8bit):	5.46774364079186
Encrypted:	false
SSDEEP:	768:RmiGMWmExoISpf4BvNZy2/RIKVFBDmM8N5:Rmd9mQofpfGvNZD/RJVLDmX5
MD5:	B29F63C2979749F35010E0AA56715AD1
SHA1:	7E21AF3F58BF1B20AC09B8483C1CE2945A355668
SHA-256:	3052CED600181A4ADF6E81903D913529E6FFD667984CB13BEA4F198299E0A534
SHA-512:	B5D6C3968242BA8F25720359815197B129DF7ED7182944508B00D34A78E83A99C4BDDE15E62D511DDAB765D4ACC0540DCF0B27607F31617ED5E1529DE9376601
Malicious:	false
Preview:	....e..P.5....X9..g...(.!Y".<...r..Z...Z..v.F.;.... /.\|1..,..cFoR"....8Bd[..G.U.h..EE..u..w..\|joT. .r,.r...5:.I.x>.=. ....H.B...Z..II..m.fXy<.......y...I....t....E.... ....W_F......'YW.f.....H.p....u..Ew.......q.@.t).&.....b.?.t1..X!..+.;.C.mI.j.1.....S..]...l+..'.X/...pK.>....4..<I0^..Xx.m.......O..?....`...-qjR.......t....:xK.G...+......\|.I...7....{K..9.../.M....:....V...@$....ve.%....K4.'.....mB`...jm"..(..j.=Z.J...;....l.9......mP.C...........S,4j.I".Zx+.........>.......U...oxW........^.oAs..V;Cl..[..."..;.M...R=$.......7....r..N...................]#.f........7;<.4.S...LO.>E..P+1x.2.v.7"a^-..s..Jw.w...u..S......S.<I......r.M....K.l./T..HG....d].,K.K...l..o.....C..'...=..Z..g5.........&...p...ea...F...0.2.....]....h!.ZR.M.:.?.r......1.........Y.E[..t..}.b...,......._B....W.z...q.u..Qp#R...)D..^.l2......1..x._NK.u....m....F..._.>8......?.s....E..K..p.7d.U.]5.2.:.-.L.s../..YT]...ma.f=.....-.....+.u1B}@...1.H.n..#..M..h..J..

C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.Assembly.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.793452685062623
Encrypted:	false
SSDEEP:	768:pwLcvPUnJqXzjiSRxLr8U8goIw48AU+fPDj8cLiHzL/LggUUMUAtttttttp0rg+R:scvPUQajHf4t/c53PAlYDL
MD5:	EC465AA7B719A6D1E0504AEA77535C93
SHA1:	E4B25E23D36E584E672F7C07339DD6BFD2352790
SHA-256:	2BF3628D73BCFAE4A65F905CF63B84386673E4A600E7D491567C28EED85129AC
SHA-512:	9CC331F97D84EDB5685E1E594285F3A94A6374D5F48722BDA550EEA21B7FF1212F058DFB7DC39D15FBF30FDE2E441F679218C1C0611E5383783CE56B240A04B2
Malicious:	false
Preview:	.........[..K..hP..^.....G....%.dA fg.qU3...J.+........ .U.C3{fV#..../c...........G...(......;.v^w"-8..).d.._..5..q!.bY...(.........p..."....Ha.R.. .F..\|..,...#....%%~^s.?.nL...$.n....<P$aaQ.H.nj.IC..G...?k.OK..0G....F...."X\|.0}..{......1.F].8.s..<..+..xY.B..c.....4U!.y.....!.....;M..o.h..2[.....8xx....#]k..k.s..:<.....U........Y..s..+0...3.\|:.c.P.'.p...7...bv/B.........z.9;k..\b.c.B..E. ..I....3....}.w.S....V.$.\|.....b.%.p...J.+...-e.....#@fhF......B.G.f.......e...P.\|...%.......h: ..].F.......]..U.S-i..>.P..F ..e>..lV.....a.!FB.U...=.L....oL..w...x..D.8...LS....ka...%'.=..ev..Ji...G2.D@>U5...di..\H.5b....:B..t..'../.R.a.I.S/{..J.....y..*A.....>.Y.(...(..9.R...j..\cw.`..{.F...Y..c"q..bA.b.S{.y....../....2...(.......3../......".]...1....a..Zq..]yR..[...x...8..;[.....7.e.B....N....br..H...s..^..,.Iy..W..c.e..B......a.s7.t4.].T`..P.....}.9...._V2..]......P.D.iU.Z..X..2T.On..X1.g...;0....5.mK.g.].\kC..<+..]d]...F.G...@........$....

C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.Assembly.xml

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	49845
Entropy (8bit):	5.627753917988555
Encrypted:	false
SSDEEP:	384:tOgdQQLwjFZNlPm+YgOlJ7lqyVfpC4BGMlCoWrQGDg2X1:sM3LwpZNlfYgOz7l3CexDWnX1
MD5:	C5FA632ADBF587B442156744F8510A48
SHA1:	CE296B111411F235E7DAD6667E920FB6A643FAAF
SHA-256:	2AA115CDD7AB1C209CB5E23F71E0C10B75ADF7A0E090162F0372BB98803FB6C2
SHA-512:	DAC950DB9E67B3336CE94952CA9BB997CFAD50F8855B6E15FE3F203FD3CA715FD02E5B8C31BBBB2491F5E59EABEE1BC3E05933D85A29A0AE833AD54B2533C0DA
Malicious:	false
Preview:	.4.=.?.....K....o.P...'.).baB\...+....:...0k.w~\|U..L.;....`.#.....q....t..f......J...H....-./.d.%........vfQ..\|.W.A'.Ry..........Z.v&.....IOhz.}.F.....w.+]=E)<s'.z...;..U[........j...T.=^.p^..7"....e4....5(U..........%.3-\.3.#.D.A.0....efnqWh....C/..\.9..H..X.h...(......W0'4....y...... @~qg..^..&.b...6...Js...Y,w3\m{.....d.PW....H4>...7.=..It...+.....@.4...-..\|.qJ....T...:.... .....N(3........./....z#>....,.........]4..S~.dO.@.H+'..3.Ku..z6..6...ZI<....c.y..a....t...d...zU3...-f.L.X^P>......N.fPd..m.2....,w\......{.B^kT......O......[..1gUm->G-..a..-...uM8.....>..#5..%..w(...%..TD;v.....m.I........T..E.@\.G..AF\..O...t.8.k.5.O...\\|....Y...ae.b.z.p..{.;...9..!....Q....4...y.f..U"...\|.\.xaN..nk.....K.R......m........LK#9..9.B.j....(K....'.Y.X..G....{A'...>.5D]BS......D..;..+..8.t.:T.'6.U..2..G...,B..P...v...k..:..1.`...............\Y.g&].(kg...YTZ..o... "..kD..U..N..%.h.......a*.Yq..>...v.....X\..[...Oov.$...........m..#......:...P.

C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	53671
Entropy (8bit):	6.6157172246256515
Encrypted:	false
SSDEEP:	1536:C5d26y9y1Ctzf3B39A7rYDttWt5pmMFJPj5e:CS6iJ4sJi5pmIPj5e
MD5:	793C5271F60E8997281069D7BECDD6D5
SHA1:	A436097C969322CEF48AA361DF7BAEE6FAD39946
SHA-256:	5A849B7EBD92C5FA0C886041869ED4DFDC072877EF3A86616EA2522DAEA450AC
SHA-512:	65F3DDC3B4AF2065EC7B19EC7A7177B3C653FF666D91D0E2B9F5DDE156995D9F7765B223853FB28375AF25D6DE4841D95A47490AFC164DABD069E1597F208EB0
Malicious:	false
Preview:	.!'.4GF.......&.I...;E.#.or...X.M.u...G.l2>...].(.U.52GM)1..L.!...K.](h...y...6.]0@../...r..m..jy..o&.....3..W.2.2...L8=.;.>.'.....oW.......=.j....h+.>.....9.}...B...e....ak....WJ.v-........,.`{2....qo...-..hXm.....:.M....AlqP=......\.#.NhR].....h.W7.r........OH...e..r%..Z]./\|.....n..Z.OoT......../......Qk?I.v...-aN.g...gy.?i:.......u.s...Z .x..Ct...]..Hx.m....c...^.n.....$F....]2!iN2D^..d.<C..w...E.Lw.."...].R'......Y.{..@.qg..i.SN.@...4..q......./o8"......N.. /..90.>..f...gE/$...h.9!...0q..x....`..>..cb....8..u/..qfS....P......<'...(..?..f.1j.!/..{..Ma.D6.h.Inv)).y.kG...c....(.Pe.O.:P..p3.(+.@3q.?..._C.\.!.@..?.>:...b]2.5...U.hM...vl..".$....'WQ%......>..p...............a}.(-5.V.I..8..'c..{.....)....Ct..."..^m.A...G....V..y.9T.9/...{....)......~.@cz..Z.Ss.=..%t.<..;o..'.J.._]P...}#9.(zk..-......#6EE..2^.f....A.7.F..>.]{.........?....+..v/....HVJ.m.r...Y..E\|....@;...Q."..n..<.5......._T.]kg.C=.".S....}.9..[V..P)..H...^e.c.p...q_....%.v..\|.

C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	726967
Entropy (8bit):	6.886216187356949
Encrypted:	false
SSDEEP:	12288:dYKnrutD9Voca9OIPzc5qpSOyo4l1KRlOZeKtgZz8mlCtHFwNhacUK:dPuLica4IPQgtTZxmH2hacn
MD5:	DA26248D508ADAF3F88C7C9A7A901480
SHA1:	49645200C7F822A6CE21F9192F9AE5D871D534CA
SHA-256:	2A823EFB1F53ADEB56604F8C3F95F52D8A9135A24A70C67A0009D9257C6C2713
SHA-512:	CE86C5A942F1197B9E1D9832A315E1F3AE7DFEFCC2426FD76062260E11E2F1A8FE1C2029439464BC1CB8A93C953DC4D3411AFB94CD9470CE178C88DF82E26A8F
Malicious:	false
Preview:	..u!G`v0;...8.z.P2h.LGg.$..?Z...P..V.....Y..TS[\|T..a.g<l....@7..).$.........@.G........y9M.D!G....\..`.. a9../....5.\....,.6.....(..CO..b.[......>0........L]..>.t.`m.-A.SA..apZ...L...!^.:....c`.J.;./.d.\|...{...X.H.R..}!k....E^....B.%.!g.."....m....D...c.k.U....MK.'.#....?b.)....tP6..._..'..2.!..zW..$.....ak..C....o.A.qPB.m.....8g.... ........kXW...$..s...ms....3-.2aup...2..=.].v.y..)../...-.^."...!......q......U..m.&..u......["..#3.$.AZ2..m._....k+.U3.]..FJ.....]..v.pC...<...Hm'z....F..Z..........E....A........q..0.<~.K....P..X....o.9......G..6..\F..snG....+g.....W#?s...#$)..l(....(?sM....k.:.W..l}......t..w.*q..fkq..1S.K...O..F.3..s..b.V..u.R..%}....V2..........'....dih.;...;+.....(.X.sz....v..'.4[R../.4H@....y...'.{....Mr....k,.. .....x.?....6?.}^.0..K+...~......X.lV^..4G...>8c?4..N.@S...n....p.tN..._.^.x..E...,......{3...a..y.x&{.&.X.I.{...T.c!.S.{.Z.-.BK..Z. 2m.8.&M..)(...)..o.l..Q.....w..n...9.......f...f/uHf.S..]..Nhxjrr.......d....g..

C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3_DLL.h

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	13320
Entropy (8bit):	7.190205028963733
Encrypted:	false
SSDEEP:	192:mVYmq59q7CtrCdyp4kDukMvxnhxYv7fxu8c083k5mk2VuJOlhuW2ZnQQyP:J6CtmY0kMvHibM0mZqOlhuhZ0P
MD5:	105DFCA47B386BC5D5D7808B2AFE4233
SHA1:	3C218DC623F7E09A5758E180F6047C6998A5BC7A
SHA-256:	2ADFA0A3FA475D89B2DCD6411F2E52B61F68CDD6F22E2E97246B2E8F49523C68
SHA-512:	C796ED4B68CE86F2A85F41049E63D3F1DB2A105C5D9175A7869274351DA8045633C8FEBBEC8AEC8F5A77D1FD5D19AA56032149554AD6B93EF85A3CD06A449C8F
Malicious:	false
Preview:	..P.......Y.60u.@.:."..$Q.=.........g):U..Qq...;}._.+...dh..G...=.%..\.1.C..\|.!b......".....M.l.wb{..`7F..T(.?I..l..4%..h.L.q.t..^-...V........m........d..X.....p@/.&"...uO..L..m.g.,-C.j}+Y..j....!r.3..J.....w+,..(..k.zI.]..........uB..3I(1......f.U6T&E...X...J9..9..K....z.../...X.......'.XE.MH.Z...v..R.B...$&.lc...Q4{w{.c......8"..I.^xR..:...o....7wV9...,...@....\kk........QQ...t.._==U(D@.7..^...8.Y...w\|....>Q..Q~...z....bFW...o&9Ql.W..~.m)....k.4]...d.2...~..b.$y.R7~.x_K..f...w^h.k....].G.I....9W:....W..BC.(..YE..P..a..9.Gn.b.-..CQ..m.\z.-...=.....FQEu8O....d>L5].y.].2h1K.V.....u....1...E.U0..]...Q...E.A$.N(k..Z=.....ZW......9%.$a/.s.D6.1.~J....S..k..i.MX..3....d;.%...^Y......Q.uw\.P..z.....CB.W.......6...^a...8..,..t~.G....a._.s.......0.........Y.........z.}.#.........Q......j..^..))Oz$.i.I..K.d...'z:..n... {.X..i.... .O...........{..@......Vi.z.]e..x.."..[s.un..?....._?...K.8......K.....wb...~.W(. ......\|..2..q..Q$.h.

C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3_DLL.lib

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	29303
Entropy (8bit):	6.25438834336721
Encrypted:	false
SSDEEP:	384:ySX5U1S8BOhuL3cjnz5TQnQ2KZnjGYQsGZPOhLBJ3nknsKnVnIVznkZVfhNvnwLH:yWU1jBE97HFw8glipf/
MD5:	CF6D546546E7FC0705CC5F3056D28AC3
SHA1:	437E7D7625E1F57BC7BA4369705CD249CF99E830
SHA-256:	44F765CBA7D50B3D8D3CFFAE0D3CE37736093A312ED150C83D9546665AA90722
SHA-512:	8377280EAE1D5AF8DDB2DE95C20BBDFF029B48442F35896A03B1E022C5B3A3B17F7F47DFCEF5C6CF0C9EA0F0D3E8A4DFB397412815A0606D7E5F8465C08D4B71
Malicious:	false
Preview:	^......?....1..Y.H.......`..".0S-..h;.\...t%.A.9....4.t.....c...%.^..j.f:M.\|..%.q....h(....K..y.!a?......0W@.u.2.."...R6..Vv...v._Q...q.v..,'..2.<oF2l...K.....j.M_. ...e....wt.......{7.b.`..[XdB..A.....~.H.{.F...Du..)../.............:..2.............g..>.....2.r.Y..b...`E......T.V.a....1.TU_..G.....Z...".z.....J.Qn..p.An.. ...].6ov.......@6..z....=:.%G7...&...B...I.6.b..A..%..i.'6....A.j.H.~j .c.^.....Hx .....Hc.&.k.u..'\|...P..k@.>..-!.........+~'..S-..$E.<.9..K..'......A......pP.,hUP...y.l......y..d.k...9.A..=..`.....g....o...........9...8M..c.......P....m.1Bt-....v._^.Uk..D.S..vXF.-.......lc.0yv.;M}.%..= ..*....TD_.....V4..:[.h.W....d..nLi..z.^!T..a.{Ag/@.7a7.<.t_7..Ut......cu3e.uFFC...\..W...2K/.......].re5...RY.gWkp.Es~8m#.n.j.y..8...7h..oo.O.@......R.e.."..B.....D.....\..s...A..w#Tea....Gzv5..b.&..6...5.i.._x....g.?..2..@..;J.:.....:......!'...{.$....#..1....8.!.$).S........9.?.....1..Z....w$.....O.''.4&......P`~CvHV

C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3_x64.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	921015
Entropy (8bit):	6.685068581471113
Encrypted:	false
SSDEEP:	24576:I/f4Mhkt0gzcgMUbCynIjMiSUqho8eaNz:I/fBhkt0jMiShleaB
MD5:	7E8B95567938DFC180F2D315D618576C
SHA1:	EB4304D52667DAB07388AD2812897319C7A0D3D8
SHA-256:	33936C69F3D180B9D8391A0DB700EEEA350C91AA2D69C91590F37182CA693265
SHA-512:	81DBAB6907327827F75ABD4D350519585E8FD3C6629D9608CA621F9D7AA5B6713F84818C5AD746C421906A064E78C2E8D18905A587446F5DB89F4AD00EA36878
Malicious:	false
Preview:	..L. ..d...[.....[k"..=..-.w.G...9O.?.4..~l"I...p.v.C..,..,..Y..v(.......S.{.].$....m.?Y.;..K.....56.=2.....nA$ZZ./../......Ws.....Q......3..a.Z.V\,....R.r=.u.).^.].5.qX..6>....z%....&(...t..>....9.M....KB..6.....96b.....=A.V.?T.&.z...fi.c..JM...f.5eM=4J.3..&..q...L.............W...O..v.....t_w.J.d.16r..71.&.?`...+.br...o.I!.\...h......(...\|...Tt...@.\|4..OfTN.Gw.I7?y.V...o2.dHF...:{..`.f^....Slu.......}7...j..zd...#.\..b.<..U7.U..X...5_...~!...D....Q..3..[......u..\|.`b.%.r\../[..^.U....g.Hn>t..p....q..-.x..`7)..W...j...9mc.'3..j....].i.c._FC..e..-.0..a..../g.Zc\......2.A?..4Tv.O...F.J.mW.Qa=...q..z.......F6.x....}.j.......0N......<Gm..x..W...`4..rA.6S.\|.r.....~.........j.z...........N......5.6.7..+..../x.FycG...c...j...7.V..E.8....H(.f..e.t...{2....H...p.s%.....+.~?tCN...vl;..L/...Z..%............."...[.N...f.7.j.d........;.....2.YG4y-B.l.O]...1.aD.!..l]..V.....U......D...$.xE.J.=.....?..g..3\|...}!.....0.n..N2Ef...q4..0......f..

C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3_x64_DLL.lib

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	27873
Entropy (8bit):	6.095001664132198
Encrypted:	false
SSDEEP:	384:sEzrb++fcI1VDoz7i44z0dLSDs7lqopP6FHye59P6:BrbpXDmipmfV6FlM
MD5:	204B1F3D2FC65B362ACDF08328D67860
SHA1:	93FA6A15A457AEC09E97EF34E790B7C692E04F97
SHA-256:	00CB25219B40C46CE272B16882C3FC33139F7BBB64649A5BA41FC38AC1693602
SHA-512:	8099F8EB9071B596DAB35BE659D8C61FD971559091AE3E4421569AFCD3B7868C46EB07E38984B4DE887A3C301ADECCA7BE7D43EEDE325DC0DE061226A109DDBD
Malicious:	false
Preview:	.m.8.x.r.....n1.<.=.B_...\K..$.....V.....\|...75..Y..F'.f3...s^_Cg.k.Fw..C...T.G<..b."....+...Cde...7D\Gz.7.....Gp..e..p.p.p..X..EQ1H.~...-..&...........P\..M.u.`...%.J.+...t$...%^R....KO..N.x)Q...uny...-..U....'..!..ZP...c.C..#o....gBG,."j8........e3..\.o.4V..1.[=.,.xZxH...v........-G>Lm`t..u.-Y.W.1..2h.._..e.$.yZ..J.....=........-F....I&.T....=`Q..=.~.%.{.[..42[$1!.#K.....~\..^....F...=..z.. \|...n......5.......o]..(].YjOp^...L..B..NvMf......H...]oDf...y5..F;N.4`..C'_.2E. .D`#..9.........!.>.N?.mI8....3........;...gH...Fu{..).........b...z.U...oF8^..\.5;..]..6Pa..IE..lbd...X... ......s...wP....L3..o+..M.3..S..........J....tAXc'.3..?...S..2.F.lfP.Q'.5..NE."~w.I@I....5.......T-..hd....#3.7.zAa..uB...g.q..C./..U.!..8+...O..E(I...\|eS.0}.."..cz.....`...Z$..#..4k.\|}....Q.@[.b..j.qv\ .Z.xR.....x7.._.K.;.b.c.~L.i.<j8.a..A.......\|O..4.S.f-.....+n5tno.......Eo.~...E...B...!;qz..0d..^.X..`.....>.f.}..,S...m...".....P.i.Mg..._g]s..>7..YB....O..U..<

C:\Program Files (x86)\AutoIt3\AutoItX\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\AutoIt3\Examples\_ReadMe_.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	534
Entropy (8bit):	6.73196515241819
Encrypted:	false
SSDEEP:	6:1cmtQQB3S7cSgdRTkbqP++WuhmUj/79RbVYk4vMl9AfLo7llpnobi2nvb9bVg6XP:1GG3SYSw1ZPTWuMK//VsMWLmLpn/6EtW
MD5:	313BBACE4CC70A60F186E96F67EA01DD
SHA1:	B621B2C88A194E7B1B02D5993D8D9C306E9F834C
SHA-256:	0621852CA9975DA5E7D5E089031B8B82E494AA0E9A94F6CC68EA4DCB2ABAC9F2
SHA-512:	B80C1446B4E0EDDCED84E19689CA5A07CAD93AD5882C028BC51ED5D46F5BABB5DCD7513FF275727AE78CFABE082C306597CE330730AA0C18976C02F90ACC2F98
Malicious:	false
Preview:	.BF.k...s.;.5Jr..a5.T7(..RmB.1.\....w..xL.D.ku.......P..KP.Z.C_u...{0k......^."...j1A.....G.K...>..GB.OL.......Q.b..".xX.C....;...9...#e.j..3..=..i0i.[...[{.g.'E{<..{P..f....H...J..].ns.....- Jon.....`...]... .'#..t..[.u...V!K.......c=M..]M......m.\|n..[.&.Z..)&qj..+..:B....G..qn.kF...G.nw.a.+aj..@.Ac...a.u.i......._]..s.G..}.r...5u."L.7.e@h.........P...<...*..+.g.%n.....6\|..$O.g.}Ga?.D.^.v..(..o.F....................................................................................................Y@....czyzk0zzhil.

C:\Program Files (x86)\AutoIt3\Examples\calculator.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2194
Entropy (8bit):	7.792302317905323
Encrypted:	false
SSDEEP:	48:2SbdbsXZoVorWfWTcpkRogWGuXnKKg+896d1orjVQY8OBWaW:2SJbjVXpkRuK+8ssrjV8RaW
MD5:	10EE8C60341F23B25BC7F1F6B71B00DE
SHA1:	AD9E5DBA60140A076875898EC2E10B66EC329079
SHA-256:	08BAD368913817E3D2E2A85D4149B189EA6E30745FC18D4BCFC7C2910CEE077E
SHA-512:	A7671CF24E31667C48BEE2AC77AE96ED51A885E7BCF81FE759CDFC8DB8031669D51E16E3941ED08D82E15CB967EE4EE04AC1F6B32D683AB686CBE06009391BD1
Malicious:	false
Preview:	.1.h..!aD."]..k.s....9....Y.?..r.e.%...[.-.1../E.X,G...IFE4..TL...II..ZL4..u..;..h6#....r...a...`...P.A.f..g.]..\|.w..........t.}..).......R...BX......n...W....I..@)Dw.t....G....\|Rb/.[..k..9&.}0..._.b%......o.....$.}..Nm`f..r..h....n.....K... .k....y....b.........C.).D]...^..>%X....!..7....$.q....s.3....jF....k<k4....b............d}....%Z..>..41.wBtA.q...Ph..sY.3F.../....._p.....f.&.@0..\|..=.T...sk...h...2..U?.6.l).(....Uc~M</......S.#...+.IL.>....M...b..+O\..?..!...z....J.x`b.'...!.....b9C.f..i{'...&......._.Hv.BX$:.F..3+.........CiOT.?.W..Li.J..%.0G>}.v...eOa#[.-...(.v..~^...w;.#`.q...96.O#..).2.^q#?.=.P.......V...w^.M.A.sO...../&..XJ.b...s.qVn..+.$...?@p.....qk,.....&..o..I..w.8.N...I..A..bd.....UX......A../V....C.W.o..b.:..}.c!......Zyh.S.,p.....7...4..............R..y......(a.b..y...H.......Jr.J...bW...%.!=.YS.@.B..[)#.+.pG.....;.,.=..Y...@...t....EY)4.Gh..E..g..Ur..ZN.&,.D.......\|.A.:}.,........3%v]...nT.&...p........S.E.M.

C:\Program Files (x86)\AutoIt3\Examples\count-do.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	Amiga Workbench
Category:	dropped
Size (bytes):	1630
Entropy (8bit):	7.692433773105367
Encrypted:	false
SSDEEP:	48:BwAnSZ2sqRlsRQk0xufPLvN4lHFAxmGo++8LyLHW:BNnSZ5q4RQ/xufPLl0ex/o+VsW
MD5:	028BB014DCF6EEFA55FF03979B8B60C4
SHA1:	CA2D3A649347D01CC35FD07178ACA9DB9AAF53B1
SHA-256:	F9BB3B5AE60842B17E45F342487596E9B3E261746AF7F69D0B0B014C2A8A1584
SHA-512:	B93A613E0740F72436C36EDA1075FCC9B91B2D040050BEA0CCD52DAD7D69CBDF2373E1D988F5F1391376B5711CFDE1BF752313898188AB6573546ED5267DBB84
Malicious:	false
Preview:	....9)..b.Q..rF..x...(.1e/......{]...."...8)6.44{..9..W.c<....p...F...C.. .3...l[[........a..Y.Ka./9~E.q\|..h.DF@..C.-w..Q.3!,....P]R.Q..a..+....t.5......=......4...I.B......g5.@......$ .7r.......8........T.Uo/...X..I.9-.a;a.._.H{T....1.x$....xB...tT.y...wz.I.s...6k..fy...E~).0........s..Z...[......A.#.L....A.3/_..F...4l......=.\..3.....{.s4...v...z....p..a>O..!...9..'.+..z=.Q%P...RT...!>.\E...b.N...bl.J.OT...f{...K..LQ`)..G.KH.._E...H..%.R..L.]..i..4ZJ.;....dt..../r.N$.2d.......V....m....X.O.tXF.....{.bD....z.=...B.m.J&(Q..X3....Tt..Xm.$.]x?...^.....#.;...^..9~].eyQ..5h..X...E.....G.;.[....&?%..FS.....2......Y[.....R7.$.....Ie.r..2.1J.O.c....rq.,.O;.W..R..m<.&.!.....jb{.....k.X%..@..3_X<FN.P).....`(b.n..<$$Y.".Lt.y..l..hZ..b...N..6..c...[E.eZ..p.\|.C...QC\.#$..3..b.J.?.y7........f..bu,k.W!.W.TJq...pd....q.g.~..Ob-..M.m.,.1[..{...!.}.. i`....!..Z3B./....~.0.H.....9AO..r....wW.u...,.I....bY.m .Xk.].P.D.+.3..{.W........-(.$L...G99&..9a..Z...

C:\Program Files (x86)\AutoIt3\Examples\count-for.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1413
Entropy (8bit):	7.628975737341955
Encrypted:	false
SSDEEP:	24:iJ90g0slwKAXe3ZiWNqUaMwdmCMKj8y+2DU7FLrh6pQG1+hPlo79jExRCuX5S+uB:e0gkDUZKRdmHO8ylDUVN6GFhPs98PuGY
MD5:	FFA1502DEFD225B06B78AB84031B5022
SHA1:	E8799B4997F14E6DF224DBD6CF1DB908D3CCB8A3
SHA-256:	89D53F263D1DEDE1784FE5F17F36835349FA036B5C9498116EEF3B074E944788
SHA-512:	072EE3967D2CC93C5DB490346CCA04E920E27F9A233BE5D4284986207818905FB863ECA493C0362DE7797A7A9FDCB1E6CC926500F4AB1461128142532A71BA91
Malicious:	false
Preview:	...H .....t...Fk.GB.<.~ro..hbRsj"s....,..A.,...e.s.{>..wa..7..8.e.l..z...&.....!..-.7.D$.cO...b..?,..+..l..l.r.7V...:y.V..l0...jwI..C.}.S...u.R<...`...@I....'.f...MQy...g.......U....a..F.......u.......v..X7F...%o9.....X..w.N....=.a....N..p......'. 4.E...K@..CN..'.r.i....>w.X~\|..[..........j.1..L.....4#V... .K.P....\|....&.t.l./..).d{.../-{....>.....#..P./.......m.>.j.1&..t+......@@....S.8...........W.=..}.....X..\...zZ.i..?Cj.j..hJ.'.....)F..n.f..`...5.u../Sa.R'.N^......-.If..#BE.....Y.....@...'y.".....o9v.z..;....PD.co..@..(..-be5l.A..fS}...RT.0........a].O.\|e.n.q8.".g~..e..(..o....Xp...KM.J..`..+>..-........h...]0.#..]c..9Q/.v.....D>..k.....R...\|.%..4Q.DC.[&......{../p,.a.X^.\4#....i...#..=........N.%{...-<.g.J......P\|m.......MA..m)=).A.b....[.}.P\|.:..a......t..[..csJ..... L.t.....d.#.ck[.n.DkF..q.>.<..P. iu,.....IE......8.q./.'...X..X..$Y.Y..bs-Q..BK.c.b.n.H.K..%y.....{...O...0.{........1.n...*d.Tb..V..<....'bj(....'......\.../

C:\Program Files (x86)\AutoIt3\Examples\count-while.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1622
Entropy (8bit):	7.71478641372963
Encrypted:	false
SSDEEP:	24:apDEO7zOy0PEWrPTVVxAai0nsnS0R58ALXqbG2xFBJLhcxfiKhb/E8AYmZ2+FW:apD5HOBvaBnV5LaqWFPLhYfiKB/mYgzW
MD5:	659D6A8A84D4ADAACA0C8D616A7AA663
SHA1:	79BD838B0F8283D7525AEC66306E38FE1901789D
SHA-256:	B8F5F5094043F9D3ADF1FA782D2A163FF02993B2C497DA2886B04D1313280ED4
SHA-512:	02D089B2446EA13085A555C7ACC86838B97F0412A87CCBAD3A5F63BAC85123BDCDF15EE916E506081B45496FB5482BC42673E8D45596A82C06D09E5C719D1D7D
Malicious:	false
Preview:	...Vd...2iv...U......7.b..M.yEg..F.YfnN..pV.4...)....R...;....a...v..A!4...C.....5........J...5.3........+.e<.1..Dmq.lT..S.AhO.7.W....q...iD....e`....w. }..)..U\9.>r..G....@tJ"@q.23.75..!..!F."."x./h..T....L..Q..u.?.F2...?.y>.../V.S2.......v&....ln.u...b_k...8Bu...G^.C..l....-.$ii..0. .j.7.Z.s..f@..I9.... .j...../...hU.U..v5_....0i..5"E....?b..a..~...9..H..pC}U.%BP....EE%..w..@......Z.eQ.=;K.[..7...A....x.-.0}.=..K...:.C......m..(&.+iMPN>F..ar......D.F..X.0..o.p=...K..i.fuH.J/x...}h[b...LwO...~.yx..a...z. ......-...G..+..)...%d.e.5.7J....P.h.}{.@..Oh..0.B.j!..W..W.~9....$X.T.&.g..E.o.A.1z.6..... ..B8........J9....te..\27.t.#Q.D..x\.>.8....O.......%.0.....%.Xo...z{V;ZM...:pO.Z..b...`..so}....Q....7.`,...d...l...Z...3.}..{.).?.M....5..De..:..:J.j...89l...3.....7~e......r..2O.[.T.F.*!..u\|n..8g..F........#Cd...[. P..zV.b...V1A..Es.O.J.I....b.'.J..d....6&VzuC....bu.d.8... ..y./..<.....YX.D.Gv.hU.n:.cVkq.^q...1.+Em....".p.3.

C:\Program Files (x86)\AutoIt3\Examples\functions.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1599
Entropy (8bit):	7.687124947834384
Encrypted:	false
SSDEEP:	48:Y03oSiqgBFmEQE5uAMTL3+OEbWCg2qWcHL+D2M5GiGCW:J3oRqgBQE5LMTL9Cg9+ybAW
MD5:	E43A1CDEA521AA33B37147FB4141D485
SHA1:	C2C1F04D9B2C3F8691A60979DB76F72C92408207
SHA-256:	760BBA8D7FBF1828E3781906D5A380F29452F24E7E894C9E42918291C3C22FEA
SHA-512:	3BB806EAC299575E24202A3DEB8AC3F672E103437EE57B0959B05F7293DFF9BD585D352CB4D3B504D29C8E281C125DCDF441EEF1BE7BC96A539B72EFE2612C65
Malicious:	false
Preview:	.J<.."2\|y['....G.gm.\|...b..=.>r.Z.!...p#k.....3E.......}...uc..D~^..2\|.".f....lL._.:...=.7..WY.[o.RTs...1._.....,..O.p.0fLAc...^&.SU.v..)..Mc..d..F`....y.........&....c'..F.....o..d.Kg.....\...Um?..&..Q...i.M..n$.Hh..... ...O.,.m...&.....\...-.^BA4!.Bx..}...^.......6.{{...q.5'.C..6.W..g......).v......tlB.y.+..........j...L...N.d7..o.h)J.E../6H4...2c. B`=N...../_........Y.5..g.J..C.t[.@....>T...<b..N...&...i.c:...?J..W...]..#8..!]......b.\.=.&3..-7=..Z.7....5o^..9%PX.0=L.. .e`....W........=vd.,[Z..}$.F.+....c.E.z.{U}....0..F.Rk..v]..4.....O:...6.U.l.R...De..HU.c-.e.k..8..Hr@...x$s...u....R.Nw.\.~.....0...CeR.........9.O..o.<.J5.b......#.Q.$..vC..!`...7...\.R}.<.=.o.B..2.d..b..Mc}4.C.N..^.......`&.._n].U\..ld.e.>..........D.G...V....F..b.h..].p.......l.....4.....q/....M...^..(.......2..a/:..W........n#....l.&8I. E.g......W..6'.M$..-.JL..<..........._@.(......x+...B........<...}.................dPa)..R.I.(zv=;..U}*hu.$&..?.2.1

C:\Program Files (x86)\AutoIt3\Examples\inputbox.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2155
Entropy (8bit):	7.802873867219059
Encrypted:	false
SSDEEP:	48:m9GQ1kb1zrRyf7uVD9O71kMJrTbH73gIN69hZdXJ7EP6FOj1Gp+yb6W:mS1c6Jo7ZrNNw9J7rgGp+yWW
MD5:	817448719159E86DA3C39446CB262DC8
SHA1:	8025397E4FDBA41E2B278A15247E236FEC35B44D
SHA-256:	CE0AB7A6CD7248900C449F2CDEC130B591EB8B966AA195434DD4A3F3E49D46AA
SHA-512:	073E64CF5C9C2CE93DFD9F5C15D822EF50031E91973EA4441548E3643A2571B3087E8DC2F1C59366BBC29AA681DBB7516A3464C42FE22E01905AF01A7CC1A2A8
Malicious:	false
Preview:	..C.hT..5..W..(.G.9O...>~r&.T.}..:v\.$]....YLpq.p..\|....H..m..lo...w{I~..lk....F..;......TV...s..K$uTy..9'{]....\|...\C3.R.b...^..(..'......Ht........^9.7......UO...8.+.y.W.k.b-WJ...v])8..k...[. ..0..g...m...$..:V...+.3e...?....l=.%.I.....@..e...o..[e.HIJL...Xl.D...b6\h....?w.\|y ..FdJ...m.......<RS.......2..<......[;jI.:.J.0..:.E...<N!+a.!t`?H.SX.@.6Gn.".R..k9P.n.#...4..JJ.{.{..-.&A.....G..[#..9..A..r...\|...V.G..I.........w...".Sz...uh.?W..!..9...\..$0V..X.J..SS.{;.y)..U.....d.QX...e..pi.z[m...r...A.{...^....$.C...(...2...-..........m......kc.E........^...e..`.N....9.:.(..BL.O.....N.H+5?@..@{y..U.....b.c.DR.bp.@.n7aC..v:?..$>.....h..>..:A....e...1.Q........p....A.f.;1.2.....y....5.2T..!.7.`.y0.}..w..=........*.l.:..ls.-.NE......"M...P.\|...hcX.B.,K......a.+.q.&.N.x}n.......M;..g.J...gu.....?g.Z.n.:g:.b.XF......I...._......D.&3!z.-m....V..pJgC..a......;....Q.s.,^...I.E..5>.@.!......#...@....]8)...P.a'..........&.N..FA.E.........(.../.lV.

C:\Program Files (x86)\AutoIt3\Examples\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\AutoIt3\Examples\msgbox.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	786
Entropy (8bit):	7.2496819673970405
Encrypted:	false
SSDEEP:	12:gILQ37Y7wIgGrt7dSMDL8J4hlloGzVhlfmJ8IpV4JPhOIs1nFGXHgIViXuW:gIC8wIguxukTuJ8IYJURTGrieW
MD5:	79B74AF121CB150701A129309C4FACD5
SHA1:	9629A7B0CD3D64F6FC9EE001C26D7B99A1FB2F99
SHA-256:	2E14F6CD80FAA9B190C329759A2A480CD9C63EAA31DDFABF403CE0C95EC05138
SHA-512:	12DF3EBDAD1B02BDE6089F03BC7D6D7B039455CD50EE688B3C3DAFD5F4A58A6A1DF4320EF4CC96745F2A54D0AAC5AA908155EC0D79A2191B51C8A60363D85D65
Malicious:	false
Preview:	7.c..Y.'......3..6.D..{k..$D..LHo.&....\|2e...)..tj....-.p.L.ws...pM.;....1....4h.C9id.c..i3\.P.ik.n.xY.".5......?.3..dV.........o?n.#L...}.q=...vl..)....7[..2...%n.Dx....>F..Wy.w.h.Iy...O..IW....&.G...EP#..e.n....1%=L1.U...a9.l._.\V...Xi...^....:.C..#......Z../8;.o.......'^f...b..\......L./Dg...S..8_.NR.0Ww..4..w.[.Wd...RO..5-.(;....=..V....&...Y.'S.......r.o.1..B.3.^.. ..\|e.J.}.....>.N..I}..b........\..S..\|.gl}.E.".v. line 3")....a.k.9!;.k.}....WG.D...R..m..+...;.4.?n.p.I.%.D...-p..Et...G&......N.d.k.-.[..m\|.s.r..[..(r....`.m.T:.t..m..t..*...q.R.............x3.HW.....p.t/.>_.j.l>C...OZ&H..J\|F....A`..fF....(.^?q.$..HF..-`..Y#.....................................................................................................Y@....czyzk0zzhil.

C:\Program Files (x86)\AutoIt3\Examples\notepad1.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2165
Entropy (8bit):	7.801666117563385
Encrypted:	false
SSDEEP:	48:8jyBZiqc2um4BK87ysn01BimNkrjO0EL4z4YehkOQJBVjDbX7jFCN9TX3u1zW:4yi5fm4701kmNkrnELtLhMJLvbrpCvT/
MD5:	484AD985A18F31AAF99457F785C479C9
SHA1:	851FBD446F56807A4ADC63B56CA6D63F5320F9FF
SHA-256:	8FE6CB96E6D08D56D8D4743F74A19C4E5968E2D6BFC5A5069FBA86E43746C0A4
SHA-512:	12689A41FD0A5EF374C0D7BA0D2BD257C5BBBB7372CAE4DAEE92F252763451B333822DCA9ED81C8CC45AE39258B739783F105BE1EE222F817129A1E07595ED44
Malicious:	false
Preview:	..H.\|.......$.w..........5[a..O..x3.S......r.%...0q..i{1^...s.q~d..n.......`.u'.?.V..\.\I.M..D.R..{-.........A.;.N]i...Y!'...~5.@..k....b..n..........O.Q..M..".=........4......).....ED......sd...9G.k.j......Yno.>.5.f...l.,.}..$..T.P>qqVe.....Z6.p...ZC......6<)..`3...^T {.!..tZ..,B...b.(.I.....X..2z.6.......S.JUX.e...e....e.C.k&[......v.... ......7.F/....2......6...\|.c..:.F`du..W....q.N.61..Q..-Id.8...^8...yL.....\..4S..K.ip...%..zJ~x.8.i7\|..H......p.9......./.S>.o.&~.....x....qWX.x...&..KS.>.N....M..$,......"h...H.`..y...ujT..p.P./....$.1k.".....v~Z7.w......%..0.P.. .J..$w....w....3......o...hF+.M.d\|R.W........P.1...=...4..d)9.......}.c]...,.l#...,...\|..P\|...?....O...Nc.7...z..2+g*\.P...+`R...Q..:M..`F.!.K..Y.+....4m...........1hR..l,(...N.2..4.......&0...5...i.....W.1...sJ.....) .&X1.ID1..O^H.No.[.m.o.f.....y..6...@.._....$.61....\|.B1..,....3).).'.V9,.u.........:..=...........;..T...je....@_b...T.\|..jr..X#.2S.cv./.X.sGF.....)Y..!..h.

C:\Program Files (x86)\AutoIt3\Examples\notepad2.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1875
Entropy (8bit):	7.7386331903304395
Encrypted:	false
SSDEEP:	48:6YFavdBy4cdxvc1BeoEAEqv7NcKFuBfLul7H2uBmKtQ1hBCfsoOW:5FavdYddhKCmTNUjc75BmsQ13ZpW
MD5:	9E426B3501623037A67D81002DD5325C
SHA1:	BBADDB6AF0874C197A438BB13DB4BAA938FD81AC
SHA-256:	D917E670CC2750FB52112061EEEF082B37209E11DD8CD9130307F6E96EA6A218
SHA-512:	5626CD4BE60A83B44B9F7D4E91CE3B4F9AC0AE1B7200E5D16D76FFE5610E78BE8499BBF9EE901BA9CD49AA52DD6FE3892F1D4A7C22954765A4797A6181346B5C
Malicious:	false
Preview:	..G>.........lY....I.E.5......I.sG...^;..h.>p.(.p...0>.?..z........}...z...%6.I.V.....R..A..gQ.v.z..5..I..9."E..T(tq.g._>.UrC}z..dn.^T.\...I.&f .F..]i..j.....s......>...>...z")....C-t.T;D#...B...b.~....S...K?..qL..5.. f14y.h..3.....&.lWNx..h.PJ....B..$.8Z:..#Y6rCxO..OYH_.[.z5......SjJ.?z.N..2..B.O......q.N.)v.....K.p.X..N.\.4...<.R..K...i.......ANBu........."W.u...%.........X*....b.n.X..K,.S..../H......+gI/...<..."......f..f$"..y'....v.....r.x4s's].........tgS@D..vW.._..H4.y.H..Q.H1.h....-...8f..=....N..A.K.V$N..4.A2.\..F.!..2A.5%g....Zt]".. .$...d.B.x.8V......{c.t.H...Ik..4....Z#...&......2.......+....gI0......o...$.J..k...k....[.J...^...dE..{&m..U/...$...Q$.'0.v...d........HrA..$.....-4...3..,...+..8ne.\|\|[,L1zK"....h.=f.e....:F.,Xfv..BR...Ga.b.....I.x..T.x...~.....V.....r..[..R."..-.._f"U.%b..5..Sk.k..t.=.Z..?..9.0/......5.5..a.:..du..B9.bsQuw..w....l....e[...F>.#./S.#..^.\...k..=...n[`...w..vm..!."..k.M..q..j.....wN.tD......c....

C:\Program Files (x86)\AutoIt3\Extras\_ReadMe_.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	504
Entropy (8bit):	6.5457773350801265
Encrypted:	false
SSDEEP:	6:0LKE/rx3lU5aOrzC7f35yEDjDvQpuwimsd0/YVh/YLjx3yodNhchxPoKHW:cKQFZaz+3ASjUpr1HYVh/GNy2hchxQ+W
MD5:	BB45F75E52E0317F69F06384C41D40C0
SHA1:	60DA1DF85F6A52427A902F150E7708ED921B3686
SHA-256:	8B8C0C1345142F1E3D89CEFB0EE2DEE4710809F081C8E9B52FC477B41AC14583
SHA-512:	3AC3F7AB8C55DA84956884E7EF9672338472AFED2A00365ACEED4FD910555D5ECFFAA868BB63A37128692BA97699EF8EA82F253EF5789E78E45B82D1A5D1C0B6
Malicious:	false
Preview:	j./.]?....H..M..f.x....Z.,.H..x..p.V....F.....E....u.L...o..Y.S.g...8.$.H..2@..bN.7...\..i..l.[......:...1....8"<.V.aC.T.J.ve been kindly supplied by users of AutoIt.........%t(.UL..HT...(...c..Nq1..A63.i.dH).".y.N.........z...h~..r.?..S......5..8../~K.<`.u.T.l.@.jF.J..D..e..Q(..]02..G...jr^..QZ.F-..{._.....l~........o......r.. ..#&q.1\\....H.....88r..g...h.]...I..0p.X....................................................................................................Y@....czyzk0zzhil.

C:\Program Files (x86)\AutoIt3\Extras\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\AutoIt3\Icons\MyAutoIt3_Blue.ico

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	7733
Entropy (8bit):	7.334703931094772
Encrypted:	false
SSDEEP:	96:68fVYl68CKN+NT8hcwf0CgFQzPV1ZbhsXNo94ZC1jc6hI4AP3NJHNwSEzHLSpkmf:68fm9pdc1/eLY2IVFJHNdgH+ptx
MD5:	AF7A66F9F248282FA0ECC3B37A728168
SHA1:	D4F024C0663A81453C2D184A9223E446A2E94C06
SHA-256:	37B1D8425B41CF1DDEBCDC3218A268427A4D1AD8FD3616705B7F07659D07E8BA
SHA-512:	17BEA5B86756E1032C5CBB1D16E5C6686F938CA97E2B9B83DE7B5211BAECF15447D568EB3B297219CEDFB58BEC36FC0E50203CD51E1E6104EF3AC933290AFB82
Malicious:	false
Preview:	y...%......HF.=tOP.0...>.8.}.......g.6..,9,T.]kW.f.`.....#{..#..7$;..\|p[gB...B.^.bs[:ur.O.....D.z..R.E.b..wS..t.=.Ko9.k..1..B.!W....Z...K.....)..e....>.jj:...<...../.^...@.n...c.scMA.r'.bO.-.Y....f...D\|....@-..u...3.....fj^..Qe....t%]`<..U^...,..>.I.z.P.ds.r...~...0.W.X..5.Bwu.A.8CV..Ui-..z..t=.^DN..$...q..f..#.^..EWC.9A....+T....YMG.....E...S...wS<.`.aoAF..,..JX.A.;.....Bw.....9..........P.....!...<....O~...n.q...,s.....8.j.c.m.P.I?&.;..]9............/.!.!=..x.EQ.a\.0...q.2....uG......F<3C!.'..Fj=.w8.o.(V.i.G, .J....,I9...uK...Q.6..;...Q!.X...V+L9C.>o.o..`.`...../.j}.G.k.N..M.F./.5Xf....q........#.rF[.......0 ]......&.....R.......g6..}....S...,....i.a'`R"...=.._#).:.S2ev..Z._v.x9.....M}.h.Y. ..z[aV.'.c.+.T...e.>j..o.z..4'......d.....j..~.$...#..O..tV..D.s...z8.0.......p\.t....3@.....o2....nO..X.O..3./..&.@...\|.....fS..D.4..?.qTM}hi.-147.Ec.q.9..kg..frr.....CZ...._R.<>..@d..3E..s.Z......iWe.(..&..(........xP.Fhd..c>g%n.O.#w.[.=."

C:\Program Files (x86)\AutoIt3\Icons\MyAutoIt3_Green.ico

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	7733
Entropy (8bit):	7.347015746984458
Encrypted:	false
SSDEEP:	96:++EIWKrD04Nzdjfjv7pmz9QfP/KeTDp1qYb2Sw51GQG3BHeaXNavL///qF88D/5:7EKXTNdjrTpmZ9gqiUoxHLAv85z5
MD5:	2612E8CC80A59E8D4ACEF39ED4DCC11F
SHA1:	EA7054B37B4549978254B8A8F2426438726B5066
SHA-256:	4287BF62F975A52CA1DB9DC188242879F1C5D9962F8721C99D4749A53F94718D
SHA-512:	9EC5B6D486D4C38CFDB72A288C501F00FEDDB1EAE150B2A0D54FFB6767AC3FCEE28E171AF1C1FC41B3F687231FD1B5F89870958E57820C02600C3158C05C2847
Malicious:	false
Preview:	?...m.1/..G...73.i.6./.b...+.B..D..........[r...q3.,....zO.h...c....b....j4n.....B...>..r..g......I.v."!.=>...r. ...(.5.K.S.._45jn..@R.Ps.;ns...P.'u....E..U~"n..B..O[Y.]~...._).MIE9..........)..`.L...<....^(.pl.t.....5.A.....6.\|./...\..;....Z.....h...45i.Y.G..t..<v....@....P.\|......=.e@.Kr...5.]x..P..J[duL.v=..Oa.^?.Z.....x.(/2..0y..m [..j..:.Q..;.J.I.........r]..5.;.!S...61.K....f]P...s.........y......."..y.Xu.uq.S.Q..2&.....$.(.v....$..~.Gd....1....(.......#...s.7..;..,.....6P=!...P.....\|X.>...........a.`.J(..{..O.&..Qp..{....Gvz.......F10.6.....@...0.....<-..J.Hm...6......,.S.wK.n0.h1.E.%.`../.uH.[(..?.K..K..~.>(.t...~...o.Jv...3...$....f.Q....N......Zo.._..jeW(q.........p...&.-H.'.::9'#GQn..Z.Jq}U..h.v..2Qh.K.l..b$w0.....B..1...W...N....my.+j.....uY.)!I...H...V_g...M..5/.n..C.5u.f[..a5u...SA.U...8...D&.a.............;'6z.....g.....X6..HW7.Z.F.`.%PSkR._d..$...w.ll}n.:..7.........kn.m.."0...\|W/+.l...Z.......>..b5y...$.Q..3o}..f...NC.!(f.

C:\Program Files (x86)\AutoIt3\Icons\MyAutoIt3_Red.ico

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	7733
Entropy (8bit):	7.351854568772185
Encrypted:	false
SSDEEP:	96:W7f8/MJ+z4B9lL4c2x2RrbRnvxNxB5rG7LWn4Ibv36TzXbc6XN3i//SAM3:jBzYE0xyJTbf3r
MD5:	05E8422A4E99DA8B41AA4C9BD753188C
SHA1:	137242D3571A7C493A18150D75FD23B0E0429DF3
SHA-256:	4A5A8B3C6A7F042986BFA6D7C4DE6B98A5EA5827416268D623023DE2F96C35BE
SHA-512:	33714003D2572A7061B6A2C93B2E7F1896982469BB0C9EEFDB7D796FC4E6931C9CF312C8B175310A68427B0462943717C5C25A7B36C4DC6E253AF9D2FE2A6986
Malicious:	false
Preview:	.....4.....B......YX........y.. r0.P`B.0...Rpi....G...=.Z.......M...c.....A-h.F%O2.G...5@....t.N'...../b...f...6......d..`5=Y....O.......9.......s.$.<....0_..!..sEGY..(1U.....4.-.dR.>..Q.=....-..X.V......>.....j...\$4..1....Y......pNb....PZ..uI...[..@d.v`.A._.Gs{O.L.a.bi....1..O...k..8.....9+...z...N.E.N..ft........g^...C.5....?..J.. ..]...&.[SN2..o..}R.}..w...@.7... 'v.W@.#.+.[.......y..kE-.j...i`bX............SM&L.?Fc...\..+.v...T.8.........7...}[P......J.p..Z.F"....+..^.PV.5.t...wm.B.u}....._.+.1...#.x.:.(.L#.GW....D.i.MY .=C.......%_..>0...6y&....y0....8.u........ .-..7O...a]._..p...H..mDB..v..)t....5XSA...8..%iU.K8.As.....y.Sr.9.V..- ..g..l..g....?..bS/....w..:cx...V-.+.!.v.).U...P.4...\...\|....4H_<==.7...quA.....'..^'pL.X.2....v.R.E...i.p.\.....S{.G<WUgM[H........96A.).T2...j.3.x...dY/,...h.....B...N.."............J.w..."......j.......U.....!....<..E..W..0...c\|.)......'F.......H...3.2.y...ux.......5.<.^.......Ij.n.

C:\Program Files (x86)\AutoIt3\Icons\MyAutoIt3_Yellow.ico

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	7733
Entropy (8bit):	7.329098128425351
Encrypted:	false
SSDEEP:	96:hxR6YyXbBOgnArGDAefCiJZ6t4mjUJRH9bKQfGn0AQDNl7nvD1wzIkqI3BQ6fMH8:5WkgnbHaUJRH9jGn0Ll+skqcAbg4JTO9
MD5:	9F1983F459EE080E1E5FE6ED9554394B
SHA1:	B8E3D952D740B2946C250DAD73594C5EE9DC8A53
SHA-256:	0A3E4858141C8FF80E2E753EBD3D3C8851ECE6AD6847510C6AE8DC8993231962
SHA-512:	239390B91C4A3CD7120D32FF32E287889044D3CDF88BE1EE2A07BED4C8CBF463B2BD21BBA3A2DA9155A9892066C7B6CD9BE95B7F20DC9701877109F321FA4F92
Malicious:	false
Preview:	.............._.p.-.^.P..7....W..>L..`s.sWsQ.s....K0.jSA..h..uj.....)$.y...........1r{J.;v.9..{..F.5...s.-..fO..M^..f?J.%E......b..1..q6j..\|...Gws)....%.l.b..3..a.k./-O..P...Nl..Y..D.C.b..v..'.c..a!...y..z...o.$..oL......x.0..jc.r0k....k....n.l....^E.{.3.....i......l...\|...O.+..[4z+.R.v{n.jw&...U\.eE..fZk... .L.g...rS..a..:...b... C.V_+......U....N.8d..c.g.....a3.Jyh..Tp.[......3....+.q.....7M.'@....&.......J..0...........5..3.D..IHQ.8.V....$........u.....q......+.._.k..d......S5..JlU..u.6..@..j...'O...M{\|...9]...JbX-...!......3......m....+..N.U..[....1fd,f^eM.._......X5... .f."@..O.e.I0.M.k.DV&_..W..P...+h._ .8./.{..B...O..Q..........T.1...........Y.......^..*.?....lJ..m...........B...3..V..G..=.C...=^:..].D....H,......$4.V..\|G...b.L_.6..MK.-%0....X..oAxj..>.F...O.@.8.\|.$.Z....-'1.K...E.#..:...z..bz.u.A...1....d.R.gT...#.....z......JV.m.Z....."...-[>.M.kU...1.\|!D._..K?.......$.....S8.:..8)..Kgg{T.#..v/...]-$....,c..v.c(. b...1.j..

C:\Program Files (x86)\AutoIt3\Icons\au3.ico

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	31853
Entropy (8bit):	6.580374432384675
Encrypted:	false
SSDEEP:	384:gKvOtlGMe85nTZaXr+f0q6JuiQx5LVkSMXDFT5ZlEd52+a8ZJPay9/adBCklUR99:gIiGMHaXrFJpMBcTjQZJz1rkQ/QRA
MD5:	FD15986BBD672B9EDF4518950B113D1D
SHA1:	94C1198746A6D223DC388F04D58C8820F5C9BE39
SHA-256:	0049345EDC21F2E52BCC46C585E9A709E9E075469221E2692B4638A75EB1965F
SHA-512:	24286FCEBA31227F4D522B52650AB4AB1F7EDB1D735F76BA52E977E1DC272DF552ECB9D35457A6BD2B47DCB2D129D0AA12366F154833B5EE0452965640207580
Malicious:	false
Preview:	.3.\|.3....E.c.FP.:q.\|......x2{.a.....@j...w.^{..q?..%..iH..."..f..O.!...9.1.........m+.1%.[.....P..k..v...?XB="....im.......^....#-.p}.....S.......J...^.!F)..b. 3.(.......)..D....rM.s#..x.z.VQ..p.6t."...X../Q..H.r.}.J(...%...B.~..}#....w..h.....W..#..-Om1.w.z8\.g.d....qP^.1..Hs....s....y.....z .J.J.[h.T...L........Q...I.,.M,[...J..Q..........^W........R.?...)@......:..&.. S..4i...%...Yt....,B&.3b......$F.C.-..@}t...{.,.4..b..Z{..8.X.Z'.`\|?....L.........}d....@..!..3Cy.5....6.F...................k.LJ.a..~. f.X...J........y./H.!.`..0&..>E..^\|{\|.....yB..'M...3...>].c.pg3.x......`/......`.....2.7@n..p..!.........3.R...j.....T..3..C.........>...\|...C"...t....WC...8K.\|...sX....X...bZ.(-/.ui.&...........O.G....~1....S...=..1..;...K..p...T}2MX1..*.~@.g..`LH..P..)A.....I.IXa....= H..N...r..io.Z..E.......p...+../...&.3..+c.!..3.9....-J....FC..43.u....(.>...ak.T....E.1@.24...N....{..2......... E...=M.....D..~Ph.,.l..;3.L..H.G.a,..

C:\Program Files (x86)\AutoIt3\Icons\au3script_v10.ico

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	71873
Entropy (8bit):	7.624667711548015
Encrypted:	false
SSDEEP:	768:vCkMtijFL/WQhhEpP33QjhGovQ7o3EiAtr3Zd1HwGlXzg4UF9L8BxjKncz+i0lNV:itWLOQKcTRErTaGgF9LTeB0l6g1PqYn
MD5:	86B6FD9103F8D5F25E8F96C3D2E86C56
SHA1:	B2D9F4F0FD03C071AB1B9A70164B1C81EF971F5E
SHA-256:	B6C9E5F7A0E9C1E1F1674B5FC547D89EFE70BD1BF272382C1CD6F1A244ABD22B
SHA-512:	2F3A6715944C1ABE63372FE3B33830E9E0277C5D413CC5B7D70F62708EE4F41CF46386851BAEF2F1A58D410A33B2F75435E24E7FA31A8E9C87F44FBAF80D566C
Malicious:	false
Preview:	.1...Y...e..)3.../H...(...,..d..;...'.$BM...,........nb.d.d#...E.T...@2.L...s.)..M......P......y..1v.k.&.....k...?.7?S...<.BE^KvHS..K..... ...D.v.P.v....[...7!\4.?...~..$.........X..<..v..#r.g..@J}t.R..+.n..Z..P..~......r`.0..0.%...QV?.P.a...n.M.B}P..f..t.f....z.:..n-.a..$..T......FS.{.:..G....E.j....T....J._..C.9ur.wZ.7.J....2{.6...%j-...../..........=.^ 3...>uT5.........d.k,..:....f..N..8.C1....,...6yf..0../W#us.Z...:..-.B-+$n.........l.}.4..6..3.Z...K:..5..C4........U..$8.zM.......@~..v.64........<...$..Vz6....!:7HZ..f.D.\N.8.MK.>R.......`Z...K.K....b.]\|z...}.^.Zl../.......4m..../x.l....)...2)....n.H.:k..z..j.}...%.5..Fw.....~....H.O..O..f.....!......K{..h....."..tG.\|......l~J..j......A{...1...H.....,..%......b..Q...cz%h.."apm...mS....c...?..=..R1..>_.e..S"...p..i.aX.....0...m...Y.@...K...+%....n.%.8...y....IP&.Y`.....&OF.......hb...J..(..Am.w....}..lG...'.\|d.R.........Q......ec....9..\.8.....'......!.......?.....;].+".vqDS

C:\Program Files (x86)\AutoIt3\Icons\au3script_v11.ico

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	41614
Entropy (8bit):	6.502863312237588
Encrypted:	false
SSDEEP:	768:WljTAYe+zLHlMCZTFORcTHtQFpPRDOapmOPb:WJAv+HZT0S637Pb
MD5:	DA0C2EAFC8A196FC27E0D92E64F45B86
SHA1:	0D29BB645179D056F4981976389BB708EB64B799
SHA-256:	97E17BA19AA769E6CC421C3F182235D8EA07AF23E8429D0F508E52378F247DA1
SHA-512:	253E956917FF74948634C222576A746575FD823271385D84D1CC2289C9C7AE2D1E66974B79780E50A6D86C692DE938676CF732409532D638B9C8E1714D0FBD1D
Malicious:	false
Preview:	d.!.N.s..[.S......B.R).4M.[.?p.Q.txX._.F..Zz.k..l.%...V....b.#4......{\.K.U...7+..WiU..>..x....w.X..D.......2...6!..E.......ZE..V%.(.. SP...l..voc...h........9..c.....^...-..w.N.8.n.<}J..-....NCv.}t.;M`.S+\1.q..?c..3..#.......&GEl.f.Q..M.k.I....!.[...F...@h.+.k......K^.'..!rK..8_....l..sI........q.&......_...c.PC=B.....76.n[c.'....+.p..JB..B...g..01.......U.#..!.4.os.s7...^].Qj.k..4.L.5.k.8{...3..5..)..8.][......-ZI7pn <.D....V\|.....t.4\|...Ri.9h.9#.>..?3....tX..F2..B<.X..l=`...;.....J2..u...X..4MI.F....7.2V./y..r.K.....G...n..z./..X.b....^>.Q../...:0.2B..0...E.Q..8.Mj.m..u.../.wr.P~.f.2.[pZ}s....M..<...(a.Z^.\|0.EH..2...3......e..;7]9.GC.>.-.t. R....GH...O..E.R=.@......fNw.VZ<..2\|......R2]......Mr...).....y..,.?Y..^#3....d..[U..Kx..L.U......c..uc...d@..+......./0cA^...lV....G.J....L.:.P....t..@!..v.w.uS.......C?9+x....7.\....}..2 ....N+.^.H....MhM..?.....8....v..T.p/.;..\|..m>^_.,P.=...jc....=va......CK.I^+.f..L........f.x....I.

C:\Program Files (x86)\AutoIt3\Icons\au3script_v9.ico

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	25541
Entropy (8bit):	6.589575012849366
Encrypted:	false
SSDEEP:	384:hZbJGDY6c7LUEfhTwyjORZqOGmZJ9k5BI9fNTX+b:hZbJGU6o7fh8yyTqOGmFkvafhXu
MD5:	62557795F0135F80B440954A21A2CC5D
SHA1:	C7CAD60FEC6E286A1D23636D0A458908846E33A4
SHA-256:	4FA09E263CE948FDBEF80881AF5FEC5606EAB52B1A333341C377FEE85D6FE510
SHA-512:	88C54E83A80B9FAF6CC1E9DFB35737BF94FC74D8F7C03E67F4483B972AB96A72B87CF08139AE40F67247F9D364FE3F722825F69E8632E0E3E323806CA72FFE8E
Malicious:	false
Preview:	p<A.9".2E.e.....r=....9../..<...T)Q....9u..1d..u..Tm.....6.C.M.Q.R...y...Cp5.W}..@.U.Z..g......P.......#........6n....G.....jkT8.I....BiO..M...J...Y......._.K...1EoS.^....3x..[IF....%v.W.T8f. .O....rA...C.x...o...t.C...,..... ...emE..W..s.i6...G....[..\|....{..B..d..J....{7.x.I...x.?.[.C,F..l!..y.T=..1.\|...I......_.....kp.p#k....p`B.lz..@?. ....d.".....4.F..1,.IM.&.-.[(.I.....>..:....!&...yV.tr...z.N.....Aq.qJ......`8..P.g.]..:.e'b.b9...JR.7.......1h...$....1`.Q..^~4F,.2.....y....,.e..<?..c.....i'..H.7..z).\.5rq.9..P.....{....._b...J.`.v.o.;...j\|........0Hk...1..<.\|!W...o{=...aa....1.s...P..O..b_6NcSA..Uw..E..u..5..OY..ue........f.M..=..d.J..........'..C..(L......?>..}h.. .wP..j.#..A.q.....:....,...9./......h..#..Y........yS....."..G/..cy.q$...b..iS@..."+.Y.G....>z.9.a..y.$...1...Y..c..K.p....f*../..d!u.g(>.k....\...9..S]k.?CG.....vB:.>.Qt,.MqIF..(.).585qh.U.ca...)&.....]O:.!z..}M.. {m..E7.u....l]..sH.....>.Rr.c$F.k..K.8.!.....<....'.p@.q

C:\Program Files (x86)\AutoIt3\Icons\filetype-blank.ico

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	48376
Entropy (8bit):	4.73916243016414
Encrypted:	false
SSDEEP:	384:r1dmGq/zLx1oqUfCFnOAJ+lgGBjPBbtLIXixQqneqMjNHYQIcaJt:Jd2bDorC0W+lgMrBbtLQwQtJR4QK
MD5:	153C442012FF1C36E8E1EF74D75C597C
SHA1:	CD87DFCB4DC3157915D7B8D4A2B2FDBA2262985E
SHA-256:	50BA382D1CB620B478BA254C22096AAC9D9D21B0091C771F85D962CF286C94D0
SHA-512:	E12E42B2EFC8F807AB6C04A0577A5840B478CC91D2CE51EAB731A325A3501EE4DF243E282494EC943F1D4796A591E9BFB94015EA55EC7E9180E80FB9790CE171
Malicious:	false
Preview:	...5.9.}.~.H....fc.......B......x........Z$. ....N...p. ...S...6......N....<.....Au..?.............D..k...m.6FJ.uD..P..(H......!.......H.\.....#...to/......V`D...s ^H.?2.S.=.J\|>......>.5....Sb.w.yGE...2c..2Pf...j...g....z.d....c.d[.)..\#..z.O.......n..g.Z.m=....K..%t.!qp?........8$...m[.....'.+S.9....t.F_..Pg.Z.9..qgd.)'{.oXV.1/tW......q....9..f..fG$Oo..).lV.q.=tI..e......V.n.....7......3S..j....A....(MU.Ku....W)w..y.i.{.+.7..F..H.....Y...`....<...f\\|/..m..!R$].DS....o..K....}.u.."#.A..S....2$.........A....;=!vp..3..5.......`{)g.=X.Z..uH..ahF.co.D.WmL.O.......YQ%..y-.....5'..M....'.........M>L....j.]...eDu.Z..n..uN...$.1...W.q.RJF.R!..Q...'..i..^.X......o .}.CVe.vD...4.g...w.....@..?(.....g.[...-..k...$+o.5v....Z......d...[a`W..^.7.#.....v....X`f...:.\|/.p....Yq..`_K..w..*.....{..pk.C.[.\|...8N......0...4.K.........Xs..[.&=...`.MxAh.."L.>.....;.<..c.d.$W..5......1,..!.8x.@..R{....)..)&.....Y.....Z...0......\Pz..~.=.Y..`.C.33

C:\Program Files (x86)\AutoIt3\Icons\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\AutoIt3\Include\APIComConstants.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1298
Entropy (8bit):	7.582660024511111
Encrypted:	false
SSDEEP:	24:1T+uxq/M6hjkjS6doocY6LxCH21mjhPW1yV/yXDfvXWnL4P9W:Xxq/+jS/2j9uDnXWmW
MD5:	E054DC5B1927F03C0A93DE5C0C9A4534
SHA1:	5546074B9B634671FDA5AB9CE0678E664B068670
SHA-256:	34E88BC509C2083E695A3903AACC473AC9C4D6032E1DEDA42857A592792E0D23
SHA-512:	AA0CCA04DA40C898042264882FDADACAD5E1885108AEDFB0D54716C8B10F152C9EACBCCFB9FA506F8B10515372EBCA4697C0CCE7F5A07AABFCB40CA1D149BF1C
Malicious:	false
Preview:	..[uP...e.Eu...........V.Z.....h.E`..g.I^p..7&..rM.Y..U5=...(U...vF..$l.o........`Po.8..{......4.2G..2...\Z.;g....f..L(......U7%/..3...&1... '....u...j0.i.\|.D.%.<"4....U.{.B?.A....Q...3}..j..lZ.+..Xy.$._..D.r>.#.....V...(.q.1..j.-NeY...V..GX..gY.C.]u.J]..w.......V~TB..r.P..l.{j)....5..e....-...S]+.fuz.D....,._. .X.....Q..~......T.>.y..G.7\...........3b.......!.O..z.&., .p.l.....[g..a.....F.y...<..@4...-......^=u...?=U.F.5G.\|E.... T..i.;n.ZMb.[.w...................o.8.o.p.&...0.... .0..(.1.-bM....A.&c..o....:Q....5.......W.hdp..OO...\|.a.......".iX..rd..H*.JY....T7T7.N.iOw.c..%...."f@,...}'vK"}....ZI...%..9...}.k..'..q...J.....%...rj}.Y~.1...,.17.=.8..UD..T...p........9.s..o...R..].2.......?.\|.^B...;.Ao.v.<..~\|^m..Y..>/a:../......8..3....,._..Y.....!..=(...^.a)..7oY..&....../.W.}L.....X..)u}.?.c..1yD....A.5......5.....2._.._2G.......9t.....b9%;.J....Cv.c.0..L[..Ih0....vZ.A.-..f.Y..0......=========....&xC...kE...kNx...r...i4.x

C:\Program Files (x86)\AutoIt3\Include\APIConstants.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2075
Entropy (8bit):	7.787405458179495
Encrypted:	false
SSDEEP:	48:95vXBtSTc6ZId3mi3e8cucktacDi79Q4EFhbYx3eWnH4KyAW:9pX6ZId3a8c9k4cDYJEjYxO8sAW
MD5:	8A91BEFAC4DA12B9769A1163CA912522
SHA1:	DB0A610F2D0057723BD88C783170F8825004BB70
SHA-256:	67E879F57DDB876C20B89C9ACDBCD36B5FD0AFFEC0AEE4A23D08CD6EF5194896
SHA-512:	53F52987CF38C47A7B97276BF61567196D500268D6655BE1776259FD6AC23C683535BCD307EA6563F5D4815CE0155D7F35587635EF72D3E8FE2581EE7BD3B359
Malicious:	false
Preview:	fzlW..v....Xk.......8....E.\...9...[.f...l..r7.(N.\.J...M......`...8..D1h4.s.T.NG.\|t\|...(".~...C.....}.9P...\|.G.]....l4m..yC...9i..m..O#..685.Z...f2.+...WU.."t.s..rG..:.^..l~j..:..K.+;%..:.u0...1.....S.<...^.d...%..D<...ah...6...Ip.COW.X#...[...N.d.W.$iiP...(.d...,=.j.LCW@.8I.Kv,2E.%...Io..Y..MWI..\LC."...e.q.a@.../kPE.d^ .v....8G.../-.z....8.F..n.'....`+.....LQ.yJ.H.....B.......[..79T..3.dh'.s.[.hX...`h}... ....v....DJ..zb.2.......?..9...gKx$h....d...4..G.Wj.HC!..1..C...l.h3s..#..m#}...VU..:i.....D...1..TJ.z$1......U->..eK].."../...!......{.N..R.q....T..;\|...[i..?_$..`....f..K..I.K3':AB..Z w\|..7...~....K]F`h...p...t..?m.....R.N[B.<.....T..a...... ...;B.!.....9....Gf..@...M}...5...u..0.$.[.."..W.Q..`......dwF..>R.......B..G.....\|......cx.&%......'.+.Y.(...1.b..;..._.....^.S....)~...S...zx...\4...9.......Kw'...90.......5....R.y.. .....l..jP._.B!b../.;.,.8Rf..9'..\|Y5Q.N..M.{.W.^..5..o..f<..?../..s............_...e.....X,....v=.>4I0...m

C:\Program Files (x86)\AutoIt3\Include\APIDiagConstants.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	3233
Entropy (8bit):	7.868348799174575
Encrypted:	false
SSDEEP:	48:OX02ni8xeEFWEU1iDWtZkZ+ttGeN/pOO0GxEP0wGtXKHE6hbOuwgFOHf0IsTW:OLPvFlU1pSZ+N/vhxEDGtaHf5wgFOIW
MD5:	3B5179407720F0C3FA1CD3D6BC175F49
SHA1:	B347704DA634D39FB6FDCD82F5EF85EDB33677B7
SHA-256:	D6E6BA95ACFBB4EE0DFE7F1ABD2B2C383AEAF9D6AFDDA0C8E574C5EB66A6EF32
SHA-512:	8A09902BAA1A9DDF70E18CAF5161932D1FCAB27423BD3224C9439C2BC2F0289BB96C78041916264F2FABB89637A538AAC3A7C0B2C31081A56EF1548B0B321709
Malicious:	false
Preview:	"...'..G......q`..S........D...Cu?...$].1.....dw...\|.hr.C@~.k...[:.+.#....7.......7tc>.q..g%.?..@......@.U.HZ.5..&(A.1@..!c^..e[...I.]7..(.2...$./Q..YGE.\.\............?.%kn...DV...Zq2.t@.mm...vn..N.`....02.,.o.M'....._ME2.n..a.f.+...h.6.W..x.1.9+&W..w....h...#.U.S...)...+.~0[..Dq.8.).........w.q.t.$.u.RA.\|~.$/R.q...s....dV.....+<.X.'&+..^%..<A.......m......^.}!.y.8.y<..c.:E../.........XF.G.CH...+.M...#...l.I..f}.Qy.".tqf.C\..^/.......[..n%V.m....J..m..f.I-.C....)..f.........n].'..K......tI..Z.........K(....NXOm...K..cM.Q.r......".z...%.6..............uZ..h..9...f....p.&".....^.........e.h...e...,.T.....8..m8.....PA..G.3:.K.(.L.#.%...n2...0Xi..M........>...fT..5.U.\|EV...X/b.I#.f.R]....=.....a(.KL...8..x..=..KiV........,.......g..t...R3+P...=.l3.F...Y...+..b.........~QOa.9...s8[.C/a.E..b.8.U~pR........uJ.g.?.V_...u.5...#E.......(e..]..6g.D...w....PMf..F.........{}...7]..r.....*.22...I..G.k.&."..[....G)a.ES.C..P.....h.>H.#....y..v..tI...'.

C:\Program Files (x86)\AutoIt3\Include\APIDlgConstants.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	11082
Entropy (8bit):	7.259803756115053
Encrypted:	false
SSDEEP:	192:vCj+UAjmJhtQuW1lU+TxanZVm11p4KR8aKgGzsQMXXbJu2WoAu1lolhtkDzMcfhX:vCjG6JhtnW1lJcZen4TaKgcsQMXXbJuc
MD5:	56A00E25B2A1EEA7E18573E118BD27F6
SHA1:	E5A05573DC0B1BEE474DB0A6FB82A2DA2D966723
SHA-256:	8F8FB71C81F6F1D43223A4C6D9222BEC6327B4C673862C534CD484F196EAF405
SHA-512:	E60F08A621D3D489C342CD65DE7E1195873750FA0F140655D558DE0EA4118AA292B8FC39C1ECC539921B7351EA43B3F941AD1960CE1D233D8EB261E3EB66331B
Malicious:	false
Preview:	........Ivo.T\|w...V.......-Sg0.......V.L.3.]1.....!Z..@}(..F....C....u.......g.........4fM..p R.........A....;.5&.A}..K{z?..=]D.....Z......,.]....[Q.E\|j..^v..`..aNu..rs...37...YV..R...v......RQ.s..a.`X.Lxel..X../dD.Q(.P....p....=Vl.._.h.:.,.)...!...\}...C,....{.'.g).....e..v..ap".e.x..=.0..j...>^.~.. .Z.G.(C.+..Z....7..YI.uC..P....2....".....T.z.@2'..n..JH.n.)".v....k.u.O..V.3..L....%.._.)g..T.x....'..%&wS...+80...#.t..!..K...a.-]....J.@....!.Ay-(p......[W8.<L5.e....W.,.Z..qt.....d;.........v..P...vRm'...,.....&l..."..+..e?@Y....6...V.2.......5.h........}....wvN@._..w......t.....Hv..;.J.Co.....6....16.T.d..(.G...hE.m..~..`..h.BS.Q8..@...#.c$...f.9Sbw.....B..<...1..5.....F.j......0.?.....L.!..A.We.{Y..Z..G.>G.V1.<.K.S.&.....L....k.d.r...@...c.......$...u..1.h.......pO..pq..n+......mG\-........!....o..[..Q.<B9..G.oG...e}..`.G../...).;..J....X.&).)]..~....(.@W..l{@>.p..........~...Dk.....M.OL...'..\|...Npwz>...h.l....V.dg.......

C:\Program Files (x86)\AutoIt3\Include\APIErrorsConstants.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	309788
Entropy (8bit):	5.8906888457959425
Encrypted:	false
SSDEEP:	6144:fOmrXB6+SwMF7b43I/vOp0aIGUlw34Jvg0:BF6+5Mtb43I/vOp0aIGSw34m0
MD5:	6EB93514E168F2405E297C981920FA2C
SHA1:	36E4C95A26EDC81173C298B9F557695192B5D0FC
SHA-256:	88EE481899F0301A2BD8C4C5F1B8D90EEE075288CB61D2ED0A02B2561B064399
SHA-512:	BC1BA021C3265425D5751A6230DEEE7CD2D59B7936FC338AB4EA486040A9E12EFE98E6535612CFD4B21B40B1E40D03A35D07A52F75CDDAFDC35D9AF65BECC762
Malicious:	false
Preview:	s..7.^..ZXx....4...........p........-C.1..P....(.,h.\|..S,..^..sJ...J..}....H7J....L^4.2.....,pa..Eo.4p....V$.....k.'q..`p./.$K.T......q..E#.9..6....n..8...OD.?....:OC.j......F5..........4..-C...SmG^.....C........8n..Ww..W.1Y..^..52.(..l..K...,I...%....2..8.bU....?....s.w."MpM.'...n1.R.T.".U.B.QD....FA\|...{..4Dw......5.h......8........7I.~..&X..N...N..s..+..#V$P4...{..W9...DV.{.y.bK..).'......0..T.Xg.....;...~..x.x.f.R~..O......E..Ob....ev..a#..D.}.)d.W.0B!.}.Qn.#..N.,0.2x.V...G4...........[Fk.\|.!7....6.#)...dzn..H.....awypL...*[.,J....8].$.....{.......Q...B...[...S..).......p................^....H2..B"..ni.C.H.[.S~U_.....t.....3V....Xz.p...GC>M_.p.M.V.7..:i4..$..v#O....Y(+...9..W...%......w.-$/.....y.@kT.`?.#.... L.VM..t.0...N..h.U..1.!..l..m..t]D7..]F..Yl)/&&F[.....:..Z..1B[\jT.. ......D...,b....~.-...{."={\.e..k.\.=cV.$....._.a.j...7e$...a-..sjqI.Z0v....I{w_.E...`.....L...u.$.~.Z.....4./~:tTB..N\..0.o....?.V)..0]OQ..2...Q..k..ti..2..Z;0S....

C:\Program Files (x86)\AutoIt3\Include\APIFilesConstants.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	27760
Entropy (8bit):	6.476582837862486
Encrypted:	false
SSDEEP:	384:x83vFFwju28v46q9qHGYc0LxoOdR/AQHFB6NMAOsvemPlnZzBERXfn:yvFFw2cIHR/AQvF+l1B8n
MD5:	A1398E79E92A17696FB25A8CCD9636D6
SHA1:	1D55F87EFB69CA7979D9F0DC2905CFC0FFCC5FFB
SHA-256:	23718A3DDE649E1BD611631366A685C312FFFDAF7F282E72A29FDD96E34F764A
SHA-512:	9C9C72B355FC08BF4E4AE92F0874B1D0E9A9AEC1274339B103B9423980153EB4DBC05895BB4D596CBD6237F2FF10ED56A25057B3D9DD4CC1B24F6D45F6AF0A2D
Malicious:	false
Preview:	R.Q..7.k.jE5./.....`.i..]q...k'=q.>R3.#5..5..$...8.a4.}.ae...+.Y?1.......PP.....S`\|gy.O@T..h...6=.9b{......3<J...th!..d..qc....z.......j.W..1Y....JX..L.3.-...M.+....J.a)2.<.SF...{sX..../.=....bw.u...Ko~V..'....M.65.l..\.-.%..k.{...}..t.....4...\|^.E...T..4..:.u4...I.....\|.QS.6.U.Y.+..5g.7.......Y.v..uK%..N0n..n.vl.a-...}E^...p&L.{.{..........\|#....%[0a..9u'.....^p...{......jY##L...W......#....%.q1U8.k.&....('T.#J.U.3.&A#4:8.....N..ExS;Q..D...a:.....>....+.G...x1>...yQ.r....RSH.H!..$..N&c.@.;.a.4..c....:....N...a..#./..e.....>.....\e.....Z.#...I....\_......g{.........;I.v.&::.LI.%/.q.G..R......1.y.[.t...vs..... ;.L...R...\|..'K..`+...F6[.pk...W...j.....`..X./...;......M.........k..d`y...@.hg..\......z.. .t/..X..@.N...5......Y.e;S....`......nve...~+F.6.~a..\|;..).].0......r\|...(&?it;..$'%X!F+b.\|....B.6......A..WJp..t.oz8........\..\|...P...Z....z.X...!.......n.......6n..J.M...2.K<....D...z...(.3X\.>...z.....c...O.I3....-.........{

C:\Program Files (x86)\AutoIt3\Include\APIGdiConstants.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	19749
Entropy (8bit):	6.827062259237504
Encrypted:	false
SSDEEP:	384:KzepwTLdUyPUFAPkz55tP7Kt7JigmoTqqtqA9Ub4vl/iDX2:ZOT/PkA817KtQuTqOCcvl/iDm
MD5:	2F322D49777C3F7AF1C31C15A1D45A98
SHA1:	DFC241F7DB7C6F6B2E3261096DB5AE4217679EC0
SHA-256:	699F76B2128B66E8072321C314FD4FC7102CFCFB96A560ED7FCC078C625CC983
SHA-512:	56C7E93946900D6D8578C3BD0D688EDFF2C47D649DAAD95893C9B3A6F6DA9934E9C5C3565A236BAD266E582109787D3B88C465AB02774AD51F8F892D53EDBB65
Malicious:	false
Preview:	G....+.........nV...jKU=..V...7Nn.%.}...[..Dm;"o......b9o.@.`..{.......u2.....^.F:<e...u.t..).y..4o.q....\|?.....a.uv....<.N..-....k5{e.C.C1..>=.... C..\|.q....j.Q..jA.....q)..5`...k.7v..!......<..4v.\....3o...............X1\|..?....K.Q..?Nk...1...........Nb.D_..\........iK....h`....8.K..i../...r.f.I ."....4./..6xs.f...H6...-..N.+.g.j+..8kzp...X.I..4...c.1...........i...fR........oc%...h)...1!.xcAR@..]..@..".v....=...@.MTZ.3...#Im...../-..tpu,...lW.1..B..c7`[.......&.85<......".6+...k......M.&.9...>0....XF...0..Sw.i.TE..z".m..h.m......T......v1..3T..8.R8Z..)#..0..a+. %V......2EW;...Z.."..0.-............m}...S.A......=.3a.fD..E@o. ..#....f....@.......12...J. (.n..q.w.{L.....EX.5:...?o..T(i...V..x.Z&..G.mn.r.0........_!..)..4.ny...H....Zg..,R.b\9..NU.....+.cb....DY........2......0._%..^.#....Hg.JUUs..a..%i#O`I.X...WT..&;\|.0...Z.)..XQ.^.r..m.......!..Q....$I..C...r.:6F.....p...%Q.a?$...]7.2DU.......*?-.."..Vc5.Z....Y..oo.X\.`\.

C:\Program Files (x86)\AutoIt3\Include\APILocaleConstants.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	8084
Entropy (8bit):	7.630915247023396
Encrypted:	false
SSDEEP:	192:+WENWdpj/AnUL5wUWJUNdpi9Djyzq/zHNf7lxuqnFFf:+udpj/KUlwUXThzWFf
MD5:	E1DE9E33A125AA3AEA7B57F122FF5D31
SHA1:	309CD3B21A5863ABF58114361D7DA724FC54560B
SHA-256:	68B2B46B4C302E17EAC7E20A9004DC7DBFEFE255E46D67983B1EC8B58A9FA268
SHA-512:	1D2A47FCACF0E7D21BFDBC231F1E13A1E2DA1A1386430598A95342996165BB146E11B7AF6B9FAF9237CA780551037D7E2298A90B3E22FAC59974B1F3EAF9417F
Malicious:	false
Preview:	...a....N.n.Pv.)V..J...Y...(h..p..h...u.....L..0G..G-K.s.5.3q`.:........=..g..Z...X.YqN.{...9Z...X...l.......lQn..f.....R\|.......+....J..i...G...u.a...v....eJ.=x....W.......r..D...Wd...(.~j...j..0..AV....+...GFTa.....;..t.P.p....$.T.....3.B.R......lWy.I.H......Pq^.7..B_...9$.".V...v..$...\...o......7W..2.....6..4g+...........\|...gY.....2..S.......P..e...KV..<..~-C.uz.(YfI_.>....NatT......<.X.f.&..I...&.....Ttzx...]..,.(.2....1l.=?....WTx*...U..\|.E....@63.C.._.Z......Q..)...,...,`>.VH...~...C..>..p..K,S.}.>v7.......... ..An.;..\|.8.$_...%W.<.>?.H3..dC...../t.{}....\|.$.-.....x..7..d^....9.<..j......&.~<......T.Ft.[/......5..a...`.nW9.]..U...........r...7......E...@....+..#......e.....G.Y.u..b^YH.M.1.V.RKK...Vh........^o..}.X:o.U...p&.&...6.....4kS.n.]....s.........S=7;W...i(.T..KJ...].....M!f..uP..p...mDA.r)..sr)..Ac....T....2.J...?l.T./..\~..{..-..j... Uo\|.K.d....9.<...$.@.I@u......X..6Bid}...p.+F....(..<..xS...*F='.cZ..3......W.x}.

C:\Program Files (x86)\AutoIt3\Include\APIMiscConstants.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2206
Entropy (8bit):	7.793304136589054
Encrypted:	false
SSDEEP:	48:ufE9whrLl4PSS2i2/8qoxjeu6wHXJco0I+nokC0mGbDWOUrW:ucqhv2PSR8tfHXJEokfjbDWlW
MD5:	4D99AF3273E534595353C46C3B95090B
SHA1:	F1A89A4A6EDBF6869B3A2967173A27F5962EBD8A
SHA-256:	28BB9F32231203C486864A787EA6BB468A0BBAAC879720D1446D2E3981670858
SHA-512:	2D1E2C4E43F9759F0246773B12F20560F65FA03179E8480B07287B8BB200FF0C5CDD5270FC6E6CAAE6CE22E4B5269BFD4CB46D6DE7A332BB079F3372D56DFD10
Malicious:	false
Preview:	N46....tR]...>..hX...G.......C.!q...aj`..5b.....85s.M..u..+_RvE.....>.D..zO7......,."'.3....}B7..EO.(8.....D@'.W...6.....<5.q...Bn..vu.......x$....&s.iR..I.....T2..#J..P...`.9&..7N..^....GG..U....c;...O..3A....u.a..Y..M....y.7.>j&z.4..\|...........X.o^._o.......0qG7;..e...D?...ya9vYWe(.......K.zf.52.-...,.z..E.. b.....o.\\.e.h.G.).._TA.'.2k.....M..L...V.....z..0.i1z.3.Sa...k?M.........-[..#m..k..D.fE..:..p........._S....-..5P..4.I.x.nQ.m......./....Y%...0.e...6....Lm{a...A8).e.:q.g.......O~..wh!.F..<.g.Hi..Pn.8.qX..b...H..\|F.)Lm.......W.Y...Q..`j.d..J......m8......hvY....w...,......2#.xar...p.,...,."@.L.+H...h.....M\_..D..Z@....YF....n.(..{...W.zo._`.H..C.,5.\"+F.f3..m......7.!yy(~..e....pL....2.......h.../.o.P.Jm..6..D?.#e}.....8..!jD,...Bq...#z.N(.z...^..R>........-.).,JT.........v.<....(9...#.).cs.....H;.o...A..{.....`..<[..c~..tX..Z<..<...lR...]..{...s..B{..PH.......9......:Y5.e!..s..2?.D}Y.S...\|"m......r

C:\Program Files (x86)\AutoIt3\Include\APIProcConstants.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	5438
Entropy (8bit):	7.897439066191282
Encrypted:	false
SSDEEP:	96:sqdR+H7KHnNxKxplcPv4MasbhtPKPR8i1Q3SmOaYqKrXYirFw+GvUbUET1X7Yzk:sQYGHnNGcPwJutC1xTbdhXY0TJ7Yg
MD5:	B4F4F905069B035EEDC838ED8EAA8752
SHA1:	C7C50BB02158365ECB3531B9A92DB883CFFBC3FF
SHA-256:	8853686E754165DC1EE4560A96FD48617342C91CF041A33742F6CA1DB3C9716E
SHA-512:	528DAFE8C30ECEEA714613F7DC0A6548A3580CD577ACAFA3D4B26812265B2B1AA2B298613CA05B151CE548E5362642C7611CC7B641B98C081B8CA2C792332DE1
Malicious:	false
Preview:	..]l..NU...Ee.......(.NX.kK..'.Q.6.^.ep.Vi..S.4./.I.@..l.. \|3B..(.......c..+..........[.."....MeCf.....c.w@.l..\|..>.@.j"e.K....5.(..j7....k!.E.....1.Z_.u..B..w..J...\{.e. .I.e.Y.....2+.a..9r4.....G4..7..6.\.]..b..0.6.0.b..P......WXI.F..7a.m..>".....k...j...\...i.\|.]/...`.0fJ.~t.P......(.0A...;.o...l..0.p.Z....[T......YL..7+9..j+/Q...y.~...s+..m.Z.N..(W<.&...B.U.....1...y...j....X.`NW..h..z.)6....u.<.c..2...T...)......2O...KCr>'.CIk............z.iT..V..........g..\|.s-..]=.....WZt...S.cR...V.$..Sj3417..\....f..j3..A...E .F=U...(...m=q...%s4?.B..U....$.r.y2......n.7.kM......E....8.i6......f...6zKU..Q. ."..b....`.....h-z!..-.).j...RO.].QV.{.R.....4.X`..X}.a2..W...1EQ..%.......24"..Iv.$ .Phs.Y4BgNh<...zb.4..J.9..c_....y1}...P!.C..-.^5Y.u5.F.y..Z..p..).......l..........K.:.....i9,..[..\.G....s....1y....Q.LK.\|.:^......BKn_.7. ...Tyz.A..^.....<].-$d.p....M"........EL?@...z}y:^.....r.7\|G0........e...S3A....h.N7.b..{..3..E.Nv}.VSL5.0.T..]....`

C:\Program Files (x86)\AutoIt3\Include\APIRegConstants.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	4886
Entropy (8bit):	7.931289906430709
Encrypted:	false
SSDEEP:	96:tkZBRtU8NttZIyLu6hPj3DHSUTodx24yEmceeW:uRe8ZZIWyUwM4p1ev
MD5:	C05B0B50502124CBB667B49D3DAF2D17
SHA1:	AE5E85DF79B3AD1C9BACC1A22847A176F7A03DB4
SHA-256:	1C3BAD9877C7A953FD03438D097F8F9CEC787EEFCCF74CC52A73E768F8EC68ED
SHA-512:	E96DD19A35D4C3D1AFEE5E4FD1743C6375A43CA694F6E46E9C9A4B0BD7A09120D7BD13675F3ACF992395426AA6A35C8830D600C66FB084DCAA69AE9D60B3F65C
Malicious:	false
Preview:	.....<..................7.....1F.{g.5t.r.....oz..DH.A.3....>.P..U_F...5F._^.'..#.{.j..c....L..i......W6$....e..D.!...k...AkZ.N.[<.q.5..cr.0......@(ZFV%...YM.R?.)! jk{..,w.....$...P....R.b...../~_.dX.]\|...D(..1.d(..i......T.....u...63J.R...<.....J. ...p6\|.T...d(.....y"..........a?`Y..Q+..{e.i..@..g.=...~sU4..h.&....b^.@\|;..kx$.su.C.<!..LbM?.\.d.h...m..@.~.....r....y...HM>.G.........l..8n...bZA.b.."...#~.VHW2.REO.......>..r...p.E..S...S@.d.(C@.w6..k....,.?...KJ..3..s.mO..\.aL....%_.......Z.iX..I.G.....)q.?U.-./.+..U...V..fN(}..Z.Tp.:m.4G.#<.X].C~.<.i..r.}..m..-e.#q..9.0SK.V.......cW........ZVhj\.o..\|.o. ......8+M...i.-.=..........[...z....Y....G.....l.S.YF.@....<.S.Yr{..,...5....v..^.0Paq^B..n..y.bWe...ae%...T.b.,..O..Ag;.W(......q. ...Z......QT...5..qM....qt>d.=.Ph...i60.Ex\|....S..:S.'...Ep.2...9.( ."..N<.j......*.P_.....D8.x..v....%8O.b.0.....jL&.E.....Dbh-f.......v..3Jr.u.c!...5{;....._a.z8..V...W[C..xN...0............J..p.9.m...7..D.w.MZ

C:\Program Files (x86)\AutoIt3\Include\APIResConstants.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	6812
Entropy (8bit):	7.768560439971096
Encrypted:	false
SSDEEP:	192:XfKX+aKPNhE7okd2pW76dM+9NU8uR3UvTDnNZx:XCO7MUkdI4+Mi3G3UvTpz
MD5:	28B85F0E9A005D27003D4D96DE384BB5
SHA1:	EE305D1EA393B1B8E2E782E8821A8E56CA1D8400
SHA-256:	EA5EC41DED82C5415DDF0130C5F7D30BB628429BB14862DF0CFA6C5FAF7805A4
SHA-512:	485B338526AB090E6E2556C900490DE3D82B751DF4633B6EA43ABE4078852C00A842EDDB7B7B027293EEF691B0DDE965B62ABF2864826984AECFAD180EC37E44
Malicious:	false
Preview:	g.~`g.".8..Q.....`U..U.M.s..PLq..U...##R...b.j.O.m.r?h!E.`.}..g?/`..7.p.QU.{....jz.>..s.\|....n..)2i..n...c.1.r...M...>..7.. .;...o..\|.'\|.".QI...to...........NIG...i...olM...$.....!.KCD.....C3..r....z7i.......2(.u._9.s..8.Gd2.t.0..vT.e...7qH..m9..Y......._]zc>...L...V.,..1_5p...-G..^:"~..@...S...m..........d.g.}.Q..NH.........X~n..)....^..0...j...IA......#H.....\.,..:...l.....8.A).\|..O"g... B.q......40e......0=m?.:.........1.C.p..M.s.+g.An......H.9V.f\|.C5.S{.V....Yff...@.,.$...pS.Q.\$...............o0.3.../5q.u...]....r........k.s.SJ..\..?..?p....=....0,y.#........C0..vM.1..O<.!..o#..}.4.C..ee..<1...s@..+/.sf.H.......?,X....z..S.r..D._.X...Z..Cqz.b.!t.&......G..R......Dv.?.l..;'.I.r..V..'..>[yLP.uQ..j.....W^_.r..CP..n..a`.b.Z.2.k.....2.G.&G<i.......d.B[....M\....6..d.6...M.e..(.7..1."..z.d...M1\.....k7.....SY/......]!.>...E#.s....,{....Zp.{K.z..wyh\|.X-....g...ae.w.4.9qnM..a*h}.`p.......F....+....e_1.}C.._..,.....@Ns..[{O.....}C...

C:\Program Files (x86)\AutoIt3\Include\APIShPathConstants.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	3498
Entropy (8bit):	7.875600349134971
Encrypted:	false
SSDEEP:	96:KwleWg9GzFW9YwGdKpmu04S+29bfZ/jM1ELXCAGW:4LTu5dKpx0Bf97Z/EcXCm
MD5:	F531DB1451E5C21EBA258FA400166712
SHA1:	5D66D185A16422C0B9245065726CDC7CC98EF972
SHA-256:	B0FDCBE56156101E7B79578D89AA10605EA643040652CB05463FE7A669C4338F
SHA-512:	ABAF844C5A94BC5485D6FBB99F66551F6AAC3D7D5ECF56CCD9C0CDF5151766DAA9FD0B7D1475F965E297BADD448F6DF92DDD73AADC7C099C6FD66F4732BA7A84
Malicious:	false
Preview:	"..o~..b0..r.p..J.Y...~...;.../.{.i...V...>o......Qc.R.X6.....g......x.\|....+.t.+Z...B..U.].p..!.q#w[-...E......~.'p.t(.A.........0Ez...........OP.n..)>..}n...fS......w..ZJ.L.....I..y%...hRN.o../[..Y.U..%..F.~..'Q.../.K<4.....:...B.&.........N#..s.i.'?..J..ds.7m...e..b'........Q.....evV.....{.i..h..P3..0Nt46?dk...".....h..s..8...>/.ZT.f.].f.M..B2.\...~w.O..jo.I.P..i(...eo1.+,..p.aA..y.[.b)z..u...^......s..wS....A....T.H.M.rjRy.1..Fg.Y..I.l.."....3......g}..ha..d.B.@.......n+&-.?g..S..%..&S........l&1.....u@3...P.^..F..3....v..ZKG...\.......`....W.....EM......Y\...7...._.tRJ. .....[.3...'L.+....O\|..Z....r:~hE.p{....$s..%{......f...A.....s.Y..Fr6.".I..,.z,...<.,6a..\|..M.E..!..D..........-....m\.56.*.}....j..".pvR.~$.X&.....O.......BWm.#_n..l_....?..1./..+.g.]I1....F...5{R.}..N$...8..6._.f...k.<A8.=.e..'-I/..f..c30.8g....=.5YZ.1.`o..wYYD...&..u..C.!.,...;.R...K....9....2;..F.{>...+....:...._..0..._...-.-._U-...\...3.m....d.....z...os......

C:\Program Files (x86)\AutoIt3\Include\APIShellExConstants.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	33436
Entropy (8bit):	6.582046016201711
Encrypted:	false
SSDEEP:	768:DAZqkgHMnd6bJg8FRoldHmayWaNBWHk+J:EAkFnd6O8FGlR8WaNBWN
MD5:	24AB0A4D78E9ADF021BB273420F4ADCA
SHA1:	AE07E52FED176C5631D9F78E0541130A29E630C3
SHA-256:	BD555CCE31F9EE4265DBB71DF76EC51F96DB34E31FB8E814ADE05DDB986A912A
SHA-512:	8CE23F4C0AC53B0AD10FE076E1CD70E40231C5EECA43C1A03C37347D1676F5D6016326DAF3ECDD7516D96B7A8E1F6461944BAFD8587C544B071146531BE7CD14
Malicious:	false
Preview:	}...sp._o....y...#.......o.p..3.n..\|r.V!/..6.j.[1.N.4w.&.n.....0.E,T.Us..w......rO@.x....&M.....VOjh.....6+..xFvZ.1-.0...:..`....5...9.Z.b]K.........`fb.\J.?.N.d..].q..]...w....`.. P....p5%.............{.....W.4h..:..X.u.\|{.:^p.~..Z(R...P..##.6t....<3...j.l...l......\.Uq\CfH.........<.5..^.R.j.I.S.I.^A,=.Doe.J..<......5..v..@^.5...eA.MP.aW.=.!?.Y..7..T....<.w.1.?)6.E..xudu^...@....m...r...'U....P...(.....$X...ip..(I....S.!.7.$.....%Z.c.<gt...\..bD..k......I.._..V"2..b{.....<.L.J.4..\W....&.Yo.Fk.wK..]M..........l.I...^.....J.........._fr.1..x;......,ha.yl..70.+).o.u...:...:@...ok.dP.q'h.}............. .mQ.<.A=....b......\|....V..Fx(z.N~.H.v.}...H.?.d%.9S..BM.....m..}.....`G.~...Z...9NR. :.H.\.wT."kT~.....\|.V..P.Fb..m...}v9.7..[.km I........h..8.....zK.p./Y9..R~,.~.^.q.`../.C.O.......\$...aahe..K......\|..Gd;.E0..a #.Z....:...}...@.._.^.n...PFk..yY.R........8F.Y3......:.....+.../H<......3.......<./.b........;.."d9.7?k..\|..3P

C:\Program Files (x86)\AutoIt3\Include\APISysConstants.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	16539
Entropy (8bit):	6.968385745110593
Encrypted:	false
SSDEEP:	192:T1kH05UT0os2JCeiHezrMBmmTFDzc8eMXQJi4rofPb0HDxPA6O/4/Oez5f97q7w1:OFiHsMkuDB/XClsgvQ5rvWoFYd
MD5:	9C78A0F21AAA0D200040BBAB39E16647
SHA1:	F41914AFF84E728F214467A22B1B625127D638C4
SHA-256:	3695E8F02D940FD06015C36294F8BF4BB14CFBE18F28113F5CAD3FB931640F33
SHA-512:	ED7C699FC164A960E925B18DA22AD01849A2C4D34944B7AC2AC05F6C56B74450F192DD9240CCB20BA25E9E3562B5097C9A7BA7EB8DB2AB38FEA97FF6DB790542
Malicious:	false
Preview:	u:u.^..ztub.x.)./ ....Sdm./...6#.u..4.Q...._JF.......4u.U.......x:.u.].s...8.@~P..vm....,.,.3......^AaA...?Y.`.-.7n......r..?..d.9.....B1Qc.u....z...\..s..\|.....9Vh....Qf..R..m....r.@.dS8.......+.q}"G..[.;..3%F.......>]..R..."......X...B....p.X ...3...X....x^.pv.B.b....Bmh.w}>..F.^...n..q.`~(...('?.>@.......$.......u.h...g. ..g704..<>\.q.E.....'..Ov3F..C....^..n$...fK)....i...!F.du.K:.,.\|..h.r.u..(V./.-.3QV.A.8..9M..L..>..X..{..a.....-.Pz=..%....~=s.._.x..[..x/..b.....,..E.E$.x#7.R..O.]J..D......b\C.....0.t.i...=a......[.>F....0.B.m....K)q.vO....$~.]..K.K.L.-.."53...56.j>..'....H..@..uJ}b.~..4..0i..../_8...iHF..e.... ..nX.g.....7..;..h.;E.X.sS......./..9...E@g.+<.>....`.w...8....'.y.W.$..Z`>vD...8..-.49.F.q.1)..E)......R...Xy..}....2.'....Do....L:...p.U.;.:&F-'..K..18..j.!1e.S...Q.VQ]4...c.&F...w.....q...O.....V.PO....tt.B.9....nm.,.Q...GDbb....V./.}jc.#..)..^;.ibc."b..'.....#.d.......XXO%^.......jM...M....-.. 3.......k...d..9(.2..

C:\Program Files (x86)\AutoIt3\Include\APIThemeConstants.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	12179
Entropy (8bit):	7.160293788761039
Encrypted:	false
SSDEEP:	192:C7PQo+05sPs5qWagkQTJnChlp1S1Ys3GMCrlQnHSWVHIS61p:GPQ4y+agkQTJnCJ1Sd3cenvVHkL
MD5:	8EA3BB2C371BA76956672742C089CDC3
SHA1:	8A1161C0FC5DB24159358E725385229C96CA28A4
SHA-256:	446F1FB2FC6C1011BBCDD4B1B9C8ECD03F47F7B7219CABEAA2D0BA7767673A07
SHA-512:	9280EC3766EE9741AF1E08701A255382B0798B25630A03ADC46673FDE1D83A0C85518D8CCA929605C8710054DAB698EFBE5D6ABCF62C060DCE9C6B1A4DDBED5D
Malicious:	false
Preview:	hU...F....S$..nl..T4...\.H....m.U..&e..r>....7...5..r{..5E1.4..LG..I(.2..... .=..I_.kS..+. ......d(....W...vq...~w.x.&M...}...g1...;...b.7S...W.....F>.S.^.0.b.BOD......g..tG..x...........h..W.2..p.Yy......)..$...p..c..`...K......\|.P..Ek..:.u...,m..GO..v..[..T..s..{.t!a.#..8<..n..l4...X..p..."s.$.z.L.l...S6N24T#&...9....W..5`...],.Uu..S...'..".6Y....CA..6B...y....K......Prz..3.@....P.....'.p..=M,.......I..k^..&7.......W .....0;s....J..cBN(..K..w.<$..>.;.Zc...N....#_.......S.5.;)JA.....u...K.........+.......9.p......vV.B.G.....W.2X....H.....%. .j....=..JO.A`....h.y<.{...h...G.....~.<U....2.\|(.....@L6u............z....Z....(.>.C6$b........*.....A....].C}.N..]...A.,N..+..uK..v.......h...$.8.,...F;..... ?.F>u.N-..M...!,...1V....{ ~q..lS.F........\..S"...9..ce..s.U.f.#...pL..g&@f...C.}bb......rM....\|N.<.fE,....wVc.R6....LNQ...Ls.{.A.:(V.v....K0Q..\|.....O...~..".....c..5..%GP..i.jI...+.....!on.{_&X`..f..M.I.%...\|.!QM......u.\..z.

C:\Program Files (x86)\AutoIt3\Include\AVIConstants.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1910
Entropy (8bit):	7.714277197741344
Encrypted:	false
SSDEEP:	48:LSE7//0U2033yyJ1adtf9trJAeyg7+TfPu5B2qz2ti2o4HiW:LSEb/0U203rif9trJAeygAXuv2S0iW
MD5:	4DE6F8C077E713B89519097DE53617DC
SHA1:	7934ACFD579A804042E46D061FB2432536C73EA1
SHA-256:	68EA10D80D9554F0E1F84AB1C9FF4743B702527C812146F399964A9B90984A18
SHA-512:	85B6D5FA31D3C81032EABDE33038A3AC4CF454FA620204BB6CA8F3A19F2814130B862A268163A0D8C1B283E88BBC3CF4589DFB410E7E93F3A48D7574FD7732A5
Malicious:	false
Preview:	..H.\u\|O#.eO.L..m)<......k`l\| JIN............j{...E.-?...L.\..&..2...9L..$:....4.)a:.R+..Gi.^. ...&.&Ph....V.v.........7.K.....).;m.........d...6..[..o.....-..t.RT.........{.E.!.....9......R/Dd.....6....nb4U...K....s^..yi.......g.'.Z_......U].%..>...L.p..x.._l.c_...T...;.d.gV,@{.r..n4.MX.P?c.........fE.N$.....w.+m..r...rkbM...&D.K2.....x^...7...=.M.....[.e..b2...8.Z..>{M..fj4g..0=/.y?.m..\|xa...3.p.6E.zU_v....1....P.@.$..E..r...h.CM..Xa.T..o.h...t'b...C......1...I.....y...sg......@.9.....41.....$..I....!....@Q\......B.$N\~.\|....X........sJj7^Y;0..q..`qEG...y}M....1...A....7.%/.G...r. ...05b.I.....p"..W...m..\|.P[..h...3,1....ZF....~.....p?...$J.....3"J.9-....i.z..:..l.....@....."rF.z\...&e....q....{.{.j...d....\s.U....s.[!T4J2.]..(G5f34.@......>...P.2.>.kZ..:s..o.....k.UI...v.k...7N3..!.....w...M1..7..`0[....J....o....w...$...m.Hs.A..itf.?.5.....H.)7....)... ...@/j.O..z....*~...K.k..r..#....3-.PAVJe.=uT..B.%.`.....u.....gP......8.wT.0..

C:\Program Files (x86)\AutoIt3\Include\Array.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	85552
Entropy (8bit):	6.048698845691754
Encrypted:	false
SSDEEP:	1536:kNmbPUnzTQ4le0Gv+mCUc/dYKJIFNbz639nKqF6pD2L7AsnBuNJTJhPYXxNuArqk:YmjUnQ4EYQX639J66L7yNJTJhPcxNuAH
MD5:	89C533E26811565786B4A342E35772FC
SHA1:	2D970D95850178F2F8F1587F0942345304979DA4
SHA-256:	69E5A3D6068E27A201A64B49F627D1C545BAADA973129894D9F19A8BF56B3D32
SHA-512:	781FC149371925B0FFCB6858B608D277A7D404AAEF52EF7D15BD10C465E8127906705E793C2203EE40DDD473344EF036E7C67B684CD5E7EA2E1A690FF16A2F08
Malicious:	false
Preview:	.y..<..).h...1U.0..n]....`A.k.(.-.F....j.........a.f.lX....g.....^...q...x.".........!f..K.Im..=..B.Q.....S...i.....P...V..t.HY...3...../..Ys......\.....,Y}........(...TwV..r.....~.]3....-..4.C.E.f..K..7.K.y.........1)..T........'.s.~..~$.L.s:A.A..G."%$../L..`...B9U.q.:...(cU..C.I...%..Xs~vWHUN8..).]. ^.y>.....gJ9l...2...iEuE...c.b.H0.n.fwC.....G..@2S...C..x^.x.x.....N..JP....S....e....tYY.5..k.R.BIs1l..FA..c.BT..%.an?7..A..../..=yoQ....b....V.....v....NnR.t)..Y.].#.P....xu..W%.c...;.p.J....?;W_.g...7.g.2!L..6..lp.J...".........`.'9..T..-y..sTwu+l?..T...I...os.-_.....A..z....f.........^.... 6.&..4h...c.`.H..Os._V1.Nh.0....aP...$....n8q..!X.3..Z.5.AF..D...v..w...b..i>&Q.8t.-..X.=.9.......S....8N}.`..l....!....A.Q.}.V..O..#.U.T..).....t...uS..\.....z.-..?.F^..R.;3."e.u..b...}>l!^~...k`..@....x.N..d.b.{.,dW./G#......<ia. ..Ob{N."Lmhz.....YwB......A....VL.t..z..C...F......k...w.6,f...3..x...R...r;!T~Q...w...Z...@.1.0....9M../....f_...}5.

C:\Program Files (x86)\AutoIt3\Include\ArrayDisplayInternals.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	42802
Entropy (8bit):	6.519204857462084
Encrypted:	false
SSDEEP:	768:H+JRqVWtmqPLqCXGP2txa73mANMYDuWvQNVJCz/R/:eqwrxYDuY7R/
MD5:	2021DF59BC8804129C8AA6ADC4E9B048
SHA1:	01590101B74E12CB606F734579DFE3A9CF34E167
SHA-256:	05B9B37AA10E02B04A2B2836FC7F66438E884E18599191C58424CAF9DF496D12
SHA-512:	AC9D64E22A9418DE7B0DF491DB6A0DED2B79D378EEBF4F677FA861004E4352EB88E53FC51D137BB5C2BE605B97F81CBD25F3375AB08D5385804C5F2DE7C463F4
Malicious:	false
Preview:	....E.....2\..7.{.....@D....P...K.5.E.7....^o...:.C.@...e....H....v....l....8..1..:...p....d.\|k.s&.Mr.\...u.^.&.t........I...0.GBj..Jr..Q.hH.P.#.\-....f0.q..D.RH...^m'.... ....f......cA.$......Q.....<o(..G....nP[r.7T.H...X.M3..n...B..F...A.$}Z.y.N...7...@.hm.h...Q9n_.Q..-....P.r...J..q.....Cg...Gt)....7i..A......(.S3....J.....X...-#.$...x.Yl.%....2..#.N%..~E..:..P....OP^.bS.v@.m.....!.&.;@p....z..xS08.4.3..7.'...E...kg.....[t.d(DETT..;.....I+>......;p.G.".i".b.O&.......U.T.&i..*8....[&..J+..!.mk.....P.]..D<."pQ3'.T)......l......[.ae.......".}Q......fX...i.....Zl..[..@C-..&.6...3G..B..9.....U.`..47.{...r....WE..3S...Yh{...Ba.j........r.FiF..w..]D\|+#..(C.........Q.>.>6..v.dZ`.C:".o.K4..8.gB..uo#..-D.........QV)9....mP6.re..........p..}_...\|.\V .R..<2..x...~J.O..&...e.4d7.NC.x..#T}$...Y.\./......m...,".\|..G.i.8:.w~.....x.r..l.G.6...jH.g..........B...N7...i..k........P...`....p..W\|.0.....c.mP.G.U....\.^...._k...f...A..3..-.0.........<.V

C:\Program Files (x86)\AutoIt3\Include\AutoItConstants.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	13081
Entropy (8bit):	7.167106942468275
Encrypted:	false
SSDEEP:	192:f7A7wFF2b3Y0jxmQeRcAUvh4H6U0UDywCm03zz3+sXjYa2djgVgcZj1O:0x3Y0xjAU54H69UDywg3zz9Y/+VZ1O
MD5:	CCEE035E522C8EFF92A7CFD2323AAD04
SHA1:	04DB4ECD120424A7B29FA26C726FF02042FFC31C
SHA-256:	EE7B7DB196EA55603F5E5A7F87887B20C51930DCC7BBC075D1B3A7B513631A9E
SHA-512:	07D82D4E9E40AAB339F5A7E646648A4BCBC44EDD61F5890B29F564D6E9EBB953C47113A5803B123A7517B1A9452D7D44CD37E2E56B00F03660D5A2AB91C8A096
Malicious:	false
Preview:	.P..t.,.6{.N.,J.....Q....~...{.u.....6.].j....H.r+..H.H..........I..>..`NH...[C..RQ..w@q.R.."=cq........W?W....KUbc...t.P...I.kY]....8..........".tb.ccb v......v2...7..I..@..~.....jQ....9./.^....l.v...b.\e.......Gy5..a..i[..m...0.....z/a....?u.Dd.Ee..y.W......4}Pl...\|.l......./....m.~.p...X....h.CE....R.../. ..f..V.cC.Z.i.w.]o)....,L...)t ...E...m..2..\|h.O.:../ .b.a...=~......l"..G...... \|.<..,.4./7..........o?.%a>g)..{....I.....2.FBvGQQ.:..=A.wI[.g.I..qZ.T..6...]+b......fx?..1....#...-..z;.wR...u}.%.(.834..Oc.....B.K.8.... ....i.$..^..cw...^.....h.%{....}..8..B...6M......S....=.~:.{.*..,.Y.....>X..u....+.x...1.b...%.h....S".=3Foq..q.r.z..4Qu.. !.Hny~...g...a<w../R..4&.i.\..!?..._..c.#@{+.Y.f.b...n.5zO....d..ua5..v.U..2...b.I...L...,!....L~..H........M....#w..X9...T.8...Lsf....a.gt.(...4a..?.<..t..........%9...%WG.T~EP@H.z...'....j.&8.E.=..s..d1Y~........T.N9.....e.c.q.c.{....4./....Wk..(...x..y.J9H.m...6...D.=".7"..M0\..Vp....YW....N.

C:\Program Files (x86)\AutoIt3\Include\AutoItExitCodes.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2805
Entropy (8bit):	7.852453118126333
Encrypted:	false
SSDEEP:	48:T0Je552xhIDbDYD08kxomZ6lGo4cZhW5WPRPvTCuuQ2Qn4vhl6XndewQU4UNsTWr:v5rDK0PLZoGM/Pv+khI6X0wP5sT+0HW
MD5:	A3DB83DC9C9705868201FFCBBF246D8F
SHA1:	1A4B4A4EE513476FEBFBFFCA4CC35ACA334F391B
SHA-256:	EEC83421068C982C3E55C731560F593E284A6FF9C647A3A91C450159ADE251CC
SHA-512:	67F4515F80760E9CFBDEA2B710BC6105F55DB50765609F63E89CCD9AFBB1AF09B63794E638BF3E4C929E4A9696C2F2BB8343B011E44C9DF6190BF2D4D69EA9F6
Malicious:	false
Preview:	.....k..h.0%...."...k..h.....K....C..A...1..D..@T..l.aC...E.......D.......>xV".!E..w`.05.7.t1...ZFgZ.Q.}....KK}.B].....:.5J.B@.a..+^..P.S........4.....`x..qH...;...J.cLV..#1ZO....oT.E....;...$.D.4..tA......W....W7.N...NM...m..%....U.-...Iy.........$:Y.C.5..6H.....[.f..7..v.>..>o......U"+dT6.c..pCh....h."..`.._...:4.kl.....&...t..4.)..V....h.........H....R}..f.v..o.hZ..q......Ff.T....L....&.....U/...xG.2.g,.5.2...\|O....+...vi.9.@...a..tM.OL..{.W\|...o..?.....T..M.......b.......7\|...(VX...Fq....\...n..=.D..-.?.H}PbWD.y,....q...=.ka+.,.r...i..B.. .(.z4_\Q...1.J.1....n..X..b.....i.2C6.bRSx..ht.R...... ...<..{a....0.~{...Uj...N....x./Yd.b..R7...!.u.....y.AAh.~..eD..Q.}.8.).......K..."..e.(..........b...X...TP.~M.T}....^....9...u[e3.ZQ..w.K.K.._..NFP....=.R*................$/e....t.......1.".YN..v),4........;..2.Ug@.P..sT.P.U}F.N.z...K.{.U..#!3...Y.NPuEN..n./Q...=0.$!..U]......?.v...!.+YA..9L.g...H>4O#J.......(.`...F..nmz..v.OO.t.2.> ....$.T.2..

C:\Program Files (x86)\AutoIt3\Include\AutoItFatalExitConstants.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	6711
Entropy (8bit):	7.80037619092308
Encrypted:	false
SSDEEP:	192:zHcy4jHgG1EU0+vWmIbykE/xY80OtgQL23K:jYS4HWB80KgQoK
MD5:	7609FF903A2F216577E3B805A8D7C53B
SHA1:	3DEA6C9F1631709507348326ACE642B0ABE2F12A
SHA-256:	DBC11C99ABE25B69C88589313CAC5A8D83F8E53BDE33B2F619079C849853B85C
SHA-512:	384E0AF16BF4F58021EDB9D27C750C2BD9F0A0561216C1B3E786FCB9E331B4C23FF6496E09DD8DF35CC549EB0453509C1999D179B026ABE91AA223B83F44D814
Malicious:	false
Preview:	I.S...<.M.M.LZ)...C.e.F_`.n.rS.h..1#....\t.k.5YG...(.t..MZ..tr.........n\...\|tx.#F..m7....5.....H..'.:.zi..<`..4K.~.z..z:..>.0..elR'..at..T'..PrO..LF.N....._..:.vi.k..p..z..(.:..l9....>./\V.(....L:..e..~....8P..R<.3..$...s......'p.+..O.Z.....t7</7.fc...Cc-eX..#..........FI.........M1.Ml.W.~).d.....j.^..:..L.....4l...qp_#.n..".....G.Z...*..Y..)2(I.".O.....Re..... .....)L....2k.saD._..B$7..d...2.oW.w.-z3...(.&.:...MO.....{.....f...BB.H.h..]...R.J.....C.O<i.D#O.!t)........:/...o....D9.n..43<R.G.mVi5<.H.d.......3Y..i".U.>.6T!.$...\|.m\..>..w55.TgU.a a....b.c..".J(..0.r...c.?....2p.!...P.....k.u2.Q....W.Y.KQB...`.%..I...R.5.........a.]...[...~....+.....I.-.X.{...>.v..F..gkQ....i...Wl.\...%...$k.;z.1....U......&#<.......'....]...PahU..d...d.....jz..#..qB....?.c..A.Q..S..N.a...q....e\'.S......#0...]{........o%....VB..^jr.V.@).'.g7C...E..R..Fn...o1S...t%.......X......u...O.`...m3....?..o(.o..x/..).3'..J..5..&o....`..D..~.T.o'..\|.g_.,..T....bA.?

C:\Program Files (x86)\AutoIt3\Include\BorderConstants.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2447
Entropy (8bit):	7.821868185030538
Encrypted:	false
SSDEEP:	48:QALsb8a4hvpqix67F9JXn5vbGbseZzyplsCUUrm+cr4XejVAyDlkC6nOW:QALba4h1x6xnpbGb51y8oncr4cV5DlBW
MD5:	0EACED7EB608C911B3AC196BC837CDFF
SHA1:	DB8E414C8F64D669DD54134A68DCD75A8124AB5E
SHA-256:	BFAB6867DA8C5E800B6A07615187BAC90EDBDE33A66666476B98683C1F23A29E
SHA-512:	353C9178ABD3DEAB31ABD8AF6CB7F4C30E89B84515E9E2822C7700E3C489C5DA6E8D9D32F57E9987B3A724828EB7E3B447F041859A0F2881270EBCCB7660B1FA
Malicious:	false
Preview:	..@...(..d.`.jS..F...@....t...['.P..vM.Z..n..~.H.[3...\|.[~'.`.. ..X..!..X......u.R;.CM...._k.\|....ON........Scc@..G..;..).^]w.,.........1..w._............BCgs."&v.....=..J..r..\.. .7...k.r.9......#...!....flJ.n..P7_D....$@..-.s..$.&..G.rE'.j....8.M.Hb.(.H8.'..q.?......,..#k...6....<...r%..q...uB.....h..=.g.Y.v...V....C..(....t..k..~...a....0..5...e..Gaj)A.....1..(..jH9.......[...$..>7l.?y.6...m.[.s.m.{....#....T..?.-.v:...5..o2....{J....D,(.A.W QJ...u.......o..0....6W..F.m...t.....DO.5(U'.F..D.f..p.e .........uN......+5..I......NK......p.d.i.q..d...x..`.R....r.T/.[...r..<j..i..m...y....ML<..2j..d....d....i.)D.~.6.>_......#..^..r.....2.-j...Zc../.(.........<.23Hla..*O.d'....w.m0c~..z}.F...e@K...-...u.7. .,.,.$J..dC.A.\...S...L.....o.q........:X...@.9..,.0.zn.{.M.z...)m...H.A^..Z.l......A....r..\|bm.G...(EI....N....0...y..../...".^...8S.^....@...B.3..ni.........E4P.._.lO....F......<..\...2..b.J\|.../.:.v97.F..zK.....O..J..>0y..XX

C:\Program Files (x86)\AutoIt3\Include\ButtonConstants.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	4778
Entropy (8bit):	7.91719043618197
Encrypted:	false
SSDEEP:	96:dIbi31mo5PlfPepZBvjV76biQkmGNBEt5qCen72VEEWW:Cu3dln8XxkixNBVCe6VTn
MD5:	8444E24E1CE90EED9C105C5E6E43E449
SHA1:	20EBC71F1EED8AEAFE7740DC9B7CE77502726398
SHA-256:	064E37C87CDB749920E9218BB04CB233E457F7394051AA090AAF6AC5F7A2C8AA
SHA-512:	ACEBB4C554D2AA71CE93C3541B173BA556CAB2ECBDDAC3B667A8B4E8EBAABE208E400C78AA4D8D5AD5471F131A7C0F8F11E903AE8F8479AD7808B4AB194661D0
Malicious:	false
Preview:	. ...y....a...u.C_.KG.........et..;h,....a....#..J,....~.....a....f.F$;{.\.}.a.j._....u..f.~.[.g..S.^....'..X....%..T...z..........v........&..U.......<...nD.;ny..8..NP..\.os.....;.rQ2...)d.K5Z.].U3..m..... .@....3Z..%.Ug.W..=.b...>.)....`....4Y.._.(.q....L....GPN.x...].8....k.6t.... ............`/..?....:.....t. .O..X...2.._..o..7....<....SZV..<.....W....)..V...........:...w\|vn.......-k.y.7...+.P.,....H7..Ll.6...b;....5 .g@..B......K<A'b.Zx\W....a.K.....>.W...w...Z.].....+.9j0FA.aX}..b.t8)4@y.-$.~...F.....]..R.._....v.....{.?...}}.X\|..-.n...J.+.......8.... ....^..^~.v.g)..R...j..J>t.I.}.~...jC?....<K..DmJ..... ......(u...Z.a'f~4(..8/e=..(.K.F.J.S. ...........R7...\.....#...#-u...8...i..E.t#.......e.4.R..\|:)..Q>..........H20.&..i2..\|..K......,.P..V...\.0.w............Dq..t..=ZR~.}.}....S...5Pk.0.s.Q,dE..f..t4+.y.J..V.$....~......W..L..4.[..G.6+\|z....<......]....v2..i..f...D.i..L.ho..gl$..?...Yq\|..I..]..ZCP:..k..!y..hT..

C:\Program Files (x86)\AutoIt3\Include\CUIAutomation2.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	47988
Entropy (8bit):	6.322434028902186
Encrypted:	false
SSDEEP:	384:Ia5x3i/ub8pjjAFqjkWqoPRs+c1VLudHHhKyH9U5g03zd54GTt+kLBS+i4g0SOlY:Fm/VjzjTqoP7gpBlmKSVV
MD5:	89BBD3C583D9A78D65771E7F62D2894C
SHA1:	056AF7961CA72CF5C2127E27911A496283DB726E
SHA-256:	389C8EB2E917E8D9E9FCD97B418598F8BEDD46F052B16CC55C79EC14A73CAE59
SHA-512:	D1C0191BD7FC43798BB558C4685D40D61347AEFF9CA82BFC11A1398E1B9AB9FC2C4448B45F13AC4BA51CBD2CBA0CCF8826561B39786462489E4DFFBC9A45A317
Malicious:	false
Preview:	.7u@.w....HCz `Q.LJ...s....J.z.ae.z..T.UX(..5.W.R ..?..f...Z..8.......S7..]....-F..".....SF.c...Y.-.b`=.Q..W.:.$.....,....+3.. UN.^`...?.A......B..}s..O^1.../UY..;G.@..($.MdP.bAC.8D~].L.....?cz.;...E....H...3f .F....=..........h..&..."./..O^.cq...l{z.....4I..O.......zV..F.......~....Z...b. .....z.:.;.._q.Dx2.W.W...w..$z}H.Ya.zdZ........v.m=..5Kl.._.F.i...U:.M\.k)g>\|m. )x?!Ue.UR2..H=.."...F.(b.]l....v...L.#.}.....)..Uz%U.`X.]..r.SG2W.q.....XW.A..9.\|.b3f.^...4T........{...#........^Y..U.8.M..;...x.4..{.s...G.Q..)....a.k....O..n....J82>\Y..i..\|...r.E[....T...T..:.W.=S.g..y........C.4.Xk..o.P..F..H.....#.....u.c...v...A..}..A.65Ev.OP.....p....b,.W.oZ..p....d...0..]..d...j..............s....i.J.~.(.U.>..@.T`.6\Am(`....i....8...rg_8Z.d..~'c&.........q...{...3i+.,..6........q.......I....k.Rb...x........\M...zL...%...A.p-5I.Vo.U.7.....iW...b^sC...Rl.3b..d0.X.V.2....k.....0...*.2......x...%.Z..i.....(.$5v.m.....n0!...>...w/W9...f...."...&..lS...>.P

C:\Program Files (x86)\AutoIt3\Include\Clipboard.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	19245
Entropy (8bit):	6.409425766157328
Encrypted:	false
SSDEEP:	384:e8R9mNe7hc8uAG7QsNyfv1fHJsEkf6MBQR2yJ5oqRWjQVtfbi1azs7:e820hc8uAGWVpsEkfPqJ5RRWwfbSJ7
MD5:	27F4B6DF4500504B5DA115DD6230C628
SHA1:	6BE04B61D35A36DEA87C77CBE3E5B61C00FE54E2
SHA-256:	18C9366EA62A3AC60FC61141A32FEED31E917EC6D3A30CB3E63C7E56CC0CC0A7
SHA-512:	80E8A22697EEF4529835FCDEB9CCBC801696EAAD0ED15E206DD42D2FE2950733F7848A703E08FA02020BC40F8DA0E67DD436E8ED0E7DFA7FFA6CFB4A8E81D01E
Malicious:	false
Preview:	.F.?d_S......-u.X,..hS.....6.....:.d...4.>.....{.......T.....k..%0L..S....8.Z.}C....B......>..r..U.@\2...PS.;..v\|..H<...W....+.jxE.....c...W\|...lv..)..?.5..f........_..'.fw.G.c@.`..C..h}0.n..Q....,').W.'.DpB.C.xiC.8(s{@.,K?......(.>!u>.Mx`B.E.. p...m.K....8..5\....m. ..S.\|.g..nO...Y.l.?..O.I(....Z.GY..S.~Q. ..}?.~..y.i......x..(.u.n.....l`(..g.:K....m.1F.\|...P.#.=^....0hSxtI:.pi...Kr....:.......Q.{..\|;.........+..a...p.qQ..Lj......g...?+qq....K...\|..^...[f.g.....I..Y....;ax>5.....,xv..W.. ..!..Y...m..._EpT.`...`\|.2a.,n ...[..2..]....j?..K./!.,N..c....^..p..,....7W...^...>..<^.7.\|...pz.[...8...l6r....u.r.2.<...4........d.:.w...'..V..5.$...k5.Ah....xa..+.#l.9..8]3......1.1`...B3UK>e.oJ!X1....6....1q .n.....\|.B<.1..GVj....e.i\...l.-...P8.8.Q..0%^y9.+<6.;..~...R..s....;..jAk.c.4..V..+.....1..p.&..;Rk..%.....D.x\|...U#..1..X.O..v..m ...}.....(.x..I.....2zv;9.i`...L...A.l.2.._.2.0.^..j.A.FrEbJ(H.8u".'<3.4..W.TWOq..X.+.&f..zR..X....4z..p.*

C:\Program Files (x86)\AutoIt3\Include\Color.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	10311
Entropy (8bit):	7.085082929792488
Encrypted:	false
SSDEEP:	192:ggf+4hKomIWFuHqujqtTwS0R72YRTRqmER8+aOb6YI:7f+0pjWkHPjqcNR72YRTRqmER/L+YI
MD5:	B9333F63B79D118F328279991B4D8D71
SHA1:	7A21D96D4254DACCFAB8D510298DEA51E830418F
SHA-256:	C0610CF3C6C61BD438DFA647888C2D4C00B3395DE9C4FB2EEEE833A3397C578F
SHA-512:	A2FFED2E0AE0CC66EFAF27A8F449A1ACDDCF135064391208A936CB2E525FA4C6694B5E69B9D626CBA7CE37772AD0C77F391FBAE91F06558FC7140E7E5C615C1E
Malicious:	false
Preview:	..'R.0@k....3...QJx&....T......_.......j.....qd.xL.....!...y(...y...gt.+.Nu.po_!..N....J8..E.O<..}.y.>..fS./..=.....$..X.N?.L.$U.&.f!LjJb.S..Gp\v.s?xQ..)......v...8.....N.....V..@{w.E).NQ~.!.....aA?.n...dz.;..\|^.`...`.;d.5..4&D.oWSu...H..M...B..-.Z.npU...)..`W.}3<.!.3...........C..i.fL`. ..O..C....T..}.<..../.j.{.'`.+....#H...a....aY....F..]..d{.0`.^..4...5$.u,.u$.f.L=#JQg....&........b..8.?.J....X.j)88'h..H'4..t.....M0..j>.v[+......=k...c..)..f..X..p=.......".?....{>6...V.g.m.q..}!.3u}......#..7.J].}.....BE..-...C.=G..Y.\|K....`...4/....{L.U.+x...s...zYW....}%...f....!..z.C...........$.Z.."RO....<...U.. ..,F.V}n..6(s+.].8.H.SLu..._.5.b.I,..e.......:.T....pw!_..tf...i.N8.?......N........%Ay...oO...f.P.....@&T...0&..\|8...\........M...K...B.y.Qy..Z1..L..H]z.i95IH}..t.._..I...GM3.wwxf.2<.p4[tA...x"\|..J..bP....?...\| .......!..2.....\......Dg...[.g{w..&^d..i.....S.VdN.1.$.R_Z1....l.A.^...v......r{.{c.qJ=V..$.v.o..."./...:.r.O...W.f..x.

C:\Program Files (x86)\AutoIt3\Include\ColorConstants.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	12883
Entropy (8bit):	7.093790078816868
Encrypted:	false
SSDEEP:	384:j4pFXqS0JO1fFyOPFZLgoMXo3WfdOXflLPU:sbq5JO7ySZLgoWoB9LPU
MD5:	1E186A6C3A32A415755265BA059CB4B5
SHA1:	1B4A160408174D9C6C91075F31DB6C7B6B38950D
SHA-256:	5539E3B8A35A427EB6C3E41927B91E364C0D6B64B816F4A6CDB5EAA2B3459485
SHA-512:	817870D6896B0601A325ACE43D4BE6C8522E922E229395D767B51DDE572CF9F5DD69B23CEC76E091C0FF072EC9CB8EE369D96C6D9CC73732C59D5171E4453048
Malicious:	false
Preview:	]..yE.\|..Cs..b.J.1B..+..yz.h)\q+....d....?..p.85.........H...B...d;'..9.~ZDI.$......R...:E...O...v..2..:.7)...g.?.?...\..i.h..`.j.j.....EZ.L-...t....F{..%.I...LW........r...{).L...X.......+Jr.G."^..8#uH.... ....&..y-%..?.......}.p..X.Z.}.=..V......r.6\|.9...C..dJ.&.........5.m..s..@?:..1s6..@..[J.U.A..n..S?..8....w....f.E..D......UY.S?h.@...Ca.j...i.d...,qi.l..H.f?......~.~U..9........-Tf/S...Dv...o.#.oqa.pQ.z\..T].Gt-A.\|d.n.X.)}yH..F?...?`&\.\|....3p..E.n.).h._1....G..l..W.f...W.;...P..f.w.QN... 9..]..D....e6...I..a...n...O...T."..3....nQ..+.#.Y.B.........N.3{.o.`.:.v.N.zq..a<....G.x:8s.T....N.stx.".....{.c.c..&q..+....c..hU6{.ph.v..V..:vm..~.i..o........4$.&.......1...=......B....7.?.a.qj.e....]N.L..6....Qmc~K..!S.'...@..b..cS.Q...G...............kE..\..+w.kg5`.ps.......S..i..A...i.A......D.X......,.-.z.g. .j..l....\..D.T`.$.....Jrp.9.m....K.Y...<3.....u.'...#W=}T...g.E..]..[....<+.. .)c.....\,YH.4..1lA....:..i.ib.\|k.@.4..........=l....

C:\Program Files (x86)\AutoIt3\Include\ComboConstants.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	8098
Entropy (8bit):	7.627619519641129
Encrypted:	false
SSDEEP:	192:kGCOVeSGZvsanu9k6W/tS2uPLs3VRSkR78mkvB:k2eSSv40/tS27VRSjvB
MD5:	A0E8A8EFDA743DE84E8C83FA169AB23D
SHA1:	82DB9074445AFAA613DC2F933808BE3DC4B9F80E
SHA-256:	226C162B62BAA92428ECE645A8148EF62146034B932C18EE28CD9090D6A96F24
SHA-512:	67DF7990CB26500EA52A823D20BB0257AFEBA71E9851A1774ADBA43FEA084FDCFDFCC85912ED39E03EF50ECB21B2145102D206A4DE01D850A3077A915CDFAC3E
Malicious:	false
Preview:	..R.].y.MoJz.E...X..+t......R.1/...a. .#...C....yH..0..K.....k`.8..$wsJ...,...0/......w1.....\...4..8....t.P}J.y.k).....S.2......K.1...J......>,O...0.4Y..V.!,V.`....,.8...3'.C.K...u..r.....c.....dm7..e9.......a...J.....ep2.....e....&..~...??V..z......5o'i..ATh../..k~....../.V....r......>.(..6t....k.....W`.}...C....x=U.Yh.u...d'\|..G..;.(k.'.kD..>....cg6AM..'G..h...N>.n.....P~W.O.r...].D...>.3.k/..,.<].(E.Q.....?.&..\|....F. .6.M...SF...3.P.&.Id.`....r..,aH...6>..3.b......u\| .8.9.F...%W_L....]....6...R.....9S-..D.,.pr.....M.L.....0.;......K.w..O...(.A<.....&A..+.....Y..5#......q.P........_.....F.'..,..7."V.!.~.D.I...w....8...q._.:..NS..m....Pt]E.DM[.q.......#...Ik.=~.Ft.....r...../~.=....U....W..*qrx..O4o._...x.18~....fe...a..z.....r.5...j:..<.tQ....Qv.l.9.&.L_...n...et..F..!%.).40t..d%b.p..".....Z^._.N.N.X...K.n._.[...xF...&A.HF.I..Ik.B.O.~.I".....MG..A.[...D..nd....L.N.3...Zx...N..;$.T..=..I....n..H9.Y.hXw.G..1..k...#C...W1..u.k...dq8.

C:\Program Files (x86)\AutoIt3\Include\Constants.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	4560
Entropy (8bit):	7.920516609936844
Encrypted:	false
SSDEEP:	96:afLijBo20gZwiSSA80qc4DK0w+vGwQIMWiZZ6FU1qBRyFco6mOTIW:azi2XgZhA3qbW0xuvRWiZZHqPodu
MD5:	46F741F58BEFA2947D03E8F2F59E57C9
SHA1:	D68894898C906D924A303A698FE0D86CEC9E8AB8
SHA-256:	EE65822D886946B8362224D158BFDD5D577A4E75779E5C932629734B152F584F
SHA-512:	6D642011A7D26A710FF6C12F02B89001750BE13A8DF3F6C2DBAC9023BDADD170ED8C95C8C32F067C0EF77882ADE8082614464CE657FEB918CA54914444A493FB
Malicious:	false
Preview:	.....d=L...H~.?p.._Z..{z..Z.mS#..?..q.$0.....O.k.l..W.........{.........x.EN}.;....^...O.]..n:..P..B....9.dC...&.L........F.......h~O--aI........&i..U..B#.Oa!.......u...O/.@v.$g,...Q...{....P.U......P..P.?......>.&.....o.L.y..#..#.........)....&....U.^..2...D..,.2.....i.....).).!...D..S..tF...Z.tL.`%.._..Q.QjqL..?...@q.....bk.n....gt.u..EWl}._....zZ.,....B.A6.."Dze8....fi.op.FS.]...> .....V..{..]U.-.C.M>.....Q..<!.T~.Sv.....G.lB.Z~>.LB.B&..."._.fq....f._.-...^..\|f....b..H.,.z...8..],k.%<O"?W.r.L...k..x.!....c.VJ...*T`..nl....R.i..ao.k.+....k..t.:....0.=.8/3b."._p....U?i.I..7......?$S.a".\.ohp.I;.F..F.d.8D..._.....9..%.x.;..j....$...^`..x9..Mvw.5zD..7..A....R.j.m......KiIo.7.....,.....A.R).F....w..f...&..2......8. .....y$.@if.7.V.e...6Z....\|..iXx.O.?R..vi..p.ao.q...!..o.y.5.Q..leF0........F.....K.v)....%................P.@...dbE,....!.r,z......q....a....\.0.HH..%......]..s.F......@.L].>......4...r..\|.P/.[...'....).C.......-....\..ZK.\|

C:\Program Files (x86)\AutoIt3\Include\Crypt.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	27588
Entropy (8bit):	6.416343262834754
Encrypted:	false
SSDEEP:	384:a8mTWyId8X2HFIBSbMEPHc4AcrQ4rqjUWuCNZURKKukh/hA97BoLKWWxbky7UekH:nWzA8mHpbE8qwgHYDacB
MD5:	17554A26D63CFCDCE224603C9865F592
SHA1:	EEE69AC266B0E1ADEC2B71CEAFAB7C6B29DBED09
SHA-256:	5469D222A994831FCB2B7590E2A77CF4151BB0C8C4624DC1F7D2BD814F1E562B
SHA-512:	ACC5784351BD51BBFC01F016C21BDD811DA7BAD8095B53352482AC563E03B6E63F4256FB6E1014D0717DDD67256802F5C094A326C11E328C194C844B7F2D663A
Malicious:	false
Preview:	..a..t>......O3.....GR.......c.,..t......5...N.8C-........h.58'.m:.Y...tZa........-...m.....@..k.(.QX.&..]8.:.z......R9.Y.....f...-..........:v3}oZq...7X...l.<.$'._:..`D.H....."......D<6..U.........e..#]....C..qQ..b......._..8..Z...'..5.S.n.d.fOm.?..w..w.j.Q..[....#P...........?,...$.T._g.#K.k.y..:vB=.vO....B.T.kz5...,..G.w.#..K..Lm^...lw..XC....... .U.lk...<......$t..fM8..n.}PC....:....s.q..[I..q=...l...`..u.._....xk{>.....ax.cZ..\|..d........k...m.H#..R..8..Z..B...q05E.U.~C...(..S.5W.kf.{.&. .L%X_.L]A.`_GVHg.4p..wH......l.&:...n.XA.j.n....L=?.3.H'...u~..\|..>..........._..g....(_.?....u.D.X8K.,.t.....S..0...m"6.!...T..M....-.."...B..P.....$....'j..6."..7.Q.9..._.iqr..1a...6.wh...ST..b..j...-. .. .~.sU...LR...PW..P.)...Q..s.g....c.z;.`u..+..i.....>.R.PRD....5......7.0.a....!.X..4...X)./D.t^.Q!9-..e..{.i`..tv.W..j.a.U.U..Fyj...u.-/}i.PU........i.s.Z9..}..*:/f.S@...8(..#E8:\|....<-P......dbr.. X...b`../...4...=..x.;=t..nm......;Rs..

C:\Program Files (x86)\AutoIt3\Include\Date.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	86407
Entropy (8bit):	5.786530742426501
Encrypted:	false
SSDEEP:	768:WU+1xRmbQI0lLwI48OVbjuvh5YHk9PcZxX/BpaCqoGhEDRYEq:3+1xRRvSVbju55hKPbRq2RYH
MD5:	F82BF888669FDA87E2FDC844913C59A4
SHA1:	58CC4DB206E26C1D8CAD53AF2A27ABE5AF24E888
SHA-256:	AC304852026F12C2B4268B49045240161977D15F9159FA067DAEA2105593A702
SHA-512:	25892F003CEF21457606E644F53F5D02A1E45CD3E13AC64CAB5C8390FE5575DAB0FB4421C5889CF5F36F7ACD320B883D7BDE1253BDD50988F16BC7B336D96B5F
Malicious:	false
Preview:	<mm...by.y....K.E.?r~c.A....;...s.;N&...e.3....38.<..8.9K...B...X/.M.^...n.I.6...1..`...N.[..b.....,.:uqS...x...B.)o........Lm..p.#h.X..p....\1.!S....t.<].F...l0S.d.">T1...Dl. ..........H...)O...CV.$.p..&...{..w.}..[J~.<..4.<....#...QX...z...%...U.....+.........?.i.....Y@..sz.c$.RD...I..8,6a_.,H.....m......[...rB.'Tb..!vF.......(..#..q.M.X0.z%ShBG...X.1#..45..g)../.h....;....a..d ;.0F..n.z...}...d.l.!...j.-MN..\|.O.I.7)k.i.b..&x..X.AY.\...j....\|./._.......u(Q.n..:....-2.\|p?.......-..T.<.Y/..C...........'.0?p^=.........K...2.H....:.\|....9A.r...c...7.. .!1(b.pT).{+~....~..8_!..L........]...UN.U...g.RK.6..1.\.R8.....P.4.r.\|.u..F.w^..3....L....._]....Pc..N.`".H.....X2.Y...`.>.I>.56.......taH..f)z..,.".]...lK..b....#$..u'.v..f...YO \.K...R.hq.0.n...$.oI...B..a..(....-..Kw.... )..d.*T.f,........cm...ZwNDr}..1....8e.pa..c...k.....n.....G..16 .o(.8L..........O..7a..w.;..^n.z .p)>.F.l5..G;r\|u...d....'...8&o.k.K.z...$........=x...a...1O.b(...

C:\Program Files (x86)\AutoIt3\Include\DateTimeConstants.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	7381
Entropy (8bit):	7.727792140551975
Encrypted:	false
SSDEEP:	96:h4xxh0rR09FhVogvFnRsCf1+2XGqFDu3tF3sRlCUEyu8ZwbPmPlSL/3SfKhJ:iDhY09LNOdMl8yu8wbPmP4L/3xD
MD5:	7E909085E6898E3792875BF0897FFA00
SHA1:	B3D7C639F9278F20E673BAAB93E4B57C4547D7F2
SHA-256:	9E5FF99D4E5B9512CC1194E72BC41D807DDAB318CD1AAA419402DC4AFC09E668
SHA-512:	D13A13DD1CD344BFBF1DACA35632E088EFC1C56B0846CC1E3C1C9414C3A17D768357EE265654A3C8CDCC669AD644A3DCA9874413CB1E643F921B032D12D88AA7
Malicious:	false
Preview:	]$.. ....i .......R.nYgs.e...AQ;..m...<cB.n....L.j.................a.."..(.z.\.U.....^...n.,.Z.Pi.a}.(.$g......Z..v....R^". .G.<h.;x.]\|.p.i.m...\|...D7..A.<..~..Wp.G.z.qFZ.q...?v..... :...H~..,..../n(.WY...eaP!o.2..7C.@.dE.....&.......+S6{./_...}.d.Ar..b......T.....O5....,.S......3.....{.=s.....Z....Ve..>c73..y...7........C=._..,{.........{h....vIj.......C..s.Q..[.6.g...^.(..KS..07..a4.....Y.'Ipf#.1ah...s..R;[T...Fe.w.N.>?..sv.MT..m ....e}.qP2hL...a1...u6$...a...../.....'....Xh..K:..`806...EV..y.'..6G.%.}. P....d...*...g...C..\|......i`Gp.S5#..-..G.>.41......).bSL.H.,.....\.......S.7L(.$..Y.@.$.Z..C...N.u.......\..%<t..:.......r......#U!.4....c.......Q.#BR..4B.......4..v.;~../P.)U...\|R..QB?..6_./A.7y.p.]....?..... .-..UfM.hu....q.u...S...d..L...?.....S....-<.K,....W.....ZT...1.e9q3....F.....D ...:.ox..[.D4..B.B0.l5U....@.m..%CDV..0......../.~.b........0}D=3HwPV..I[..:..q.<.._..Q &,.Y.bK....._.m.6#X..e:.......D .\..`..v....J...z.#.Q.6Z..p.P.<

C:\Program Files (x86)\AutoIt3\Include\Debug.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	29620
Entropy (8bit):	6.4176181984299525
Encrypted:	false
SSDEEP:	384:+Pv8FDqwMmRWOL0Hthl3ZdwchkoZb5vWQHW7ZRd066QuFd1Fp4X+eOu:+PvSDqwMLvthkab5vWNVWbpu
MD5:	C030F2FC171E6A8896D418547015C5FE
SHA1:	1C8F6409B8E079B3E31B03C4ED7D26611BC2CFC4
SHA-256:	B1F8727492511B2A3A5E0FB9CF9BD056AC093BEE2C1B4F60E64F7C7B854F3E53
SHA-512:	65BF0B57DCE7E1BDD4CDDBE4690D3525D49360364C8501759EB4D3C3A3DE3221AAFE69092CEB5BE05563BDEE4252084AAC2D2FDF9AAA6A5D63948032AA6F4826
Malicious:	false
Preview:	......b.i..y....{..(..it.N..{...k.`.Ji.,z.gMY..... l._....d.u7fI.6=..B..3..@x.....XX#0.QN...8........'...p.."....-..ly.s<......=...H..I.WW(.q....V...~..,.B:.m......].....0..'_..$..S..4.L.a.^..y....n....=....= ^..%.......:,...{<.X..p.0!..]zYv7.40.=#4AV.....fGL.K&.....NJ...d..q~......2...jm....Z.i.......H...x...I-.E.wl...<.....t......0jl.].k.G....F..)W8....\|.....b.O....E!!.0..`..PQ.z.[._E.yR.p....{......$..6:e..^.. .~.(.q~...`f,..M.......M./.l...4...7.PGE5.....z.S...F......Ox...D.G_ ...-K.{..~8Q...~HY......<}..1...k.!....&;...U.F...ce.'..az.6.P.<..[......L.D<.qt....XT.@J5!..O,N..#..2...w1.5..".....^...q......+.^7.8....=.5..2.N6.vtP..........9.=)....."kOz.N..'..'Aa3.....).....<.#..ben4X0...}.{.B.z.K.......2...kS..+..1U+..<.Y.N5.wt....Yqs-....DI.q.............w...>.?..I;.}e .`.4..X..s.=.....}......OE...+.r......\.T....v._...\(.U...Y...}.h......(.daT.X.Z.H......?#Y.@......x]'.'c~..c]j.\..u..t..&C.y.H.[.R..<.`,.7Pl...9f.>..k(P.

C:\Program Files (x86)\AutoIt3\Include\DirConstants.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1422
Entropy (8bit):	7.627342775299804
Encrypted:	false
SSDEEP:	24:Z10aTAr+QkkqYMyPGbl3d1VJMtUBwynkvLfAYgZOqBhldFrrvGpt5BuI5/xW:cr+QksDshdbJMmOvsZlBhlTr7WTBpZW
MD5:	053CD5FFCFA128F5F94F0BCD092A5114
SHA1:	5515571A88962EADA2A2889A74D0F7B69220B47A
SHA-256:	DCB149E47C96CA7823DCCBC0F4691B82F2A4F389AB71041617A7FC6922DA4671
SHA-512:	5C16BEBD55408E0441236EDD3D842EC47595B27A43999CCE0AB567B74A6FF2D2485BEFEF93E740BC8FA2EDC1D60E516A646D582B9BC70BA27C97D23E6EFAFCEE
Malicious:	false
Preview:	.P.._.T.C..>...p7.....k{.e7}Cf.....(^........5D..-q...;.....}a.....42.h..4'bz...!.6.X....Z!x..c.B.&.+......n.X..]...MN.\..$...+.R._....N...p..e.(...J\|im..I.+........'J... N...y:.....(.=...2Z.Q.J....-@Ti.n..#.h1.YY../.x...:1}.Tg`!&D.D? .Y....9.S.$.(.......oz..v...x../...{...F[.?..Y.?......#.....rr.6....lS...L_..w.0......Lm....Lt....s/C.....P..2a..O...3.....G#[..G..."..S...c.(3.o/..!.1.R.....Wd...@.......x...zI..Pz.et....v"....,v....[...>.O.#.....&...p6.]...O..._.GmD.H...X.S.........qm=.......Uda..{..L33....<xn......"IR.H..S.......MJ.9Tn..a.g.\......^..b.8.-.........:o..(6.x%..' 7._~......!........`G.....e...^.6.^.{....T..g.... ..lB8T[..../.Di;.U....x.g.i..-.~.V......?@.U..................Y.A..c.......i...W[.2p....~A9.N..K.VMy(..6.?...Q]..}.#.".Q.A.i.0.B..w;...g..;...bG,...+....>....._....d0...8v....m..1t.!.....T..R....Hyg%.}-.q..&.V..t30"...@7V...."..N....{..uH..1.$...0.`E8...g@nc.6.$m..5...<+.8...>..C.q.:....w.v..?.Z....vDy.......gA...

C:\Program Files (x86)\AutoIt3\Include\EditConstants.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	5161
Entropy (8bit):	7.931196327533265
Encrypted:	false
SSDEEP:	96:+V/DA57fXqQK3w1IMpAG0cnjvUkn8t3Q+NqJQ2VfO3kGtFW:QAFo3wmMpAG0cnD3yQ4qJtVW0
MD5:	4CDE2AC63D855D5CD9A41FB9289AD2C0
SHA1:	04786A09E87464291D949B04399778EEC169C416
SHA-256:	E68D2C39371689522154696F591A8BFA313188341AF300DE846DBB4E6F5B521B
SHA-512:	5C9A00BE9CE32E81946143AE5A0B9491573B24D15F4D4D5E6CD1C48123D6670D60A79778461DDF1700610D4B930A21969FE62468CA2362CBA2E61846CE3DA0A0
Malicious:	false
Preview:	x.k..\..n..n..N....L..P...B...1.8.~...[..........M.N...E{..H!...t...j...,...Gz^.@f...j.m.A.....PO.B..nH......:......S..LT.S_..c...2:.x...7..Y..3n.f...k..e4...zi.?.0.`..C...Jy.H.y.O..p....l,.......r.#...OsaL.H..;.m.jI.:d4.......@.9..:rYXJ.+61..o.@;...i.. ..T.Fm..'..].Wo..ir...;.....w@...~..y.s..L.4l(.P7j5....X.:K>U...........#....x.fz...G.w:m.8+....l...%r(.......8..S"..L.E%.Gr...lg.).]..B...R6.....:qpb.".._.b~8}z.vE..6...S+..;/...j.?2.:.......a..<P.6.1...Q..#.3.......?....R..7.f..!,nC.:/.........{s.}...LuQ..=.g.j.P.q.)........3xF..^-.mt.z.j..............$.$q..XVHL..........D.4...G...=.2..9&...xH.j..T.0L.0...\.A...<E).+Jw.13VW......Ggn.......4.7~..'../d.r.4..4.....J.F...8..dC..T..B..%Y}...~...i`....-s.....@V.,Q[.r....C..I..Xm...;..nY....U....9.[u}......R....6)y.,......7wC.(.W..n..O.......u.......wH...KP.ay..#t.....=I*\|.?F..r....x..t.PF]...0...f.....8.5L..(...7.x.2'.4,.G.p...}kzE^.......:>.^$...O.YE.0.p..9[...o.C..K/a..].R...^a...

C:\Program Files (x86)\AutoIt3\Include\EventLog.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	31434
Entropy (8bit):	6.266333692005311
Encrypted:	false
SSDEEP:	768:npgf9DU7kE6SVvH6KaxbLIlmoLo4FUrd3mKJvXicLjbO6VD8adWHmASJf:npglDUkFoLozcc
MD5:	50C35419FA7F0C4EA725191E033B8FD4
SHA1:	02164285961770C98D5AFDB96FA67C55C1A78954
SHA-256:	9D9017585230390D65EA1699AFD875B6750351A1E65094A94BB84437562B1B50
SHA-512:	B8B79007144F74EE9F8806ECD4460E272803ED51DE5508E0B3C0FF5632B5677C64B24285CE57C5EEE3EC3DF3BB2112EC5638B13ECEDC0708C604E5330AB3CCBE
Malicious:	false
Preview:	=..[H..D.....(....'...T.D..`..6.f.A'V9.........3>.....>8Y^-.#.1...d/c\|.W...u...9...q..k..V.6z.@F:...qm..F.bU....vzb...E....%..#.jv...NX.....Sc:.e..vo.....2../.;N+..2{.....v,.S.4.'..*T...(5....A..F...4]&..G....c..j...>t..^pb..sQ.@l#.[n..v.;.t....1..P)z&..j9A-Z.-..L...\'F....OR\|...V...%.{B&^.k.x..p...1.f.f....3P....Q-.....x.[^.\|......H.sCDF..M%.....)..R)n+).X..:4Xq.O.7)w~K.....k.P.c.r..($p..^.I...l..e4r.,...3.2.&Y.A6.-Z........~..}...G.)..h.".....M0b...C.9.4}.,7a..7..D.h.WSaO.".-..6fXQ*.7..1..!W..}.c.mqq.DO.aK;..-.t.....?Lc.p......3...gn..=.....s9...'..A:@.mK..A.c.J..h+N.vy.C..'...]I).6..(yc?..}HO...C....b...EBz.....fnNWN.I...................c6.I...X..PS.b...En...;...Om....7...K..[m=..Z.".J..C3...X.t........H.8.....:(..\S....M..$_.g.....q8.%..z.....?.^!.'.1.{.....K6..P........Y..N..G.S"S.M..%...N.N.Bi.\|.5...........(KL.......9mm.{.^......Io..3TT...d....{1.PG(7.g.r.}K.i57..q;.r .....t..-...R.l.#[8.S...<.......... .J3......U...z}+..p}...>b.......T;.

C:\Program Files (x86)\AutoIt3\Include\Excel.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	57947
Entropy (8bit):	6.087665172433545
Encrypted:	false
SSDEEP:	1536:Ltq0bIUXYinR4dErKar1BgnDPaa9rgErZSaWrCaEAxqAbHaEP4+C/alr4rb4ZAGB:Lt/MWYinR4dErKar1BgnDPaa9rgEr4aC
MD5:	30665D62DD5173117746870D1AC42E82
SHA1:	5717CA353CFB272DCE8548381CC74BAF67807575
SHA-256:	5C5F57AA9C4AD23AA013F22C0B30FBA664D3B130E6560F0704542140DC86E518
SHA-512:	4C8CC29331E83388F0171B45175F89B64EC68DA7EB45F6B2DD761FD1246A5272170030F166005D27D99CFB8BC992FD68306E0F756F211363F3D92927154F6673
Malicious:	false
Preview:	.=.T....hiSdb.'o._....N...M.A..f.9.R.bh.....+..PYX..fnm.5....rj..&.rl...x.....`.k`:zK..>....E.....i...L..5.=..q..zS...E9..+9z..B...)...2y.p....[.[.W...4pm.Rs..}....?..h..R.A...I>p.Xh>..j6/9.....c..Pr.:.."...[/5.}~.......xqs.z}..)s.W..f.>N...o..9.[.U..l[1.......I.)v...`......}.-t.XJ..U2.n.....5.Rd>....../L9..h.8(0..k.<..B..g.Q...j..np.mt.....:....$hBU..r.Yj.`.,....r{..g..n...;B.."...].T..+..E..4..R.M......[.I......^.W..].G....P....8....A"..)....}!...i6./T.B...]E3C....,.R....~.2.....]..Q...c..$..{...hs..\|y.!.AS...x#:U..y..?.<.".Y..Jx...'....x.xH~...g-.....5....T...4.[;.r:i..D..s.7.3.1.v9.%g....;d>:b.....{A_...'...n...M.(...$..c.....)W..T.$oz..>.D.G....3....y../...x-U.~..]z.n.Y.v..&.\|q..ZI..~q%.,.-\o..n.;....<.<..K.h5.......0...U.P{.U..M.K.z_c.qr.\|x.1...............B..g.N..N..i.(D.,.w..ZP.!......!u...q.....7a.r..?..'N.H:,.b.X0...77..l..]v_\|.......zU!.....8T.N..w.6...../..Z....}Am...}`....0v<.......G.ktO?....&.bp&s........v.7S.Y\.

C:\Program Files (x86)\AutoIt3\Include\ExcelConstants.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	19944
Entropy (8bit):	6.654917761803634
Encrypted:	false
SSDEEP:	384:PYFWe112JHQr/DTZiMRgRavIX41QMcR9SNateM:uWI8GiMRgRavIX4CM6IPM
MD5:	2C5AD391912DA55499F9972F49C992D9
SHA1:	BC073CA8E1FB48915EA1ED401F4F9A64A82AFC95
SHA-256:	386C063443FE1751E8425C7C6739FF37F45989ECB6E3E1A0BA0D74800AA832BD
SHA-512:	EFFEB245E40613C772328CA8076635EE726B9E45C07F5ED88449F9C6FFA747D9FF0A15F873E2B6FCA53EED426A610A3CA42CFCF59381E507178DD5D9D1606992
Malicious:	false
Preview:	>..X.P.M.f....."`...h:../......C.{p7.H..:7.....(........Y.7..C....i=..t'RCh.tY1\.X.....F.N.[..........".]9c.-?R_.Fz..L..1v..6\,]C..w.[?..P2..(H>....Lz...V........p.,...V..\K. ....:.d.2......../..jR>F.:.5e.+..jE..i....q...%..L..I8f.}I.Z.......u...b...{.P.Z.-..l.^{.X...8.%...\..{..H......I..J.N[..#..!R.... #..D]..o@ez.J@+Nq]....^U._p......l..l[.-........O.u"...W.8.;......oy.L-fm.3x.X.R!...j....o..<.f....aZ.2.6h.G...G.......M"..?.l......K..X......u....#]0.'._...1G"(8z..6).......l...}g..Pw$.$[...8..p[u.&...C.X0Z,....9..9t..t,L..EA7d.L......#+).G%:...T...?.S.Z.HR..o`(.!...!5..k.:..".G[3.`.J..U[.}#.B!..Z..]..A^=O.T....Q....+..j%..n=Vz...m5xL.%z....z....b.d...M:...F......2.!.Ls.6$h.ep@.1m....W(a]......".....?%....H..M$!e2{...@.<y.....r.......\.<....;..d\1~KI..I..&r.Q.~..['...c..=....^d...W..8n.#.k....F.....j./..{....e.....u..3...4..Y...=.%r~,n'........[.."..b.s'9...X....&.\|+.g+<_Q.J....8...{....i...JnY.l..<..f..J.....YZ.K.\|..D..Py,.?m.},.S.

C:\Program Files (x86)\AutoIt3\Include\FTPEx.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	46553
Entropy (8bit):	6.165590339273555
Encrypted:	false
SSDEEP:	384:BwmxBnEOYdJZNB2b433s5iBN8yaHDyI3/phs2azIlwVIjIt4UshAzKSzHFHlWdL/:vBALz6wHavfazIlwVIjZ8PU0/2D
MD5:	C35155AA09AFB18AD97CE3FC27551E98
SHA1:	D38BBEEC5FE056E5DEB6D3ADDE4735A471A7ED18
SHA-256:	D1BCA3892DCF5B45A8A72E6EAA8F24C1E038918DBB3EF326D4BAEE9657156E99
SHA-512:	A0752C36BD2D4E3F9653DAFEFD358E6F10B08F16B18E9F6A63B04915B4AEFDC643B2B0371481AB61C60BD7E32CD273333E9A8ADC5DE7AD2FE4C75A6B3750B645
Malicious:	false
Preview:	.[)...d.9VF..N..a+..K...{.t.m......kZ.=..\|......FX..s..a.F_~W.X...T......X.3......J.\|.%W....Sm.^.0..QPq.Y /..`..E.3..k..J......,...7;].....S`.P..@.....j.o.LU..z>.. .}@M...C.I.z...5..@.Q.k{iX.\.795...amFl. b9PUn/.E.).....vNj.. =.K.......n.39=?.J....$.Vi..rRM1....]G.../.).2W...........=."..4...u...TD.&.{a......r._.$...G.(.....a.....d..P......n....3D...BE.a........Nzf...5.:1...s-u.3.7r..u.y..]..Xg.;..:{\|..h.....x...~.\|..o........a>H.a..8t<.&...\b8]......9,..r8....=!...j@.D...).OO...l..3.".x.....^...=bs......g.y.V.WDO.x6.M.>b.n.....p.1D'R7a.gN.q :V.'{.......J....&r[..).^HH...[&N..o...Aj8.5V..]...$....v.g.A......9.0..c^....-Q1.C#..i.<...<..}..2..V.....e............%.).~j.v>B..cn.\|..:X...=qxf.r..p.....^.V...)d!.z..".......4....Do!'..pV.~[&....8.]...'x`.Uc.ND.p.]J..:wv.....i..AL.X.>.Dv../.[..?D......0...Qz/.\|p...FNr.....V.....r...e..?G.<7.d........-..U..=....h..ZN.......k.%..a...,...{..sr..Rrh..Sv<..!...5..-..K.6.E.....wI.... c]...$.fF.;......

C:\Program Files (x86)\AutoIt3\Include\File.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	44456
Entropy (8bit):	6.2954415895377975
Encrypted:	false
SSDEEP:	768:ZqsIsPCbsOBQiDKnT6Ml0vlkOiNgCbfTZ6qHEyuRbkF9pJJEmk5F9L:7I7bsOGh6MlTOi2gBkDRoHpJJ45F9L
MD5:	D5FD04C842374B23A3E11FBA0A5AB1F6
SHA1:	FBEB830D4D350AA0637C9997F135772460FE7518
SHA-256:	06FEF81866E02C7ED05960D92BAA1E3F17B2917803CBABD0907A9A3FDCEBCE26
SHA-512:	D44A43D89A1DA2DA0A98F60F012698BB0855547E88D97A2AD958B6EED0422DC91E9E4704B93D885FA82937DB1F5DC2C2135D28BAD382E461CC122941C57BFF86
Malicious:	false
Preview:	1.....C.9-....6........]5.A..(.-gPC.3../...0..U......5...!.....D..%.N.........7s.D...^H.3.d.....>..~1.<...t...5N2._=..X...h.5...ZB.P.W.C.\K@.==.Ir..a.6.^..Q..c.........(?...8......K]m."h./.-U....}.=..n.:@x....+.........9>.H..vTP2. .sE.CZHd.-....<..1..R..AK..R$...RA.W...mTy..T.U...4.8.Y...>.._..i.L...6.c...l..+9...N......q......O.....P.....Z..."...ep..{".....N..%.._p...C...,.)..$_J.V.{F..._..5...B.piu...cv.h...2.sK..m....X.Py..x.lw.)...D..\|...$w..L;...>.L.=B..R...h...w............T..xH0....x...U.....y........3K.Qw.6.T....<r.K......p...zWb.i.b.c..S.&Q...w2K.T.`............_.p.dK.N...#.$.G( .aPd!...9...\|.......W...%\|c...F...7............V_2.a..0.h9.lW...)).....{..6...A$#n.....A...^.m...~....x..>X..4.:(....\|...U......4.4...-......"s!@.8...\\|RO...4....C.......VA.!..5......Uf...J`EvV...t.tW.m.......6Hg.`......".y..h..p.......Rr.$..r........x.<\|..FrU.w9^+'..I,2qW..M..dd....k.....Z...l.A..i..A .r...i..d......h.$@.'..e.z...uIR.m

C:\Program Files (x86)\AutoIt3\Include\FileConstants.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	7061
Entropy (8bit):	7.78163053354933
Encrypted:	false
SSDEEP:	96:8EmJiFjsOxDNtL2e7HOYvqrVGxwWVgFvAgqW4ZQxg/Yi+cBmhoSMerVIqjYtrYVM:lmstBx5tLp7HFvqrdqgPgg5cBWMeBIOw
MD5:	329FAA5526A621A8457AA356F4AABA63
SHA1:	FB3D0B51FAD6231991CA3987C32C41947B596123
SHA-256:	8513FCCCBCCA1D52E17933953ED979A6373F937F9BCD36375F02E9B975A6DF15
SHA-512:	DDA4416138E7C22713F201B6A9E1632C37BD1912E37B023846AF8845DF64B3E92020E38C6A196733C8DE89D73ED341326DC53BB8FE903A4A9DFED0D9C88CF3E3
Malicious:	false
Preview:	.G.t,0:.&h.......=#Oh.8..bp}..w8..$......Ck?..q....@<.e.....t....B5.. ....F......N#...u.[SmO..U/N...%..1.S#.!..j.$..'..(d.\|......R.A....n.....q..r...i.}....).........F~.oT..e..GF.b.... .G..z..`.in....p.."/hU.B...8<..<..4@I..F.W.g.-.p.T...........{.$.J2..7T.V..@D..1cOX.....Crr.YJ......zs....C........t.\.9.....6.h.......O[r.q.f.gi.P...%.<Y.f^.9........7t.......^f.V.y\..3.a-nOE.n.P..1.V...0....eY........o..4kt{0hP........z...N.7..{..V#.. ./G......%.R?....]"5....yg}.HM.....P.I.KD.N.........9j..$N....5......a\....1.+..Ne...Af3.Z.....b.<9q.. ..I!..5....)!]...lZ^.l=....^.._hK...>7......f...-....{d..........U#Y..;t...k..'..n......GA.C..r...g...2..u..b..\j.....aOo...{....Qa...B!..GG..u....A.[.i.:.b..7....'.......O.8.{=m:.QQ..E..4..~....u.@..H.h..r3....T>ocO......Chy...g.).......qFR..W.5.9D..~...-....Y}}...W.....UN...b.5*...%S-.R.<@.!@3]^.M.!`w..E..V..4J.=.....&N.'.<).........05cxr....X..c:....i..,.C.K!..).........Q.....'...p.us..[.i....

C:\Program Files (x86)\AutoIt3\Include\FontConstants.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	3933
Entropy (8bit):	7.899844089081159
Encrypted:	false
SSDEEP:	96:ArcsIp5OaGcIWK3Bde1Zbc9Tpb+9/7jffU5JOi7toofW:RLOa3ILreA/+jKzO
MD5:	688B455A6FF842EBD689960B6A7F4A8F
SHA1:	88D9982B28F90F9F7C610D7871362D0B2EE0CBDB
SHA-256:	A70F34C0E9212D0B3920ECCC4A63B85017F3B9BAAA9AC21EB7D0050725740BCA
SHA-512:	E0BD95EED1285148645FAA21EE51887AE26ED797B309E500D4848CE18A1B9DDBA2DE9AA15151DA537EF6ED1B689CEB8541EF52557D21C648C9CC42B09CC9B676
Malicious:	false
Preview:	.?..\.!.........Ce.d..8....Zn.bA.k.%.........bu..jwe...1.K...Gf...........]..K.{3......fh.H...H(.......d\|..t.tAc..t...O.....`.@...3OP...L..ng.m..~.t.....j..NY...._.A.....h.Z.po..m.n..f.1.@..0.`..l.e....W.MS$H.P........kh.S....f....0...Z.0...%.y...KL^}KDA`2....$.,..=.......eP.1..?.y.\.....K]..v8,......"..)....p.....p.....f/...S.n&......[0...U..X.~.L...+.-...kWC.&..~...#..'......a/..:t4......M.....Mr...A... .`./B w0.^.5T^...K.@..,R_@... .d.B@;.T..w....iO.D...[Lr$,...`l.$CnDtr.oxY}j."O..{S...O+.k$.Ps..:c:..........~A..%.w...Bs.../#+..c!\|.....)\|..D......wV.\M.$.>.o[..0d..,)r......b3..Q.....D..g...n....VY......._V....E4....?..75,.`...:..B...U...tm-C{k...{.[.i.;..U-....aY..........\\.o..X(.g.;.l6.n.Ie,kO"...c.W.]>..E:.....Ux..B$..S.S?..z.O%.e5..>jn.1..$.;..xS^.._..G#...O8......7.p.g...[y.k.9.Q..I....`.....0.(..=.&#J.}..(.8y.Ii.y..hfLg.+..9...;......[.....@N.$.....mokEN.a.ld..JN"..Z.O_..O...D...0uP1F4..........^...~D5...%JG...6...]

C:\Program Files (x86)\AutoIt3\Include\FrameConstants.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2395
Entropy (8bit):	7.817489396477498
Encrypted:	false
SSDEEP:	48:Hhq1C8d5VVYlhT1f0O7s8WZIkNRp2Bc1XooGr0+BRpGiVr4i1NojW:HM1C8klF18LTZ3RphXMrFlGiVojW
MD5:	ECF0795D4F6D515940E3511B8C8C5E72
SHA1:	6E4B872770AB2E26514C0E7F253C8D544E9A9A37
SHA-256:	B21DD070D757196EAD2515703CAF372AC8B86734F2CDF792F36617B3503E6D06
SHA-512:	D622B0A08170B0EAD6A7DA33EBF0912C27644C065B79A4FA8E64876054395B974591EDDC81740065A90AB09249152B7F507F202CA533B1E750E6971738A084FD
Malicious:	false
Preview:	.{[.g"....e......]...)&C..>.q i....eU.+........y...(.........DAi........5[..fd..X..T....XP....,&.0..1;.s.....K.....G..@..5\..).w...{9.. ...&7.x.]..Jw..F.s..L..B..)..]....HR..a&ES7...(.>].8..D.......5..>.Q........P3...?X~.D.3!......IH.i..X[~...5?..r......Wh@.....]....sqM..2.~....h..lr..,........$..T....0y.cpG8.A1j..SR...w...H....xl.o...'$.a.$.o(B.6.c'3.-......D...s.J. ..7...T.I...'.3.....Y.M..Fo...\|DU......X.?Y..Ik..t.gx...........&......j..x..a..R...s..h...#a.=...z.......^X_.^...p.... ..."d..,..!.d..ut./.U...O9.=.G........+.E.Kw.&.W.R.`;...,..c?u..f..5.p"...r..p..U.&\|...c.5V...w..7..T"....+..W[......eeyG.J.&\|..th=h...q.t....e>3.6.?v/..F..4.^..CV...5.......(.O.q+..R\I..\@l.O.W..B5'....z.e.gn..X.F.T..6;.s..&.......>.u...6=.[......? .8@4'k......I.0.pi..iB..c...m..7A...).............y..Q...\|mR..9=.....P?o_c.w..@..H.LM...z._;m..SB.1. .O.Z.2.I9z..;.._Ij......io.A.Fk.....@.n.......^i.C...O....+..I..h..7.Hx....&.V...".....4:.Kv>.. ..V........

C:\Program Files (x86)\AutoIt3\Include\GDIPlus.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	304947
Entropy (8bit):	5.448074872426076
Encrypted:	false
SSDEEP:	3072:aSWHIOwC05EWo2fELCs26QIakIUDcx5Vaox7ZFHjQfzcg5iUdDzJlorVBrd:6HrbQISXBZ2YmYjd
MD5:	5C0304C7D0EEB2FCA7D27A86AC85DAC4
SHA1:	BFD20EEA2D43B1D55015FECF65F1F3088219A0B3
SHA-256:	0AED049463B5B339C79325FAEF122B2FD16B747AE1F8C35BEF294A523819D125
SHA-512:	8A92A11ED005635E25E76F64F5C16D7C07A6BFA9B0F65E76A7969354FE7E287BB4FCA99B01D94546CA7039E5935598FA5257BEB59363975B23D020CEA5B7F140
Malicious:	false
Preview:	jv@.....%{........_"...2...y:..wm..\.../W....g....0..t&..^k5 ....f.s..HyKfH..0.^...<7...H?.f...4T%... 6....\.4..dT......4..=...wj...Bo.4..hk..i..a..a.+...}`.....Es.>.O.f....E. .V......a.:e..w...N...g(.~....6my......6s...U....).@#..B....j.V:.....-......'L.b.Vv..6..]...u....vg..I_Yb.UeDfC@,uQ.........)t.ya...........S~r5..=xKiO.....Y.W.......].I...F.m.......KtK........._......9j.,>.:W...p....k.......l.U.)5.}X."...1..\...D.4.5.PS^w.LW\|.`.v....$6.a.........-W.,.P....p....y.`/T....-eE..a/..C@+.8.2A_@@.F..L..)......ni.....l....c...qv..e.1g0Nn...j.Y5,#....g...q.......%...]..a....^..I...-..Jd.._....A9..kS4..iy`..R`...w......88....Pi.].....*..D?......}.c.-..p..xe.....$..&.....:..t,..J....;S\|Q.]4..s.X.99..q.#.;~4..P..b......1.....k4....OA.d..\|.Knx]I..<....$m..(K...hzu&..P..+)jJ......W...B............K..d.+.N.`...Zw..\|`.Q.-+..n1......\....l`....wX-,.&. 3.._..p.\|=.....V.........._\|....e..t...Y...N.r..-..b.6........Q.m...;g\.....P....1..A..v4`..v'.....

C:\Program Files (x86)\AutoIt3\Include\GDIPlusConstants.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	26533
Entropy (8bit):	6.731180302470053
Encrypted:	false
SSDEEP:	384:lJrnJavikBeOM/59XbWkfV9h9Hq4fi9d95eb2iMY0GU8W5wYnX0:lJrnJHOW59XbWkLhkii9d95OaLGKX0
MD5:	AADC1859D734F2FB6C7727B078B20055
SHA1:	7D257BDDDC6771FF6EBC1BDCEBEEC9B9D8FBE00D
SHA-256:	FA2C6EB8AD9A54D23726F1E4B8D68BBA3646F273DDC242DC82D7B6131C8E5CD2
SHA-512:	343188E4AE66152D4EE3F1AE447D24BF4DCE6A5CA32F0B16B378417A881D45EC36FDF90301E36E088BCE55D59E6E74B954AEDE3AC597981133562B5D8AABA52D
Malicious:	false
Preview:	(...m.~..7.<....6.....ly...#..K..{Qe.?'2`.z.B...fc.$.]m..?..h.1>{...w....ul(......Y.....H...9..XH.+1u....m..........EY.'.C....A...E..}..].MSz.t.Na..".,5...w{G&......w.......%.P..a3_.cnM_....:@.D..4..C)m"....4._.f.abP.JZ.i.Gh..7....&.{..*...L.@SL^6.....(.J.....d..U..V:.J%^(....W.\|].wEk..s.n..Kk.o.l...S.v.k..w......."ce...9.9.......<.&K6.s.d.'q/..g\?V.,m..ZB.".ZJ......6.$.Q..&s.....i......"..6^.#-j...w.@.2j..C.b..f....n.....-.Jf..`.,R.ooOy-.6...r...Q....?...c{gD.2o......9_._...{r.2.0.8.4..t.v.~.>...f..q..n............R.......!..=atu..@..b..L.m...F.P0.H....I:.K....b..y....#.~;C.{.......QN.....U..}..d.\.3(.u#.W.wlL...\c...k!vJL.~..#..L....+..T.G4...3..c.C...y"../.xm.....C..../r$...TQ...L..Pw=m}..^..4A....l@Z.W.S>....;(.%.+..-.H..g..".6.]..g.2U...&..Z.F1...........Q...8&.G.,..O...f.tf.Y.D..o...$z..R.Zb..kLc.]....D.r....WN.pl@.`.oK..SL....9..2....,.e.l^.R.Cr....C.\P.a..t...?.N.^R.=."<.u...m.O.v}..DZC:.,.. ..Rc..P.$..e..b.5w!_....]....t.d......

C:\Program Files (x86)\AutoIt3\Include\GUIConstants.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1336
Entropy (8bit):	7.601585281649395
Encrypted:	false
SSDEEP:	24:rJJybqQQ4KjXcmFQH4dHt6dwOt+XzHYe/ia5FmfHCh+jKbHzeLUWX6sTuElVfW:rJQ+4KYmQY5mRt+XzYe/i/fHCImH6Jqp
MD5:	CFB77F143BCED21E415809F0F7593EC7
SHA1:	44F86BFB25FCBA9E37C2CFD010FD11280F962861
SHA-256:	BC6FFFC8AADAC12140EF1CC5F1FF3306669E4E3BD279249B5EB8540C4902EDF5
SHA-512:	A5C8399083C4DD02B0C96D860067D9A3A462305F1CE9957EFDAB443431E5B0D3E3531AB3F9611A4CB1BC9757C235EA2A6C9C88B3F5B3B240C3E69BF03268E8E3
Malicious:	false
Preview:	.1L(.....E......F.....e.(.M.......o..g....C.....$.U..#Vfy0.>..+.Do....}X.^k...k6.......X...'...}..........A.'Y.e......NG......3.s.$r.{.a"l.jev.......E.....0.zv.....9i...F......".c....l..%p. ..g.......x.M.9e<Tj.z...[y_O...A}..3.....DTm..1+..U..[q2.$.vHC....>P....twu.....&......f.....O.......5...s...\|.r:.#G.}}....Ae.l...df.XV.-?.W......(.#...+...x.}....vEBym..An.4.m.]..~...p..~V..4.)...M..s.%....m.....-.+..F.6...K.1...@.R#&../..A.dQ.\|.JU..8,...aD...+\..].4Kn..@..." ....P6..!....d..K../3.....#.?<.;>.:....Cw~._...Q..u....,...aq.....pn... S....p.j<...p.T[...u.-...,..f:.f..o..p'...lej.&..d........$}.../@_.....$..$.;Zf.@)..L!.w..C\|%Z(Tr{Z..0.^udP..J.X .(...Tg...Q..aK............%S.KN.O...S.]........+V..i....7...P..K..\.K.S..].lD(>.."..G...`<...%~..c(?U........W&...%...O.V.n.C...&.3.z(d)Y.KQ..,...........!...A.sd..4..N..}f!^<.....~......uC....y.<..H(...........J..-L.d<_.[../V..@JV4?..O/./B.[H...e...X$.y.YG..Constants.au3"..#include "WindowsConstan

C:\Program Files (x86)\AutoIt3\Include\GUIConstantsEx.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	4376
Entropy (8bit):	7.90634846843208
Encrypted:	false
SSDEEP:	96:i4LHPzNw1jTBnv+2HLTOCT5q68ejP0YNd+PsW:i4LHPzNqtnv+2HTNqtej8Gd+PV
MD5:	5F488C92D4FBDF7A185B39FD36478199
SHA1:	3335C5781344B16BB9333A661B2B5A2C0D8E0483
SHA-256:	231528F40ED09A4597741999713E77C09C88FD5E283098AA6A842269D6D2F025
SHA-512:	741B0662017602195DB3B04701EA941C90E2C180E6BE93536A4863A828DE06A2C28F02AF1190BCB039602EB1AEFB82F39EB12B90F49BBC9A3A8E0ECEAD2D2759
Malicious:	false
Preview:	7&...HqD.`......W....3..........\|...B?&..U.kd...e7f1.i....K0......=`C..n.@._..H..A6.......+.z..>.M.0f.s...u...%ac.+....`.....)zl......HZ.U.Gr......~gz.?.J.].Z.......l.]..c....TAc.......P.....dW.p..P.1Ti..O............m.(.?..@0(..m..:.j.....e..`..?..%4X......\|..m. $....s......-....Mw...2......k.b1.....C.B....{?.'...Y.!....!..-..9NY. ...V..=.....r.gr..a.7..?6b..r.Nk.. I..xZ6....,..........&..x.2.....\;P..I...<..m.N.S,P..o.$.....fo.N...S.;....n..g.<..$..{.L..-.;..U..l..=M.<.....Cy.Z..Gp"..2.L#4dp.'....l.B\|..I...$.8.U.7.-.2.z...z..c2.7.W....2d\|.&f.3.6....B.EjT..[...q8..7.+.6g.2................b.U.i.C.....Q...c.=..eN.Y.....c.}....fi.~.K..h.....H.bj.....#>........B.Z..k..\G_.1.6d.(;...N.A.>.\|...g... .,....g..<.4+g.MP-C?....\|...h3hH&..F.~L....7Ow.."i..c..gh.{V.q..0>\|...-[....m..\|e..U.ZO7E...,a.}\|.K..^HJ6...)..R...@...T. ...;N(.%cB@...._.k.K...<.W....."\|I..fx.+{..=..!\|Q;]..z.$._.+........U.......)uG$..wk.....L.C.NZ..nr.....uzh.._

C:\Program Files (x86)\AutoIt3\Include\GuiAVI.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	11283
Entropy (8bit):	6.9781585437368125
Encrypted:	false
SSDEEP:	192:nNjdPofqCBGCQGZaNg3d2jkoBv9oVMl9IhElRONfX3fNGf2pfmDPldmf++:Njdwfz1FLQjktMl9TlQNfX3fNGf2pfmg
MD5:	E4FB6C2D90BFBDB871F5913796FE9983
SHA1:	B6B906DC93B410767DC7726C2B3DD6F97DE32A34
SHA-256:	C74AEEEF2C2BFBB279BB6EEBBEFFE4286A120A800AE1C5CE41E8C54164EFC39C
SHA-512:	127A053F6E29EE7FCCB1A3685D18D557A1579133E78C60354D0F0A814C50E8A5CB627B2419B5E4EE926A98E19F9BDDDD10177F3598F7806557FB77A7F4F0AFD6
Malicious:	false
Preview:	4.vr<...+...o.{./..B.[?B.J..?......8.L.R...9.'l...W.4.....{e.o..g.4.(.M...uH.]..@.....>..M.Tni,....Q.&.l..6...^..>N..<.{.....\|..TE.p.EV<......./.........l..\J07....?_4......r.B...c.ko.X>.E....@..)..&...$......E.m.4gR...T...X.?.=.J..B.......x...6.P...'..^..]M.`.>..'.....C.[.....~r..-..W...w....Y........m....I....+..<B....B......6...r...K....l.?t.!I..u....TF..W..tP."+..&N.-1...}....5.E.Pdbk.F&.P..d..A)...r9......>.9.H..]. .0.H...!'.NH..F...E......yhO.B.0E...t.....?..V....Q.@..:.Yyi..2.t.l.9`..1U.V......TJ....?m..j...yS....y._P.Q..{.k.4M.55.[....z....n.'b..9..."i.A._..U...A].....S../9..EX.@...IA.h.."....F<.BP[.r"\|....?....i..+.....9.Xf."....5..[M..J.Rw..4.W[..y..7...X..x.<o..!L./4....UF.6..u.X]........\|1..%.Lcf..Q..OI.....V..t..L.j...G.zn.O]...........z..R.....[iJ.@.y.I..]....]....0.....$q...........6.m.$.......{..JHu..3....0e1.............'~g.?^K.9...../?.k.}:u....E......l..$.O\q....u.q.....}.F.*....W.#q.3.[..:....D.9..\g.C.sc..

C:\Program Files (x86)\AutoIt3\Include\GuiButton.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	28812
Entropy (8bit):	6.137881886964658
Encrypted:	false
SSDEEP:	768:J+N6EknaTZtuH8uALNEqfq9exClixVhrmx5z5GJyIFRhEC0t+B:YNXXghgJ
MD5:	7F3A87094B3B681E1240D963D4D7A176
SHA1:	192AB600471A9484AD1C1A2A3AFFF56E1F032DE6
SHA-256:	10C91AC4811579E9E32BAF2DEF0D8AF86A7B4ED602E2EF6DBF8DC8C8A893FB4B
SHA-512:	1A309EE84C9E7975E6E8700B51B75DFAA74CF9D4CD4CE105F959285F6EDF04AFBD810E52D474FDA88CC58E0D5BEE466AF52993A91EEDB318FC59B4822885E349
Malicious:	false
Preview:	p.BMn...\..p..;.h;0'..vGa.cENH.?E...E......Z!...e...c..$4b@....a\I.jn.\..UQ...G.....~..cX.....?W~..(............n.....d.........e..)%.m .I.....H.......=.2.EB.3...N..(_Zd~.J.e.O..@c.)....#.4....d.Z...5$q...f...l.;..h.N.....)_..=...CV.;Vp.....gZ..\|...8z.. .#.n..<.1oO..x .3Y...efy........67/.1..I~....Z%.#I.......1.#.Q......V......,.5.wB.....j.9S..=.;^,vD...l...a.k.......bcG...B...P_$..7...Y,.};..m..9>.I..C/.f.G._.5.k.b!Q.z2...8....!..j...............yn.._..B....5.q.......X.+.z...7.....g6..z....m..:.h~o...8\.B:...6.l.........>D..[..R.n;.... e......b...d......"..E....6Se..I.!..m.v...?..w...@.........F...R<!\.'...4Dm#//1h\..9..?.:J.{D..F..ZAZ^.SN....}...-..4Z..X.u..#...<.9..V)XdH.=.k..q.a.fil..9....'..>k"...V.)...Ogq.r.h._y....L.J.....=~.8.M..Q@Dq..r..Y......0@S. .pd..qv..3...`4..'(..LT.....\|......:....[.5..o..6..l...?uba.._.\..vm.H...!T\......kp....&4....K.lM.lJ.67rV<.mg.U..C....n.f....z...o..CB...p...W...W..x.g....7.W.t.......

C:\Program Files (x86)\AutoIt3\Include\GuiComboBox.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	41944
Entropy (8bit):	5.724450732115021
Encrypted:	false
SSDEEP:	768:LFtPRw/EoIdiZpL9J4L+k8EsdJA5hbDR/dbq7D+1zVWf8FB4/vK/cp6sODwctYl9:LFtP2S3+IXQm5oAi/
MD5:	0EDFEDF67261A94ADF65CD6BE003430A
SHA1:	DAEC9B843EDFDB1AAF3CB8986FAC335EBF9BFDE0
SHA-256:	DDB229756B6CBF01685C209E09748A0CDE7CA5D69B57F637CE14CEE75B0C8DE4
SHA-512:	67B04EC073505566BB35DA2435D9479B29E4C36531526BC8B4ECFB60DFAEB29B23882B834EF2999717BEACF8FAD79144F1692639ED46EBF3332F5C0709D88145
Malicious:	false
Preview:	!..E.^...<..#...\|TI_.M"&.....:..../_....a.`..>h...+...wO.....).:...;..\|..q.c..GS+..-G...X.......c....(.t....HC;R..z}/.TO.......F...k1..a.....,...A..D..=...GujF.....z..y..f..`P1....UQ..i`.>.s.;g9.HsxT.9u@..m2<..;{.T._.. ...4.4.r..Ns..\|~3`..c..}...>...I.....6..U..DS-.....w;....].S.K...w.lYXc=f.A..J%..9-.v...v....b.oX!........F41y..b..P..v..cr........aSFhUV...d...[Z.7kq.b.._..s.Wg..i.....4.Ll...N.i..9....S.$.qm."$......\|....q.\|-..z.o/..].. .XL./X{.>..ME.j.]n9..ag.').;..........]%..}...R.k.C..5<..;m.eLY.9m]X.{.Dr.xI..+..!...G...;...T).v'.......g..Pe.."..g.@..:.j...F;.....u@....f..Kt.}..O...`...96.\|Q.-.&0I.."0.,d.......i..'.g9.`K..!...}..Ag]RD0g..-.....~3s.kg~l.3.1.....!...#.3.q.%...pl.....1...Cj...u._!~VH.k../...B..y..E.'..&...2!........3..7Kke\0..jp.u.dh.E.:..(...K.....n...h.r...t..rS`G.Z. ...kT......f.rc...F.X...Ukg......#a....N.v6...r.Yc'...._..F..2.....i..9....&9=.i.m{E.......e...5.].GW...J...8.>...=..O.IJ.........[.q.;.\|`.'......I.I....

C:\Program Files (x86)\AutoIt3\Include\GuiComboBoxEx.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	48553
Entropy (8bit):	5.5473848446209795
Encrypted:	false
SSDEEP:	768:hvz1+KvVnuwc3X/1ZOlMoI2ZTQWjLX2ckuzqluCBH6JWKRnDxcb9T6VNHc3XXcb+:51Zvy3X/EEJ7zN
MD5:	4C3DD377EE21906674DDE508E569A680
SHA1:	8EBF59DA87DE9CA3274CB0E6948BC50466645A61
SHA-256:	056AAD9D6E2E8EE4C6548805358168DF568C493D9CDF2EA4B45F332E427B821E
SHA-512:	3348262D8B19BED0D91B101F6238C7046F8920E2FE14E37342AD44E5EFC8DA29488F1D4E6119203F52526431A2D1E5DF4302046BCFC4B26466767B391839384E
Malicious:	false
Preview:	[.n...x..t.s7..s5/j..PK.gI....t.C."."Z.......m.\|2._....H... ...........vI<hm8T.:.sD.@y.x..N=<.!XI6p.Z..T...wd/.>.z...{..r.e...J......![...Xw....S..np.4F.W......?.9.sE<. .q.!....r5D...{..b...j....Ys.vi.%.pz..U.\|..t.1...".#`.U..;...........<.q..z..F.u.#i.z.9.5\....-.%q..=f...S.8.."....o.b..K..Q...Eq..7.......$.e..@..-.T.Y.s}.......[w.}....K....7...;.......i...v.l.A...T..U:......Bd..Zs.1.....(h.........nd.ic8Bn..e>.....f%..fQ...O2AquCF..@^.k.U.&...w6....^.}...S.Y..7.....Ka....E.qJ.....m{J...qlTs..eF...qMd/..`wXI.h..@...~D.DD.I"......`..a..h.!.P.u..q..>0...f.L.~-..H.Y.7..e...1..s......T_..K..P...y.%.1.)@..g.J...#6r...~.vv....n.A.E@g}$..<]!T..~B...o.c.f....... .5p..f$.Q......<y.EB.........kk..Ow.f..n9..ZwY......:q.w.'....>.p.q...6.k..IF....D............c.!..c2*c.3k..t.U[bG....r-..:2....&..X.Rl..>...h1.]N1.).l...z.....b.+..';Ry.......i.7..w..$.WZ..%lD.eQ.7^.peQ'......z...lO.e[jo.....Q,.jV..,.C;G..k>O.S@..f5`<..f=.t7..-.(.$.">.X...0c}...o..

C:\Program Files (x86)\AutoIt3\Include\GuiCtrlInternals.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	7452
Entropy (8bit):	7.700689638023909
Encrypted:	false
SSDEEP:	96:5/RRc+QdzhUx2UE8YkeBojjV0i9qwb4bPHcFM664oF3UpBKRAmnrAos45gKTIALT:zRbQUxJdRjB59qw86SEpBK1XTHO2
MD5:	E082D637901566B5D52B9810435EBA6B
SHA1:	C56F53B404B4B2D218C8ED5D81C4E7047A82C7D0
SHA-256:	A98377AB4A4E808B05E11ECE3F766609BFDCEB7BEC304EAD6A003ACDBF759154
SHA-512:	22EA0E7E689226683AB9F45E8717AD36FD546D4B6995A6E8D5258B0CC15EFC17E3B516F574A0FAF7245500C95F8DB60797AD6D118C370ACBA32CEF1DA1902D43
Malicious:	false
Preview:	.0...z..~_..uR.^<......rz.F.;>.$...0.d.R.I.......`.....b.i.X.O..H..E......+p@..g.ak......J..3q..A.....y........Y..D}..K...1<V....a.?...e.[..>. r(.T....U.(.&D4.;;"'X>...e...!..`z.......".&...3.v....41....S..E.....bv.c..]{.......1\.rF..6f=.....cu7..,..fx...{..@?j#....6...m;e.......l.z.c.TKY...Y...\....6.... ......?...y..QH-...R.}..yt...+..}#f....l......C.N.n@Y../s.........1.^..T...g.b.. ..{\|.XI1..c.cUb..5?m.FW88lx...H.=KMQ.....g.'.8$..+.d.P.BM&..4..f......(...@.\|....;*.iY.IF-.-.%._.........P/2.>..y.4u.Kd.x..8o.R.x...s.RX.E..Ei..J8..........?X+....o^.9.m.]R.u{\|.AM{w.#..HP$.}&..&.W.F.(k'...t... .F6~....X..9..-......sX.u..........q...%5}pb......'.....zW.J._.n......43K...c../S.g.._....4.....m...o...>....yHAy.;&.........D.....Y...GzUr..\|.~..A.[....FY3...D(eoPT........H.>.....K..b..s,.7Rr...3..0.I-.aS...h...!..+A..fz%.....b.,....p'{.2.7.v...^....b....b..7.....@....t1.wv.......L......U...G....-..S..... FWD...F...Z..4....d..@F..

C:\Program Files (x86)\AutoIt3\Include\GuiDateTimePicker.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	14236
Entropy (8bit):	6.700238723716293
Encrypted:	false
SSDEEP:	192:uMkVJA9Q2cmcYImrfHb39oC9kvzN+ph1jRPvYtjY/c49OVX5nPt9GtP5abFXmK8g:mA3clGHbNDRPu2dOTV90P5aRv02z
MD5:	0782C41CECD0820755A7E1F58F97B88A
SHA1:	12A92D7456F8AB067E7A63BC4BD8BF001C7D9312
SHA-256:	54B43A52D61A23AE29DF68952ACF97F10EABC90DF706A6EF60B5B4EED1826D40
SHA-512:	8968CD8AE2BE8A6DE6F1299A9335A18DC4FF13BC56EC3DB0AD514AB5C598E8937F586647A5D86708649FC1B5706D61B388815B2B3EAE6E4213AA495877F306D2
Malicious:	false
Preview:	.Fg.D.\..!...,cIm.e....;4CRM...!...;..x.n......e...,....bd..;.b..y:.e.....9HrzG4hG/.. .TD4..@...;..+.F.0..N(..+T....w.Q..6.......xv..#...xB.......!...s..{.[%R.x.........X....%..0...{.....r..C...ZAg5%t.#.....{...8D7..m].iq...~....u.v...'..}........).M.....Q..d....w.@.d.......9.<.o......+..h..V.'9?._..[...9.......9P...&.\......E...<V?MY.?.0......o..F..m..x.S.......].=...S..J.D.;".S.I..D.,........]........]_..".O.........>....q..\...=...5>....N.M..) 2AqO.}....&....-E.4F......Bp..a.Gd......u...L.;..I........n.=r...#..Bx......w...."$.m&3_.2 .......:..`. CyY......b8...hk}...(G.A.yb[...m...<..G..7...5..4.._...N...J/.O@a........5..bkp..Au. ......j..^z.@.Ca_...k...Sk`f...rY.8...8..tK...=..C!..-..........z.Q...l.hM2.y..j9P\5...?..[......lVF.om.[.......;...sFH&.~...fP._.Z..T.....4...+t...U.gK.RV&.....d.x..B]F.......K:.......J..W...m.!.c...k...S.J..A.}.....;......r.X...f......M.!..9'<R.....T`...I..xl.J^.Ua..I=I..tNF..K.Dpu........g.

C:\Program Files (x86)\AutoIt3\Include\GuiEdit.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	55257
Entropy (8bit):	5.819979172302311
Encrypted:	false
SSDEEP:	768:eKzNf9Zeiiu1KfEbQQQzuONgABHMkii4fTQH8F+vFSA6x/09FyrVJbxWfz9g+NH+:HRi5QQzsNY7Yiqyq06
MD5:	18A523A8A30DC2DBB2575500633733D9
SHA1:	F9FD245EA75088D2B4E8357302FD65627741C1E4
SHA-256:	7D9F96AD8DF4735F34EF4A2C1B8C05BF6A085BAF4DAD1FF5B5902925E0B479FB
SHA-512:	3375C4E716EC28E39FCF90E33C228EBDDBFA61400DDC374DD2D036FCC93464B27A7B99EA160EB793D47CCCA32FD312CA8B433BB7A80AF227E32D78ED305D213B
Malicious:	false
Preview:	+6...".QlW..zDrZ....K7]0i..%^..^.&....H.......w...\|6.....$..<,..ZH%#6.$.P.."U.;}......j.8..M)f.0.I./....b.....a.B._.ejW.OU5LY..}K.zk.Q..+..yI.5...."..v.........u.VqU..>..o. ..e.B..-._.NM.@(Eyc)~;.T._...7..G>B.......8W..O..Vk3Osx.s..j.</.....b..r.Q.....U.M.....k..lD....7...4Pb.z...y>.+..O.P(...+.j....."h.F&.`......\|.y.g.\.<C>.V..s......?.....x....\y.x!..%X..(?.ckF.M.'z..../...^....}..aa..w. N....-.z.bqGRK.I\|L..Y...g.....E.k..&P....e..lc.;},..R..I.Oy.Y.$.\|H..4...4.$.X._.t.U.2.4HA([l..9.....3r8.7{ZeS....?.....m....z.XLF..+..&L.....C?.!;.zI..$.D.+_..$.O........fv....+.&K4..X.o.~..I....6...R-T\..n.J...-..f{u[.S.....p........e.i..1...s....../Bv..Z...d.n..O..Sf..=v......L.....C^...opOU%.W.c..~...rX...zY./x..j.=F.V..qZ..-.]5r..Z.... .....".....\..`t...HF0vyB+i.bp.E<........V@u..)..+....I^..#.I..}6.....t..>..\..3....6^....\|....p'.`...)....#Mxf.r........m\|..... ..J..k!..bd....!J(Z...............s.n._....X.b(37.4*...j..(r.0._.T.Z%..

C:\Program Files (x86)\AutoIt3\Include\GuiHeader.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	41907
Entropy (8bit):	5.766754559297519
Encrypted:	false
SSDEEP:	768:Tz9uJ91X1MyoUE29MYwtNadJ8cPxLteCB0BIzWSZ9L9v5d3E2+cIJVYi7+6nXrCv:nEJjMbiFT1Oc0Y2HuB
MD5:	3AE7CAD662874776530DD9A2ADD285B2
SHA1:	AD8B04F0330B282E5A3A34A3C3D8CF0FD04C7B4A
SHA-256:	FA423501279E0DD22758BD92080167D20C3065D7D4032BCD059281E2CBC9E2C3
SHA-512:	0A4D505495DE3DFE71B745A38936D70DE860BFB227A1AE4C203BD0FB2E136102B9FFD687582DC3CD55BB9106AA1A07075B47E947866E6C5D6C720EBD2D3906A7
Malicious:	false
Preview:	}.%.g.I..7r.....+.....Cc.....,.NQ.e.K..l..i.F.....x{..,.R.....5i.r;9..g...G....~zO....$Tza/./..Pn..%Ja...h.s...E,k9J]..?....(I....5...t5Z.2J..(J..O.......Q.<m...i.P...qa6.q<T..f~.G.b.....#..,..BM.a.n.....s".N....0...<}hJ.vVs.,..a...=s.i......m.;....U~6.....g[..(.jE .n~:.msD.............8..``{K]v..K..K2.EP....b......%.......y..._&.....}......G_.U.5..^._(F.Ns<.t..Gqk.y....m..i.:.c.n.....x\|RER.>..sj....eN.^.v..J.:..k...@.\.S..s.....K.......2.........qY.r^..@H,.Y.k..:,...M.W8.^..&.dDp......u....-.!P.z7Vi.dc%J...'.?..#.%.m."\.&j..,.UUA.......G(....,.d..".B&..E..V^E.+.....].................&..D.H/.m........u.(.....6.......(.t.......hU..@..J..P....X.%...w..h..5..E.c.I\|Y.<.E\M..... M.srr...d.jA.:....k..8N..r..............&zA..7..@.a%Q.......>.\|c.=w'v...n...C<....\|.a...r.D.j.P....X^..h.k.A...+]....IS.0.T..`5M.:T........"n...&'..i./.j`.i[..)R.M..~g.a......)../p...........nI.:.....:....U...m.:.j.zE...........b....]......W...Z8.S...k.C /EO...

C:\Program Files (x86)\AutoIt3\Include\GuiIPAddress.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	12746
Entropy (8bit):	6.7071124394991095
Encrypted:	false
SSDEEP:	384:2GDY5fmlWXiy5CjlululflhPlAlKlklJEZlqNlF02:2sY5+Qyy5uqqNhdY2sJOqPq2
MD5:	FB8296D15D18B26A7A4267DFE24F238A
SHA1:	8B712CADCDC1944D028A8B4FD6CEE5C1F1958980
SHA-256:	1377716ABBF7A02BC7EF919B30A129921F355D79C7D2AF801A862C63C13CF628
SHA-512:	E9DB5993221E365B6A6F6F324297CF36F83238AF7E3C459C703B13E7D8CEC65FDA31594AE71C1F95AA4FFAB588AA1BC99D1F65A0241996FB71167BAD987DDFB9
Malicious:	false
Preview:	,.....S...JC..UT..z.~/./.p.....T.p)..+.W...K@":.'!.,.\...K.a..j`.K7...M?F{z^.`..u=.z.i..~.....\|.....V..:j....r.E....=.KZ[.\|3...c...U...TG..v....K..0.........F.jH7...{.....1$.c....Y.wU.T-....F.(O.. .-,..03b.J.0..U.9_.U..U...Q..A....2?]h..._.7.XsH&T..`$Z.r..(T}..jj..\|.p.....{....:.V..A.[0j5P...lZwbP.....x.OD..?..a3D.nT....h..n..).Q....-..J.^.....e...2..mQ...f55Q.K.~.....6....I..[.J.5.H.V._...........Y.<q...a.8.}<....k...<..D..mH;.-.....?,.v._..o.;.!m..!Pm.Ve{.5.E.M.J(...zN..r.<\a../kp..`...G..I3.5h?..X.S.........+ME.[]W$......2..=.06..;..R.k...&.j..f.+........O...MVh.hq.Q.....Sx...o.....Oo!.E...4..e!....0.....R..]....Ra.x.'.uK....,M......2.t..Q._...O.....3..16%........A..Q@......8cfFY...R.\.j0q..T....,H.Yv.8...)J)..9Bmn.._..HI.=T..i..o..%W...F.HpZ/=6a....aC>.....r........{.b..Sj+.q^..6i.].j^.[.....?.n.......X./m...].0............U.;....0......_..R........c.}....u...&.....#c./.6.b...J8...V-.E..B*Z...NyS+X......1...\|=..

C:\Program Files (x86)\AutoIt3\Include\GuiImageList.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	31841
Entropy (8bit):	5.9924439489956995
Encrypted:	false
SSDEEP:	768:AJvEJ8bM/+xBKvHESI7U5L/CC1oCEXj2twf4:8mWok8557CA
MD5:	0386CC3D1CE6697D2BF9D0FDD8074085
SHA1:	0F4F654E59A5A406BC45CB618830F7BB39800498
SHA-256:	E72E418E3B6ABC305308FBEFBD79D78B9D3ED137177260FD263E28948712ABD6
SHA-512:	F1412DE97802F66D31FF056D5727242D4E7DF8851AA99B05F1162DE6C170380804ED425F2D83007F5BB11F419A5828F86DAB01BC2DB6635561E6D35E552BCC23
Malicious:	false
Preview:	...IF.bG.3........I.j.6...O.......&(g./...H+;B..\.,.....>..-0..q4Co.....W...m~.zj~V..s..Ml.^...=....e..W[@\.H.......D7.O..9.V...].......{1...s..L)r...e..8}k..HvB.L.\.....U.#....9c.U.j.....I9......+.B}..b.wABt..P...o....Z}qxN'....."/.5! e.%+m....0w......G..Df7r+.+.7..<D.pnx.....[.C...sb..6..f4..R .h;%n2...h`A..?8$.....qI5S" ..b..r....J.1^..a....^.YN..)t....o..6...[gM..M....Ro88.........Tlj.......6(..\|z..E....d.=.=u...."...8...]...8.m..........7G"....in.}a.....a.9.+..4#.Y.p.K.........]\....KLa..F..9.\+D.bg'E.oN./O{...)Q;.B.K..#...V...'{.u....\.@... <.CDs. .n3.......7..M.c...uR.y.x...4.)s.4.t.d..x....eK}...&.._.P.*...2g...M...p..P.q.9.y...p...[.n..~. n..ot..I..z.2....T>.6.7V.E$.r...B.;..T~...zS..I\|v.ST...7%..L..:......./K.\...=..I\,R...`...l..J_~...W..<....NtI...t.....p.2.l...U9Cf.FL.).B....2.0_K....P..h......H}.c..d.T.p+.....d..1 .}..q.7.&-T5.J..Y.a.^..i..(....W.tK".....?&.$.C..d....f..M....m.iq....].K=o.EYzp....G....{.Y....^.@..g.Z..#.

C:\Program Files (x86)\AutoIt3\Include\GuiListBox.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	44417
Entropy (8bit):	5.798162585819726
Encrypted:	false
SSDEEP:	768:JbfJ152EESWGSVu1tvyN9aek2jlvpjDYnd8ulZUdE3cyBc/+Z3eH6t7dZb8sXlsi:lRj2/cv31ejSL
MD5:	B21B0B7D4754E73861789E4092C115FE
SHA1:	3AB0789150D3A90CE41DAED0D1308403A463D369
SHA-256:	CB1766DCB5FB5F04ED2D02C8F46BE60B17A076121F58007935F163DBD50AB606
SHA-512:	6672B694D74EF5D31F38EE8400F5457AD87D8673789DFD22776ACC6F1A3C85F25E6D180A95D845241477F4A2BBEA8F4822B58705270D455B76B0A434BC455FAB
Malicious:	false
Preview:	s...WJw.?25.o.a.....x.P.:.$.7.`....x4..4.R\|.\..(1I."..P.....)......M5..u..iG2.....zwO$..W'^.wz.H.TK@n.....&..'..W...!t...."p..mT.^k....3..V...5z&....K...D-.N+.h...................AqB.\|.s.........\.T.p..^..........]....n.....4.R.g{.I.E5".W\|...A..].<\a ....^...w/.hK(.6Y...z.....M$..\|.,.s.p+F..4..a:...#rv....ey..j.4.j..7..~\.).z&.c.fydV...~`"...;1^.........h..cINw.$.w..-...y...v...pO.R.-...Q......O"......t.......#.Ew@J...yhGz...&de..{...85.j.9X.r.H..E.....0tF.S.rC-W.........V....YR.....e.........Ae.FL.1.#'R....`D.Zt..u.K0Ue..^.T..........ra....b.}.U.M....2<.!.dv....V..........B$..y...w&?.s}.&..T.Z.....Z..=. .....#/..y...j..._..m.j.2..~.~......./.8_&../..ZI..6j.r..x..c].....O..2..5.1.%o........@....@t]..v.5.WZ`\M..@Bi...s..{.< e...W......D...l.-...H.7.n.l?..Q.@.....Y`54.......C..P...X....-CJ..x...v....5.tQ..O.x..X....B.R=...MYm..V.....+`.t...O..;x...x.<..y.@....N..$..>q.".Tg#.R.. !2.dH.[KH...p.}..&.s..w..b.B\|..Z..B!.th..qZ"e..u....3.i....,.....1,1y..@.Pm.

C:\Program Files (x86)\AutoIt3\Include\GuiListView.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	196312
Entropy (8bit):	5.649707303100959
Encrypted:	false
SSDEEP:	1536:SqQpQzigSOXsBsrgHaiMaYXcgGPuzgAskWTGWlG23TCHF2gXvI+/uAodPh3GMqfp:uvDN/MaU2T5O3/s529fhTepqFUc
MD5:	172D2593F02124B3E8F1071FF14EDD8F
SHA1:	B92CA9CFFC2517C0FEA8112276D7ACDF35C44AC8
SHA-256:	391EF03025DF472D4A58CD22035222BB4A0A7924EE4D103A5E96949FB268BFAE
SHA-512:	3E6910D4D3A262E29378A1985CDAFA5C22D3E407AA8E0F017D91068214F06F122188B4B30942EBC8857A8A32D1A09CD79CF94A1BCCCC6D6A3CEBF34456D37E5E
Malicious:	false
Preview:	L\K.P..l..u.. ..+S(...........7..;u@.;_"..T..0s...lZ.I...z...../.....6..t.~..>.2j.&!~..q...fg8GO...`...9u.S.6..3)7....."............[..5..F)e.Y\|.e..Wj.3?K....z..Qf.............Umh..q..j...pI..2:x...qx...e.9..E......KT...7...O...6`/@U. u\_.....?rZ...ho........U:L.0.<lu2<.,.. ..-Y..I.7N.z6.l........./...{h.. .)wB..]...6"U.i&....Xe.s/J..rt....qQh,&G....#....W...\.%o."...[..........m...5n.RS)nv..@....F.S...;...S..SP...x..D....2.doLt.7.;9..`.^.WU...f.5.>....W...qM.<}Z.p......Gv...1...7K\].^.u.)`...:.7....+f..kE.(.R#g._0:..^+/...j..T..Tz...H.'2.=&9Xe4[.......z..p(.)aS.I.k&...\k.`C7O&}...9......7@.\|M.;.4C.D{...0"....~Rw.c.5.)."n..s8....z...........i....4&l.J.q.z......np.g.(.q.._....d&.vv;DH.....;i.E=jb......#....rE.....[._....3u.=./...l"y.'_2..i..`1!..B.1..]H..&L......l...HS..?.. \|..t.!..FO..........?;..^i1.. .....(._.^J..F.[...2c..C.0R.m[....Ym..b.j...E....D..$.....d.B.H...}}.v.m.~.p..:... O..g.`'.>...e....b....{..5P@8...oGs@...\.. ..(....

C:\Program Files (x86)\AutoIt3\Include\GuiMenu.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	61913
Entropy (8bit):	5.497516749245632
Encrypted:	false
SSDEEP:	768:lLdOlp4TxoWhwcqALcNtb0TFsV/L+CHyLy06DDfyT7V/ac64/HrdHmPXT:pdOj4TOQqAAtb0N8
MD5:	195875D48AC34885B5704B614F15870F
SHA1:	5E9D4D0527F6DAA8D14259DE45DE69739089349A
SHA-256:	1BE70E7528D3FD04E55E2DC9F4DC608891FD51B4DB299F837744C5325684DC2D
SHA-512:	8588FF29E801176C94A7F921F22C03FDD9EF485F54F36A6711033A1CC5B25D070CC5A3DA264E8CBF418736C580F71AA15B1B76BC2505E945D8BABBAA5D840F07
Malicious:	false
Preview:	#m..'.....g....Mf.0..A<a.L.E.(...6.~u...d.1.7........B.......'FM@....M[..........@....b,c.l..V.{.N.. _PZ....;.I..........v...q..`.7.../@....l./..... 9q.v....1..i.....U.i...D.n........Q.,X.l.C..%.w...... B...cj(iB.on1.. ..c..;......JS.."..";..#N.......g.TV#.]9..K..6.5....}.q...2.........s.S.:(...B....X.+...=....;R..R..'@2.....rR.....E'.4.`..t...P$.....Q..=..BV.lp^..PC.$?.Q..<..........$.HJ..!.....V..pu......dd.I.3...Z).........sF..@:..zb...7....bk.Q..p.0...}.7#...(o..)'.D[."V...u..[.y.u....t...wy...D\|.+.V..b.?..T..#.sYN...VO........._.`..~._.E.6..WL.z ....:f.z8...B...>Y.f...1..A.aB........81.\* ..r......4...H9.y=R......?.j..$Q............M........"5H..b..Y...{L..4..x\.*>.......>9-..o...:K.....7...8}6......D.?ij.X.l..^..?._...b.j.......w....M...)JL..:.Ri.5...S.w.h..4......._..L .l./.-.Ub0..uu.U.M$......jQ.s..;..-..{N..5.3.-.P.o..=Z...m..VNs..9....Kh.R..p.&.wd........a..V...Q..9.....&.W.........V.....]..6'L...8\./..8...C..".,.u..F..

C:\Program Files (x86)\AutoIt3\Include\GuiMonthCal.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	40063
Entropy (8bit):	5.805226275025545
Encrypted:	false
SSDEEP:	768:/p+BkNl1pSgkXWjb2K+xoKB5dFW5XdF/+OpZ3hFxrO51P5qB9pCqvOyeNFahy5:/p2b3E1j/7bRFxIbEy5
MD5:	75C0CDF196B3C0F63CCFF2C3F1E7CD85
SHA1:	4B73E15137CF7DBD2F762679A0971F7D6893150E
SHA-256:	9BF77644FFC9DB21D78966D1F2330B85E16D1DDED7FCDD9EFAAAF228354435EC
SHA-512:	BE5F6CA91AB4A2C38C3FFFED42F63DCA6E80C8EC883124035C924616895B616642CC9E0C0949C5C8F608FF4D6E544241040DB40F7354C0F0CBFB3E343F272BA1
Malicious:	false
Preview:	.....dpH}.)......\...zS].n...b0n..c....l..".q.G.).=.`0?......W..]...~}>r..k............,o.B..L.....e..Rmj.p.y...9.@.'..2..w...f....zGg.>..>Bf0n...1w.DS.9\....N."....4.<.s..^...........}8x....P...(H]d[.....0...`.T......\|..Y.!.1@..B...S...Q.D.bP....".z..\|...^x.....w..s...:.O.1,b=&.^i.2....F.....!...:-....P.O:....0b...H.a...5.'.....yw..A$.>..-...%....X........4d..%.O...N..."...n".:&LV......P..,.NB.-..%<.HS9v....5!.6.L%X.=.S..w\...-...~<.g.R...\|..\|..,..K..`....@y..pM/j4T.!=x..Y.'..Q....X#...kbG.k..&{.....B..t......M.d./.:.l8...~...,..#..(...{X....h.=..\..M..v.Ve..7{(.&. +.y?.P.Sd.....O..ZC..P. d...Q.j......!.!...<Gx...".~:.....o.P5m@2?...B.....s..i.l/...R..... .f$.P/'Q.!...e.....X..$}j[.\..l.dm...V.\| .,.OS..}E]}.E...F.mZB{.:h..w5u.<..=Z.e..9..z.]..Y....M_..`.`..W.M....C.....{deV...b..1}..Y..{.u..Qc.7....z.g.Ah/?.[+..........w.4.4....U:.T...B.).K...\1.R....22.K..3.Ah.......&S...GdOfBF....3...w...._....9.].D......h.A.v..?_.{Z../..0h....J~...O

C:\Program Files (x86)\AutoIt3\Include\GuiReBar.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	67460
Entropy (8bit):	5.566616658547324
Encrypted:	false
SSDEEP:	1536:yCkDcLrLMUyGXSLlCJmDpFxppugVCNb/GBW3Utt:yyLbyFlXdF/1F
MD5:	9CD98B9363421D751B139196420D4544
SHA1:	DD2FA31C325E91E4AA1A99F92EEE12226E671242
SHA-256:	47449740DD18A9BC845143532F5DF2E613346DB65F6B93F60B9546D271BBFA9B
SHA-512:	F00CA5872FF37B5D0E5AD82BA0A333A4437CC4980DFC95A20A56E31A9F8D24AADCE55D1D2E0E28A7A810F44403D4ED1ACE242BAF1EBC5166F995DCB2D9ECAD49
Malicious:	false
Preview:	....T...:l{b.^&..~U.Ch.w5(/..X...}.0>...e.E..Q...-]E...\"...'...@....BO?.............?:<.z...Y.\{.c..=./..FL...B.A......y...7K.t\|..{.....x..s..".L..........mV.o..ymp....S....\SU.......V..q....;R <...GVw.!..#.k.o..U.u4U..>....p.L....v\|..C.fTD..v..XLI.6i.elp#.........3G....kW...I..V%m.^J...!`.........S.....~..4.h...aFj.... .l`......O...,\......5..V...{!.......w...fNO>Ce-.R..J5...?+g.v.0k.....E....W..KO....).....e.9p.1a......86.^..$..c.z}.Q^...i.8Dv..H..$...+....}[`1.h.r5Wt.O....I...Fd..p_.j.~[.!...9.....g..;..J......9.7...m.AG.........}$.......bS...;-.A.i.p.........a<&s.........A..Nq.X.>i/1=....TF.&..c....h.w..Uc].D.Tg.U.....#......g...9.5....9...!...@..x...N.z..:i......9.....cF.x...-..W.e.5I)}....X..u.eI..c}........mF.].m4!s.x.z@`. .lo..L../.....>w.?.."....k4.....[.6... ........x......K7.0....f.......N.u..j.......$.0..3;.C&....WHjXj.v....y.QC.RG.M1...t.........pM.M/Es/Ip.H........@Pv.PX..?xNY..d[...:...,..6?..~.{..~.B.5n9.P........

C:\Program Files (x86)\AutoIt3\Include\GuiRichEdit.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	209316
Entropy (8bit):	5.770781006628221
Encrypted:	false
SSDEEP:	3072:YEXAwhwhY1KDpB6vmpNb3aKrKy+GOvESUx7Ab:YMAwhwhYh+pZ3rX+G3xBAb
MD5:	8401C61EE5C624171D934695C1102B6B
SHA1:	ECA344C9C9C1D0F456F503CCA139ADCD9C381092
SHA-256:	4F0E4B58F23CA2A5F2216BF94603240DDBE680D9A1F8BF9CCD21B0CEA878D98E
SHA-512:	655E9EDC75EE817DD3182F65F22C0E6D102D21B91BC561D0B5444971069BD6F6CBFA29C4CD8E8EB93EC89CAB57F44E024E3E14579794E0A16B65438A2B6CE1E4
Malicious:	false
Preview:	`.{.f.<.....~...h.v..9;%sI[...5Z.H.p.....85D=..m3.......t({Ye..'w....%X_..Y1_..a%.........Nd.b6S....`..j.l..j.!.....WJ.e.23.9. -..(.s.&..Av.$:......q%.\(z..Q ...s..f`&.vb.\|.@.! ......6..=.Q..`..A/....D..\|c.\|.'..TLE.i.6......u......Y;.[9;P....V.\|.....2$.E.....t...a.&.@..w.s......Y}.D.j*u^.C...O.....S&..zmV....x.....'#.a+.IN."..].;.s....d..w..).t.O(oc 5...6l...~...U.....Vr}.a......!.Hrs.Q.b..'..p...G...!.e....r......\'..o.....D...b..~V..k..%..7GW.Z..)..4.ej..nd7.=.\..=o~..+S+H#...@4...v._u9..(..3.w....#v..L6.z...#.DqT....6.M?c.0.>...7..x.'m.....a....OZ9.d.hH.....b..g.g./ko.b>n..........P.!..Z..d.=......o.j\|w..a..'E....np]T....CA...b<..[K...Y.I...#....=mC.9^.n.>..P.0..a0.8.Rq..^...-.....q0.N...d.K.{..:3..)..<..Zr...\|.h.u...F.-'.x.[..].....s.b...i=.........b...a..[..9............?...P?3O..Ev.E]..j..k...{/E.!.-..(:e.@.vB'@.7.i_+...ul......._....H'.s..{K^..@..{7....1..P...S+.M......< .Ba.Kb"y..V..4?P......q..7.fx.......U.........@5...j..

C:\Program Files (x86)\AutoIt3\Include\GuiScrollBars.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	25003
Entropy (8bit):	6.270171038308681
Encrypted:	false
SSDEEP:	768:PgW0aob80zYfgmIpx+q9Mqym88u2P9ksYxTMD:0cFiF
MD5:	0F3C57A2B418AE50CC0E8E5FB9F04AAE
SHA1:	394771B8E2061919682295DAF5C8BF62C9F86BC9
SHA-256:	C36D5B4F13811D40A8E5CF03F910AB7640471E35C97565BEA32408D4CA07B910
SHA-512:	3332FB1D154F22FAA4835EDE3DB15C054A4FEC9A2B13D85B8E4E5201081DAE870DFF530EF9778CCAE1BA98EE123839D2949F07C6988335004EC75469425AED28
Malicious:	false
Preview:	p...ES-)....z.Q.G4.H.SX.j...9..~....%J)_{.`...-?.".V..w.i.._..iH.,.\|Dd...^.CD.......]a.C3....C.{..9T.W....,.].D......!..:..2f+....O2.$qD.l./o>..........Dv>..O..y.<{..&..~".$..(....C..v...6.tt.i.G.`=Y.<.$.../..S&Z.....2..P&~. Gg.M..^s.7..B...p.Wb...%... O.9.O.:....d.w....4<..^[.}H.........J.Y.6c..d!w.@..*cwy...u..O.......ir.W.d.}....Q{Tw..w...\I.E.........V..C.K.x(.......\DE...T...{K.U.A.7..o...>g....f4.Y....I9....]3<.>.L......RX...Iw.$........S....?..=.Eq...^.Q...i+M)...`..X.....2..PG..W...S..TBH...$CIV..$.-I.4......Im-.SY..Ea~.g}..vh.x.u....il.UV.B@..n.......e2.UK..x.....5........q.,..% f..l+.z/..k....0XHp.lYD%..X..z.!.....Is..1c.....b{...[c.,...&.]2w......g=:.;3....2...j..o.8.._..$M.R 5...$..k.'ai...h:..]....7. ..9.n........n}...c.%dM..R.q/...#...2..;.E...?.-...]....0.....J....N../.....sP.&.r...v..)p.\.I.@.9^Xd..l...N?...............%.^..mIn....=y.(......~..i..I.b>K.......!Lt.l.\|.@..8-..1<.<-.4j..../......h.,.S..k.;.....J....{.-6.....:.)qJ

C:\Program Files (x86)\AutoIt3\Include\GuiSlider.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	27102
Entropy (8bit):	5.737596655530509
Encrypted:	false
SSDEEP:	768:1fa+rnGWi++iUlE1RTfHpyNZRfJdNFVhKUhnHVYMF2JdVIcLetKmp1u7j9fV5U2:Jv/lC2
MD5:	A7DC6AFA36DDE70CA53FCD46328E64CF
SHA1:	53F30560867CEE06678D11E0B420B9052DD0C56F
SHA-256:	6450703DDBACBE3807D69501A120CE9405BEB146C998BBE05A2C71C9AD78302F
SHA-512:	310E72CBC23BD31FB1B030CDDA17304C5A7219C20E4DB5191D3B0E5577752F9B31B976A8DF12F8179C8D60B597CBF10F6636580B5043BD580599720B448DA08D
Malicious:	false
Preview:	..k...{.......L..!.;..g.ts./{Q..Sa.^.\|f.E...f..i.%.7.6aX.\R.Mg%.......3he.Q., .~~.@y...5'.&....O.h.'......Z.Q...?.u...!...7..sb.h%...@L.o.rOcp..0Q~..O.mn...{.....S12...w...v.Tn..:y1w..j...2...R.U..K.....5..Us..5$[.U...>:......B?..e....Q(.6d..C..+@..V.~.+..t1.,....n...8-..a.O.o...E..)...tZ...cM..d@.x..s...%D..y. ...x..?..6..........Yv.$J..?+...X-..mm.......R.uL3...0.Q.......i..y..X.H-..s......v.sm5..Hn.u....>......1..h..!.Y..>.>...;=...T..]/.........P.)P.F..Qom$..l..`...2..1W.......;#...#n..#..a.}...FP.B.G..Z.fA~30.....o..(.n.......Phm...r.4.D..y...-N....s.k!bJ.q...S.C.]..5.mvc=..5F_.c..l...6...i#.U...^......C..`S.8.0.8R.Q+.......~....%x.+.bL..Y.}..~.+...W.;..LK..!.25...{..e.....c}...c>z(.9.......M..M.q.~.Q.._.u{oM...y3^...\|.0Dt.w...\/.3...p{U4.'q.V?.W.:...&,q....4....(.M.c...:4...s....p...k..=/B<..._f.u.qe....t..q...n_..C.O.6V..J@..d,.I.}......d.jJj.`n..Z5.......Q...6.<..U..z9.p.-....l#".0.....).R.....#}H..m.,..h....s..U.>.

C:\Program Files (x86)\AutoIt3\Include\GuiStatusBar.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	28792
Entropy (8bit):	6.023847824433366
Encrypted:	false
SSDEEP:	768:qcgZ/6WUkKaP5H0KBqpLLDVSIiQwdR3Kh32Id5wLQyQ08wjK8kvr1+aZ:qJZiWUdUzqpODDnUyQ08VzcE
MD5:	C5B4A32FD22970C3275FEBB4BEA12DBA
SHA1:	43E47727A32E57AA6E8629673E8D3EA25E4B1650
SHA-256:	3BCEC8B319F4EF7D06A4FDA9C58DDE1C0024880E4F7142AED1899C7737DB5550
SHA-512:	019740AF9C95354ADA6C9BCA97EE63372D248200AD424C5A411EC1AE93C4FBDB84DD65841FF82533E3B900D39310859223985E9D27E0AEA8F5367A8745DCDA60
Malicious:	false
Preview:	....f..8..@./IV.O^v...].-.E........N..pN..@).0F..oX.......m.;.E......E..?...]....4p.....e.)hJ.......9Q..~g).LjU...d6w.{...6.Yc.wtb0l..f..c{...J.U..X F\|OJ..(.3..OE.._..U.z. ..o5......[.D.e..e.VXr.C~..z...Y.......zT0.W..Hy:.;E."m..9T.D.....C.T..._8z@..]i.ynj.rE.iV.!.v..5......t...o..^H...U..$o5.....k.W1^R.?.N.i#F..{..P.....:!..../7el...A,.^...TW...5.6...Z4..uPp .b..%...;.....c<9V\NX.... ...........L..Y.b....".6.....D(U.V......+...,`....`....@[...h..[^....$2.d.;...u.G..aBr.......#..?......\|...1....>.XG..l..).......U=[.M.5..z_k.[kX...d:a...g/..m..MG:..T\V.t.@l.0.TpB....=....J..u...g.h..._.,O.%o.&....nb.q.%..0...C.kn-../.;.>../.?..O....r.F%.@C.n.z6/.O......o.m.....[.&H{.$aX..8.5....d.v.@w..9...F..u^/.IM....jB_.Jf..G.3%jIe..S.]-..r.6......d ..0d.0.a..R..[.-...K;.+n. .h.0...4..W.8...)......9q. F.+..........;.H.....}..J....."d.7.x..A<i..W.....d.....w...K.A.\|Njpx.k..q.....$..SP..!....... l.....m..[........h...Uv.q_.#...v.e.....4g....!?..(........&.

C:\Program Files (x86)\AutoIt3\Include\GuiTab.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	38525
Entropy (8bit):	5.810385066868209
Encrypted:	false
SSDEEP:	768:73oFQguKDX62kpJEbOYT0r96TIOS9jUsSedm233TdI+0Nu5GCdGM+URuIQk/iqw7:Ltn2a9jUsXT2E5xGpJ
MD5:	165C3AE38B9ECEFBBE0710BBB317CBC3
SHA1:	AB03DA7D394B0DAA15361924A8A25DDF5A3DB0F0
SHA-256:	6BB485A872469A401D58313C3857F7DAA20944CAF5E84085B712811CA94E98AB
SHA-512:	1084448BC0D4F3F5B8EC96488E6488402BE1EBC97D236A7CADC6D062909DD71CA4872C2E27AA237CCEE1A279D06647ED0EEF79D28E46503E6C245FF05EDA5F79
Malicious:	false
Preview:	...M..v2.V$..\|..Wpo.y..x..]..1.=..?...DD.fD\..}..Jl9g5d.#.5.{Y....i.XP+.....~.......:.1i8...(....UD;...s[s.R.4....r....l....w..C...)..5.U(.....6.2...O.5..5..[R....5..J..{.L.L.h.^,....Y.S..8...~...}./N"bB...^...\|2.....zW.+.+...j0..t./>..{.X....W.&.{9....;...C..H.....<.....Z@... ...'.iq....L....tn.....LA..$...g.\D.T..`.........h.z.....G.?. G..5..\B.F..........^.p....^./.9w.J.......^..P.&\.x.[.wE.....~..H.jvHD..70B3.?...p..o..#..S....$.........L-.Q.}N...\|#...5s4....B..;.......#U..~A.@...At......n.(`.......O..yJ.([..w....8+.....F. Z.?.h.....w...N.R9.xx.I...q.p..K.U.@.#P.@I.....V..t^.K...'...t....y.6!.Q..#"}R.......5..&..S..S?...r.r...01...;..R.6.@.....b..$<...z..W...W?Yv.q....j.X.UR..f...(...7K.....m6.....i. ..>._.>..h..........l...B.g...W...&.Pk8N...........d.k..9.$&j..N...uE..w...Y.....gO..N<..p....K.u.E..{......d.c0...N...d.-...2A';..x.... ....X(.x..N...V.8j>T.O......u.....FLA...5 .....5@....g....$6.hf.Gz...Z....d[..0...:=.s.7{.

C:\Program Files (x86)\AutoIt3\Include\GuiToolTip.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	41175
Entropy (8bit):	5.790285301279427
Encrypted:	false
SSDEEP:	768:abNJI0ru0pZlr6iqGeV6Y7Ov4WJ6RtrYefdEm06pc:8JrT3qHBp7c
MD5:	4F2D6DE091C334DC02EC3BA10D9928E9
SHA1:	4EE0AB96DBE55BF188E80228C586D95B92BBA607
SHA-256:	A7452C5CDC39E6DE1FCBEE7CD3189987B343772D2B1049E9B8543110CACCF48D
SHA-512:	5A28EF2112B2B4FBC4AEE77D2C9F936CA2A7395C41CBC605F28E197E9DF7E3CDEFB0CFC38129914C0E6A23589A339BD1CE7A92024831E75D3F61C4068A20909C
Malicious:	false
Preview:	.J.G$>...e.g...Zs.6,..Cq.p65...`2`kO".o..F....BD\.r.a.FReO<N"...3.'...O....... .Av..E.s...?D&....m..l=....-B.[..V.D....r.Y3.LD.../....&..:<............%$^...\|..0.j.WH...n.Ed)/......F.8t.iu.y.m.<..TNr]J.....^$..I.C..".....^D...z.a.md...._...u$..=...\V.H.k.S.!..].z.,9.....f...-...i..\-...X....?.e..8.h...Nc.0%..<.S.....i......./....,. ..<..^....?1..SH....,.._.h/./.X...$z.....RuDP..d.V.00w....).X............MX.2.!..3...$....f~.I2..L.wR.hZ..........9...X.+.2l..b.w.\S... ..[.#.2E....$.K.Z.......k.D<..t...2........_R...%.]d.$...DJ..I^(?O.q~q}ec.<.&.@.4..g.:...>..h..m.........,/$'.<...;...?.Z^.Y.d.:P.i.?.Zo..OQ.{..kb..."=..h..#"mB..L.(..n....Fz.z_D..Q......{.&.Bs.4y..Vl.o.Yf..`.........>..AX.{tb.p..mC....d.>v%8........:(O.U.&.].....)..~!.F;.2..W..u..v....P.....!...t...u...u..11.....I..........;`'q.#F4V.Zw........oD.~O.../A.#.../..6a..x...!..i.W...s..$.K..T.&..8#.....&:...Ojou...[2@.<.9O.M>.:.:%d.m3...[q..q...(9....r.\|........T`..8.....Vu!.......j...l.5.(z

C:\Program Files (x86)\AutoIt3\Include\GuiToolbar.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	80346
Entropy (8bit):	5.304922647162928
Encrypted:	false
SSDEEP:	1536:z5cbePfkv1vIYflQb0qtjDSFb5wsDfuNC:z4rfSTh8twUJ
MD5:	D617B8F1A060E237B165799964CDB280
SHA1:	A71DB81A5D56A2420E39E9D19F06698E7456137D
SHA-256:	B4839E63C580B19E1DEBF1102846BF84A95399DED11298FC3848D936C77E8057
SHA-512:	D3D11B44E9DD01CD68A89AE3E4BA902C1506FE623411C2C0B551ECC226B673AC29B6A3BE9669E96AAF4C9DD449F69F19B4943BBF6B6356376B635FED22826E17
Malicious:	false
Preview:	g....zQ9]E!...0.b.v.FH....W...Y.x..[...Z.....G.."0.....\|../..Cn.....q.{bst$..W{.-.,...toiAK.`8..hB..AX&....g......lgX. x...."..~.YW......a..8.....z...UM..X.M]3..9..NTN......a.}.c...A.K.E.z:.<......"....y..i...U...4..j...p...r..kU.<...a.....9.T.2..B".3.......vI..}.Oh..5F.{.....=.....(....&.B....r>7..lY...w8.x..j0......6/h.J..........v"`T.....S......G3...9E.Z>."...Rz.....?...s..`...p!,...v3$].!..f..&U... W...c...k..+............?g...W...ZV.r.M1.........T:5~.>..oQK..g...rW...\......q....e0\...d.!...Y.8k..z....U....}'.'.S.XOP.:L.7".......F....&.U.L.1..D.s/y...v.'0i.....ro....2Z%N..O......2.O.D...6d...g...{.Q......T...1js-.l..x...x.J...q...b..h...;Hvj3....d..k.B...W...:i0..}.\c..9.......V...c.H.f.....8`Z&-.[...?.S.._.R.4...}.....g5."......L?Z.k....hI...>..o....l.B..D'o.XM...hw.Y..c.5!......9..1....H...u....nK....._...........s/3!D..]...9 =.F....c...Ky.\.....S....?......Sn.....'.!BEs.B....n#.7.x....i$.o..n..~jJ..SNe....ZqW.L.o...k..i5.!./

C:\Program Files (x86)\AutoIt3\Include\GuiTreeView.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	118816
Entropy (8bit):	5.573163782099614
Encrypted:	false
SSDEEP:	1536:CAHTrRlV57lIiJEOlJnuGhC1xDR+P0HiGy4qAXratHMVI8W9hc:frz76YcX+MHiGy4qYWtHWI5a
MD5:	CEEFBBA8A8DA4919DDB14C7CD75C21A3
SHA1:	15CA0A4B0549291E6AAD8BCD25B436FA72A7061B
SHA-256:	219BDDD5D8A41011E988CC9BB51DE9D0354EDC82271116BB66F1A5FC238A5BEF
SHA-512:	E2511297F4627EDEBBEB2BA54E71237A7FF9482BC95BAA7F995F9ADCA38DB6E4B908CE36AFDC7D8C85D55D72E84D9AFF08EEB99AF67C86D1465B08DB602C3309
Malicious:	false
Preview:	.\.?.i..."..:k._=.51.I1.h.O.n..2..8........d..l....[......aM.j.-un....V)..T.r...>/......uI.D.....&..S.@..>U.E..mF....;.%AOq...=..dJQ.-:.}rm.k....\.......{..m..h......\..\|7.n2.}....w.b...fcb+.K...[.AMv.269-..%"...{L...,..[.y.....>.a/?......=<....7.i._..1,.'&-.......H...V.%..3%.M[L.4...^.r.~..s.NI+...h\\Cn .K3o.2XC.Y. ..V..Z..I..2..../.{.pY.....M...Q.+.A..KW..[......f.me.....d...OPa.uk.>...RG.>...7h..W\|.,..uC+n..>(.\|Y..$....TM........U.4m%.1.y...Gb. .....F7N...r..ilR&./..O..0!5.j.v....uH....)..........g...~....R.m...v{....!..J....H.G...G. .PD..#Y.w...J..zn.d{.n...6.f....h..b.T.....sL0f{...G.q..=.U..i.=....>=.m.`w......`.j..X..w9..$...../. ...,"0%.n.O..Nm._.e..e..:W.......W.^h...6.J.......[eR..#d."..).>U..3..rVY9"...Nk....)...../.j..N@.;.g.l.j.C.X"Gm.R........bwG./?.z..R....2.c+.k.n.i..{........=J.j.....(.1..`..5.+.g.z.S..X.a..]..>Ds.X~....?[.c.}..X.k. .U..\|..hy.....~..$...a.6.. K:.Se.P..a....2...R^%"...6.R+.....?..:DB..~.l`..~W.v.:t..e..

C:\Program Files (x86)\AutoIt3\Include\HeaderConstants.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	PGP Secret Sub-key -
Category:	dropped
Size (bytes):	7340
Entropy (8bit):	7.708701939212126
Encrypted:	false
SSDEEP:	192:pRY8eDttJRPvUEq7dY8frnEbkcDYPK+nJ64KPAJ:M5ttDK7y8frnEblDMKF4Ko
MD5:	BAEC88299DAFD21805A034C32E532B93
SHA1:	AACF0D06BAE45AC8117EF423F45D4BE19D70079D
SHA-256:	4FEC2C0332D186813A3FBF346B44ED44A0BE76FEF949534AA1DD6CA7AC258447
SHA-512:	5BF26F7323CD9CAEF3EE1F42AAC8AC1268D1517FE94FA3FD16CE64A03D70943B8F1D4C4F3F38D47C0966D4C78CF3F041097DC1A4B5B394526EDD08821FB9461A
Malicious:	false
Preview:	.+.{x._$Q...8.v2..GbP..l)w......?oY1[x...#r..{.>\...N........=...........i..P.$...w+.tx..P.:..(.H....[..k.<...>./t....k$.\z..7..$.R.@.F.M............6...#J_Nh..c....../X..X..}]c?.l...".u+.}.2........^..(nx[..nj..._..J.....O.5.c.\n.NZ.^'W.sSL7....E..3..?......g2.Ri.d.F.I.........EFX......X....=.....r.X.x.%.S...%b/.p. 1....8...ZZsrF...>..S...u5.....L.!l...$`..U.E..^ 6.3.,.c.S.rs.)..yg.M~.y$..cR..7.........n..........p5z.~5l.K...?..5......F.....eWCP..e.N.H}.m.z.q.EF...-P..%.p5..5j<...C...4hv..'S.Teq...(.(.S..}..Z..m.H........$..k.L.W...2...].{."\|.E..z.L ..\h9.9.fZ.Lza...-.0;.=..Nw....od`@.../ }yn[l.).ox\....Fv.O!.E.'D.u...L....-.r.2.....=R.tw@...s{.T....<...1W^Q.<.....Y\f..!a.3kO....f.Z...T. ..h.%N....Hz...'.~{..N.^F.{.....L.bN..z.N....w>zV......./..;...)g:.tiX.M....hq.\|o...B\t.9Q9'<..VY..z.Z.S...$*G.F.G.C..._....0...Z ...A......j......n.px...U.U.....N[R.9P.....9...I.vl....56...V..t.T.[._9..2.rf)x#.K..HR"W.sW..$....j0i.2/iev.R;.5...m.d.

C:\Program Files (x86)\AutoIt3\Include\IE.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	153782
Entropy (8bit):	6.015963513608706
Encrypted:	false
SSDEEP:	3072:lEcp0CkzWki7iCWfV0NMj3/DGkis6PQOEH7POhI6bAI6Yff4ORUoZUCUES4JeEvt:rjkKivfVyj9uhjS99
MD5:	0064D3C4C79D92045BDE67B22775AA6C
SHA1:	604AD04752D49700DF49C290B350F9EF51E0339F
SHA-256:	51218413001ADB3A615091659EBB25701A316C2E3383FAC9ACD5EEFD83BA87D4
SHA-512:	C6912468953BFBED82055B052AC3B9D849875B90D714ED0C3EB77214AD0FB0529B617C476CF9D18CE67D13CF78A84C9A07C80A30AEB4D4EE65CCF9C9D3CE58B9
Malicious:	false
Preview:	p.......].42.......ai.oA..:..>2..^.^.x.I.........X..^F\|.lI.Qs....EM.L....%.Y....i.b.F..O..@.?.....,..C..2.....{..Fx...........k.........;.......5P.........7..6.z....._...8...#}H>u.9..........'7..j.z..?..)c..j.,2......#.HZJ.....T\|.]......,Q.....jqP...vR.:IM..8.VPv?K..4.....b.5..".#.\|.......w.v.....Z"..Q.@.=..#..O.>.... `.../.y<.lz...\$yfJ,....Y..L...h..[.s.f..:.@.P.m^..+8.\|cT..h.Cg...f...NS_.g...[....e3.B.i.....}...._.....+.....Y.tMB.P.?.&.K.o.n.z..=..R..y..,.......:..B\|..2.0....,i.kg.N........h..-......]A.9...S...Q..>^SX...9D...(...K..D&k.qN;..9.<..N.[....Xpr.....9.^ ...pnr-w....ta.}.+.G.....!...bt.L.x!.._x..g_Y.4...4..F...u..&...T.P.+h?.........l.....lvmB...w...m..L..@J..^..^R.....C..}.O".....J...T5.FX%@..jXx.h3....o..9QX7.rT.2.9O..............W......u\..x.@.m....W.....m..A.;V.....>..b}F..~...t@m!...N.X..........?...].Ph}`.s..g]A=...A'...c..&...A>.6..].p....u...W...H;"..R.f'V.O....^x..*.@..0.=......._.`..+.hs+.'&....pfV....-Q(..p..

C:\Program Files (x86)\AutoIt3\Include\IPAddressConstants.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	7.690750205933286
Encrypted:	false
SSDEEP:	48:T+2LrimSZFIzW+ENSmJr7Kpfm8ac9q20RW:i2LrtSTIzW2mgV993yW
MD5:	96996D91B07CB6E47C5576290F84AB38
SHA1:	4F36DA81BCFA0F556AFD5D162E046F3CBCD89A0E
SHA-256:	ACB621F054BDB87CCD3837B1D3A2B7B85F6A5749A81106936409C07D53E6DB29
SHA-512:	FC716B1A761B93D5B1EC5999568F18330AA893544F231884313E79089D5F336E57E4C85801944F0D02F1BDF11B6CE5F60F940A913555BA5589AB2B7401E9C2A5
Malicious:	false
Preview:	..o....>Vr.~.b.j.]u-..q!.h....U...;i.aQ}$.....&m.........E.q.-9!....&....b....$F]/.^>.%..i...vS..I_o2.b...z....W.u.].U..D.H../...1.z....%.....&..`.,...D_T'.....7...(.._D..q..U..(i...y...1...zx"...8c...P/.....c.g.7yw..}l.T.)..S..u?....,-.Y=.@...W...I\|To.Q....:.v.<<........nO,n.....RJ..#n..-.d.m...\z..E.F."..q..n?.Z.@....oF.=..O)..P.SR.g.!.....J.,..w(...g....J.6..\|.G..!....1....~...?.%.... .........K`.B.*B.K..B.1f..q..R.`...%..-;....W.0.I..h.x,..F....LA0m.}..T_........'.....{.-K.."<..c.>\|.....l}..].r..(..@V.w.y......../k=...W.W.c..........N,\,.3.p......G..$'....c..t..z..K.....BV"......5..6...>...M.Q.Q7.iE..MJ2&!.!eK.H.0o.C.`Y.7J..O.w6w.[./.aW_.....?p."...!p!z. ...fR.>P...C:S.. ....v.ZG......X.;...Y.......<7....K.>..2H}...cec$.N./0.s.&...mWH9l.9V...2$..z.+.uN.X7......`..%.C.......j{.\.t.....I....IR6...5.....o..i..6..iAOscZC.h!::.DD......lFw.c..).Fb.x..#...C......{.k.nGl.....\|.qo>.m'.J{.G..>...\|.f..[.$f....:.gS....4.F]..,.T..I.,....

C:\Program Files (x86)\AutoIt3\Include\ImageListConstants.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2072
Entropy (8bit):	7.772960243697382
Encrypted:	false
SSDEEP:	48:yEs7VgtWTltk5R80TO1NHi/AWaVn5cHQAScJZD51W:Og8ZciHiYWIneHQqJZD7W
MD5:	027206B3375316064BE35A6B5112763B
SHA1:	EAEC683C2937105540B766D2793762644D20F060
SHA-256:	F6D3F8A7726A3DCFB616EAB9B2AA69EC24136D982423EDD094454748BDC8E187
SHA-512:	063B4C14DD5A322DE76AE4065207BC91AC2D2CBFCFB7DDF24DA887D5211DEEE6794870ECD82A2BBFF3E87782717DFF44DEF9EC6041DC57C290C8668F3A2DC50B
Malicious:	false
Preview:	.~0.-t...ge...h.^.f8..h...`..X.9...".....o$...0..e...\|.:...?....$.:...V,.....-I.. ...D..P...l'...7 .,..v./.I.Rr..p".;....?.%..d...Ieo.B4......?9..M...h...j..N2....;z..2O?3I"8<D6L..+A`..l. ...4.Z...Y..4..4.4.[bXO..U..%jkv.`...w"....%.u..T`..yB..._s.Z.W._9..\|+...G.z....m.....!.3........V.....N.....\......P#fM.=.....Y..xD.pnb...3.,[....;,#..r..n/...Wa.i.......[.`.W68..a@X..Ja....}Dl..aj....a...O...."#s(V....C`.L#1..J..6...1s...>..M.W:.C....;j.QR.......gX.s.6.....ZQcW....G..$g.C...S...Of{.].....Bf1....gZzz5\..b5 H...ow..t....K..w....(R.X.!,..QHZ.D.T$Z;.W,....6C.(..=...H..R+.QxR).....'a...qSp{..eC...&^....S..n...X8...)...b.....Ee..X.?&QKg.w.@.a...C.3.;...[.........;O.U`.5.........@c.......R<....f....d%X.....{y.j...r6.4!Y......iK..c.b......3..D!G.1..v8.(..y#.N.AI.#n...T...........M...$.sj.....nG.t.........8../+..\:../.....A...H.:.7]W..U.g........=..f..CM.a3.&.......8>. .*B.BB.....C..E/....2.&........;.Gl9..t.k.S0.%..U.;....(

C:\Program Files (x86)\AutoIt3\Include\Inet.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	15519
Entropy (8bit):	6.969779577396026
Encrypted:	false
SSDEEP:	384:KPWcflBB5AmT5yUa2Vk/Pmq6xrVpS/weRndt2:KZVAmT5RV+N6xrkln2
MD5:	7D88C2A6C37C47DB4232F40A7E2ADC01
SHA1:	955F0925B9B043F80E47589BF5E3C4102F0FE592
SHA-256:	61F6C39A18F05C5DA23D1562FF1217F2CA6C421275CF3446515C6C1B20316450
SHA-512:	1B3601115F67905AE13E812EE8DAE980D585E195EF81DE97A30D3B36F97A6B9B85A263AA34C4DA5B01813D59D1742F8A021F8D24CEF22EAB516FBFC0FF8933AC
Malicious:	false
Preview:	..P...O{_..-d...Z!.y...:f&-qu..f...[$...Fm....Ney<'#.w.F...U.U%.7j.;....$.<z;o>..x7.e.....G=/.0V...E.t\|p.R\|q-.nM.'H........2...M.)-K..{..kQN.aD....[Y...6....Z-).mN7.n..uF...f...T"(.....22..f..h.i...I......).L".8..B{..f.Z.t.....q.......$?.h..%e....6.%..../...f...FT..`.....CYPp..l.]D.......{..Z.6..n(..m..Q}..G..tU1..aN...6.5....n(.6.2.....8O.A..451Gz.v...B.k...x)w..$.6..Y@{.K.G..kn._).3..N..k.Y.^...N.....K...'@{..n.B.&....<......fV.QA..g.^....x.=.`..+T.R..o....To.q,.....^^=.H@..v.p...FL8E....:.p:....2.....R.>.\|L.k....\. .L.d....^......(..W;.<P>g.}.;....'..\q........s.y:..U...;.AR.krt.p...,m.......E...r....._.m.nng..Jm'H...._.lR9..].....%...*..G...1.8..Q.".......+M..R......z.v..5......4.....h.....0...#..........u..+...NX<.....P;.E.bl....5.&...?A....a..O....y..d0`....h...0. c..V.G"TvVjL.....V....mL....eP,....Hlg.92\|..lI..I..h.J$...~f..-..n#N.t..\|..c..0.rz..U..-.....x.."}....}!.....<S.2..\..T.r.h,.5...El...Q..2[B.._..xp..8.`v},...f^.......B........

C:\Program Files (x86)\AutoIt3\Include\InetConstants.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1623
Entropy (8bit):	7.672542686237558
Encrypted:	false
SSDEEP:	48:ImEb0yjeYSPEnULIX0xllm6AbBqpxzEKZd05W:Je2gX0xll7xz1yW
MD5:	D9F8B04E072E1FD0760580EEDB77EA39
SHA1:	F4F8F322DB900353D3F7CAAAEE90543943FFF642
SHA-256:	C1A5BA9904F6425D7C970F961179A90BA3F053C601574EEF576FD8508993B02E
SHA-512:	65E5ED0EAFE743E6A9F8BBBAF4E081CF28C929CFC01868525B39693BC1BD73EE059D57E2F31F8D63127BAA61D318883DD95E1E291B0F649B8B695D19BC6B1606
Malicious:	false
Preview:	..l.p.xQ.Q..#.....L.....=Yo\1.s..}Q.r..bm.D....8.VE.Ul.YM..3......_%.....Q....@....8.>....f.4X.g....CwD..`....i.h,I.4._.....U'..k.....+...>.4.<......Ry..a..;%.....e....R.y.qi.".p.i.......4>.......o...f..5].bT_:...e...#.....\| .u.y'J...`.$<...\..;.E.....E..-...m$...B.P........\.....%....Cm.K.... $..}Mv.MW70)\_[....m1.&.L1...z.t....dJ..l.Em.R/..ZK{..._[9....,O,R..P......e..=.\|..SY......L......~.YUih.o.-..Mc..Ea........R.#7..,d.....F.S.Y...}x.....wL}ea<[..h]{}.6.1....%..wR/.fpW.A...."z..H...z..;.c..8.(.a.....9p.C.y..9.].{.j.".....PM 5<pz....=....i;@V....c..R..8..\..\pKis...a.....:.^3..[V....7Upf?).j...nbnl..../22.......>GAw.}K..C.......8....-.............9..qf1.[..:...T...r....U...c.s.....h.X).......f..i.[.o..o%/..q_.O.'f.._.....f..uH.,.....;.2;L.C.....icZ.4.\Q../WW.......j5..0yYZ.B..T....:...pf.*..c..#..G.~hw...W....}...........e.U..!4.5.....'..N.s.%...z...!.;...Z...Z.....U.y#........g..D..:^G..t....vl...7..N/.D.\.rWO..p..$@M...V^2..A

C:\Program Files (x86)\AutoIt3\Include\ListBoxConstants.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	5351
Entropy (8bit):	7.927542271400875
Encrypted:	false
SSDEEP:	96:seBBC28NVxCoLv/IMcrdo3OOLX+x8hX4tFDOdam:seBIdNnXLv/INd8D+etSidV
MD5:	240476B2070425CDAB6E1F8993B76E24
SHA1:	0FCD10B8D8C4536D341749D2360B3A3E3E904D7F
SHA-256:	7D6985BD8FFB4DDF02191973231ADFB3304489E52C807677D20A862267D18C5F
SHA-512:	FE40913216678229FBAE92F824165C831C93176FE8CB249D7F8E87C5D54DC650835841D5B05F6039AE0E3038D332DC9EC5FEB2075E991A41B44672CA619E0C2F
Malicious:	false
Preview:	&....\.t.q.L..K......z......5.+.'Xt.:4;.=..^s..+.?.TIU{.A.!..y...s..M...U.M.L.3....\Z...#z.\|...w..O.....D.=}.z=.W.4.U...&;..C....P~....N..)...'Y9E.lj.!"0u.n.."c...q...R.....w....iw...Qy6."...j.l,..$.i.>...GA.c../Ym}...,..g.[0X...%UqZ.YZ...4...J^.....I.g. q^.Sy,..D....+/....n.>p.q.L:..;wY.0.>..k7..&..v..-.j0?.......#..:...l.....s....u..%f/.4.+p...l........c.E.#./..7....i...6.-.]7.f.~...s.qC..'..T#..r.q.^.....RO..?.\|mZ....C.\.."..6..=u..........a[(fx.A...)....~&.........>Ka......Wq.j.X.8....4.7.(..E.,...x.../Kp...U...R..../.@..Ae..'..\.y......M=..Hl..E.k:...0R..'_..`x."..Ew....<.lEi..C....;`..F.b..A.....M...8zOh.....e...t8ne..q_.')u.oH.+..y..-..O...T.d..[F.t.p;..&5.x\|V..1.f.8.:s..P5.c+9C..D1'...T.Z...)...m.u\u..P.......jX.Uja....,.(.{k.w.'5..b......>.I..w4t0....l3U..}S..._4..S.....o9.Dt-.z.2...b%..+..;...7w.M.f.G....XiU...u....".=@&...6K.\|^E...=5\|.M.......l{....If.\|{.\|[..@.....D.G.;..X.X..hO5..uXE..>>.`... .*K...=P....(........Ulv..

C:\Program Files (x86)\AutoIt3\Include\ListViewConstants.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	23547
Entropy (8bit):	6.713624173169906
Encrypted:	false
SSDEEP:	384:P2JpgurPWDNBs3OQQ9teVZYiBjjpGu76lxgVlHLIid7co1WRy8Wh/29yGnJztdWI:P27/r+xB5Q0eVSu76lxgVlHLIid7co10
MD5:	1C7150E7E195C6FA258C3A4A47C177DA
SHA1:	6AB9A1C65EB029212B387BF27C57EA963465123A
SHA-256:	9DB756FF1F5B6528BBD4546A4E3F567D86E8577CE81CA9BBA879EBD3B3CF5981
SHA-512:	87DCFCAD3C2597C41B0E4ACF108C2713C6B39815A3BE543E2849A1D7A97F92F3AC3EDDE1BD7CBC010342A9720277E009805785FF329A6799B3F3ED166F2F1B77
Malicious:	false
Preview:	...P}W....S..1w4...w>...F..C>p.I...b/..A:^.t...e...T.V(fWu.<.P.(a..a.SD...7k.A.0...N...X/.......cJR3..g..'....YM...z....g..\|~5...K..t<..O....J..zD.I..+..ak.H.&?..l....k....3..$p.^"....]h.??<..9<..gx^9....0".....A^........ ..2bS%9. ~..w>..).IN..!...i...i-\x. d.%'I...&......`.%.+.../.&..@=.p.I..9.....Qv._7B.....Ne...(..+w..^.x"0rKMS..BJ.....2.#. ..d.cd...,...%.$..........%.L.........b2<....7j)o..]..S..a....4.(..:.v/...L..D....Y.&!b...... .r......W.-...d...o..:<JZw.d^.g.8.......,/.....Kq..y......].....$}l3.F.k.....a.R.N.....e8.]d.'.X..,.%0gD.........t..(....T.e'.<..n......ay...b=.e[j....#...r.t.[....ba.4....F....(1.LD(..O..I..a(...0......Bm...2...V1?.G.=.P..P.Q.Um...>.BK..3.t..^P..9.>..R._...P...K.....5.h.......5....,.......O...1l..s...`..`q.........W.J...[..].0.....4l...../.d...&.............Z+.A........\s.....I.....M..e5UG....pg\|.k..N...&...H..~.....`9G.......s..2.O.V..V..vt.....ol~yne.e.V..^.+.3-.$.......E".I.sP....)...hK..i..

C:\Program Files (x86)\AutoIt3\Include\Math.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	4977
Entropy (8bit):	7.926488597252456
Encrypted:	false
SSDEEP:	96:KLTnw990uf/g7wVN40dRl2AxRczKHC2SBvyDuWlzicj68QjCW:KPyhf/g3qlncewvuuWlhj68q
MD5:	865D214EA1F9E6D4AF8BB79D958AAF96
SHA1:	6633F6F7DB379860AF8F8ECAE918910B38E288FA
SHA-256:	DC68844527EBD275BF1F99FCCAE794855E6FB3C5829AE35E40FB996D2586A200
SHA-512:	FFBDDF6BDADA3E2B5872216EB2CB7FD02F633125F8B6F77A8C7A23BEABCCBD0141F32686B49336C8E18840B54F65B1B41C793A5F29E3AB6BB02AB5BC5E88F0BA
Malicious:	false
Preview:	.c9o...$~2~.O@.M....'..6.+.jC.....L......D.pE..h..m.;...=<.C..;......t..s...f.......)..k6.l..p.....y.3..R.q...1_+..]Y.G5..w.HqoR.....G...D.~.-E..0&..\[..>-....1..Jq._N7......6n.......}W.F#?A.i]j..I..U..WHU.J.'_{.[=y.2..0........t..'.....6...F..q.or-1.EYP....p.Q2/W.&.....G...l4....D..^.T...S...A..V.$.o...$.n.i.tb..&.. ..O....C.\|..0._s......d.Q.N...B..rh..Q.4.!...u...R.+.....Fj1.)..i..b./......p..q.x4z.b>nG..s...hhCk!w.......Tgm.J...4`.+.p.~..o..7...+.....H..h.p../.9}......d..?../5x"3..&x...D...9...>..R....H.0.....O..`0os.j:..kC.?o...6h.[?.7H...=....%.vT..=...j1j..,.......$O....Fl0. ...T;..a...oy}.98j.."..)....6O..Kc.J.kx..tv.G\|,.>.F.r..F..0.;.6u..c2n..i..k....d...=).4..0.,..R.J&-....\|...S..../j.+.1.n.".H(...a>..z2..y'.k../-...tG..L...F\$.d.......8l..E.r......2[.=.S....!.A.&.bD...5......%E%...\...p"\...(.].rJV&b.f...(.R...\|.P......dw...C.1....%......n..QSb...n#`E.G/i>..^m3,..O....4.._...S....].KC........ .H."~t.....:~.mCk...d@.^..T.4Gl.b

C:\Program Files (x86)\AutoIt3\Include\MathConstants.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1253
Entropy (8bit):	7.5411101188307565
Encrypted:	false
SSDEEP:	24:VFpzaGAMoZIO+6lq5sCHL2Xr+mkKFIA3DyGC8bX/YgKeCaTKQ1XW:VFBVAM56q2+A6mHICu8DAgrTNXW
MD5:	779DECC4745345781CD80FF92AB329DF
SHA1:	1C6E50C199E67D0F39F8142AAE7FE918341C7B75
SHA-256:	449D11EA5797E22CF0E5A8BCE1EEF5382C5EFD271006598B1E8C14B446409FE4
SHA-512:	5F92C9AE5A32A7B41DEBD5DFDCF6D0D1191BC385A4C492C9262C83753B2537AC676EB11AF353F93E1C43C395A09AF31BFD236C8F640369F30197909088E18510
Malicious:	false
Preview:	.&.~.U..y2...F/tsm....N.>&.Z/...}..i...\.7....Xd..,...S.k.Z.z.xUI.~..../AP0X..hxB.Y.o.+."y;@....+.4.l6.<.......x\/<..Fk...9...\.h..L..OCT:3d.I..C.%....:kA..LT.PO.rv.$.n;.-...X..t....$o.A%.99..SW...\|m."..y.. `S..2.Vf8.}.vn.... ;.....X......[..r.,..;T..;;^%..h..2..T...zI.~.s..M.;I/....J....F......`.T..=tYPE.'~@..:..1F.ft,.2...&.[....I?.r.v'9S.....E.....Uy./...uf.h90.5.....c<.2...IIh..X..v.'...mM.....\.=....\....Wb5....W.^.....+...c..=5..&`"UX....a..o...O..!..(<...'N.."9..o..."..>D.........2..........'...'.T".D.D.E.Q....,......8.yp..x;......M..OKh"...b..q.T..M......`l.E..\|....D...O3y.Y.@.g......@......".7..YQ....'..e.{^.w.-B3n.mu....v....l-..(..\|sx..t..y.d..x.M.}.`%.."tG...t@m5(.......K.....mW....pD...XA.....{.rG..Q.fc..V4.dko....n.1....,M:M..A].t@."..\..8.......7.z.....m.7..~...(~~s..ou...E.h.t..a..8u...0k.$/Y........!......?.:.j?R..============================.......:]J,..e.V5...CzYN.C.hl.>%`......7.lX..D.7buB.$....5._'...@....=...

C:\Program Files (x86)\AutoIt3\Include\Memory.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	18511
Entropy (8bit):	6.512344147625017
Encrypted:	false
SSDEEP:	384:W41BXZx5Wu9d5YWduC+UVFdU1uLFD68PHeu3cBYusmjsBG1j8kdhud4es/+g4K:WkXZxHD1Z+GjeuCqCfhud4rl/
MD5:	5BFF63AA63146529F39750AC95C6D469
SHA1:	059CBAE509B730BDC610635B14A512B3F8A79702
SHA-256:	174873554E98BE8B175465B46CDC29D348ECCDAC0C63E00B4E50830F4CE90E0D
SHA-512:	DE01388CD7D1C6D63DC9B9080821CDDF80BC5A1C643096B180B67157317C62B452BA49DCB0D075CB34F9A65CB3B2886DE869B8A931D3B8A42B3BC7D8D8EAA5B9
Malicious:	false
Preview:	..$...R7...u7zi'....0..q.G`.^2.v.....pjC;.....i/..E.O.i-r21.88.5.ZP<..o...9P..r..J...q..W.c..Y...gB.:.....4.c..Ru.....1=&].$....'..A.o\..I...W8\...D;..fW.I..V#....uG.....t..c?.. .8.CD.$.!$.......(...3h....W6<.d. '...n.Oa..}}'.K.3.9{H.....F......6.x..h..;).t...~....K..:.3..r............3...&.w{.v.3..w..a...?....F.`j>.#.o1.h!@.y.J......=b..IO3.4.\..~....o.b..93......}..=..XW..dA../.3U&b.l?...L..U.......[<G!...z.g'.,.0.Y...<iC..4..t.....k&.....hh....Jw..(...k..U.A....".......{s8..J.k.t0..+...>..Z..d...>3...U....>...2Kg.......fXW..DO...)d.9....n.-F.....n.j.lh...jC..@i._.2.`...n......:...a<.X..`\..'.....J'......_..+Dx.>..7....KS..N...o...%.j"..~i\|..>........R.q\.JE3....[.E....9.t.S4:g..C..Fa..).cEkm8.........;?...&2.R%..V)<........oS3s......l....Fq...:...Ea9.i.....`..].{k.Q..Dk..X.knH9..z!.......AH..?..w..E.Z:.......g......t[..SE....Y..Nj@I.v.<...X....k....;}Hj..^...T..NH..<..E.T..]_.F.]?...So.!.Rt.........@. .@.<Y...4.0M".7...n...w!..>lK

C:\Program Files (x86)\AutoIt3\Include\MemoryConstants.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2760
Entropy (8bit):	7.841365698490962
Encrypted:	false
SSDEEP:	48:tvRHsKhWuXgEGn7um4zKLq82yamj9LLG/Lgp711/QanaDxqNUBWuI2rQmQW:tBsKJM7paalLZpBlQIaAuI2rQDW
MD5:	D53D7D69A30F0F865131828AB6D04A30
SHA1:	8E53095FADFE5A7ADB03BDAFA42B4047FC3858A7
SHA-256:	9A427AEB44F35D4E36D0FCF4FD0B2C9E5B4BD5509D70F3C5C82F0BCF2390F80C
SHA-512:	3E4CD970399936C238EC1DB3283630FB41DA8D79FD544317875535D066B03847554F0FC807217A938791DA7387EC53B19B1F84C3CA6768BF6DD5504EFA1367CC
Malicious:	false
Preview:	.....s...\|.G@..0...b..V.f3W..>a.....a....Z.@..H......O..3..aj......Y.......F...s...D.NDR p..b<0.J.(5e..}Q..Ru=....r..heO..ii....y...1m.M.e.......`....ayN.V.3....M.<......^f...O.;..z3..J.....e.^...bW....[p.'Lx.v&..2..U4.;eu.X.H+.aM...$T.O.......X$....E@a./.hk...a1Y......^....;l.EUe.'..J.T5...I]....^!)(#..T..L.N..9...7..^....\|..b;u...F...&H.c6.I.M...Nl..!.....~n..K........$.g.x...p.Z.`'..AD.U.....k.I.....Bp#;4....../..t.E.L...........u...........&...5A.l.\|..e.a....Ul.x..p`:H.5..\......a=V.."S.d..%Q....4.".PfN.N...4l`.~..S...`Yj..).O.g......lwKq.=q7...!{5..:0.:\|..![.......T...e..$<.5.Z/.5kK...[.8..7.Ln...D.%.;.....].p...\|. ].})Q......A.ws..hsw$.s......%HE{k.n..^.t....9S:.A.R.....Bd.2..mX7..m...U..0.B....&.0...~....i..R........y...i..P...e.c.E.........C..0.0...."..2.q...}.....r$..BY.G.%)X..........K>.]....qG.R(.6F....w._..ub..A..P...x.l9O}q4..,.{p2....W.1.qdL.....\J............ C7..W.......&=....Rh?..SC...w:.`............o.C*

C:\Program Files (x86)\AutoIt3\Include\MenuConstants.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	5221
Entropy (8bit):	7.9219702373726735
Encrypted:	false
SSDEEP:	96:1ui882BWKqdE11JEYPvp8B8jUKcNSZCs4jqA9YN7F0tpEA0Hu05ibgDm8tnlUvKW:IizMNH7EEuVN2ChzWN7FcbNzbgDbtnl2
MD5:	D2EF37D9B263E56E293AE1A5E517C661
SHA1:	2A0759D1202326177D126F066898E62660513B5F
SHA-256:	1234AAE79450EF17BCAA37EEC9786C76AC9D15D02FE50B3ECCCB4387850C88B6
SHA-512:	CAF00CD6B5D6DE201022AF07F6CA1389727C9FE1AAAF45005C0300FD7BC0BF11FE5853C446C645A8CAC89F2538E05C8BC2D5E90073394BD0AC2244907DDD6BA2
Malicious:	false
Preview:	....,w]E?.)....R.mJb...."...:.RV...,....Kq ...\|..i.?..K...E0..%.P.....U9..W.X.$".F.R.................xD...5a.w>.....tBj.F......`..8p}...r........L=:....XS....hb;.!T..@.(.+7..?..MU.;.W...1.W.L.L.>.{^....I............h...5SR.....%i...b.j...]..u..E...f@.i.~.[.{..2s..s......bn.w..4k.Gi.....>..XN...W..b..h....d...`.B.^b..<.hR....E....k.Q.'.C.0...\..{}>2...R~"..PpE.74........dD.g .k.~....#3.0n..W(1.`...K....P.kY..d<.[..s.C6.Hq...S.$...M.5....O'?.V.K...N..W:2.$..v^2.{.......sjz.r..uG0.Q..J.s\|t..o......m.t.S.....g@...uE.....n..._.[e.$....H.d..U..P.A.59.....p.p...b.-E.E_.7<.E.....N......6.h..q.8....v.S...em1.s...\f...>^..a..=."..#..Y.v\|..I..H..v.>..L'.6...[....=).g..8....N..[#C..~.)mV#j&.."...z&ST..J.,.5X.........1G.[.....5.....\w.Bm.5m#2..I.....oH...XL..;..f..,.....3f..P:d.......u...c..DDP'G.. .....u.n..W....3....WS/q...o..c.g...\|....G...?....~B!.S..;^Cl......<...:. ..Uu=.8.....8....Ew.*.==....5.=..X...C+e..Y.... ..Q..$3..~[.@]..Y....zG.;._v..X...\.}

C:\Program Files (x86)\AutoIt3\Include\Misc.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	35092
Entropy (8bit):	6.344301897491154
Encrypted:	false
SSDEEP:	768:uW3cSSKLLHkHn/nI1zUdyqlRupIT2oqbU9gnmELB+H24HzFg7:uSCMHQyqlRupITP2UKbLBf4HzFS
MD5:	219CA3EC3081AEDC78C38C0B2CCD724F
SHA1:	D6E0539AE10F88093DD3D5F4C2D52936CFD0D4EF
SHA-256:	D92B9511EC98147F6FAE2BF3B84840E3E6E7E76D63B53B3C07700507AE5A702E
SHA-512:	35BBF89638A653D2839720BBE8A70870AC2DBA1300EB6FFC54E52758D10F18A2EB6953AAD0A1BE64AE2C8B8136053C74B064717FC99ABC99A1FE3EFA301E970D
Malicious:	false
Preview:	i...M.vb.vS"=......Kh.....h....5........{.........rU.&&....&..iu............... ....S.....S...M...Q3&o.GM.....0z....O.f<U.v4.T:C.a....fj[....)+....7.ZR.f..=..quZ.ZN.n.....[.8D..,Q.m.pU."-....\.C<@.....!...Lf.!.\|......cF-......_\|6H.C,D.....Z..x.1?..x~\|....2...p...%.U....e.8.\|...0..ylI..N..a.-...W.......w._h..e...qI.p..y.. ..n.t.IF.H$.O...........B.&..5..$F`.....?...)n.<4.$p...-..x5....5el...\I.y(.$%b[q.%U9..{n..TDqG..\|..k.M....g.I;+.ns....}.6.&...#.(.n6dP.....9z.....9F..E...5.....Arn....o...^4.\V.d.9`...d2o.......f...k.[)..Y..%.\^lN............X.:..B7T?s..W..)..f4^6M.8....M.c.-4.g..Sa...Y...."..uJI..."..2.......DC88.c..8+........~..0.^.G....ud.Q.Cp.<......N..E..~.......=.o.....%........g."..o..!..0\.d..tR...10._...c..U.....p..5.h..>.8d9qzs.....Q..!...U..#o...X.}M.3O...J....S-D.......@.V...%.........l.1d.-....7.t..K..U..L.T...J.@.K..Z.%.q.k.\|.m.i../..RD..k.m.(%1......&.Q.c..f.,...S..y.(H.E6/..."T..{.q.!.6......+...SC.'^...J.,n..0V.5..u?\|..T..}..x..X.w..

C:\Program Files (x86)\AutoIt3\Include\MsgBoxConstants.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	4495
Entropy (8bit):	7.90906635148797
Encrypted:	false
SSDEEP:	96:EO9OpqSlzETuIVsfYxncn1vz7+2xfW92r5aLHPBwW:l/SlJfYQ1n+WrsLH5R
MD5:	7C3CC3909B7310DCB0EDBB55D6C399D0
SHA1:	77B5900273815FE08CAA0620A2B5BB25F20AA9E2
SHA-256:	7AB11D3C3471D33AEC57CEAF6F90D492DF87E60030248B2B42B2EBAB6F7012D4
SHA-512:	7C75217C2FEA1CE464E23E39A1E35733C36DEE1FF7886E0459FFEEDACCABABD15A8CEA4F29F47500E4F3087DCB8150308253D69D9700E942B64D444DB97E05D9
Malicious:	false
Preview:	G..H...{.(.......0..r....@..U..Y...m.\|.R..Y%.<.(.........Q.........}?....p=<>....1.[.l...6.4\..uk.SC..q...e.]...Rao...\|V.....%.6..q.Q..].'..M.+.9b..Y.Fl...oI.>.\|.z..\|.P.C.L>.ok}.D~......z.\|&.L.+.r\.r...rL..!"..E..h...`E..<o.L.R...&T.$.q....[G...)i......WH....L....].].u..\|1.....G.<l..v...=`.7..r.e.t......`..Z...@..F..O...D....t:.......n....`.X.DU.BO>r. @yj.U..f%u..._,....._y...CN(.".bMl..F...m...+.+.4.VV...gX......DD[..X.E.,....._.......,_.sD.w.y..,K.`.W.;...w..c..iJe.~......ep.0....m..m....e;.P..}..yq_.c...H.....]."..o"..Fu......'..1>M.V..q)V3.:.}?,..WX!...D!i.6s.m.O....W.../....:.{.8..3...&.......+r"....,`2H8. ..+.9...\|_...V...=.......Q.\@Or....Y..9.fnE.......W..]Q}."..\|...!E....a...X.K.m..X..Yk/..q8.q....B.. ..q>._G0..{^~+K>..Zv.qK.Z.e.E.Z.j.eebyg.}..F<.,.P.r>...g.n.....F.~...5U..I.%....=k.w..Yw......:...Y..v..xMT.GEJy.]..TYj...,..[.L...4...\|F..M...JPS.........Tx/.iZ......=..........,5..o..........._.Q?.u...d.!.k0...h...[....~-......Pl?.#.

C:\Program Files (x86)\AutoIt3\Include\NTSTATUSConstants.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	241001
Entropy (8bit):	5.921540137560678
Encrypted:	false
SSDEEP:	3072:Uy4ioFh5qeFe+xs7Zo1ovybZ0mddSIyTZu/5dn5pV:UHVrsuSabRShufV
MD5:	970B26F8B27FAB9B9B909740F26AB991
SHA1:	BEAC4FC8FEDE75FEB0ACDC9EAB1B85719E987638
SHA-256:	3B264C59A18D222938462E53E1D4DEB2ED0C8E452ECB2E021746FB8ADDCEE82B
SHA-512:	69A907A1A2B552BEFD959633D070E070DDB7B47A1E4CEAC4DFE339459AD17EFC1954F81AD604C6BD50152203108FC14061CCE66EB3FB14DD1631CEA5F32834E6
Malicious:	false
Preview:	..b..f..Q....v/.S@TP.>q.....f...<.M..)$skU..5?\|...m%H4..a.^(..,..e..^e..]0-"........K......ZC...'.....F(N.0....[LI......2_..J`2\|$.lpr'l........H.1..a......T....m...P4.....]>v.......b...]..mN.....w..9.xo.S:......d..3...-&`\eG1..z...5e..).[.P.(.x.f....:..U...EG.8.c.{L..k..$.;....SX....._TF.$d.NIU..:....R^3,"SOQ...ms.L>fxDS[.......G..Tb...{. S....7....#uQ...^....#{.......@OX.D}=.s...a...H.>.7j..G...\.-.0-...8....VM+...5...35....cH1'.1..v.&.&....*...4.M...z....k.....SE..Vmg...xXy........V.Pf).c....`4)rJ.%]L../.y........xv..aW......h...F..............Z...=..M..(..Z..z6..]+.......dW..#..;J.7....wQ>r\.....0......#.4@G..o.d...P=;.........[....c.;.7.....;"......Ce...h$......NI.!....ByC....F.0.H....b...7`.H..~6.u ..).?C.(.=,..#..N...].]&...q$.sty9)R8@..3...YV.:B.....mx.....U.c.@....`..<..Q%/.p..eG...e^P.............F._.0...K.....2`C+.X..U.^.........P. ...`....!.v..t_....e p....}5.:.t.r...1C..]....s....Q..........-%x"....0........

C:\Program Files (x86)\AutoIt3\Include\NamedPipes.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	14272
Entropy (8bit):	6.844132826784394
Encrypted:	false
SSDEEP:	384:JxnPk6EFv0kmVcTrNr04fDY+GiXpKJt8Avoivx2c2f:7TE+NxhQ
MD5:	22E1F7EEBCA126AAE9D5875E28A69816
SHA1:	E5A3DA6AFF316585114D942C077FE84B523A64CE
SHA-256:	BB319D9E7179DEEAA974BEE75C984037CC082F485120EA7743F54F098C864D69
SHA-512:	DBF8DF071730D5E2E05A9DE0B860868AE79A631C5534F7AC8DB04A39F00236B082D932860C782B714BDCC9D5356DC90D939613B151B3347CC8DCF3001C5D107B
Malicious:	false
Preview:	..x..x..l.......W..v!.Z!......1.e.~F.5D/.2.P.V..+.7.q..qf..Im\>....Q6?#....Y.,..$?......Ue7O...x%.....\...65YZ...5..\|Z.@g..L}..0'..5r..W.}.7.V........61...nv\|......zz..z.5..t....V.2U$r?r..Q....k.........X....6;D.z......@.........S.mm..d...s...... s'3..?.y..9.T..Q..X>.....+.&.....p..C.5..W.T......I.lX:f.p...h..{#......(.....,@W.`..w?!...aL.z....9.xe..f.E.x..&..........5...,...\'..I:...wwc.z....@.....S.....}..)..L9d....L>/Mty9..\|\.d..8.....%'.[.....).....bw..U..H#HS....DZ...!.3...7...I..l...p.....:..:1.H.:%L[....#.e5.ex....i...J.D.gV....h.X..'.....8.....).;J...R..)....(#.5Q...]..>.z.F.O......%.s.2b~P..8.y<y#e..'....$.G...\j@..!.'l...U...u9s\|.E~1..\".bc...l..!uG...u..W95.0!....C...../.w.FC....>.e....w ..w.\...{?Yw.....\...,..Oq.6..].8.....Y........g.Q...[..eH.....-.7.*._..c.y....J.....?.W..^...:..Q.>..A..q....U.A..c..WR.o...xn...F..ww..yx632...u....'.bl...+5............`%.-..q....`z(E<.....s......~...f.-.<..!.......p......\|b...<..bp.e

C:\Program Files (x86)\AutoIt3\Include\NetShare.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	45796
Entropy (8bit):	6.082770787196401
Encrypted:	false
SSDEEP:	768:t96TDZFv1Eq+Fch6Eq3ThWf9sc47mS6EwLd78z5o+8F8yb38KMMj80QN3:v6TDZFv1Eq+Fch6Eq3ThWf9sc/S6EwLk
MD5:	4A634BA3AB4C4C9E110643E7E5AFA12E
SHA1:	6B2597CDF719542A39285A7474C41E207738F763
SHA-256:	58BDAB858C314CC29EC39538F44E4B3522FDDDB0926649E693F0F50EB5802223
SHA-512:	68E7C20354C69797E49701E91FD90588BF0118C4C5FED65B3921083E192F5F0D91AA70511E0D7C9926753AED3D25EFF273A3C00F0C156F23B486735B471504AC
Malicious:	false
Preview:	.,-q...n.s{...0.4u.b.jX...B...IT.O;.9.iK.B.......k..i..P..:T..c.....j.t.Fu\|He...]-..Ag..S.Ty4...{..GP,@......Jq.N.vV...,................W..F.>.....i...3.M....,O..Q....:.p.0.j.T... .\.Q..~3..Bp2...h...'...H._V........w.e.: .4".b.].f!Z...0^.......iS......\._...c./......s....20..b.>...;.].T4....l...i........]z-]..k.6g,.R..zw....RQ(F..i.[.....q..&.T.@r.[u.3..F.Z..X..>..N.....(J..~)...C..u.e.....c.....#:.....;..po.m..".`y.1`?..G...Mv.c..t...3Y......n..O..........Y.=6.#.. .A..p.W.mD.....z.....R./c..kd...w.Dt&...'O...D.e..t.T....<.of..........U..'.kc.._.\....=au.....'...D%...)......a4..<..ao...97..K7......>..(..8...w/...l.?..'..Z...\x.9uQV.^TO..l.s....l....!E._P..w..F.=....@.^...d>......=..=+.w......&..>.J.0."D..#n..4.....'y..FPb.Xs!...r...{e.......P..s...?x.)/l.g.j>.....ZC..L.... .........C....V..L..V.Y. x..._XmS.m....I.A.....3#X..Z.......I.^...E."E3.k .o..YX...QA....Ji_.q.Eg.E.X..T.....h.....+bT.aY..G.....m)=E....'.$..'z1.p1f...$.9i=6.:...C..

C:\Program Files (x86)\AutoIt3\Include\PowerPoint.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	58044
Entropy (8bit):	5.94974984210963
Encrypted:	false
SSDEEP:	768:xTO1ajK8qTr1SA/r6ur+OFu53w1zTWHiWlAqWMccpZi9z2Wvk7RZ9u:IYWAkGWeeTCQBqw
MD5:	A5BF4A27A76ED2BBFCE4A49E8C967B67
SHA1:	6FC7249CF272CF057C048B34573D94DC0DEBA0E0
SHA-256:	1C081C4972699BC5288BD78C8C44B44AE91D671C2C23AE05E20CA14B03100221
SHA-512:	B52EC3EA5A589DD9699E88563250DC8C926345674A3D49258B56368DDEFE7BE76C1E4143BA7765371E6FBA8D9BDCC96A84F3010315BB27F4E0D6840CE3135A4D
Malicious:	false
Preview:	"..F@).q..M...-B?.....5"..TG.\q..[O^)....o.....v.J..Xq./J(\|H...IeX......A_Z...C.....m.di.G...`C..Da~..../(`..A`z.e..MDg..ia.T\|...9.....w..B>M..De...F..5...Pa...18.c......t.~...s.U..@..8. .A.w&[...]C..F..kv.v...Rj;...Y$.2.{.....dN"..<.....c.....JRR.q......"Z.v.DVJ{..N....L.j ..n$..&.3..6.[....wJu'L..'f....j.......fm....9..d.@..ez.(...#m...(\|.......>........15?5.......}....#5To5..a\..).B..v..m.t.....D.-Z.......-,.M.3..-_t..b..R 2.K.[..&.+.cb."..E.../.....z....U.?wNe\qe.2(v6?u......8a....oO.f...X"pi..e....H.R.!8....t.J..8`0...\9A.s.0.....F..@d:.2.9<....b....u)5.!.~..bC'.\..;co.(G.UY....ea..3{EX..Z..5....M.X..h..ym=x.?../;F.....x-(~#..;}#)...Q$K..k.4V.#..?>)_..~.R.d?...a7...o..i.H..........K.`..NQ\./...0.#\|....-..Z..n.Z....o..6...o...._...............3&.\|.lj.YK..x....u-...b.z..a.A..X......W_.....%...w..!.~.._.5.....,.1..<...!..9..5f......EQ....].{M}[Xj)..u.n.e..3..x~rj.n4.......-<s.O..u.X.G..........Yp..V.l....3.Lz.8.T.s..L..

C:\Program Files (x86)\AutoIt3\Include\PowerPointConstants.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	7488
Entropy (8bit):	7.670424137930222
Encrypted:	false
SSDEEP:	192:/m0A6NSHE/66zQwtGSEOQDG2AXogtbLg34lnMPpXYMSoQ:+0A6Nj/vTEDDG2AXogtbLg3Yn+WV
MD5:	BB48CE1F6964179AD98A857EACC540A2
SHA1:	7BEB24CEBC19D1F1E079686D368EC227EF0EF7EC
SHA-256:	3DBA0F35A1B588D898F44FA7E44EB3521ABEA75165410F24F30C51A08287AA32
SHA-512:	4A1D546F3B0EFC60201C6309EE89771EA552565DEE5927F9329EA6E6E1C526ECB6A9AB2C8883DD10C099E9845229DD757FB0F01D103E251F2A15057A95B5FDD5
Malicious:	false
Preview:	.4..........9g.9....$Ii+.v.........#Ch...uc..H...'.k....<+...n..eb.W..Tc4.4~..`8....[.K...s.U...;.L..YQ.f.r..{..H.0g"+...!o...m.\|.%.vgoR..N..R.'0.R..F.......GsI...0.7.n...2.U.....r..j...v.b...mUQ......9.i.w.O...]......l .rw.@...I...GT...!....4...._\.e..B.G..&."oY...-....+..x.u....p.R..N.koV.v.A3.!l.:j.i..aUi.Y.{.i...r.K...cs..`..I........?j.}.e..<..r..iAG..0.......H.a......e.l.R.."..<.^..fM;\|.....k.}sH..5.r.@.g..\|_8w.}>.`6t%..?.p...w..`5....2s....{.%.\....~.x.:..1..d.y..qWt..$....^..D_.N13.}......Q.z..eG..?_..=.W(`q..v....WG.3........~..\|..e.....L.......s....$....5....&X...._.2.N..."I..)g....2f.G..=....X..Oz....(.]...j.1=.]...".Tv........]>^...k.l..U....?..p....'%..6..o3.{....-m....TH(.....H$..?q.%J..$`...~.ar.....r..6X...$..nJ.K....w.}.n..1...C.S.>V..].x.z....B..\|...d.;@;7.....E.i$..\.%.=...e.1....2A~.>....x8.8d:.x.........J.`.G7....L.......OK. ..ec.....4#(P.....9.Z..O....;*........._...U.2........b.!.....T..,.{T.#.M.[n..

C:\Program Files (x86)\AutoIt3\Include\Process.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	4148
Entropy (8bit):	7.913726110969614
Encrypted:	false
SSDEEP:	96:UGLkt4oEJNPPvSU1o8CSzLrBfNoJZ/kqADThECb+n6qguutW:TLaYNS34NfNozkqqW6qD9
MD5:	690B7D90B2F64D71A3EA50B608696574
SHA1:	231C409155BDF785913B605EDDB435602CCD1E09
SHA-256:	09356CE05637480EE5FE1BCA87D03D8535BF24301CFF6731310283169EBD982D
SHA-512:	DC35E23CEF8A682B6FEA2D3FD99C315564F601E8A202C0E38D4F5804567BD7243D8B5C34496F43E5367D5F7CB1D4BA743383535224B4735EF1EC9AE46AF5833C
Malicious:	false
Preview:	...m5..\..l..#.N.ia_Q2.T.V}....^...P~~.~^.(.(..j1#of.e..0.-J5Kd.._7p.../.F...Vf....$"..a.N......t...'Z.A...L....5w\A....fb.....=......y....8^.=S.\....%..(a.w.\|N...;.\|...\8m...y].L.2{Z..P.6...`'Yk0.....&g.&.....`......;..U.pH+f...!?...v\|.a&)c\|.8...b..U......Pf......;......%....{...k...W........5.5b.>.$...^J.{.Y....2~.z0..a....xnP.%d_.G.[..9...A.Y.n.P$DR.w.\|XJ....\..e.D.L9....E.+.......[..+:fs]...j..LU=Na.N.7?..:.K....#..b....1k."y8x..a&..jw8......d"........p..._.C.m.......7.F.Y...C..3.%4.\|)..to.g...y.1 0.E.A.v..'.9....%.......V.KiD....&0.q..........&O.]..M2{.s.{O.rz_...V..~.2..!..,.(dx`..``.^.@...9.?YW....-t..T...w..\|...&OQ...siG......PM...`>.%<...`.B...Q\..".Zgp*oM.......b...V....M~..A.WM.....$.5Rx.+.).Q.N...........~.?..J...,........D...b&a.Z\|.J\B ..K.A.o....,...c.:.O...;...m..B..<W.,..yn.....HU:..#U..E).q..`.8.Y.....~....{6...X.v.........N.a?..].?........2.]..~...........L.7.8$....Y.c....7.....(I...j.Cg\...?./.....#C.XF../.^....

C:\Program Files (x86)\AutoIt3\Include\ProcessConstants.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1796
Entropy (8bit):	7.6801489069533195
Encrypted:	false
SSDEEP:	48:Wyg/1bsQXduo7AEaoY/jthsRYiNZP52iuW:+gQXb5w/jtaRBNF0xW
MD5:	06C412912F467CEBFAA8D5EAC28EA93C
SHA1:	1D1B04449AADE95331D0916EBA4618C288AC890B
SHA-256:	91FEE92F8B86D6689C275A24FE95ECB99AC4D9A1688A4BCE5B08FB84C31D3955
SHA-512:	E943BF9225410921CEDCF84B9C2519070461CF1419200444CA37F907BFC9855818AC2AE62F4BFA4ADE038622FC300D2AECC5B722D048CEB002ABD193BDDE94E6
Malicious:	false
Preview:	.t..+.M..V..:..vi. ~..4.....Q..m..^).b.tR...Jj..8X&...H,.M,.uA.....Yw.-.8...4..Z.5..:..s...../...l.{.w..z..../........6r..8.....v..t.....p...>.f..(.^.4S...1.E....QFJ..n..n..J.:.2.........3..{..>...m......eb\...wNY]Y..U{.H...._..sR...i.=."2..v.....3.r0..Djc[..=..{..x....R......... n..K8{+.x='..2...8'..<8y.h...i.<.F.A...{y....;,...a.........!M1S...-.k..@....b.Z).JE..uF5.G.j}.E..>.P,.w>....k.......(].<....k.P.7.&J..`.Y...<.......)...w....lw\...e.QN ...?.97M...,FCl...!..,.&.d.....`t..z`W.....U..H..7..Do..g.A.1cQ. .S..n.C.#....../....?K#.l..w.....(...4..>.`S.neC.............K..q&vT..iq./.w...U1..J..B.......A..Q9...S..ZHm....;d;B..a..Y...].gZ5......C.t..~.-i:........3..Dy......Z.4=.....`_..mOX..W..g...0T..\.;..N..Ft...X..t..u]....5.g.vRf.o.......K.....HIl.0.F.6.M.=m....O.Q...T..9.^./^"...7h...a.aJ..z.dD9z..G.%u.U.7..".._...[..d.Z.U.u.b.......9c......@......}U.+(....i...a.._..K.aCmg........p....6...CX.\|=a/...v,......d5.[..&%.+$&.....:-.k

C:\Program Files (x86)\AutoIt3\Include\ProgressConstants.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2394
Entropy (8bit):	7.810622332344474
Encrypted:	false
SSDEEP:	48:7RxU0eAcjh6M4jIjD+vB6LGfiKGb/JYQx8rD+gVmW:7RxLdcj0MwI3+J6zKOc1QW
MD5:	44CCD630115739CAADD014065AFFC3BD
SHA1:	C057D0298CA5EB6B4D29F099678D90D31B2FB90F
SHA-256:	F19D84ABF6EF6EAE2A4FACDF642EA3EBD4C6EDF07BC7B76422149DB52B503840
SHA-512:	D0E90C75E5D943ECD5B909C6AE9204BAB02E757E1D92595776E2388836E83AE479931AF5DDEE0BC5585C81428114F5000426ED4C6C4DEE2F87FB47FCDBF2F1D7
Malicious:	false
Preview:	..)...tl^.?h..bC.7.VU.4.S$..^.s......Y9P.5J...?,kb..LX...F2.%.>%..l6..^.s.$GC.Q.. _"..>(...w_...B.U.T...B1D..!.1.Y.6. EjV......R/0...K..;..ns....W...=.....t..~.7.6...`I..+...."..............M./..'..4_....{.1..o.#..6....;r.\e.}l\|4..L......E #=x.5.[.7.C...Y..`<..".DP..oK..#.n..}O...k{....0.......}..t...Ow...X)....&.....iJ'..{a....oTUN.m......;..+..u...gs.t)........Q..t...D....;......"..O.z&.%.(.p..~1.j.. .E....T..;O.......r..-.....].xQ....T\|.I...........#.+V.)....Xm.5../..8.\../."..s...8.F>Z...xO.g.s.}^k........u..x.W,MC.d....!........E....u*E.."...E.s.y..u.9.6V..e.....d..7F@...p.C...P:.f.-T.t.}.a.....^.......Z.t0A.>.:O....#.j#V.....id..j8.....p.6...QWA..}=l.1.R..e<0....& ..s..3..Cm\|...x.Xs}...2]..`.;3...94..n.....f.....t.t1?e..j)h..L.. ..........hp.-.W.#.n.v.8_......^...)...'Fs...+.....G.V.....K-..>..mqB.r.(.}..p0F....(.'.n......../...S.b.jr...H."...{...k.\|........o....;B.R........."[.\..).%....Td..I6...1...LS.\.>:.}.~...

C:\Program Files (x86)\AutoIt3\Include\RebarConstants.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	6746
Entropy (8bit):	7.796816857701536
Encrypted:	false
SSDEEP:	192:/Fqtf8JTPkhHirmru/cv4S35zO30YSmouRJxj5/T:/E8J6irmrgcv4S35CS3gj5b
MD5:	C00FA1D1D05E12F634B447165FD67EFB
SHA1:	65A54DD4339FA625C9A4467CEBF695BDE267EF02
SHA-256:	F920A1E4105AC6B96DC8E5327154BB138E8EB515BFB83D473BAEF1E9BF154937
SHA-512:	091E79B5605B895E28967F516B5E05AB1F24831824B1A31582BD0570618FC647D2B5B63DD0EF02A89BE5236F9B1ECE7F81F3977B1E0269CFE656D138F5B6518F
Malicious:	false
Preview:	.......+"...-+...L.G..f-.ZJ.4).q%;Yy.....r.]..8+h..9pq"..(.g.oL.."FP.G...!''=(...y..I......WI....#..Q..P..._.a..=9MU.Q..........\|o...d..3......)%..L...AX6........dk.ahi...$.-.f...........B/e..k.. .v.W..z..!..1..=.\|.B.tL{W.;...]o....[..Da.q[^5.7...L.J.5.o.se....~....};..O@pR..wA<".]...XF..rS... ...Ah+/Bs.h.J<.....y..Vr.....ez.j....G..........L.C.T.a%.....K..H>...vR.a\|..R.W...=Eq.....K`.......M:..W..{...5..>....%"...w..8...+.<:vK.].E...O.%B....q...'y.A..ir...)x.@..w.=c.)......,.:.w.=`...~....T....V.@&..Y..G..r..u.k,....,.HAB..6X2].-..N.#...a........B......Ib..<&..G.f!j..F0...B(...>.....)L2.r-0...-@f!..=[..E...4.....~....ug..P...Rc\|u.!..y[.....K.7`_o......sG.".\.VV.HRQ....P..g.h.....JTR..qaO.3.k../.Q..'AA.....l...z..y%.1].ED.....+...C...]..4..&...%.E..%V....}....Z..{..9Dbv..!......\|..d..>.f.?.5f..D;.)...&.@.~G.u`.Oz..p#.6k.......P.m...}p<b.X..@5;...[..".'...N.....l...B.........{Y....O.h......W.y..P....NW....l....5......o...&.R?.}<F*>...q..6

C:\Program Files (x86)\AutoIt3\Include\RichEditConstants.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	14732
Entropy (8bit):	7.010182752816697
Encrypted:	false
SSDEEP:	384:crBqw4wtzd+iYHuUpACaa3H4Ejxp3YeNl6XwuvXz+2FR7imFMF/eGASMdGosO:crwwNMBdjj3JaHsO
MD5:	A98EF4DDF960E78B0AF0BDA04A279418
SHA1:	C66D7B7C05D0CD822ECC4DB862269EE103C836B4
SHA-256:	89781306BAD5ED6BF9AD5DDFFF1561E8DDE9C102D4CE02DC0D68C720A7D29106
SHA-512:	F28269F480EDD2680A277FD794683631D3216814019D86B103009FE6095F1879DECBCD44E61503F89B1EB13CB5EC431D9D3356B8E1D11BD497A7C4D8784AAA7F
Malicious:	false
Preview:	.$e.Ry..j.K..o`T.'..`95.{.L...M!Y..);H..<Q`M:....$...#...V..).B.%.q\N.f.~X....F..q[....r>....{Gf..l.lR.gs..O...P ..-....0{A..j.d.)J........PLIq.^...L>..~.\.P..$C..9..pB.<......q+6...u.>.U ..B....;Y.7.X.....lN..\..d.k...Q..{J.."A..{pa....wS1$...8%.f5f6<;..V.y..NS.G.v.....\|a...Y5G\..y.J.=.Cg.n.......4.X.@5...a8..U q....`...P.@.ef:.&.1..n:.V._..>........u......6...U..m_0.P,.>.....VW.4.\|{..T......pa~@.8..[s.p..m.V\|.\.#u..W...V..88,..G..!..4.h...<..u.....`......8.....l..j.}R..]c..W...8.'.;,.>MT.d..........,)(."..k....z...BV.bJ...0.c...D.......P..Iau.H.3..>Z....1.att..W...}.=L.zy.....Y...}Z......2...t.$..x...Mp{...\|...R.....A.y..P9t.....!....e...a.$+]0...T;.,.S}I.\|F..>.;Z..>..`...k..k:G]lcV...../SS`.>_"}+..P...wE...`?.`.3.).....X6....T....qO........D..2A.v27)1..........o.}...A.p....C.......M.z.zAS.....\|d?.7#Y...,.c.Sd.'.L!.G...i5Go..o...."\|H}....c...)8....r....6...u...(W .N.#t`..(0...A..dD7...d\|.\|.D.&3v-..6Q.!......G...xr..Jji.^@.?./...].)S...2..('.\..3>

C:\Program Files (x86)\AutoIt3\Include\SQLite.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	59551
Entropy (8bit):	6.1352735518966695
Encrypted:	false
SSDEEP:	768:nuN3w1TC31AiX7fVpv6/gTggk2iVE47GTPhTTZU+xxgsEvkaBdVbvGz0oxaqPZTi:nuNg1Tcdy/q59O+9QHNvGzJBu
MD5:	7C7EE2FEAE306B74AB32794E19CC2AAF
SHA1:	CA85350BBDCF25B4BCDD9CDABA68212897F1F1AB
SHA-256:	30CB00D354EE316ECE8E4E2895A8B8D9E77B909BF358472FCBBE23F9B60A3A79
SHA-512:	34ADB49889111F2C706D37E541D6A64A380F086BC86AD04309D8115C3DED0B3B4E887D3B2487C0D39D327A2645E121BC20078DCE076D09413E2D67D19C57B512
Malicious:	false
Preview:	q....v*....4..O.LC...........\|<U....G.f.`H...w.R..q.0............-.W......;..#sG.......r .vh...v.q.{)H..n...!..T.'..M-3......<..... ..Q.%<_.../P..<.[.!.r.....a.....Vc.>..U4`...rk.M5...T..v...6V...e.z..k.]YW.G1..6'..{....)h....~]....G(.&2......Fi...v.mDz...H..`.`j.A.}....h.....'P....I.e.~......{....U..Z.>K...".7..kR}.".p...Va....N.m`D........=)..t..?t.8\|.?.Z....~...7......o..{..~...'.j2..k..Bx....P.1....@.F....`......n.p.x[......B...rO..Y.......D..........JR..+T4...!.(.q._t.s...xIKI.....C..=SF<`.].....+..5.Z.%.N.Fb7<Gn.M..4.'.~?j...\.'...~.X`.........a.g-cc&.....;...k..J"t....3.0Xz......aZ.$.,.....sLb..4EH...U............@u......_..{.=/...IO.-..t.W........l".k4sfu...P.-..R..d.4q.....].~.p.......O.eb-rh..e..8'...W..n.....jMK.\|.{.S....?....O....co..:S.V.M.s....%...xU;.,...8,%..6.:..q...i.....{.B........0@.-......_......T.Fnl..B2x.ij.A....s(.^r...r...=R.......X.S....].qP..ci.K......Vh..?...D].....F\.(cN3L.UUA_.n.=s8.>...]m.._...P...Ai..U.

C:\Program Files (x86)\AutoIt3\Include\SQLite.dll.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	624
Entropy (8bit):	6.962570598502199
Encrypted:	false
SSDEEP:	12:v6ALwDapEnFd7SXGJ6URBnFzeYlqKryXOdXyudsj228XuW:v1LwuoFdcUVzHlxue5yudsiPeW
MD5:	E8323AE00CBFB23AFCCDA141DF0D5D24
SHA1:	AE4624EC8B26CFB4F8B53875607480C2DFC74CF9
SHA-256:	EDC22A134B35B55A8F9295DBEF0DEC8F56EADE5C98FF7D2FAF18456211690681
SHA-512:	5E0AAC524B41A4394F61AEED549AF580CC5D8E2078695E86C1970637644C5378F700E659788E056017039F92FC6254E6E013FCB2C5894D5B37A2536E67E4095E
Malicious:	false
Preview:	.G9Rb.&..z...F.s).........7.*.f".x2)mfp.1Y.6....K..~.h....6./. .....^..hx7........Q...J.e7.....Ht.'....Ih.....v9<(:..U.7^6]...i.....FO.R..,0.&....y_^Yjg.....l.C........A.$.1P.s...v.W.(.M?>N.v.,gF...F.d..[.2......yn&.^$..?t.F. ..G.Y........EndFunc ;==>__SQLite_Inline_Version....l..K.6Kt.....Q. lxF.}J.%...v.0.x...\..W.&..L7S..h....@.Hn..Q.)N.....m3..#...ZI.(9.l..!~...g..N....c.bU.L.Bp.:.%E.....n..>.A.....@t..........<..q.=..&"..+.wm`...~..<.8.a.8%=......c...\.hf...O.Bi......................................................................................................Y@....czyzk0zzhil.

C:\Program Files (x86)\AutoIt3\Include\ScreenCapture.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	11357
Entropy (8bit):	7.202527395980198
Encrypted:	false
SSDEEP:	192:j5Fhe7KC9OSNg9iW9WiJrYfZlV3cPIMRN1U34N6/kSpQ59yVNOo:j5FaRcUzW0iJE13cP9N1b4e59wNOo
MD5:	018B8F1A4ACE86EA42F900D0600B6C3E
SHA1:	F085078F5A0C310A9BD5490D3F370443FD696C19
SHA-256:	A19322C13C9620DAAE8ABCCBF4BF1179A8F92634FBB76316F00407CB7425A5C4
SHA-512:	FD50E2758A773AABC1BB09BFA5A5FAF69577A08C96BBD53EAC6DFD889419EED92C01A38CAE33EBEA3BE3074E6EA4F661AA02394B4179A106B2F5F3B7B916FF6A
Malicious:	false
Preview:	....X.......#.K..q\|...-"..CN..j......omY}.uw.....@......O.$]W.h..z....4...(:R~..4.......l.%."...&.$....?...U.?9..EP."U...N.&......~..i...~...._.}....>.@.=.......G.H.QyG..V....f&.U....Y.....[.}.....[...?Z(.m.@.(........`].\.x{....G),a,.7.w.~.....s..Az...!a..(..L..F..k..X..... .[21yEE.._....^..w......Y:.<.Q..rRL.Fhr.6.[.....[.....W....y..0k..H.P...a.8.<.a.q......`%......bg.uz.Ru..U..K_...?.N..w..+.m.vm.1V5.....p..^C....z...~..i.....y8T..._L.w......c.U8.Odzf.........^......h.!...t.B.I....\8i......#o...e..]...v.H.&G.6t.(...V. ./.....J.].>..^.q.y.......[2.....Gh..m...................`Gy.M.9.q]...rp..H.}.........s@..A...Z.2.l....LOo^`....Al..Gg.r.&....,2.-..q.x....#..X-q.....Z.+.."......`.#....%2..H..F..1YKP..6......<...h:...?..Li=......;}.dP.E.^.h.?R.\|,G..1.....Vb.....yD.Q...yg.......D.y4`...K..u.i......;u....+p..n.q./...+5NTC..`.}.~....Y.....L.r.. ..h..5Q.....Q....2.>.f.>{R~o-,]t.R4N:...:v.V..c..P...kL.1..H.....D....7...@

C:\Program Files (x86)\AutoIt3\Include\ScrollBarConstants.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	825
Entropy (8bit):	7.121173847576222
Encrypted:	false
SSDEEP:	12:oz+CYYQgOV+lT5XGJJJZUUK3slt6KL1/BiwuCTe3SyJndk4XuW:oz+CbQgOAlTlGJJhjhL1/BRuCT9n4eW
MD5:	2415B628BEEFC2FDDE05DB800CA08432
SHA1:	EEC17E9E086F3BD2E59F43E680F1F1A9887A9C14
SHA-256:	F370E56C8699B38FF96056A6EBE00CF3CF2002AA5A69CFB14872B2C4077F27D4
SHA-512:	4D231F1C0A6C72D12DA334BC46B6CF5F9B93FCE6D1B536273921A5D4990647162E940BB509CCFA21C85EC3AD1CEB5CA82761A1C83DF9386B8F00530006D230C1
Malicious:	false
Preview:	...sZ..%...D...g.x!.dA(....Mm.2..~.1....k....l!....`...TW..........Q.l.Wn............!...BA}5.NVJ.....{.=...H..=.}.N..0.z4.U....6E.M3....K.YY......K.......T.U...9......;+.+tv.$y7.<).f&...xRT=.&...@..b.6.j.p...\..r..e.4..... R...J;.&...gC..9'{..[....4d.....`....y.&ql.cJ..Z.c^3I...B...=.)...:1..O....._`..BBB.;.....F.<<Zb......_..vE.......e.<CU.W<..{..~.j>..........(..@I.:.9...K..;....Aw.....i...}L.L.66...9...[.....'-..v.]================================================....K...xAnW4.M..9..^W....$./.C..P..a.."..D5.=W.j...jx.h'C.4.\A...$....M.1...,...z..a..GNF........k.\|.............f\^..4...+...3"..{../.X.v...d...$(..p..&q.?*..........I..H.)._e.-.c.C....6.)....,.pS....................................................................................................Y@....czyzk0zzhil.

C:\Program Files (x86)\AutoIt3\Include\ScrollBarsConstants.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2288
Entropy (8bit):	7.773600601501923
Encrypted:	false
SSDEEP:	48:yYgoEp0q/oAn/CKGcIHzPLPz+/VH+Or52pUTJjLqV7Nr11XGRW:yYgUq/IKXW6t+OrCU9HqVt1kW
MD5:	03B3D56DD2733D8CD884D08C546558BE
SHA1:	4BA608DE4714CAAF860414DD480C10B6AF3E0627
SHA-256:	FEF7993D22926F101159E02EF364DDBD413AB1FE17123729191664DFB2E4BF06
SHA-512:	2E7B3ECFEDCD229C12F03A299A8ADDB4DF272126330DBB463349F78C984F73FB00ED0D0B5D10FAE3847B2E864FCBAC1061E22EEC059D56C5E43E13C75F2C732E
Malicious:	false
Preview:	,.t.....}O.>....ue.b.....f.j..z.Iu.O.U.4.;#..J2a. ......x.-...Y...txT...n..."8.7b....p...h..R\~.P...E...,....H..\|.....0\|~...S..XD....h.A.....C.]...[i.....rO^s.?m...B\k.ab(..r3A..}.. .+...Mt."&+.....P..j.\|....W.ovO..th.<.......v......9\j.v.....)]....^d....;z..f.. ..xG.......d.U{..A!7S.......mB......XH....jT......\Zi.....U$.=......X../...<.=U...I...X6.....o;yq..b.......].3...>.pw.k...YM.)#.,..^/1d..e.K.P/.....Xr.J..l.&T....(.T..)O..%.MM.G3)..Z...../X.&c v...{..K......W..4...1.......ox.y..zG..Q.T.$..0x...4 ..=.v.}..0@.Ie.tN...N.o.#.=.D..h..9...tX......#.....PBy{.((Z.<..AE'...u.....3...V-.)h.RV.T...- J.5..mp4.Q3....E._n."..G....,3gF~../..v..e....X@%.v...a-...Kl..n..X.z..k....By...."n.xC.9....f......$j;.f...k..=....oP.e...Z..)py*''....P.n.%7ER..N.a..oO..Uh.]/N-EY{..4...;.N.Z9........p..w.s...,... .A..=.....:.'...F.......q..b_..T2I..7'..o.`.....Q!3..J....h...e.?%!...x.s.I..'......;.B......q.ksz....\.\|.o....BC..-..L..8.O..2.k..M.%.G.T

C:\Program Files (x86)\AutoIt3\Include\Security.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	18504
Entropy (8bit):	6.596132526513091
Encrypted:	false
SSDEEP:	384:nRCDt45eJQ2pynj1Z0IbqtO2P8r/OvAIHLAZaluBjSuPMKrNOMpt:nUaeJQIynjVGdkHaEAQB
MD5:	F3204A1CE9DA406CA701A9E41740DC81
SHA1:	65311D5E7C21EB04A526A55C6F863959A534CA36
SHA-256:	88A1FA6BD275AC02EED6D827A26F8ABE522851C0CFC73EA8E8E6320E18C45E22
SHA-512:	20F9B2C1667029D9F5F720D43CF6316497E17FDF0FA33B69D52192BFC38E8493CB710C3B08AD386B0183488A7088D4FAF0F017DF85BC9FB093CCBEA110172C4E
Malicious:	false
Preview:	k...rr.R..}]./....,,....>....$...9b".....W.......w..^..}.....zYH....NF.C7.}]........x.;...c.>....Fa"0.s....-..8..... X/$..9#p.m.Q)Q.I.d.a.....d5I;]... .....{.DE.4\...g...$!H..{.itl.Z....T . ..... c..yS?.F......h.n?..\<./..e2K..$..@}~vld..S9~..\.....3...R5.".#..2f...?a..xk].H."...[Q}0..L8....F..m.:..QM.8O../...>X+5!.._O.(....>.D.^..c.t.S...c8.:}.",.d.r.h9.Z....UGI..Z..H.^...,..~..8...$.<z:..W...UD...2.t..J.7.[-.=..n...v..W\.I@.!:8...V.$?..e........i9..>...l.~.C.~4..T.....}..y\|../t.>.@...u..W..`.B.;.ue.].IW.#..._m.7..._........\i..w....f.T..Pa/..S..G.~........y.....B..V{........eC?...Dp.+.<..{..... f....B.N..1`.g.V.7ze9...4.....Y`.2....N.D.f..r.......jCt.-..1.Df......&.?.w.....^.....!.l).....l...N.t.h....t..!L.."....\|d...Y.=1.../..IZ.0B....'`..].......8.(N,.E........qVP.1....FE@.....U.....!<B....~.Yu.i..R....;`...\|......E.............Y!...........f_..;..{.....:#9\|?..h..Db..3......t..PY...[...`JA.A.[....Ax.y.J.cd.....\|.[k

C:\Program Files (x86)\AutoIt3\Include\SecurityConstants.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	8474
Entropy (8bit):	7.590457332260737
Encrypted:	false
SSDEEP:	192:eUiaH2NHX9+yABVpyH3MZwezRK9TzIJbC5YfWNgfLsn+f:6NHt58OMZ/RC0JbIYfWqf2a
MD5:	A97984CEEC65E1A27DE9005724E9C5F6
SHA1:	58EBF9E0FCD7593BA3063A97F1F3ADD9DE5943DD
SHA-256:	040472BCBE85AB2C5133743FC5ED0D95A48B6C068EBE26EC555F7BF09833E41E
SHA-512:	372CE8981F75F6A69FE1983731C6FBFFD85F79CDD467166203BFDD39DF1E6CBFA5067EFF26AB01104B50BD4313832231CE2F237B9E110197578F5373E4C2F4DA
Malicious:	false
Preview:	.9>....I......... ..f.d.........}...7..FY....n.2..o.....7-C.....^q3,.R\|..w..8g...@...U.,ez..c.=kx...Xja.T-A/(.L...Y..H$O>I .t.T.%.../J....Q..&...&.5.E7..I....6..hjd...\.4.....z.\y.Z....k.....S0....^q.!......l]...b...e.w.`.[..M+H.a.e....G)."...~..db=...#yiB.R .....,...@`)@~.....1XQ.i..C.?-..v....J..\|...\|...b%..cd..]..../F.:.av.G.Q.i..CE...(E..#Du.~.3$R\|.._.&.78g...sQ....s.\|{^...A.A.9...l....O3P..(.k.[......pO.c....}.9...../.^...ab....$....Uc.U..Q...Qo>sd6;..O.$..^<k.@I..$.ZS.wy.6p.~\a.....\..W/..98...C..`...%n..P:L.....R!..mh.@#<,.ML...+2A.P.)M...{F....Y.N/~..0..:n&._HW..XI1...h.zE..<. (.7d+1.J..F...r......;.J].F...rN...TA2..={..E...zx..........z.^x./gK....Z...5..o.@..b.C....=.f.j.db.=V..2O."?.....B.mV.k..V.kP.O=.I....TC.q.4g_...Ra.<....'..Z..v.-....6g)<......A/...M`>k..N#.......{....FhL..&....zd....Qs......_..4..X..KP~&j......D..aM.c!O..z.CH.@..w.X6......X.z.....o.]i.@...i.{..x6.).$.i'..............k.....A.<W...K..(..._FG....qZ.n

C:\Program Files (x86)\AutoIt3\Include\SendMessage.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2695
Entropy (8bit):	7.83596107362881
Encrypted:	false
SSDEEP:	48:MN783duzLRQ75cOn+moI9VtqbcULIR/chCy1a+gHb1MdR5NW:vdu3eNcOv9Vt2/Lcc8yYHHUnNW
MD5:	A8850D4AA2E8F27AB488FFA2E4597C65
SHA1:	A8DC659B17B0A6C86C8D3E77FB45181D189E5F7F
SHA-256:	7A9D8DEB02754DE9B42FF94423E19959B285816B315AFDD9CD8E7890FFADC148
SHA-512:	7C2FB2BD7634C1CD39BCC7F638050D88D3A739FC99B08D8B55F06D66FF19CEBF48A9C07323AAC4A37F870AFCF238448F98C9B5EF7DDBEFC372863063B255B22A
Malicious:	false
Preview:	.q.Q.<.H.r..3....!a.9........&..vT..yi..+pB_4Z.\..1..uF.g...F..N..]E..V..5.1}.\|d.?.Tj..cZ...Fm.\...V\|.F5.......y...A..dm.....i2...a.X...q.2..ioN..W.i...j]3s#.UHx..mf.....?.1..[..m~I..X.La...~.^\|=.Q.B.7.t...4..."..eSu....=W.B67K.bm..=g:..8<.I.....]P...Zl.>G{..w9y.....:nVF...]..d....6...b.v.7.Q.A....$.E9...=..b"......wQ0.2`.....J.Jh.<..c....yl...O..h....H..e.CuaN.}..e..h........M..yJ.5..ka.....=\|f.:....k.....t.......3.k............dp#....1..V..../,p.........`....G...^ .xhKw?7.....z..:...!.{.G.#.W...fB...a.H....K..kq3V......o..g.A..)`.[.......;t.B.5?,j.."...com&.M.!.Jj&!.B.G....J&!....x....u......H0...=."&2.3.Z..a..x......un..g/..ss...&....R.y.V.&..%].M.<{."..S..V3.Ft..9A.T...;..Lc....Q._".5m..Z...........>....).~&$...3=@./..Rs..j....M.Mz..m...}@.j$...#..E.....v$.2d......a].j?...Zc._.T./.....[...N.4.!Q...D.6.>..R.u#@...[<J....1........t....R...+ O..kx:..:.1..B..p..@9;W.#....E.a...iv.^xb......F.U..s..?i......K..\|..Z..l....h.....p.5.

C:\Program Files (x86)\AutoIt3\Include\SliderConstants.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	4591
Entropy (8bit):	7.905044690470411
Encrypted:	false
SSDEEP:	96:jpKoU+6CF6Mctc1g1WtmBPHshv5LkpvRUeTx6qc1XtDYC3664o8BW:jkl+6CF/6cqYCAymklq1Y466f
MD5:	A306EDFF020CE71EC72B0E0FBD5A667E
SHA1:	A9DEA48CA630354AA37323FDB2577645E48C2FDA
SHA-256:	22FD6F440327186137E3FF2D8A7C067C98B4C17DC5FDCC0104BA849AAFEBD4E1
SHA-512:	6DAA6D4A95A5DD08FB8A6FF35A8292F3100A4E86D552B69E60A7DC4B7FFB20A4FC96EB2D3A8DB5558EB7A48E2248AAE3DE3DAF0DF4E917F405E90F18D2D09AC2
Malicious:	false
Preview:	$`.p.5.OV#....H`...IIjh..^......T\...n...J...a!.P...Pv.]..!....z..E.m}c_....h.\|...@.X...<..2O.W......sZ. H]..\|....S...@..UQp...`n.F.~.....5{........0E.....cl{...6X..i..Q....fO.\|d..k..7...q....R..z........&CZ......_AtL.y..V.a..D.....4%rl.....{nB..k... ..,..>.Uv..M.1.x.&.2..}8...+.{..Z.).&.ZB...7..0...4......).#./F..i..fI.G.EI.Y8.=..E..7....".~RCn...9..j9.^...`5...di...}..".......8{.....4]..ea.n.....V.j..j.4I....P...bSm.Nj.........(L.3tp... ..E..#..Z W#G.[R.....i._b)FQ..)f!@q-..4..Ji...............g....O2....]..B.>..?.L!@\|.Qb....i...)b.OB..i...R.i.I..kW...........vH_. ..7bQ)..].Mo.0.}h4..C.........a....1..=Y....V.p..2..........yS...?...yfV..o.......X..#.......'..]..p.... ...N......]}}].+q,'...Jax.3.e..BRC&..\P.....)...e.0A..5....tl.!........v(..3\..l.L]......!..y.w........h0......,tU.A.%..KJ..%S.D.##..^n..V.}..P...7.$h.a.n.?..e.L,.=....Ntl.i..&7.w...?..F.,..bV+~S.F.xf.y..2.:......\.T...PF..6...\o....\V.!:fT.\.U..Zg.'....E.9.....q.8

C:\Program Files (x86)\AutoIt3\Include\Sound.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	23281
Entropy (8bit):	6.455173899378815
Encrypted:	false
SSDEEP:	384:d91MF+gNwLDYZQl6pBaB1bJQM1uoykkFj0LbdjBwg8YoaGji4CBo:31wWPncfmbJBuoykujcbcYs6Bo
MD5:	F1A10BDA2A9A2E4AC3957BB974F793F0
SHA1:	1BFB7FBB3748B6627E27C1C8342D29CE4F3B6411
SHA-256:	F9F4688C6B0930F7A5B5B196255717B548C411D1DED81126CFC94607EB2070F3
SHA-512:	F2AE1D88A5251E380439DA14D486C935F68E7F49028AA5A458391B9741413BFC294FBAD3FAC7555DB25EF2512180B8A6ECECB74590A6A21952E4018F0C143802
Malicious:	false
Preview:	0.7#g.5\|u....S....bE\|5..,.w.>P.Y.....kB7...@....co...8~'-.jrWN..-.E...z....5. (.....(.9I.h...V..(.....#.....#.'.@..S..z8\|..)sC..]...t.A.......mBu.".5.O...._.L.kv....8."...G\>.W.."....1...$......I.G.."..Cc^q...i.A..7\|..B..2..f.-..S..L[..D%~.^ .0..7q..lm.........3qL..x/O.....:4..0.t.2...#.GR..^..$.l....! .Pv...(....,F..Z.U...r...O..,..]..0."....7...M..,..~.}.{.(\|L...C.2..d..S./....\.=./.v....e1.p.t9.M..~.O.e..-".W.q}...,<.L.M...'...Zl...1..V..c...!o..w.].PPBx}r...j"}.....w..o..Q<.&.<....../...Q...5..ah...+U..8@.?}FL.'.y.O..Vf....z.A......Ya....q..Tf..b....5.a..!.!s..ee&.0..O..JL(R.Q.X..i..!.Y..g".m...;-nr.....9#.....$..R....l%.!.T......u......K_..u.2.V.].`r.'.$I....Ty.sK.v.^.K.5\|.!.....t..g..#;.>0t....Q....._.gC.r.=,..<...%F...F..8L...H..(O+.`...2.u..p..+b-.....m(.?..Sjn...0..gx....6U+.2c.#.....z.`........*......J9...e......\..._XBeen..>.O.8.9.......U(....8G<5K....`.p(...tI.nD,J;r@#:.V'..=]cV...t5.".-.No5N..{..?vL..Q.O..&....j..i.

C:\Program Files (x86)\AutoIt3\Include\StaticConstants.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2304
Entropy (8bit):	7.758900086546648
Encrypted:	false
SSDEEP:	48:sinagWc/x9EEgbrPkWpAnIz7leA6U3ABdBij4YM+W0LcY0nbpW:DnZW4CnMIzRcigscY0bpW
MD5:	CDA410CF9733E45E6CD01CDA64EE97BC
SHA1:	96DBE517082BD4D599250D130C6568CCFA21D13E
SHA-256:	A33132A0633BB78D9AF75D6FB26A1399F9E0A827F7F1162A8AC7764E11848819
SHA-512:	322B3322FFEC19936524EF41E8B04164A536A689A2904AB4D08BC3BBEB2A328E01C761E1F4A5B9F7FEE645F63FFF9CD5C2B6AC07E57073746699CD0D72E96771
Malicious:	false
Preview:	......(.Qb.{.$.c..T.2w..+.H...]....S..o.F.M...`.9..b..4.;.2x.].}`.Fg....u.kiG.LB.._P..d.-..0....U..6.oJ7)C............V..8JA~. U...6...@.fr6...Z....)^Wk-.u...U#H..!...!..........+.)..Sp,TT...4Yu...]b.'.{..]q.Q..X....Q.7.]..z.....&...oz.P$h.n....Qx..Y.&t...]..J.8.W.C%......*....'..m=.~i;.u...d......?....IV.J.Q..DR. $.\...?^,.m..._M...eP_......p..g.....,3'.^j_..=..S\~v..........Zp......n.O..{!./-\|.k)C....u4....Q..?JK. F..4.@u..c?.).K\|..........`....Q.l...p......_m..../.ig.2{.m.......J..R.<...B.wCg..p.{..n..}....u0t...!5d..........y;]l..z.(..{.]..<..K.5sy..Y....w_...s..N....XcRV\..i-U.....G..........d.6..>.&P.K...........a.x.Dy...;.~.:...]...$.0.s..7....r..Q.z.@.Y..D..Q...... ...eo}oYc....x.....bj(.S.<.....B".2J\...g6p2L.....z.s....Ep...,...#EHy.c.Jx{.;~..H...2....:.Nv.Ya.J.cdU%....8V...6.b..E.....K..n.A.@..!.`.\.mz..j..V...N..$..C...I.X..m..X.2..T..^...VU.u.)..7.{.,vMOM...y...g+....Z.E......=....&.]4"6.B..7..C.P..Q......`D.]..........E...{..b.Vv...G

C:\Program Files (x86)\AutoIt3\Include\StatusBarConstants.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	3543
Entropy (8bit):	7.891527485761587
Encrypted:	false
SSDEEP:	96:N3JHxLuJuilZV6qKBWJ5bt4Z7Dk+VJ00/7DFW:NZHxLuJ16q0qbWRQ+702g
MD5:	818620088DD316D78430BF241E15201F
SHA1:	0C19263D4C62DE2658C9113587FA624E500F83A4
SHA-256:	39A55D385E00FE65BA134B2D57360C6D205A7B7F3432643CDE83661C58326B20
SHA-512:	4D732BAA7EB89B09509A801B9B445B6F79F2F29F99A7B517BF05E2F094090FE74E9666652A8D38896E082A697C11401ECF5B9BE3F8A2D13D591A871E3235F945
Malicious:	false
Preview:	..I.;3.H...<...2...:..X.~}.q.yc...{..8".........4.t.V...za.m..r..0/...5.z;p.Yu......w.[.........~..w....\|.~.....M.3...._...G...1 ..PG.Z...-.h.)G......k#8.....=....D..@H...jJt.1....~F.0.8....$.m.Br.....O.XRVH..g`.G....4..&....l`..u........W..3.z.l.)$.B...}.L.#..P....T..1..;..@....Y.sy...c.2..y....$[..W\|.4w.jJ......Nz}.0.z2$_...%..~..J#..o..M>Y.Qp..%. .......c=.tK#\t)....UX......G.Y..Xn.J.....a......c!.7U...N\..%.l.0].~...v..;.C.L%3...<}.)hw.d........GO.\|.D0}...6.m6.1]...=h.I....iq?..T.]2.e...A..kW$. .=.kE..h...y.Z....8L...B.a...Yp...-..e.....S.5.dWIJ..r..>..,.Z../-.)Z5S..G9%....X.{..\|.AV..b.v...6.o\....;..ek..s.2.a%!.xw..=..=Sm..!.\|b.....~.L..,.c..3.N[.....;~.%.5..>&..EL.5',..H.z.....&.d..9..A.:#...R..iS.G.w...s.1B;4.J....]..Bp.k.......&ugl.w..d...2.S..tg...u..q....%..).....T"...~.....8%._..J...Q.....c.\..U..,un.~..G7.B..3q.kLT..R.....b.j..2k..&..s[hN.{...<./l...Ntkg..Y..u....-+.=.}....E...}...s...;.x........$*PF....'..uU........K.E

C:\Program Files (x86)\AutoIt3\Include\String.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	8653
Entropy (8bit):	7.361167716816078
Encrypted:	false
SSDEEP:	192:yqjj+7gS+q92tCw2fdyMURTUbNHSsl3qYHy965KfYp4RQbP:y9gDqJw2frKUl3qYHy965KfYp4R0
MD5:	081AC853FF074216B70B7369FDF8609A
SHA1:	117E8522700C54E2EE9E85AEBD2756E4ACC21579
SHA-256:	76FDBE4E01CEE61492B82EDD8403C7A4959A4DFA67BEDC8AA1E85BB80099C154
SHA-512:	124DC34137D772B6E5ACE3348F91D699273F23057CBCA58AD8ABA77F100D9E24B94CF1AA259DAD63CC4F953C86AB6A8F7D0700F8AD53B77A3E5393B11B75582B
Malicious:	false
Preview:	>...et......5.._.r.CQB8z..;\.....j..VF.\|:.~..-.....E...q..uC.A..`..H..V..........>...6.zU\}.....]B..7f.a..-....g...Z{./.R...p".3`.7.a....6^....J.@.O.v..h..{..)...I.T1..Jb.@.G..(....;...(8.>...9@..Lp..Z9.t.!....N.......l.A..L..P.m~-."..Dd"8.o%g....Hb........+...v.g..dL.s....l......X.....Q...........X....\...HN. .m....w.'vWW..../t.M...+.R.B_..; s6.eH.\|.{..c .....X.OR..>..5.... $D..3..$.......3..xK3.V......kr.H....k.z.U...PH.......J.h.).n.4.m.b...s..{Y(...1Rx...@t+...v.G........;..R....?.r.R..H........%8.+Cd`A..Y$...m.J.......Xu...oM......8=....-...K.L.n.a./.K...q..gr...O 6xy...\\.i....Z.w-S...(.bs_m.S.W.m...h.@5..o.Tj.....K..x&.:...4.X.....!pN.~...#.eH....p?...^.$...]..&q.U..0........s.s..Z...5Y....j.....g.!..v.$.$@.ia..bY...j./]r...vZc..y..c.H...:.'.....".......0.-..eT.E..#.....\|.i.b{...b.>.;.....F....3...R+TBP......\.$.3.........~~V#...(......D L..B...2._.....&x..`p....Rvb.4..c.=K`,.O.B......./.....i.7a3.._./9...z....'....zP....

C:\Program Files (x86)\AutoIt3\Include\StringConstants.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	3181
Entropy (8bit):	7.854663718108519
Encrypted:	false
SSDEEP:	96:1l+EovZT4nXUjaF8a+ZmF1BM0akCFqcJW:1l+3AXUjav+ZgBM0eqcA
MD5:	9323099B901B818D69E5F6ECCACD1211
SHA1:	FFA58344BDD516FB73CD292366D62AE638D020B0
SHA-256:	A98E74CF9155EF01D167656513EC7EFD70B2A55060049A2C4A05402FEFE6C773
SHA-512:	E82EFB236F5B1AF1DBBDDB160199BA9D7B90590C20DB3926DA99896D6C552339C9BB6D32EE6915E67DDDB8EA978A80A197A231188424883AF67463181A864695
Malicious:	false
Preview:	aM.Y.l....s...=pZQ.i N........k./..)..+...l4..m...".C..a.Z.2%...&.....q..}TL\/../!.t.W..Dws%..........+.....Sg.BG{....4.R<. M}g....1.(^.{.._..#T.:WO.m2].H9.E^.G%<B5.f.m...~.....ru.G...\|/- ..CD...s.1...[\i.P..P%...&$..'.C7.U...W...0>..}..u.#.:..t5..QK5.......w....D.K.=Ri1...hd...W..,m.GW^VR..UX.c..l..a.i.W.l...1.li...C.g.}VhC. ..5W..`..e.E2.\|...0.gpj...u..K!.b..5 I..'..-..?n..0.$...t1..}.S12.:t.w....F....G..1..-.Cj.).5l.WcF..Z......B......u..k"....G....F1/..hPd...v....'-.qV..4<'.u.?..Q.it.wi.....0.....d.S.~m8.....p.3..................C;L.`.[..L...PE...:.T^T..)I..k..._.-\|iq..$.Jt....n....cX..y..GA.K{..t..\|Q."..8.e...Q..~.....y..........0/;.}.:....0.[.._.S....%..q.e.t#..}.g..&<...L[..t.K:C.,..M%..Vt....W..m.....r$..?..C<.+....s..F7...2.(1..S.I.%-S.S.Aq......... .;..6Vg.f.j.b3.{...>y.m.I.g%>...<......m...w?NLK..$..8...o.. ...l..]c......A{...j....q....Y.9...5P;.....g..VS......V...>%......a.#W.b.q..)....Ut]..B...8..t..X3....M..!4.E...x.......

C:\Program Files (x86)\AutoIt3\Include\StructureConstants.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	64597
Entropy (8bit):	4.654781355721719
Encrypted:	false
SSDEEP:	768:/8lGNFEMCLCNaKphOPu7FgzOLuYSm0HVy4ICmhsCFK3w6hAlM:Q2jnGY+6S
MD5:	E348B653D36E05002A9B1DF7657C5C1C
SHA1:	39A828BB2EEE3E886DE68573B6A72434F4B75DA8
SHA-256:	0147B72EA27B2225D7EE87737FE4E5BE7EF19C8EC628C966304C0A2782B33702
SHA-512:	61CC12FE5C0CA950F9EEAE347C057930A4B5A9D9568E09E097D7600C186F07C250EF49F5706C02965D9E90CA9D9EAE37FD4EEED6D906F025384185F0852A2011
Malicious:	false
Preview:	]=g.^}.lFT...b...9.MT..w2a..n$.d]...Iv........:...u......EK..S.........`.4j....YTS631m..~.......s.#.?..c.ea.?.,@L..F...G.^w......?9.^.......:.\A1....>t....h.Z...e..:..S.....m....z@dB...S1 .M..Azf_^....$icG.....-IO..F...s.S1 ...>W..[...Q...2...7i..w6..7..4LM.$z......3.%..+......v...0..d.g.+.Wq,..j.e}.B-4.....:../..f...!?.n%....Nh.T...K.ZIv.4J'...4.....n.2.t}....O.[...T...O..Q.F_;G...q[7m=^+....?......AI..w.....h.Tt..j.o.........8...[..V.2E.4@.......+h.R. TK..kQ...<......xD..f..g{..>..(HF....S..."..t.1.6csK...P....l...f,.K....(.$d.\|E.H....U[;1]R,<....rV.....z...nok.Y..l9.;.C....l.>/...{..........}.V......Ct\.j...L.Al.Y/......!..+S..Q7..d[.v..e...{.d...@.=.F......U.l...g>ZP..%....=9.i............sw........"/.Hv../.....s.N).a.}..(J..R._...PZi.x...=.....I._....4.R.f....X.7..V..2.hg..e.S&0..\|...x...XTS.U.n.....+.]X.C..u.V:..........j.P.. .$`...o8+.1..K....^Qaf.....t.....#...Jw..G7b....I?...x6L-1 .....4Hz.....#B..G..."x."y.q.._.x....9.

C:\Program Files (x86)\AutoIt3\Include\TabConstants.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	6520
Entropy (8bit):	7.789151912432145
Encrypted:	false
SSDEEP:	96:dNWZZI0mPppC2P5IF7cN6NBd6Fc0vR1ByJWaMZh2ngWZtREr1226uG2:dGvmPinFk6vY+0vR1ByNGQZARG2
MD5:	76B187248FF0F322A65A4E31A21715B8
SHA1:	E7F48F82594A1018F2B4B8A82703FAA8723ADB8B
SHA-256:	00F84BA81102E89909F097B9C091E8736B779BDFEFEB87E55D253966EAFFFADA
SHA-512:	A3666954AD7B9FEE55B53CA604EF327766395F8DE1326EED2C4EB006E6AEDD711F895076E67E76BE32791225E6581EBB4C6B5057F24C5849C8B3E08CC92D539C
Malicious:	false
Preview:	m....a~......6F...\|1. C._.J..ux.03K>.F.V..@4....DD.q.E+.x9.\|x...^......\|0.q2_CH.%pCX.G4!a..../l..iV..{E.L..Z.0.s.6.........O.......R..=......s.>A......y.B...J...../-...^.....<MK.B.8....-.~.r.{..U...;.$7z.......]0lQ?..0...N..~.A..m]..].j.>=+......l..Xv.....}..=./K.... $c$p....N(....f~..k.SU..O......mA..A.I.s......U.. .?7.......h..u[..^s..9..u...[K....C.. ....;>Q.+8.<D..j>$\|.[.c..!r...p.,.b...+v....yF....~.Y.[OV}}=+Y.(....A.....4.u...n<..._.R4.&`.W....9..Mp....c.E.>.]..\|..._n.c.]f/..5I.;....a.-..7...e.\.T.VG-..R.....'....uV. ^{..E=.O...a....B......b$....w^...q ....V...`.X.R..dM..u. ^..>.{.,..._?..w.t..G...ZeE......d....5....F.S....;n..q.+.T..s(.2.0...o}.2PZ...7...g$B.J....J.T...#......v..;Ys.&..7...L.......\=...0.......Z.{.].p.j...C.7...../.....=.7c!.Q(._.I.;....R......#.B"..7A.9....d.._%0].]p...<B4..i...=4UjD..JR..i...At...y.......s....s.7........$8:...............6..s.....S<...u^..N....T....!.y ..+..f..?.....0.yz..?F.EN0h.i..9+l

C:\Program Files (x86)\AutoIt3\Include\Timers.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	12162
Entropy (8bit):	7.14522304117777
Encrypted:	false
SSDEEP:	192:RGi7aujLF8JR5b25vbt4PMtmULUTtA/kmk9H02lr9gHk8k2KRfuUc+fW99/WPXlb:naM+JD0vbaUtKTtqrZ2lu10g9/WPXlr/
MD5:	09375CF959F5452289C8D214B5D81EDB
SHA1:	4E396886296C0F098CAB5E115A57B7FC49C0AAC6
SHA-256:	E76C239588379165E5C0A8F924198529F9E82E0AC3C67EBF9C45331377DAA872
SHA-512:	F3B7C0CD2C31382F744D0E145A8EB16C9A8053F4BE8A656905D2E401BA4188DCD010FDE05CA464919B2C236E78249D989E8A7013C27189FE348109C3B6FDC30C
Malicious:	false
Preview:	......a..M.e\|..j.D\|=.l....T...O....x.o..P..O.a....SP..I......pa..f}r...0...;..p.nV....r...7.6s.d~...-G o...P?_N.........._..@..Bw..o/..D...j.Ua.HY....TqP..B..R....P."...L....F.....i.L..sn...........,Cu....~.aL.].C......~...E....t.........tJ...M..g.H+.._".?%>%...h..2C.EK...a.../..g...A._._3..>....r7.mv\|..:l...b....x... ..xs#7..1...%....y.c...P)Kst%.2s......v...SE._.`..J.Q5....\.IXk[..8.X$...nF.K.Eb2..i)....1.,.\'..J...P.hW...fV.a.Y...b@Ei./'.=.k.V.$.....o.X._.........W...K.y....3M.xd.Ky(l......../[;...3a..1u".;U.o.h$vpr..z....l.....%..../.UR..9[..M^@.zx...4...7Uc.;.l..K..F...r..w.?A.+.........^4...L.h....}.IG.XS.".7.2@7.EW..(.[...'......Q....C`...c........[.. <.;T...BR.\|....=......Aj...+..G.K.-..zRf.J.:.Fz.l..^4..iBp...S....i.^.....f..q.......]S.U 8.n4Mb....._..t..+.4.L.O8r..D.j.=.....w`.,2.\..F..{..".s.#.z../.."..W..Y{......k....l..X%]^.C......S.K?.`?..4...v/. .n.c1$pc#).Hr.rG0.;..8......(.....q.Q.L..]M..L.._.X.:.YSN.....*.U..<y#.D..4.

C:\Program Files (x86)\AutoIt3\Include\ToolTipConstants.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	5853
Entropy (8bit):	7.872837147285306
Encrypted:	false
SSDEEP:	96:jwU72DEuzIev5IBXqQxzwnI0qIClnJi0taM5BIFZ9hoPXAM:jzSE5eyqPdlCRJ5tpIgPXB
MD5:	8CA778CC954B8915B6F08B6BABFC8695
SHA1:	DE4CA9AB3B9BDA5DD68D4409BD141416FE8FCA5B
SHA-256:	CD581B14DA797C1BCE566D0483F01A97221FEC1D5D21B98675ADBBE81D6BEDAE
SHA-512:	8001ECEECFEB671AF6A9EC9DD628BCEB0A5C6A8607DB4FA0630602D8E562C4112739235170A1F41CF9989EA35C3A4CDD093F92133F6B5FC72D9EEAD7AA1C518D
Malicious:	false
Preview:	@...b......u>..!4.bD....:&.lSe...........U.{.y!.-..~.+}...N3Rh.......I.[......X.;.Qg...6....."..o..K.m..C.V...>z7\]TmAU..39..GM.)0)\|.`..F...b.J.-.!.Jz...,...)M`Sc.....@...-+.......Vn.#.\"..L.!.,.Kv...\....1.....X.\|.JBQ.~....8. ..6Y.PG.5~b.._..2c....U.5._y.T.d......4nLe..3..X...J..O...........&$."N.._.q.j5.X.J.1..h.3.....M.T..=2i..8.uh.p.]&$....P0...}/fCH...2.Z..H.0.?.....i........nd......T.w...+.....L.%.....Ya. ...[..`1..~s..d.t.;.U.............a.-~.][.{...el>....."'n.I....3.E.>.>..i........[.........../.d.ti?..&.....&..i'R....0..t.Rg.]P8....X..W...P7......UZpn....\|W.. ....a....i .s$.,..23bv.Un6kC.b.jK..q(.-Y.{* ....)..=8...j.O.UHM.}.[\U.t..M2.hL.....v=?<.K:{o..z....?....3....U.^......Y.GHl.5.{.p.88E.....w..=..a..am..g.'...."........K....mwUv..._...\|.2.6...&...j.^.y.X.%.v..a.Em...}...qXFbC.#J..6..h..1.>.d.,.6H)}...:..4%.!v.s.p...9r....Q..r.2k/.KL5...`.1....<..c.l..%Q`G.~s....c0..>.E.e]..L..qn.yD.....PG<.._..F..r.........

C:\Program Files (x86)\AutoIt3\Include\ToolbarConstants.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	14060
Entropy (8bit):	7.092488035593277
Encrypted:	false
SSDEEP:	384:IUC/WqdRDIkUdQ3RUZAncInnf/FuavdlPMVEVElEkX6M/eS:IxR0RQ3RhnnFnlPMVEVElEkX6M5
MD5:	92BCA775296DAA7246B917B2CE08D7C6
SHA1:	BCD5C00C670835EA873C3C72920450FBDCDCB6DE
SHA-256:	E7E3670B582FB28E37D9798605EAB88085471C7F8A1C8B623D2F10C810EF7D22
SHA-512:	D83CD0F3D47E5DF63145BFCD80F304183D078F10F0895579C7D6C1545B06DC559A64B077D60AF995C7F96666AA642AF364F173DD1A61834BEC863CC3F727B314
Malicious:	false
Preview:	.+ ).%..vj..o,,%...C..A...3..s.."......$..H.bi....;....f...Z......F...R/V.u9.9L..+vA...4.....i\2.....K'..]U..#...n...~'.UL.n9x.....]..W..?.CRJ@H..S.x_.......c..(.d<y.4..s......x..].2.....N....#..0q...........Pt2..'....]...Z...A.%.Mb.6.(,...}..Rc...i.a...........OJ.S."...W..cD'.i.(..0..<.GZ.Dq/.x...._w[-8..L.;6.`v..C..."..6oc..I~.fD.y5.1..R.......o.j.n..Rk...F5.+T.Y.6W....n?a3...7..r..I.t..l\|....C.cz.3.....v=.Z.R........g...j...4....M..w.i..!!..w0.=6.Sf..HenVa.;'$9...h...4.........Z.v.$....^:.bX.".H....v..8...J..$....a=P.....f.f.%z.@.......4...A...%..j..e.?.{G.X.W..,'.xe^.i4`...f..../..[...h..E.....,js..>e.....U..,...kr.k~.0..zS.m'H.Vs....gu....Z..8v#K..w....{.tk.%....2,.kX........]H....Dr,.2%.nkP.kY.T.G.F......#....b........b{O..........v.9..^............h..u.._X,.[..WP..X{......[.....dA.w.p....Z..6.ci..t.=....W;.bf..$-..H..Q.T.K.U.C......X..C.WDn6....uX..p.\|*..k.S.. ..R..O.{.a(.L.6...=.B....4'..Es(..3.....X.g.F.:....\|...t.F..}o...<....O

C:\Program Files (x86)\AutoIt3\Include\TrayConstants.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2992
Entropy (8bit):	7.842510284816053
Encrypted:	false
SSDEEP:	48:x/u65lcYgt263+++KmIZPuUcRthNfrQO3o/aAIv+mDVZQZ0wqqr32Pl1DRr9vuve:Zu6nIh+dIcZh1UOY/aAQDVrHJnRuXW
MD5:	B571B9BCD05B9F3DD6D675FD6C616E51
SHA1:	C1FB6F13FE74B21D0B660D46796BD7004A1F3046
SHA-256:	F7A97F80A21D4FBB653FBA4CC98E1BA22D2E995E04AA3CEF802F86613B85FA5D
SHA-512:	434EEA8858F2EDD05E354D925AE73FF91EEC90BC96C9C0B379ACF71AB01CDC19C9DCDF15DF0CA54C5699E40ECA7A7E20F47DEFF15F1A90A6C42EE36F18883116
Malicious:	false
Preview:	..d.)^N"..q8N'Xri.<{(.8H.R'N.u.%7I.uC...Q..'...E...B.w..../...ZxVpC.y.q.....?..W.'...M.T..1....D....E.......G...} ....q...o?.k...N98A...,..a..s.9I.......). <..9......?...A.yohO.#....._......w..ln.....Y.I...B.u..&_..$...@..`e../p...'..__...w8..\.i.........=.H.....e.b..$0..:...A_-.....(.#.T....{ekw.\....L..}w@]..y..-9.1.b.8.$....{....&&")..^M....V?....A.u......?O:.....LU.BC..F:..a....F....z.s.qx'C..+...u......H.2......n..#@..s........9...'f.SFMa.E....o.x.QU.L.0+.....P.....T.O...'E...h...8..s41..+.\|\.fAJ...Y.`n....S...{6..E]...M.KN..GF...8#.8'<...G#.n.~D#w.K..wC.....z.>......2}.25..}9M.77.Q........LoU.....=...............+Y......\...h.^.l9.R../...^G.........?v.....@.Rm.!`....fI.Q.\!.3.....z....F..c.v.4......#.S..!.6. ]...T.$p...I..X.....F.!7...&.t.U.a..\R.>..\...(.Rd....<W\..sF.!A....V.....'cTELn"...O.N....0x..M3.D..').M.......q....[....3wp.^w..F......!:.X...u.p.v.d...Wl.......;..}..\|j#.G'y...G...BI.7G_%......{.5.....+tu+)...}.....#..J)9.I

C:\Program Files (x86)\AutoIt3\Include\TreeViewConstants.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	9728
Entropy (8bit):	7.368560177129575
Encrypted:	false
SSDEEP:	192:o7ByoKI7HBsdfht8Wqd6C8o5x+Q82D9e3aWz4lOu:kySHBsdfHFqd/8oHH82DwKWz4lOu
MD5:	B66F7E006222433677139445D72DB055
SHA1:	F569E12EEEE1B08CEA6C0A9563C453C996610864
SHA-256:	9FBEA0505A96CEBA4F5B1886DAED681196531BBF04DF8E372352A9CDC0A9841A
SHA-512:	7AEEF855D7B2A6037CE106FFBDE80AB68554BB9F2B6C5C13A5C14F67283BDB88BCFC2B4969594323BFE751667F53B3D5CECDBC3A3ADC4E8E4290080D1FE33BBB
Malicious:	false
Preview:	H.s....Z...q. .\|pK.j..l;.G....R.F938.#K/].bm ....W.q............'.`..aM..x............V.D..n......\|du.R<.F...,.:e..f.U..<.,.\|lw.`..D....{9.qx...w..>.%dvg..1...q.f.uw6.wk......1..A....[.Ee.......w.n...h.[.9..e.u..3..`...1.N...1..Shk.......E:P520...L3..'.}..;.z(8.MK...,..IK.f;VG1..#?...r.Fz=L..r.i..d.Vt.+.Z(I.....0JB`.S..Q....f...M..L...$6.....$..V.(.....%....~.T...<..7k..p.2..2.n....O.>C+7d.......-,zb-$...M....D5.>..p..f....1.......G...%O.(.c....b..q......RjX.\|6<f..&..ze...K.......n..i._.m...b..~C....x.0.nN.....\.b&..T.J.R{w.>~n..q.o.9...9!....Ax....m\.F)..%...[_.pz..DN7..).......W:...jjz..M.j).;..u....`8./p..Bvw"...'..TWF.....2..sn2I2...8.o........E......-.....9.......b.Nk.K..Vg...}.r....V....j..]@%......p.n.. ..~;.U..Bg.;f6.".]...u!.P...:.b..E........V....w4..."C....\|\..,.(m.......g.......\.2 +l_..@.......t3.6q*~B.D.6...s....d......S......V...3G(4.&...4i...0K6..3.?i......./g``...U.....{.....b.5.?..H}....Q...&.1,.f%.... :...F._..x.

C:\Program Files (x86)\AutoIt3\Include\UDFGlobalID.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	7016
Entropy (8bit):	7.757862043369638
Encrypted:	false
SSDEEP:	96:kBcNv/saACmgx9r/4JRr1O80eyxamk/yDBmreNR+3rHrg6yez:kqNsaAC9rv80Jamk6N9+3rHt
MD5:	97469003340A0BA81FEEDEF1D89B150F
SHA1:	1B23DBF4E00F8E3D938884C81D92C005BBD4F317
SHA-256:	AD01EE53283E2B0CE3102FBE7D644764E0A4F0DA9C15A6A5F13401A29CEA2DB7
SHA-512:	345DC4A3B9593857B17936C76EDAA1779F3F8536EC550648F7387C2AD2E6B2F0E02DB36CD2AF5FB9D8FB00255C60D7FADB0138A262D1B968708B2E65DED54CD5
Malicious:	false
Preview:	.w-..B.D..}.z.s,;.y..n....P...6..oQ...2\F.=.......hJ.R...r..t..pO..q.7...EI.c.......=2..j.....5-1.Baq...f......V.4T.C../......a _......50......~....Z...>.....$..~.w.7!W.B.v....rG....l.X.g.....B.j....=......-. ...F....C..`.A4..n.]j..\..r..D...#n.7....=.B.........$...,..D..,.@...{.;x5..t...{.....Z.+...;.z!.k-o.U....q?.&.......H3..n...>)..5K0.Lc.7..K#.=.>1R.=.v..u.-.^..1.d....';...p.;..J...3.7.f.X.`u.....W(..P9..NL.^.0.........#29...WL.L....`...xWO/b......)D.B<..;.t.`$.h..>A......\N.`...8.b.'.G$..q.../b....}.W3...........0..j.&...I."..pZ.M6...W.......p.y_.x...5:s[...S....E..cDU.e{X.`..J..b...5.....s]."9v.u.........c....M.s...,.n.t..Z<..Sn..H....0h1h..i..-.5t...a.."...@no...6.Zu.^...:[r....H.3.....7k.._%.?G.^.....!..jSq@KX..kt.6..........K5.!z..i..\|<H.N+..>~../3..j...t:.m.iN`..a..V.....#.W...>.]V\.:.kxz@.....h........q.eR."...=cy.B\B!X.J....W.D..j..:#y..v.X...@.<.7v.,.Z+Ag.\|.......*k.>,..XO@.........4...M.yO.M.?.....i.U..`...

C:\Program Files (x86)\AutoIt3\Include\UIAWrappers.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	110368
Entropy (8bit):	6.1719345501741705
Encrypted:	false
SSDEEP:	1536:dc7pxotEx/YFvrbcDfACy+aeGtUoEQzO2SrJHklFcN/4Zrl2bqdej0rnwRFl52xo:dc7HotW/YFUDfACyteO5/luN0rl2v/mo
MD5:	7224EC32C539AC0302F4EEAE040AD734
SHA1:	BE2A42C09E76D6C6FDBBA2ECE5730BBAF7D87B63
SHA-256:	1D969822DDD6D2722A52F3E60A13B2933A75CE79328ABD3AADF54381E9E96F6E
SHA-512:	B75130C98D0CC9164C89149539BFF190BF31739559DBF67871272DAA86FFB83232DA55002F54CAF4B946A88CAD9DFC79E301D782CE6E1D70E4DBFBA7441CD582
Malicious:	false
Preview:	4.}>...b.E~...&.-D.?MVt..P..l.....q...hA._..=......=.,...~...T3.;....4\|)L..&.. ....Y..w.)....\|._'..D{.$..nr.._:...1.tt...HH..l...8J...3+....mB..aY.tg$G^..~...@.)X.?......f..j./......8Yv.....U...........iO.........~OHVE.Y4.n..Z.4...T.H.6'+..1.c@~.?1`..Y.....S..Z{0BT....s.Y....?C.#..(!,....-..F...lM2..;_Nn..\...:..wpX.....bL7$.#.SW...de...u'.a.X.\9Wg.....[.y.m..H....#....R.7..A.^....M....,..;.....s..R0.=.KgJYP..b.N.v~,4...3#.C5.I.(..YF...+..lsR..{....x..47vJ.M}A.\.#...B;..hq=....\|8...=.o..f..}W..]Nu..m.d<........'...J...4.Q:{.WuN2...EZ.p.Diw.....=...0.>...9I...&.1/g...x.=.?#...............m..we..{.[K.......\|.......'.v.q..Ph....:.1=...Iy..@}....<...u.T.bj.._P`,....s.+'.].................x..m..6..{..$....`..'...3..X........o.,?./..R&..l...'...>.uA..n....L..R.8..8..N....<.._...j.?.&`..TO...n.NzF.d..U.\|_[..XT.1D.o..l..h<T..!G..Q............u.1.4B..Zt..m_.....6A:...h.1..wBh..+f.~..%I..5y0..12mi.mZ..ufZ.?-......e.....YB.....=.WjF...m..9...-..2

C:\Program Files (x86)\AutoIt3\Include\UpDownConstants.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1478
Entropy (8bit):	7.562843339972105
Encrypted:	false
SSDEEP:	24:TOzAqGH2wP687ALnerQquvsHrRJvQ3sgBEDYCQc1y7JII5+1XqW:TOzme87ALerQqgerOIPQ1mIRW
MD5:	437642F01968C779DF5D1C88509D8831
SHA1:	15125ABA3154D44605AC7D9A2EC349CDB2181F40
SHA-256:	E9F530D81A58DB4EB6B8487507199CEA992D5F542C058B9B946D075BE5996442
SHA-512:	DB252793A7DBC7C04599F35B17E6603C6D3B01B2E6A06A02DF0E597F308AAA7B3A2E82C4F3A14F7C36AED60D5467A9721071B1A6B3DBDA41D26135F6E6264E4E
Malicious:	false
Preview:	..[....P.._.$..<.<.....y..[..WO.8...C.;.It.(Q..,..1.b[.\|.~...0Ui...l6._7...E..05m...2i?.%..^.0...-N....a.}i..q..a..C .....'=...T.%..Q..Fn..i..O..:.\;o.G./,bv{\....x.{Z.7.m NO....Fh..n2.....D...?qr..E.~...>...~l).w...J......,%......b.....q..v.@.C...i#..........e.8........r.+.II."..5.cR}....<Iz.hT..skmH.)..M2..............-al.\|.t].".>.S.>W..5v{.GQ...D...U0.[.s....O.s....a.\........w.........:...D..Lb.$pX.g.4....^1..f...L.DG...}..I.H...8.6hW...[y>............:6.h.ZRN...Ye./AUb5R.(.........d.b.].v.HGP.2..T.M.x".TP...Y..:......D.H-.[Z%....X.S.yB...y...T2.uH...=.~Q....k...<'.......'....^..W.8+0b..B...<./D.M.w.`G9.Z).E@.y...._S#MIW...KAY.U....$.....03?.w+......l....L...V.+(hU.../.v......8q.."g..4.6N....%y..p..!4"....d&e..S4........H}.d...1.v.6X...[....&...(a.......$..f}...C..}2..R.$..y.2*..QYm.......Oe.=.,u...d2..}..~:.f?..T.f+...6..k..l~.a.^....0o.'.^9...i..r4.A.$E.x..``\x..7..s.Mb.r.V....oP`e.<.aE.-...'.:..~.....a...v..Ma....`.,q@.sr....e4.\|....m

C:\Program Files (x86)\AutoIt3\Include\Visa.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	40300
Entropy (8bit):	6.1397191965520985
Encrypted:	false
SSDEEP:	768:leRJprmYUAFzh3rD5GlzxmyE7FL6pbJUBYnqiKKeBwR6:4/piuzx5m8r7LYr4
MD5:	C7A529C35B21DE87C6B38F34B47F7F1D
SHA1:	540FAE63F5844739E2EF021BA475E9304F99B629
SHA-256:	B6EFB7BC2C605D84012848CEFAB4CA3449D3C7D368C79CD70D8E11E91021067D
SHA-512:	5DD6A28B937C2EC4DBEAAA8C0833FDD16F891A150B83988102CF4F51ED0D96EEF2E77C4D9A3876C1EA7265047AFAE9A7C7623B677A224DAE25FCBB81ACDCBE6D
Malicious:	false
Preview:	......_qOQ..n..V..9.M.o6.qNF.....k...b..@`...^.K....rOr..5s.......9..TQ..Vy[o.U6Zh.i..D...sg......hpS..lhb..!..?n..e....86.Y"....Z.P..X1]w.^C.E.....$W...>,._.^.~..c......q.%..z..7..;R.>&......'..i.&.#.O....%...c...4...q.j...]u.-....t[Y.h.v.Z.m..\|._..\|....0.%uZ.....A.[..C=.{......o....a_......N......$.dC.~z.u...Y........_A?u..&...2....~yJ....jL...\|...V...........!.HD....Y..........P....NjD.4..$.yjOqn#...N..o@..rz..w.K.e..0....7s.X0y.?..r.!...3R._...78sG......e.(t.......iE.._.ii6...JP.I..v...k....b........Q..cil]....(4..O.}....S../..;.....u.`..eGaH...w..L(...@.&........cG....5th....../.........M.Z.?g...o.......E.$.._..c...VS".wj...nS.../X6......n.:..E.....L..z..!...{(...7...R.P...$.-.a(..>...Erb..n3....<....3..^.2.#G.M...X+.A.eRK.N.-.?....m...-u.R.............e.b...+...T.:Kd..U....sf.v...Ukc..De.;.5.Q...c..g,.k.jM..j.L .e.oaP.E.yJ>ND`..b... ..........HU!92...5n:....z.......?.t...1m...[._@..L.7...R...r...Y..I../........Y5.X=..n..

C:\Program Files (x86)\AutoIt3\Include\WinAPI.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1847
Entropy (8bit):	7.710028776361231
Encrypted:	false
SSDEEP:	24:sPHHBGLPF1lE6zqx67vKrFq37yFWby5kKu6yhcTD6y9nV+9x7XH6qu90yYdSRmpW:sPHYhAMqmCJP4y5kKy0Q9xGfKMMpW
MD5:	03D4CB785972EA57A506EA9CF1BF0862
SHA1:	ABB6623D20D5430705D6CBFD5384102B9363C763
SHA-256:	984641274405DAD394A78CB0621DECD828CD66352EB74ED8C3077BDEDBA8784D
SHA-512:	C0AF806820841FF7D2FBF908F98FB6AC279AEB9D7C52197F99D78530FDD1C15693BA089712233A51342D5E74027F6CD7FCF5C2A71C8D0AFE730714CB974A6ECB
Malicious:	false
Preview:	G.K..a..L....W...I..p..s..!&.......kP.Z.e....6..2j.Z.e..b.FB.Yu@.>....K<...X..h..g....Y.P.5..p...&..gm/..WP..}m...>.....-\.1.di.4.T...N..#....._.KQ5@'W+....H.>,..7D/^....z......u....5.....K.:........N..Y.'...j..].=#.r..lF..s.@Jf....t.~......1.y..q..........Z.=\u...J...2.r.V..<...GX.a....4..)).).6......rA.'3#.....d......y..O.[.W.....?.....X..(.)\|l}...Z.{.1....K ...F"\.[.....;.QC.Q.D..4..a...R.......'M2Jf..~z.:..f.c.,.8..`(....R...aB,W ...0jJU+.w.bW..m...GY._..3 .v...\.+~I.x....^.vN....r....tD.}..J..^AM...L.gi.z...i,cO...d..8^{<.U...g..-.......].?!M......Ih....;[6.u..f........T...#g....A.(.#..v.@..I,`".....Y)n..Ay.E..9.^.g.2......._.x......H.\1..%...r6.[..t.....Cv0L.....[...y.v.]..].FX..I....-yHCK.A.zy..#.$9u_..`..?.0Sj...J%..)-...:iw...N.'...*l.V..s.w...y4..\|.hJ......?.TD.>..3&.;5eG...t.s.9..s.[....C.N)8&.&...x>.{.o.a..s...H.......r.=.L.w.&.W.Z.,G7..Db..Kf.......u.h......OQJ.@....)JP..z...;.."..)..2.{9Xt....p;g.I....{...isdf.....

C:\Program Files (x86)\AutoIt3\Include\WinAPICom.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	9801
Entropy (8bit):	7.138371860711991
Encrypted:	false
SSDEEP:	192:r7HjHUAEi3AlSh4mCkB6Nr3U4XYbpLYO04fWZrReOfqAKW:nLUf1lSh4mD4tWWZ9eOfqA7
MD5:	0B00D27F39060F72F7F33D95A069FECE
SHA1:	00F735AB80F67EEE26624C3CB1412B86E0FDD08D
SHA-256:	EA2C66E735BE25C07BB095B53F6AB6F07C28EC8BDDA6D92BBD3DBACF2A3918FD
SHA-512:	0F7066E9044E882D0E6A8744FCFF976D0242F1B39ECAE1616A53ECE5B4C03615315671E5770CF2134A087889CE758FF5550A7FE1EA71D4E5EFC7CE7FC334DDD4
Malicious:	false
Preview:	BgKU,..W.......F .M..>Nk.T..K..._..\|U.....y.p6.uzUl....j.gH4.x..H....-j.Y......#....`....q.z.H.(..DR..$..8......i....a..J...k22..&Q.m..5....-.....~..-d`..@.MB.. #Ei/qgM..-U.3..A.A87z.r...z=.NnF./^.9.."..d&.......)s.';.x....6.WP......M.4p.P..."..#O...O......'...eC=2.v3...,^.........K....ic.....R...$.{..........!.NrI...~....q.....^.;.i..^8(T.`.S...e..fD..u.1R.!.L...<...Hh....=.d+j.w...x.j.t..hB.@\Q.X....3......+..6 (.$y.....WG....pH.<:.\n..;... .4T...v.S...;\..v?N.C...w@..j%.8.\|...;.r..&F...2....-....._\......."..5.a..HS...b.I.n..e'.n...S.....>..&....I%!..m.G..+...9.?T.=x..y/..KwW...S8...1,..i?.#....4;-.57 ...y..o.P.BK.e#$..2.g].f.p....l......L@.........E..Gz..EP.F..g....."[...UZeT.p.&S..a.....!b...2...1}g.......o.:1@...0.C....Z..q)...H........i..1E.X.\|y..yby.q..6Z.\|.......i.Q.ib.....1...u.<.\..t....\L.P:T......`.C..E..`....`8q.....<..2>.dY.j.......=..-...>L.A.>.....`.......P..K..?.VL....m.U.u...h.....P.i.D_.@. ....BiS..+K.

C:\Program Files (x86)\AutoIt3\Include\WinAPIConstants.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	5785
Entropy (8bit):	7.8830906046533835
Encrypted:	false
SSDEEP:	96:v1zRkpbQ6fa6qhZIkMCevep2qXJUh6aYueNcIihtUg8XtGNEwEltOCMGGr9a:tqfTQZIkrevep9ZvR5mCXXtWEltn+rA
MD5:	7DC6CDC7475F7E75142CF189486E9343
SHA1:	50AC7586BF16464B2476F092AA74FEE1032C1C5C
SHA-256:	82DD2DBD37D84881F702540D8548F5C1BB6FA284E9D1E79A67B8E3DA574D627D
SHA-512:	0112DB115CA97DE22B94CF5AB375E1B0E7B63CA6E6BC4A47F19513FC057C045FCDADCAB2528300FEFF38D53F791DEDD7A21C52C98BAD49A96CD2A7EC3DA942C4
Malicious:	false
Preview:	=........k.[+..&ZU.@..M4r.Dd....u$..y.T.....1U(.........I......)C..:.....:7c).)......;F.9..IsT.1..\.h+f..U...}IxA.W.1l.#..I....=f...]...T...s.d..Eh...6..1.....z)..t&...W..L..T.~ee%. .oIjf....c...z..QsN.O.\!..L....>M..#..@.v.......@K5.N.~OJ...Ih...-.X-.^..7.....kJI.K..-\..D!..w.ham>B.Lnp3...a......?..Z.{.......\|r..$..Sf.}^..98.1.D^(.r...6l..){.z...Y.sc........Uw(.r...8G;..;-Ry=.T...H.&..GT1..0.^.;%`.H.R.fR.x".p%d....wc=..].`..P..?k.n)...oia......,\|..........0..x./....+mSg..../..F.....C..Sc+X=...^.n.....o].d..Va...V...1a..Qk}........v..S.....F..9.....2..........9.lD.\.MI.z..J.Z.x...;..1.].J.$(...x.w...3..C.t.N.f?.R.=[....9#r......00..:.....Zgx3..S0..M..s....r#.KD.U.vS...# ...J..C.!...%....{...^...G3..........UF.@L..J....r...M..Kf..J..\...9..R...>0E.ts.......j..=},.....=..I..EsoN...z.o_va...+.Vu......_.kO.T.?n.l.lcZ.$..^.NR.T7.'..7`.B....,ak.<.....qF.n.=Y..o.,.3...w.!..gP....;......$!&g....9C.........Y..{.Y.+=-\|....H..&...p+.".X]i.......

C:\Program Files (x86)\AutoIt3\Include\WinAPIConv.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	29887
Entropy (8bit):	5.792554367830159
Encrypted:	false
SSDEEP:	384:zC2PW3C0p8wDueXP9qoJAmnQG7vDkvCGhTCO1o4S8lTlwv3VXlYBN9NS+jlbUv8z:zC2PWFp8WusPUcpC3FS0RM/KzAHYn
MD5:	5BD55F08B18B5882672637A42A0819C8
SHA1:	CF606C2354EB683C43EEA4451580EA5881C234B7
SHA-256:	C8D959C8799A9BD5824B80EC3F9D0B4D1AE4D8D8E73B67AA7D3711E6318C2E87
SHA-512:	7C85497F2A7FF5575F53BC00D356150FC929A74EA303811C552B3C0CD3F824E6E33E70AC3605E495AA51C181FC227B14AEB16030C760CA63C619769E52F32B2D
Malicious:	false
Preview:	.Sr...V.`Q.,.YZ.....G..:.r..LN..,E".z......K8.P..9.+.5........h....e.[M.8(K....H..k....'.&.V.8._S..M:...v.v.a.b......#.I..E3.......2_w+0...$(.......s~..Q...R.....)....6V@.<..q..'[......l..g....&(...5..X.3mI...fZ..(...t/.I..2.,tJ.A.~......3....\..`.&.....M.P^.g.,o...7..9=6.A)Y.x...\|..~.\|.NX....Ne./.c.......!.lG.g.Q..`.I&0A...v....Z.)...@......,uF./o......;.jt....2Z...L...o.Ur.G.eX.6w...E?}..e.;....KkS..y.2.!>n.v.r}.K9..:.._r. ...,bS.E.......s.Q..g.%,...5{...z....(.o...N..,..?..Ks..1.Y.\|#.c8.^@1Y.&.....O@jd..m3...xb.;.......b..D....[.n..)/..Y...P^..\|..y.Ph(..}.V...9].c.'h....F..U.b.... ...%)....d.Y.A...xG..d...7...0,.....b....vLC.xg..Ky.x....z\|Bg...k.bQ}.(..z.....K. ..\|..?./.S...k.z..'...k..ni.x .kx3...hZ..@.,...!..5....._.;/.....^n....U..-Km....0..iV.w.!..!.1......(E....{.....~.....?..{...fE.....r..o......z..msz../.....B0.a..c.byDj.B5wI...]....t{+<...vH.^0...r.<.bt=...-...""$j...I.(L..d..^%4..a&q.....eG(.!..e...a.?. wd..7.tdm.gD.t..

C:\Program Files (x86)\AutoIt3\Include\WinAPIDiag.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	33209
Entropy (8bit):	6.571259515478401
Encrypted:	false
SSDEEP:	384:x0t6o4nh6bKWVqa7l4ACqerpIYXQe8m6e1cs/B8UoJkbrNOUkhlYdQmQ4Fmn:YYnYe6l4ACqEqs/BQarEUkhlYCp4kn
MD5:	DA5913C0BB67093B0C750E9EB1DB1F17
SHA1:	F9B9415644FC725B627E4486CCD79947BBDFDA55
SHA-256:	86784D421C8F32F5C39FC898BAAD8A0EA46C1E63E7ADCC9921D01112C35CE564
SHA-512:	7FEEC949FA4E5E3837C4538CC65D0C8F36C7D44C1F3534E0EF13378F291F323AC59AF79ECB4C803DAF873E0D6770750A633B0B6958558CF36C305F1B7CC924A3
Malicious:	false
Preview:	.X......9..3.LT.cB.a..8..)..E.,H.c.Q...(...y.x.M..%........T.2..{/.B.k,.j.Q.d#...g.ja......d;c4..K....84LK........v.;\....R[....$..._...[z.."vqm...biU.R..x..7....y....e.N.....G.Q..e..."r.#.Xq..y.Yo#Q....(bO:..........6...IdK.z[.............'%..V.H..p...wA...Q..x..:..w"...M!d.(..../.....j7.&`O}.......{Hk@...\|m........GY....B..8.m.o.i..6]g..\.C.............Y..DU=....VL.....P..G.........e.$.}Q..w..yJ..#...F...._,.......\...$HPt.l.........W......4..r..."."........cs\..9l......B..M.Q..1c.(W.....^.1..9......7q .8.o.t@.<..h...Ufi\.<.H@z.Y]..R..Y....l.].......).........K...?.A...!......4T.....I...3....g{.br.0..I...7....(.H;.B.-Wc.(W...E:t'.g\-.5....+......W..n...d.t....C.bi.S.&..H..`...Xa..c.x...r..s......k.?.s..a..y....q.......D....X..<.....\k.[.pD.......8-......W/[9.{....&.s,...........mLb.5.........mq..L. k.w+.gVXin.......6W.F!..9j:......[........&.D.'...5!..:.Xv.....].....g....Lw$`....]4.......U....&.,.W.K.al....0u.v4..{..b.....xR..}.D

C:\Program Files (x86)\AutoIt3\Include\WinAPIDlg.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	39313
Entropy (8bit):	6.221910644565723
Encrypted:	false
SSDEEP:	384:ZbhHmDzAX9TXqwcQR3l+AtH8G+8x40kGx/HfkYBRmDUFV3/7lgfjdllyUuqGWPbZ:ZtGDzANDcgmQ5gb/lyrdqPd
MD5:	A2F1B71E75F36FF3E7C74A3304D50484
SHA1:	7F7EA871B722E4AAECDB53A38C3BBFD3CFE58019
SHA-256:	B9EA370596AB413D6E48D986E1168A3265EFBE2B8CCC7884F590E80719221E60
SHA-512:	5004A9D7717E8B164B61EA6847E99DCD7201FD6731BF98EF4516513D667324E69B5320CB5467E0FD1109606BE4F4E787D71F41815A3ED9786D92C8C3BF779485
Malicious:	false
Preview:	.:{v.A.q.I..+3.Q...~...^....!yV..CMjl.........}.PS[g..[?....!.=..........m}.X9....'.=...W.V.....)c..\|...G.!..E..I5J....x%Ex.n......n?.,.G..\.5.6.X...2.Ls.R....e{.b.P..<......EX....6...+.....O+........E..EX.n....a.Q.I......@......'....#..FV....46.U..<...m._.\..6.wR!l...n..C.......1......`.l.d.x*..I.c.\|...[Pu..%.;y...o..zSTt/....nh....5.4$...... ....Dz.fQ0Y..j..v...Z!.7...._....l.'.}..k.K..H...D....\...H....S..-A._......w.l...JW.<...m....l(..._6.tl..Q......."}_.#..-.E..%.{...........s_...I.~0`r..W......Z.e...n....3......l.k..s.d.....vH\..j...>.Davb.@..M8..\|.Tpt..v.!...Z%..C.`27%]z.:...J:.....].{.1G.q9...nOY....].....-.m..w.N.hM..;]=G._....#..........(...O.P\8VW./............s"J.....6].M$.ES.Ql&\|=W..Y~...j..:.{m7Z....7.l..hx.g67..........>.G...J..05o......y.tPo.O.6......`].W.....,.~....D..A...v9...........h.e%..~....tW.pq\|..Hs.&..."].#...u....:...S..~kF.2...w2P.}....]..J$?%...K.......%.....z..:..}...J`^......#;.......,.EU..

C:\Program Files (x86)\AutoIt3\Include\WinAPIError.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	12334
Entropy (8bit):	6.978253811313874
Encrypted:	false
SSDEEP:	384:hUASzssgyEbyro5jJIiq6MeTR1yEbAJnSVW:hUAJqEbllgIW
MD5:	9D317BAC6C71EE336E662453E0E088C9
SHA1:	9AC4462F75D1D7AB957D766C1334695BFB97C77E
SHA-256:	29512674A0A2A9A7FDAE5963259140EE0EDF49FF489D5D4AB2C5CAF65BF4D466
SHA-512:	10CF804BBA1EEE3B82669FBC9E97151CCC623AF7B9FDE4F8DCD40E74F21F611A9188B9F45A8D75440E7678950ABA5521B78FDB9BDAFCFD456C0CC9E297DCF1E8
Malicious:	false
Preview:	(.v=BV....$.:.m...6>.o..D.u..._.bNX..9/s...0.......O:.z...33.U...6R,#...#^K..B.&...qO..X.l.}.q...t`.-..4[..........%Q.#......H...+...w......M."..S.........i..N..v.BH..V,.....I..(9.c......L..U.D..P..c.IO.C......2V>^.0z.a...1....75T..!D..u...O......D..F.....@.^6.4~....l@.2UZ......Kg.... ..G..J.?g.zoR.Z.aWM.#.u....z........xu.6O..b.R....O...p..& .'=.o.,..bFLd.}...1!...^WZ....(.)}.\|.i...<...zL..0vE...Mrj..v.7..G[.&..H O../....2.}Z.......p...=.`.<T........)..g.mzK.....2.]......d...4,.0.(...`.I...Q.,."...z....@...d......p...yR}Dnn..C\|pb.M.aaU4..P.s....,.v.=D.".z....=n............5./......@y.x.K.X.>..<N...n..g.S..K...z.o..c...I.B\Y..-v......MH.{...<...sG!rL.cYUK.U.....W..# ...2:.../6..3.x..(.p...9.I...%.N......X....6....%.)h\|...}.`....e......b#.C.....w....E..".i..36l.....(7.....+..n..3&. T.....ka..:E.`..Y.W....n.0<?.KKu..........yh`V7......f;.f%a.T.]:...q.........R.sf...7t.D..Z[.l)F&...a.+..W!.r.ad{0....Hh.GraN.{.....A>.XY..c..l.b..

C:\Program Files (x86)\AutoIt3\Include\WinAPIEx.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1934
Entropy (8bit):	7.74075076321136
Encrypted:	false
SSDEEP:	48:zITepa9RgBawGNccF7FRfnlZJvhHG0I0+Zauj6FLkHLa/52FHW:5t4wGNFjJvBaFkura/525W
MD5:	9AA6CE9C6810A8CC348198E7A69542FA
SHA1:	A97BCFB080F7AD2072E607436312FEA08DB15BE5
SHA-256:	3DD6AA38F1F751CE9FF915CB155729AC111C67F21A5BCF26BC98B2F0EB02EFB0
SHA-512:	34C020053E82012F7FF0BB817C2D14AE6B3D3F31C42EF143CC192F74F84DE10E0AE576F05AA05475D20B6D6E77A121A5428C7DBD91DC3BC96C018EEC9FE1C549
Malicious:	false
Preview:	o.:K...a...L2.U].q.d..!.t.Ay^b.v8..VUF..w.$....S}..r..l.c.M.X.'%...<.N....@...Y.II...M...j.:mxEw......,.P.k.Y.!f.._.."u..+.n.Lk."Q1/q.(..<....q..&0....V.\|.q....Z?.Q........k+s.Ns.`._.dQ......yO[...!.'.~YX.....+.`\|....9X.,1.q@Kd\|..R.Ag7LW.\.MUO......rD.o..2XOT.....,.).w..A.n..6,.!.3A.:f}.5..E....r...4...&...\|Q.$U.......-....f@..H.....t.\...........F...%.J...m._<.L3},..p%.(O.eiV..d....[../,.......{.@.o.S....J).p).(...z...=2..3..fDN"}'c......UU......^.\..BNM1..p...-..\..=1.........i..P........,..U..+.#..S......'=...sQ..........=........%:..o..F ..X\."Cb.37r..,O..UCsc\w&.* ...i.....`%S..t...lu..=<g.>.Hx_...4..N..I.X....o....%n1..N...o: ..p.Y.B...X....e<.;cM.}...V.".8.Zh.7.....9.K.....:..#.Lf...m:...'.M...M.u....Y..=...f..n....M....}5....Kc...pl6,.iaK..4..y...:.<N..3.......N.#.""...G^.x..NF.....xE..,].b)....Z..c.m.`.Z#.......`..3..~2O.n)m4...r.............n..IF.m..=....F%.\w;..\|.W...&...]/-./]8..&h.*...=]gP`.U.d.p~..A.sF..\-;..........

C:\Program Files (x86)\AutoIt3\Include\WinAPIFiles.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	95853
Entropy (8bit):	5.668956697351653
Encrypted:	false
SSDEEP:	768:2mbko5db8BkrACwl11PilgcJBmTsYW1++PBO7sxkgxVtmo0JT6giYGOIHH6:2mbkfrMBb7Pg6HOia
MD5:	FFE5C0BF7CA54DA4D41960F2EDE68CF8
SHA1:	0E105C5969DB9EBB91F01CABB0BA47D7667D7124
SHA-256:	A8ABCD0CAD8E84F958B4AA159549725BEC74B5912A09692D937379DCCB268E5D
SHA-512:	5BB78A46A090D858F273CFEE40A32A201585E23489192B476761DDECF4C973230BF92A9110CD858E267E097447DCD12AA0695322E52F81CCB6449627580D9B70
Malicious:	false
Preview:	qv..@[dv...\.,.(5I...9v.5"....Y.X..,$c.....>u....Gj[6..P....@....\N(.F.r..n.ac.b......C.p.....[.z...='.......S.H.jQ...\|`\.......u..^B#]N.V...f.....zW.(..i...l..5.G..b.........(..t....L..w....;.......,.^...>.V.4h=....i.\X.j.R.)I.<.W7..b]..q)kPl..l..t.~.M..N..ST...9.vm.;.;..Sb"J..-.+i(..L..Q.b.[p..8.....R..p......Px..)=..e..b..i.e...T!)w...+....R....Mzi$E.X...h..;..V>\;Z.>...f.S.........R%z..b..7o&.@..!..8?...:..._k.Kv..q.....'.0T....6Z.K.....s.m..n"..W..........<....o....7D9.......Th.j.....6....y...f.@....F.N_Y.p].Y..1.~t.U.g]..5bnlF....!],j.Yb.....u...v../.dJ...}i?J..c....../......z#.&..1....?....o....1.;.".MA.T.t...I.['...E3.3. .3...ZFM...%...&.n}.f4O.YqXE....BR.c......fV.&~r$...s.lV:..6.s6....m......F-....>q;....Q.h1..........%..[3.g-.A.X. ..CW.s.e:k.G..r.dI.v..st.zJ.O.w.y..Qk...#.y.r..........d..BV..b.,5.t.4"...v1aO%..sK.U...7.L.-....g]....\|6a...........yTa@/A..<}.#..e9n.0.k.=}...5.V......2.......8...&D..."...@......./a....\|F..l\?>...

C:\Program Files (x86)\AutoIt3\Include\WinAPIGdi.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	204408
Entropy (8bit):	5.593810788080899
Encrypted:	false
SSDEEP:	1536:3If/ftrMN1gVMc5dq+Yro4Xo0sY4lBBLvpzGIxxOeAWsT3i3n5:3In1rMN1UotsY+DxxOeAWzp
MD5:	04695507D1944F2122C9E228A9685926
SHA1:	C39242F13EEB5F4DFBF18778ABBEE62C8F6E1401
SHA-256:	0FC34977BE45D5E866DE5555579BC9B5C02A84BCD2B746E13F806E74559F6D21
SHA-512:	50A2AD219D1D26D40BEDA767E13876DE45F5C48F9066A2C7ED0A8460A292F6B8CDE4D23C64D8B5F0C435411D5B2896CCC057D8D4A24B7423B6ABB288F98F7819
Malicious:	false
Preview:	c...D.....{b.C...,..lkX..}c;.....:.&.;.nX[.j..}&.f(1........C..j...k%3...x..\.4..w0K...?..\|...eh./...Azw.M..J.@<g8./..Vu.8Pib.....('n...Ebq.h4..y.e......JY...;...x..KL.(......KH.......vP...TVFH....V....}..W...M..pH..A<!4.......j.....l;..=8.!:]xB. +...S!.}...8....H..U...........w=.0..+o.&u....t..."f._.w..V...![7...QR...........8.n.a'.0..g7..m....-...x.D.5. 6....:.h.}8b./&5...a.G..}......gV..K....>3.....W ...ts.....n..az.4...^....o!V}.B....,.........EP.....i.. .pp.<.......)..Z.@S..hZ]..0..S+g...7.2F..H.h...`..B....\|......#a.h2.9;y...9...4}7B..N.y4E...{\|.2..+...".Tx.u..J.N.s.....Y.E.....sO .?.^^.(.v...z.K..[.l.....(-8N.".;..T..{....h>..Vh.....'....).$..g...*...}....Z....,.st....~.:.]u...\|_.k..`.....k.]yTbX....b3....B..X...).-x)tB.l_.o...qgc.S.I9..j.#5...m.........tl$^9Y..!.jV.T..g.B..E.z....!.q.#............u.q..c}..s.b......1.^.}.bO#.iE.F=;..A..\|1........[.K_... ....U..~y9d.]0....8..{.E;(A...........m..g...r..k.%..o...m.1...`@...Q.\l

C:\Program Files (x86)\AutoIt3\Include\WinAPIGdiDC.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	20288
Entropy (8bit):	6.242199112203453
Encrypted:	false
SSDEEP:	384:rM0M+NE2kl7bbhqCNUqSsegk0lmietle9Q1WUfqWQrCN8g6Tu3FJlcUl1:A0M1UClPIguc81
MD5:	84A9489F19AA0D9B5A5AD4E11F34EB97
SHA1:	BB909565D1A73A325500C0CD5C12F212AC193DBE
SHA-256:	51AFB07CD327E20F5FCA05869DE42BDD6019D90080C8567722B2292DC94DBD85
SHA-512:	C44C23ADA022B58699E08CC3139123566D0256E6D62A8B6981EC9EEA2D509394DA4D14323C8FA8EF111B1F8F535002B4E658E4C174F48E26E8DB38D1B158B424
Malicious:	false
Preview:	.LdN.....)...\....2...M.o4.4...:.A.i.y<q.r.~..Ltk.(ab ..B.n.q. 2..Z4_$.`......;......N...~..+?.........p..0.`}y...x...Z..k...vo...h.HT...l.N....i]...v.+.x8/.....B.$sNYa....E......c`%Q.{...i._F#7..>....!l!{.H....5..&y......W..&..lK.Z..guP.]...9.A.../+....l^{....9..;.i...K..[.&8.B.}.i.`tM(..S.....I.r.Q...Q...vL....q.l.$I.zd.......-....G ."......G.=.W.:.9...............j.@..f?1.g.l....,...{.m.U\...U.@jK~. /..=..#x...}K.q.p.b./fu..C....Z..}..,..8v$(..\|...ox.U.3.K..W..&....j...[e..6./..E.T[#...}.&\[}C...q.........;....ry..r.l.j...n.$Ud.O...U%..I<..@k....z`.........j...v.....w... .*4..R8..^....._U.J!H\..,..\.sd...E.P..x.o+ 0c.0......z.T.@....c.D ....?.D.r./Z!..b....P...7(<.b.9vh.....p.N..q....2.....[9.]..c.0.k.....I...7.6.5....:...%......0x..U...?..v.0K?d....?;v&.......w8PcV......F-R.....Q...{.&<,[.z...B.......X.h,3ZE.....5m.dm...M_(.R:...[...$I_y.....[.....;.gz/.b.7c.L..h..J..y..a..h.H.A..py..C.....DS.......BW.a".8^....3...

C:\Program Files (x86)\AutoIt3\Include\WinAPIGdiInternals.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	29853
Entropy (8bit):	6.422881149205789
Encrypted:	false
SSDEEP:	384:3fE218XYal48Eofoi3S2yUWthkeFm104l631rVJENoRmWlu3fptX7X9HLEEbJk95:51DalfoitWahlSZJELkYH+0NXg
MD5:	8B962A3E6196969F7626E0EBD640D902
SHA1:	6CCA6D437C02C84A73A661E19071F132E1211CC3
SHA-256:	07A69B312310BFE62EE88E46B399D4B622A87A5BA60918A5D742EA5FCADF54AA
SHA-512:	FC97AFA5678D9C18FB941937C97C34CEC51491B01947E2086E540EAC7997B44D74D7BE6400032949975DAD435A0DA676A1821F9BE00E52061C1C5F679F0F9A62
Malicious:	false
Preview:	...'...#..d.....+.$.P.V...!z.\.....l.YV...}..te.{. ./..)... ..~!..hP.~....\|.~.V..!.gcB.6<>(@.~..+......N!....^.Au.r..T...o...a~..o..S../.........>.\...#;..].%..r.~`....LQ..dn...[.s....U.H\.T...J........y.E..\..%...H.W...xuR.;..{._\..RB.K........X.......".;q..........Y./.'.p.,.W.Y.5.[.9.\|.?.."G.8.i.F.gc.)q..fC..}G..`.....m....R........../......5<...b../..D..@...&TWO.d..$D...... .4.._b.~....V.)R.#Up..%n+...Z._.$l.x/.%..u>B.a..fm.....u..<.......!.4......X..X...9....[.:.e...fT..B!....:Wz...O..{.l.y.....\|1..u..V.G....La..m.H.P<.(N.x..u..;..V.]LzYgQ....t\E..Vb..QE..r......e.St.. v.ZL.....L0....E...Ec...+.8b..Q...C(..0..V.v....=}.M..j..b$.G...J.S.O..uiAB..{..9..]..B.....S._qj2....uW..f....h..t.....Qr%(.q.:j...y.7a?.>.,.1..B4......<t&z....A.g.GtI...V;....R)..... .&3..+_w.a.........r....5...{.2.U.z.[6@...k.u\....;.0..E.i...m...D..\|.,........S5.a..^..^*5D.q....3\Y.m8......5."#.x.\.Q....1....(i-.x..y..8..6AJQ..i...\........./..&...m.......S.}+m

C:\Program Files (x86)\AutoIt3\Include\WinAPIHObj.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	13408
Entropy (8bit):	6.785733722986469
Encrypted:	false
SSDEEP:	384:ddZLeojkB6j07q+9Yno9YiikPqxrF3+8qk1Hz+rh5YsTiZg:dXL3UWGqP28O8Zw
MD5:	FCB76E7A768F6EDBDF5B730108C46544
SHA1:	8F95EFAAB8EFDF006A9DB4A728CC615AA2B395BE
SHA-256:	DAA2FD643A30EB6ACDA57EABFEEB6C7CBD063BD0743728CAD5F114BBA259180B
SHA-512:	1E75D69F4BC87EAABCFCEABD5CE734C4A8E73CC25935DA84F80456A97A2F33DB74B968B82BAEA0C8CFE29BF479F88FB7BC3F213A723D05E16353B047FF96D9FA
Malicious:	false
Preview:	....W.g........k..............HyVq.....K........K.}...lb.._'.u.b.'r<.dIQ.2bnv.=.....q ...........]....d.K....h...R.Vc.!...Z.A~....o.Sf.y.['._c.:.,M.T.V7...}"F3i...'.3.X......(.....Z.........8.w......'@hj.X.?.I..u]... ......o.....F.......W...j.u$..z..\....w.tj-h..Wo./v.g.p.U1........3.g......ZM....:.h.o_l.c..~.06..\....h.%...\|U.).rN............3..DeC...l.....[.[...Y....Q.vt...N$...........8..%q{_.@...pI.o.5..qY....D..['@q.kP5..rB..Jm...R.C..C\G..[....N?...U.`3..JQD..l.b.l.......vyG......-.\.AA..\|..rO...]jD.{..5.E]_D..$....'r...."....0l........ju...H%.....8.. ]$..x..5n.....r]f..tE?..N.X-..qY..XD0$x..P.s...#..j.g..>tw...W.md....i....X..o.eh.k.kM.........F.....#.+(J\e.d.S..."..L0.OA.Z.znt....=,c.D..S.>d.P.\.5.6.....5m.2"m....W.j.#'g;....;.L..PA..~...1.E.#6Y..j......8.P....4..I .h..R.q..g..2.d$/.Q?;_KI}.........;8.%.9..H....yH...z...E..z.FQ+...u......r.7a.sc.m.3r(....q<......{...>Y!.%..,..U.........x.x..NR.m.w..%..).1H..b....c6..

C:\Program Files (x86)\AutoIt3\Include\WinAPIIcons.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	25815
Entropy (8bit):	6.434562945044601
Encrypted:	false
SSDEEP:	384:e8CoetmZtdLtSkYPf5dFOfByvOWtk44BaDTZPYx+RG7Yy3:TjeGL0k+3NPpG0C
MD5:	D87167D79A83716C9DD80B52BB7635A8
SHA1:	2E01DC31CCE7594ECC96C8D018445058E99CD53B
SHA-256:	11FA6452F0D251DA3A09373B60CA4510ED8092A38DE23446C4539BD1F9377134
SHA-512:	157C0614B00A34FBA229B0F3586072BB6C512087B38FD053EA7C8A8F679438135B4B95940E51E6174CB2AF7652904D36F30BF133C85CB0F13E78E442DB38B03D
Malicious:	false
Preview:	...b...Fq97.H.....Uj.....&.....O&...n...T(..V.G."../7.%ca./.F.n..Vs.r4.\.>..[.......o....X..:YY....."......>EC..b$.F./.p..v..!'...F1.W...t............hl.S Cz}....[u...)u.RF..E#....y.^.u..;fT.rK..`.8.......b.S..2.JgT#....Y?.6=.....=.di5..\|.a.]9....Os<1.$aS....k......Na.....(Dk...........y..T.r.F.}....1/C>}......,K..0.R.....7......N...c..T).g.@..c?2.}h....!.5./...g......}V.K....%..V.Y...J....../...........Q0+.t./...X....i6...'=.U7.b.N:.._.~e\.;R.h..I...j.x.>5F......9MBZ..R-A._....S.......D.....0s0g3x.[.....2.X.. ..1.LQ.{...W..X.d.?.pgV....p.6(.Y..ZX.l.5.V..b. ........t.[[H.(.Wl(4....g,.x...z.....bu..!8t.......%_7\|g..\...'..+.Z#.)+b(...XU.....XM.%i..Umi..)p...u....G....HC...\......w.RR......:\...k......df)$E.....`oT.l.3...s8Q_...u...j.Gq/.m7....g....q.;.#/.Y...Hl.x....:..W........CW....&...g...B.m4.T}.S.h/<u.R.e......`.p...W...Q.1/.%7.k...FC....AO.2GS...1...b....6@O.._.!J}....O.IN1.aV....\^vS..........%.t.Cn.s...+.._m\O5Z;<sX.0.,.,

C:\Program Files (x86)\AutoIt3\Include\WinAPIInternals.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	18332
Entropy (8bit):	6.597792079697179
Encrypted:	false
SSDEEP:	384:FcNOE2XDmii7zL8UVwJj9obQ3Y/cR3tacBmtUV6wTaYr9EpMA:0OTXDmfcj7TTTNr4
MD5:	642B2C6E62D9EB4F7607FA29BAE02B9A
SHA1:	98154E2545616FD5E7B3F373D21FABDC894946C3
SHA-256:	1C1909F34B1D048468BA0346A021BF59BACAE7715881531847C13094379B64E1
SHA-512:	1084C1ECD4612FF0B10E2B0EB8D4AAA33E4EEA7D33A59DD0D6524563646AA87FCE68286D9E9F5D698EDB9366E38A044E280F332FD9B04CB5E5066956E1D3B7EB
Malicious:	false
Preview:	@B..U+p...Q...T{...%.^"...%7v`......."....v.$.c.r.{W......@..#R9.0$.......w.FO .^..Oba.e...NRv.8..W.<v...}...\M.X.4~.6.....ry.r.r..w..l.`..y.(..B"Q'...a.W.8..e.~.>t.(..M..B.r\...d-.icSq.....mU..q.R\|\|.....?...>{..N\|....m.@.x).`Yy.T...D.@.wd......[..G..MB.+...}.......S...,jL..... p..:...3V..#.c....A.L..VR..r.j.....t......X..[...../v...0.._..A^_.........\./........=..._..U...@?u.u..}N.x......ZA..e_.v.M[n..%./..(.fO.iK....&...p$R. 56.....S./zF.%........#....e....J...Z...r........37Q2....#.r.F;S........].../..$..."y..M.".....P.'`.lp`..G"PE&_.b.D......T.f..S..a....Gkm+...IM.....W.o..$oyH;m..j[`.2...Z}...b2..n.."....~.#\x.%........O_t.."I..a...:r.....W...U.C}.Q.cTcA..&..aR(./...w....,.b..`......<.3.4..`..o......U.-..n...^....r..+....r.V=c...Vv.)...:l..>_C.........Cph...{Kv.....0.zj....[.......M.W.C....uK$..A;\.j....TXu..\t[.Ry..J..O...No.C...!..5GT.....G.?.Q.c..Q.y?[.....6..jd@\|........Kn.$...f.h..d..O(.....YAA...Lk...`.-..y.$.C...+.M...8}*...f..

C:\Program Files (x86)\AutoIt3\Include\WinAPILocale.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	21026
Entropy (8bit):	6.214703767731171
Encrypted:	false
SSDEEP:	384:MNThFkNGz15k1g2wqRRo05oNBi4a6FkbcsrLSxIUPqR/7iw:MRhMGx5F2wqjooozK
MD5:	695794E7D6F4956AED26B026BC44BA76
SHA1:	8A8051EA734C9827300D7EF72D8D96D81F5BCDD4
SHA-256:	4D33798A5FE199F5D26844A3C22D1A75307199097BCF2ED3D2BA37950587B36A
SHA-512:	E16C9B535226C16ABB5020597FE29D22F719B8ECDA252C26E82A71FE39EF4F2A4B512BAAE20087F21271AF475799AB63E66A649F9B864E699ABA7660F45DE47E
Malicious:	false
Preview:	..a.[.........G....?....x.O...... ...5q>_H.....EV....(O=.i.............D0.......9O...4..O...$'o...H:.N.>$..."..j$.YX.ez.K..=.....h9.._Hm.U..9..h..&..4.{.G)b.}.l."..._.y.&.9.........;...$.(......fW..H...H..o.D.../.x......\|...V.WcX@f4}O......y...=....}<.1..Hc.T.u.+.G...u..[.\|...Y.........s..}..x..........^,.jy(../...rD...a.....<.]..r.QIe.q..F..S+.............m.2.+..q..L2.V..PD..h.KT,..O..?Uw..gX.....R..M1$#.3.!..y.e.O+c...u7.y7......#......{........~..H.........."Z..^x3W.X.~X.......h....J,r...jU}..+O.#.9..D.KS.NH..B. .u...u.M..(.~JP..N7.....S(bw......T7..O?.p\|.i..q..iU....:=.M.(.......j.~.Z..0.:.S..._.Ju..Z/.'...O+.....l.PMI.l..-.-Mb..@[....\|..F......qg6....8tG.....}...~.by.z......@%M..\J...W7Pj .MA.5..J..m..~W.d."b.S...3..N.,..\..._.h..s.=...^..(\P..V"r..V..j.......=..y&.Is..i..-8.L...f^0......,...b..\..aF..0.[...iOV<.9-..5f}`..U1.0...@.m.;.......O..D...[.JX..e.N..C...j2......q...:.h...drf.r.=vo\.:...u{..R!.}3..Z.PX...[.O.e.t.-

C:\Program Files (x86)\AutoIt3\Include\WinAPIMem.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	21837
Entropy (8bit):	6.331242229290348
Encrypted:	false
SSDEEP:	384:p9TfFhExojVL8f4QSSj/LZhp1p/bXhpM7A1HsfQUheqEgaqFyjp0lULGlns:jTfBkT2EJcC
MD5:	DF2399A0F4FFA32EB41AEC744146394A
SHA1:	45885E05B006AAFFDDC70AB1CD77E4BB5FF05CA6
SHA-256:	BCF19ECADFB46DD13582EC4BABF2070A11584AE89897F4EEC0304A04E15784AA
SHA-512:	5B13C134234BD9D01D4CF97ADD57AD6A0A18E0D07DBBD954AA7A0F7715953714CD99BBF9C990947B6BD30227E8B620A9ED78B0B7993CD9BBF9D8A8EDAF4402EE
Malicious:	false
Preview:	.TLM....n-Y..c.3.#.wD7..{/y..c........gq....E.P.G.....$...n5r..)V..g.D&..da+.=.ow.e..~.J..u.TKw..M.7...M.R2Pi<..%4PoV...#.t........r.....S7y...1$!.q..].r'@z.u..fD....S.r.&.CH.j.9.{{..^~J:1..[.+.`......p.4~......4..8..F........^~.2.7>^....a(..r.e..t..6....JL...rFR.....;d=.O........q.\.........M.a...v.....r.[.~n.T.`..E....k0..W,..p.i.G.,r'...x.y.....oJ.S.i...!&_.w.`.b..Uj.&E....Es.cRp...zG.._.`...Zn+......:......I{.>N..(...V..)dw....5I24.w.%.cX........A3.}.?M....+..:=t...?]..:.=i.{...._..wE......T.{!...Ewci....v/I.A.(.......e.N.2.W.!.6. 1..8^....Nz..+.A.F....@.S.....c!e..<.m.d...,.7H.z..'.g...D..i..KF.)..^p..^.jVx7.'....Y.\...a.,C.[.8..y.5-./D.....^..i.N\|..u-..U......]. ....!.S.G.........!.:.+.L...\n.._F..zN.:H...N.a=..r]G...@.ha+..aL.p.:_.R.K8.(....lq..,Q.....@.........5<....;.5...._8..!..F.).bBs.4.".i..;z.I.q<'....~.1.......L.B..C...w^.H:.75...8@.V..<bVI. Q?.....B..m.za.u....e..L.l:+]-$.3o.......cU...;..bu{..]....X?.*..%...\7.F.`..6

C:\Program Files (x86)\AutoIt3\Include\WinAPIMisc.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	14550
Entropy (8bit):	6.656188942945894
Encrypted:	false
SSDEEP:	384:59l/S6jl/HC5Jr+Hsd0DrA2SRhg5FNkzipXHKU6:5L/FjhHCwjN6
MD5:	D43E3A0131F9341DDD09F4111C2A9047
SHA1:	EB93A93D19AA81C63AF887DBFCC1F84B910E591E
SHA-256:	AAE105062486C4D47B08E637E93A7B4D2A3DCE562BC05B22047EF55577E48B7B
SHA-512:	14E5161035C49662A2D1DC4352C9857113D8AD4C31F9150E5330A2B3B54B6C77B30EC0743155874FDA677C737E17C400E71AD6206C73C562801EA630EBFD93A3
Malicious:	false
Preview:	."........e..j....@...Un\|...)O...T[..../......Y.q..2i..Y.......}..D"..,.9....5.2.h%...!.G.k...........E...[j.....m.l...@.9..\|`.2..5.....BnJ..l.>..O:i.ao.6...Oy....@.:I.!....a..kW.0..a...0...f.-.....Js....I.$.8..~a1CL.I\...T....W0... =~.<G..}.rs5.:}..>.A....(T.Q(._kW.]B8..X....2..7...=......K...Rx..x.Z.[...,......+.x.?.t..<.@.JWRW..g.p...4.....t+%40-Dxm....N.h..L..!hR.:d.+.#..N.'..AXo.5v..P:r.~..)V..x(:p...q.H/...k#=..H...E.".N).0bh.k...}-k..g..!5h..D\H...M.....;.K....L.....5=.. t0.^.\.+....Mw.&v.>.2.4..@.om/.6\|..JA..... .m.........(.C.&$^e."D.a.F...........Y{IF^...4s.{P.......S..+...:.......3X.Y../)..7.K...z.5e,..o..t.....K.#....KfaWJ.?........t"6..\.3........}e..V..%.BG.~V.qI.KL.. ..8./:.z..f.....).h"....}"....)..J...lO..7..S..........7.A..F.C..H....M..p.u..`......R.=...^7.-..x/../...>B...6G./6......U.P.....3."r..$V.G.........?J.=..$#7.S.T..a.U8.59..b;g5g.?.=..b.f../..Y.r.!......2.YN)b.C...hz.V.9....].S.<zw..o..6..8M..zX.....

C:\Program Files (x86)\AutoIt3\Include\WinAPIProc.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	76956
Entropy (8bit):	5.865268396110466
Encrypted:	false
SSDEEP:	768:IP9UjqRCav3atHyMRD010zEPCBlSWRdJ1O0LKtMz:IPrUaYEPxmd3O0Wtm
MD5:	C7577ABDA6EC2DD07154F5CBE1BB0962
SHA1:	E7F5B497D19FCB781F05A18BACDCB053641ADE6E
SHA-256:	01F08E42C83E9F703DCD4BB0DAD0D1A6A8F601C879D64B3CBB26FD3395D5116D
SHA-512:	94E65FFF83A355FE5125602EDC35A911266EB976A8DA537AE84A56EAD2E750255B55FF9669D99D6D808CBDBE7A67D8422DAE5241D7C3CE034C3BA5879E37AC79
Malicious:	false
Preview:	.?...].G[..Q..SR0.Ue.K.~...^.l2..V.mNq..........~.H..l.................E....^SQL..a.........3....@..O..B.....O..O...a{mm.,YX.y......h...=...0N..g...PI....2.9[..g......./....O..?.qT.F.g'#.J.U.s..7b..H..r-qg`.O...+.......5.Q...3..~Q{Q[t>...c.Y.......h.n`M.4av.b=Q...2...A....U3..5F....R....R.#.E.Q....\.@..DFKp)..bb...,...e%...O8.. .>0..H....5....7..~..Z.....:].p.8.v...f..W.C.X...r/{02.[.....e7w.n..r^.L...#...e".+....#........n\)...!.37.S...uaML....Y...V...pS\|.#.a.....H...k...b..d$.\|...........e...%?.3...h...O.+...dP.i63......t@..D.W.s....u/Uq.aX.Nf.u?D.....L.$w...g.(^/..%.O..Q&..........F3.X<..<Mr;C.pl..6....:.M.\.H.I.........t.L.N...oh.`...&..F.=..2....v..b.W.....A.&.V..zL.n.&GE.97.x...GH8._X6Ml.i;.5..!....W(..wW......VP.R.....y'....4D{..n,.G-M.9!..b..6....\|.....s6..:jP...I.ImJ.[..><.rZ.Kq.r...6.2.....q0j..]........Y..w.&..aCo..5.....x..o..Z.kj...&".....l.J....(.Y. ..[.$F.Q...1.\|.Kw.[../9.q.~.M_.7..]I..............B.!0.dS...~59...=..

C:\Program Files (x86)\AutoIt3\Include\WinAPIReg.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	35398
Entropy (8bit):	6.033765800270255
Encrypted:	false
SSDEEP:	384:oCVtKRi2edFAaq4QEJ6FLQJftnHbIxOlSIkduajjyorKJvfXpCfP2r0wDbHhqkTR:oM4i2edFAZE4UJ+WDbBqEKV/X8
MD5:	A78F711EC8D6EBDD90B1961706DF77B0
SHA1:	6F7B205671A7F56622F838BC62305D2C33507FCE
SHA-256:	2097626405C917357BB2344AF90E5096CAAD9E76127FC64BA6119973A83EAFAE
SHA-512:	7AD18F137ED1057FE397F4916127F4254D1CBA2514C01DF70A9DD0EA54089343C48210A8E2C530DEBFE5F54E2287F789CB8DBC2C0A2F03480AC84259D4BEF403
Malicious:	false
Preview:	.]I.....Ii.RM...]uj...-}.....o@....?L.Gn...O.Q.~+.K=....IO8U.s7.....8kA].d.\|.l.. y..b......^hAg.V...j.W.&q.-.!.d.y...F9..N.._...,....x.....C.........G..8...`..N.o.X.. ......uKZ....m#h7._!./,.I@.q.$...s.1..a..N[{;..dk."..c.l.b.X.m.....i.(..[.JH....C.\|.o._....pK.....O.L...J?4<..,.i..[.......A.<n..?.A.G..`a.W8.s....n#......H.Z.....=.a.....^.i{\w&E...C. ..v..1.\|j+l..........;3.XW.....1..V...=.9<{.9...,..~.c.E\\|@..Y.c.ceEv..n...7X.k........L>F..0.u.=......\|.S...D.<!..ic....rxm..q..3..ARxck2.b.:....c..u.A.\.B.t....(./ m0%.(0j..d.\|.[.G..m?.V_..6$.B..'..,.#...g{.....-..}..H.I......y..M.W...?....Q'..=....1`].w...j.Mv....Z:.I'uv/@{.DJ.{Yk....O....o.,......P.)...U....C...V......^P.%M$.?..f..?..@.t.;...\......hi.Pbt...{.....wG.}.....3..Ft;'..eR.J..{..Z.p.wq.ZK.m..3T....#..5.......X.6.K9.E.0.....w?.......P.. miR......k..s!..>.b..,.....L..J.o..=}.R,$T..@.."....a71..k(.v.......5w...Pf...#....J.............8.!i..fn@^"X...]H*P.G.x........6@./

C:\Program Files (x86)\AutoIt3\Include\WinAPIRes.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	38703
Entropy (8bit):	6.10881443531837
Encrypted:	false
SSDEEP:	384:e8EBYnfant9QQJlchttfojVo4Txou0XHoBZp9hzD5pnEUGiFkjdvl7EngplNkUmv:3EBefSt/KohokoyhzD5p0nlGWJobt
MD5:	F46202389192151939F4796EBCF3A4C9
SHA1:	B7209E40B5EBF3C4478CEF1FFE10C38ED65CD8DC
SHA-256:	CFBF416A082C738419F0E017B9955432ACD8884C4B61D4CC19352F9E910B9264
SHA-512:	D1B238538141E9CDF718E9D988B119133C14AFC9259EF98D259C411EBEA79C4FD90B5C1C9C0FC45B57E619EE28A59DF139245EF4073F9757C6714F1C6545BB40
Malicious:	false
Preview:	.0p..y.+....G;.,...u...1..T...$.p:.`..."..........z.&.e......... ......J........j..$.6..m..7.?".L.j.z.Y....'`.. ..+Ro...5..7.1.."......W.3t..}...?.ooc.W....W.[jw.....^......fF&@..A...#?...W.@...09..Uq..,.X...e..;..f..<.<$:GT.9gZdW4.2/.aT....<~../.~.(.z......{..uJ.&..-...y.....0...6F..8..#.Q.=%. .....[..Q..GZ;.S........E'.....!..=...x..<T.B!........Q...\.a.e.Pi.J..j.....8(.P..b....G.0p.k.~.F@L..`.....Wl....Bf.r}..?...!...h,$lA...'x.m.?...,R.y9..KmX. .U...(.o..;....X.L......2.a....f.0...~7........R......7.l....+$..S.P..N.#.#..o......Au,#.hg.8.]........s...."9.#...QE..RH....\.n...q. ....&..p.\|.z#H..y.1...k.2..V.$.\. \|3.....f...d.]._.84P....\..%=.@.F.Q.....7.....<.a..~.-.p.D...J....9"......i....2..[...`..a...mb.......\.3.^d...HU.d....}.fF. ...^.r......3.f..;.....Dq.0.....e......[.x4t.[.Q..........)..jb.7....#.w.q...Fu3.R%..I...HQ../..a$?..#y....1..M..j.$.e..Ve...<..Tk.....'...S`....A.....O...!>q2"#.LX....?K........^wvg"...8......6.kR..2.

C:\Program Files (x86)\AutoIt3\Include\WinAPIShPath.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	44829
Entropy (8bit):	5.66694595999135
Encrypted:	false
SSDEEP:	384:MxkSp4ZZZMM2o9uLA4C0/eXYsoV7D/+2cv8t7W2iVv18GDIMqIzh+Hm+7V+Yn0z9:92pcv8kh189dSm/r8aO9eFT6
MD5:	39934DBD049EAC6A6E6FFCEBDEFC1DC3
SHA1:	7BECB0B3964E218A54E17EE003811E2A506A4530
SHA-256:	AF95FE1F03F6BF1DFEE0F2718AAABE0A7BBAA069771A5765EB45DEA7BD866EF8
SHA-512:	06805F5FAA71A5AFB5E82873044C48603E599815A83DDAD451E0778BD7E0A2D084E98F6B1CA1FB8693C08DC3195D4134E92E7729C7C3EB1677DFD8E748E01548
Malicious:	false
Preview:	.CM...hq.,.1..yi.5.0.R\|...5..^...1.G..pW.\|......+w.}.L2K(...R..hZ.o!7Wm.Z`g...d....H.3....i.V%...._.he..dE....?..r...=.h..=.3...L#..D.Z%.8H..b..ki....di.88.b=2.5..)b.G...\|Aw.I..8.7.....x@3V;&f..../.C.SzqjH.:.H...b...P.d..y....8.e.]u...Kw.iZ.....R..YAXx......R..FO";.;4..T.._...n.NP..q.g.........z.a..a..TX.....;Nx........VBR.Z<...0]/.>...,..R{[..........[^k..v....$..R.M....U....<s..y.R...k...\|.&$S.+$. .....j....Q.M...y..r)G..;..S..Z../...r.2....w...WX.O.#..NT...Ub.......Z..bP.gi..5."'.5_z.q:T.........aw).N.=Wn.O..@.\.h.....w`..V.^u..8.+..Jd$.....\,.e.J.@\|.D.......jR..R^z...:.g..4Sl{.A...I;.}...m*.#..-.c.\.T1bz......v.1(.....y...SS.....{u.{..#V..9Yp....~...n:[..7....:.{.wJ.M...P.<\|..9C:hA..W.iP ..0?...H..:#......?.%]........7I..L.Al0......ZZ....a<.?..l..o.(.LW.O\|......"..q.......P..H.g.)A.........@..D.+....]...B....j..J........t/..W.J\?.......q.?....So..m6.r..".........7..m..U1..O.3.........h..0.N\|.NVn.k......@.....Q..H.U.v.o....

C:\Program Files (x86)\AutoIt3\Include\WinAPIShellEx.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	42760
Entropy (8bit):	5.916252572681449
Encrypted:	false
SSDEEP:	384:cjvuuy5tPson5kRhTB/qHkNrFZhexGFdMwMXw53ZthEDwIo9Ya4R3K0DbFPeVBQI:c6uy5tPsq5kX9yE9VjObJ4GH+17FJ
MD5:	04BAB84B0C10584CB0ADBEA79AF61391
SHA1:	B9C84A11A8E83ECE7A4D891A362059A409679AF8
SHA-256:	C413F3F9AD315EA72C57A081A355672FE76F01B82C516B3420F446856113B957
SHA-512:	32DC6DA918FBBBBCDB82150ECD7B6A9650B6F2FE1CDD6C5E5A4DD96CA8256331707117EE5D40AD1B28D68527C7946635A624394CB286381FEF5FC79235A898D9
Malicious:	false
Preview:	<Q`.DyDC7Q..>_.."...P..E=..D..q.....2p.xH.....4T....BK.h...v.~..Wg"l".0...%....u..D.$%.;.......t...._r..5..`.(.u....[Qb.S...gOpG..Y.^6(U...Ct......r...d........)%.9.o......g4..w...s$.."W.c.. ..l9.5_s...>..$&..B%.}..`&2B.v[........S.P..4...1.1...V.[.?VVr.....D.Lip..3f..c.%....{?!.o....\\|..=..#.....n....?bM.gN....z].....h.\|...]wr...q.\...4..5...Ki.........F9.z.....R.;...s.<.M2..p.[..\.r..K..e...k......Q......6v.......!....Z.d.....".@Ka...@.f!B;...C...'..$pX....h.g...\|prN.,.^..... ....".OP.!..f.&....b....J.(.( .......o.A.].......fpm_.. .;.T...(.4)............C...n.G....a\|..Z<../.#.U..d..3....n.....e...^.ht../.4..[.Eh....?.y.A..{\|..;...$.-..,..Q...r..Kh..i.'q.x...Z..FR=..\|...e!.U.M0..z............OPZ`..\.n............u....II8..Sp../..o...w.S...}=88...H"..L.WC.G!y..8{Nbt0.8.&#.......#.^...QI......7....E.......=.7l..u)h..$.?@....V....".....Q".f..Q.\|r..(..A_..(.u.dkp}ln!l...b.J..?H.E6.....7.J49...tX...H.i.....*$.lP.6t..Cc..C;.3.[6..~MMv.7...8

C:\Program Files (x86)\AutoIt3\Include\WinAPISys.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	77921
Entropy (8bit):	5.539246612740342
Encrypted:	false
SSDEEP:	1536:D5Y/jn3PRIosoQoOyoWl84BD6lkHC4cUnUYO:tY/j3PRqQJ+lkiqUYO
MD5:	F8519B9EACFE11D03C90326E8F80EB7A
SHA1:	831FCB7E2093DF7654CD10B7F0462632413924BC
SHA-256:	62A0146427BE125DD7B3CF3E19080314B003DE5DBAC210D3AB3E0CDC1578A146
SHA-512:	FDF26CBD1BDAB1DFBE4DD449FBF36D23A5245526E52231BE6C7E4B1BADA6902701099FCDD9B6F4827726604347121BA2125FB27414DE7A009039BBC45D84919D
Malicious:	false
Preview:	LE?w..I.')....4xI^(.>.3i.,......s,..1.U.3.f90.C`9.\.w.&.^J......?..l...j..A8R%.RM\...x...U....\|....ku.K.....,..o8s&L.<...`}.TF.D.:..w...g.._. @.ej?......x.n.....#..%....o...=.6..........T.g.Y.Lbr...3.ft..f..v....W.+..2'...P.dB24?...q.,.}.HZ..h...X...O..z.?,8.L\|..NX..A<.U....$.D..%.].x.....k}.1.........2.J....>a.NDYk%....f._A).9(%.b5_.8..-.u....8R........e..SM.C.T;8..C....<%:Bn.Q\..i.Y...^$..c.........)a..qt...8.\|.)..q.T....F..M..:H.S&..e...i;.......Z...<.[...v#..6zI.h..U...+m^...y.u`.%..yJ.y..)....VV?E.j.......%.{f7.n}..R.}NU{..7..7.J.gi..?...!x.P.eH..k.t..,QMn.b.X...\4....:.G."..`.,.]..$..Z.X...aT......S[6].B..3...Bg7o.=.I....F..6.......jflV.7H..h..........1......S...B<,S..K.q.0.n.f.r.+.'.. L,.;Kq..f.^..[.....b..6.13.r..G>...."(V.......c.,.....:g.......3.e.:.y...edD....c.5ON..o.Q..."...I....j.x....Kq$...E\E.9.m.......YY{.]0..H.x.....Wf..^...S.'2.{.......Yu._F...q..TNt.........-r..'j[...NM.t.........xj..bX.F!....e.(..c...c..%...

C:\Program Files (x86)\AutoIt3\Include\WinAPISysInternals.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	28418
Entropy (8bit):	5.9541298708289485
Encrypted:	false
SSDEEP:	384:4w2Q6tW4gP+t+Kq2eTgYZAIDd7v5iPDrH+qYc3ghM4ul4ZLKRxE+meRvE/M3:atgKIFLW+O
MD5:	4121E9BD6B3DE4E2A58E7648ADAD7E53
SHA1:	7FC2BE4B40BAF9C88A474B4348C640CEC169F233
SHA-256:	D0350A1B98FA5C9488EA0DF23825E258F7924BF9B05F9DE1470D7C9046BAEE62
SHA-512:	A1620A571E3AB404BE2B0843860C6847494BC94D17E9FDCBE5F09C96DC6DCF1780A682BB4B6F26458FDC694B5A9ABC9BA84833C4FFDBC8C0FCDF19B09A91AD35
Malicious:	false
Preview:	a~\|..Nq5..3....P...........ij._...YT.HxC...WM..!...3H..0.H.$..G.../~%@....m.i..@.n...-.......F..]w?....9U....r....W..fB..y..a.E^$3....k....,.BP....Dh.Te....H.A.....$H..p.f....3Bd...%Mgs.....i...j/ql.Uc..P.6..a........QAv;.l.....f.......5.........uw..P........M.x..}\...,U..Z.,. l;....=.O....\|.q..U.`..l.a^w.J..4x..Uc..K+....Q.n.B.a...N.@l...2...7O]}Z.A..........`.p.'..Br."R.t....1..X...Z..`r.....,...yjZI.M.'...z..@.&..#.A..(.Y..v>8...o..B.-.rT...3]4V5.:.(./...); ..@.A..k3..S^.D.+..K.z..R6.k..tgA. Fs..RH..8]y\Z..8._......&5]..i..f.\..z..d....e...G3.....Zw.b.I.!...U...a...#;.\|.9J.......6{.j........%......j..v....cq.J....N........=C....g...&..^./.....h.4..*..L....p...\...T.MIq..x(.\k.s.}...(.r....V...e.........`...@..N.....O..vz.8.(Z.V...@kK!...n..)....Q.>..a....>...........N.2K..S...{C+L3...E.[.Suc.bM..!...e.<k.j4 0.{{I....~.....ZZ[..l.x..g....,.?....&d....`.;.).6.zYF(.._...p..'"Y.......^..c.. .....{..h.v.....K1...MD4..p.J.XP^.I.:(U.8.....

C:\Program Files (x86)\AutoIt3\Include\WinAPISysWin.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	58784
Entropy (8bit):	5.629246296105974
Encrypted:	false
SSDEEP:	768:vt8IGDC/6rY8vQygYepoec1bD1CgjkhU0/03bwC:VCHY8vQygYepoec1bIgjkhU0/033
MD5:	B53D9F47331C69EE69FEA11A1E859ED2
SHA1:	CD302809E4AB1A244BAED71AD63B60DAB45C5A1C
SHA-256:	AB0BE0CC93AD72B0CC0DB65E253498C81015D45FDFDC45AD1E71B8531DC5C20A
SHA-512:	F64E8121D556BC6198F59396C48E89D539E59A895B975391904FBD6313BABBF3A391F036A39AC34D99E3EB9A693F0879EC9954F7A1C9C1FA0B165E0D24A476BE
Malicious:	false
Preview:	...[..z....E.}.4=..e..s.\iy..."..Y.z....V2.-`.....X..0.i..s..8c/.....k..}..Z.G........v.l.... ....R......k.#.)qx`..~.I.W..y.F".4....Ai..8eDq...,fM..S.P.........T..^E..i!.%5j...+..G..^.....C..w.$$.5...5.'.6@...~..>a:.8.?Z.Q_i..N...c-~...Dri..{x.....R.y:3...A.}.".}.)9.Fs.\|....?7.d.`...)d.)G...Q>'\.6../.!._t....?sq...b..j.C..s..I...-..,.;.oLQ'....F..;.X].)1S.l(..-.<B......f~.k..l..N..m..6.%...Fn.w.U..UO.]g..... .".,..T.M...`R...W....8S....1.r;.3O`.........C.....m.....PA..^...p..Q?;.....p..UA:.w......5....._U.]....8.f?.P....H.0...R..u..,...p....0S.#.:....5z.Y.....oC..,......]3.#...._H2..v%M{[w....}........[B.^.k..O/...;//$...u ..Q..n...k.:K.Y.._.Dll+...V._...0:8.1.}........B.W..).U.S=x@.1.=.."p....]F.~..>g..........rX<. S...He\u.4.........fr...I.Xk...k..ux..E..B.....QR.?.yk....'.v.:.E.3l..s.!.x....iPF.j)./.v.S..z&e.U...w..w<T...mZP...H`.4d.=...T8o.!*U.!....B........<.H...g-...F.6.......W...7>:.A\|\|.W..8.\|.F....Pf gL3.{.f.^.....

C:\Program Files (x86)\AutoIt3\Include\WinAPITheme.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	42172
Entropy (8bit):	5.738752341539615
Encrypted:	false
SSDEEP:	768:QDGtMGDhyeanCWpVE6Xt4U8CTQAm9E/0FQo:Qm6pVEGt4U88QAmGo
MD5:	C54BEAECD84A1EFB62558CF78E60300C
SHA1:	64937DCFDB8C7D29F4B9D7DBA2D9B9EA2CA2D6B3
SHA-256:	85053A54E11C3B9B2B9AA30C56EF775E4986FD1310CFDF83D0A75847BF4EF482
SHA-512:	20C5E007F80EA8262E9A76D5F08173807BADE97BA0631683960B991914F359769ADB90025C99D773A22E232523F17EFBC7CB346F2F3D9D82E521C1FFB2212180
Malicious:	false
Preview:	.Dz...J"......[@.].~.."0...j....,y.......4Xu..V..@.. T.R.:....,...}x....k.].........:..x.B..?.XK=.c...x.....s.].. ..{......Z..L....JW.=B...`Bu.:..l.G.^c{..&r].....}z..J.MwLI.r...l}CL....O....n...:.:...\|...........1.gS0....e......7e.I..@.......5.fBui.K9...."....Pa...5n...3.k..4~...H.v!VZ..4Y./...u..d)..r.v.1..%T...X.o..5=...WYWq.._.@..(..Vp.".t4..j..;.."..f..b..v...1'...l..V.8.........`.y....)..by.#.....F.l.\^..S..1...l=h.%.oB'.Y<.Z.A=...6a...vI..........p.Z..?<i.Z.s....P.:uq....].-.`...}+.Z(x.MB'.......k..q>t.....S.:7."nI.U&i...U/.bE..~..Eh.V.cHud..u.=.......p.........o.....u....)N..)...lG.....B..........Kc..D. .....h..."../!^.....`.sKs..0.ge8"MR.QyY.R5.{....._.....I`N....%.Cd0o.k.....J'k...9);:...%.#j.4......\|_.#..=.Egf.Y.;..\2!.1pq......'.i.+..,.L$.:8.8......8GY-.r...R,.s.^x......"...cTy...._N!.cd.?U..>~.H+..G\|.S=...z.Ch.>.iUk..)R....n...Pt#.....u..:D$a..I15....6..fJ..wS.K.s...w8'..>.a.Q..C=....-.V0.lWz...&..2c,T/c7...}(....0.3@.

C:\Program Files (x86)\AutoIt3\Include\WinAPIlangConstants.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	8644
Entropy (8bit):	7.583590388889138
Encrypted:	false
SSDEEP:	192:4AmsgRyJ+fWtYosEPgmWUbfdOHPnLOQcp9kmSJQHk:4AmsmyJ7KcgmWUbfdOHPn3c83JQE
MD5:	F72C8F251EB51F99C5BA3F55FAC5D860
SHA1:	5F161C93DA6845DEA97BD3B4C97C9B9E6B160D17
SHA-256:	7BD6229B49D8C0F1B814402F8F829F94DE74F0ABFB8FDE38BA13EB78CAD2A2D4
SHA-512:	7A385B61E88EFBDA36E173029BFD8542596ADC298729EA0F91A5E5B0F8B37B6543E889AC9EC5B9D874B5456CB55EBE8611EE9B031AE8D22E5112D25B63F1E44A
Malicious:	false
Preview:	f.....U.O3.....QR.....O.$...+......5.....^..k.m......[pz4}qj.3..')..h.C..7.$.}.S]S..$m...#GQA..~...S..y..5dr.g...UX..};..g...$.H.T..P....z.y1$...=...JDtw..D....,?Xy...=...D/...f ..R.....-..9RD_.....h..v.w....><^..R.2W....? .6:...r...v.....]..u..F.D...t..:..6..K..X.S.\|.%..Zz/.........~..(.(......T...7..f....;&T.......JIC.A@,.(K...z...v.N{..9....p...G..[..dl....x<"V.b.e....R.\|'.......b..C.y.....D.eI.T...]..5.1........0xu..I.O.6.i($\.....-.....o.2..f%6..y.o. ...6...._ru.....$.wx...S.^.E.tleb..O.v..U.P....n.d...v:^...~...i..7.,. !.....(..<.#...&..Q`9.....n.D..4y#{zF:.=.O)....,?.^...}..&W7.M.n.........q.m..Y..a.l.Be4Wu0@..c.D..k.N....I..?5kd.B.OJ..4.8>......t.<..b....,@1>.j==>./.U]V..}.>. .^.cs..k./...._m.d!;.SnUB._..1`..'9"#..:\|.....d..^2....1,}..C?..&.J....3~+.p.U...6U9{...Z.P.#X=."..i......=E....V...I.'/.u.W..>.....$2....8o\|.Xr+..M...=...;qB...:.`?..!..k...I....(.Y.a.,..g.V......<-m.....s...9..A.\.c.}o_=,..%r.n=.n{....6=]......c..OL.

C:\Program Files (x86)\AutoIt3\Include\WinAPIsysinfoConstants.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	9345
Entropy (8bit):	7.479439305826134
Encrypted:	false
SSDEEP:	96:yiSlcaVOg+rmIqkdqGqRxD157ptJ+iusZ7N5rrsalmNu98kihUaSJC/yAHT0iJ/7:XWVO9rm2q55tn6+pcN5mtuCJxy+Oj/
MD5:	6A99DFEB38731EB288CA0E2A368428D5
SHA1:	FE9A4F7FF623BC3065DF14F33D182ED841B8DA84
SHA-256:	06EF7C22393B2F0F8A78EAB312124F8EDC9FBBABD5240EB1FCD5DD78D8433A05
SHA-512:	1D24B57DBF45C99277B3A268FB00C2A12B35732FA3462BD829EF9484F448217F10AC1DB874257E3358CEFEB09D18BB740B626EF240F358B859392381FAA9C59C
Malicious:	false
Preview:	9+..v.........!.$wZ^[.R..E.Y.s!)........A.W..-`.[~]...2R..oHm.....\.-/..mGF.X..sr..].VHn..t5a.Q...k..9.A...^.&.D.]..i!.5.w.....qL..Y....e..s.....;.).1.._.K.....u[.2..i...=._..m...;....IK.....F%!...U...).h..\|.....&[.O....@.........rB..hf..wo.+.Dc.vXHQ........[.@W0..<...f...p..W.L.z@.G].Y.W....i......nK.......o..Z.yTt.F.jP...Q.M..6.....y$.........(...A..$.;...7?..-...?.....U ....'...m..1...K...l.d4U..z5&..3..8.6.....u...pj.'+...l}....3.o.F.KP...B?yZ....R. P..........8~\..X..G..C.........=.R..M....6..#........G..d.l.....T....G..T.>..5.+W^..c;.k...N....d...ioN..!=Cf..M.....6.W...F.N._...#...w........C.\>*....j(?.Q.Z.}...%'.8.\|w.XN..a:=........k.HN.F.&C....81..I..q ....fK.4.....f=$Yn......"G...'.S.CF...RS.?.`...i.F.........Ga..}..S..J4..@.I-...6.j.. .v.78..<L..[.5.e..cf<..@.N7..".A.........._$.!.f........Zx.....9S...t@.t....u....Qhy.q.m[.w...Kh......%>.4y..a....9.8.'....w..$.C......1..}._\|`....Gh.uI....O.....J+=U..se!..O..e.3.{.+..L.._.D..}.[}..

C:\Program Files (x86)\AutoIt3\Include\WinAPIvkeysConstants.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	6586
Entropy (8bit):	7.789204194524253
Encrypted:	false
SSDEEP:	192:LsDxcfaV/zBzXal1t/wc2C4kpiw/3+LdkbF7:LjfYBzi1t/wc2C4kYa+LybF7
MD5:	2CA8223F1784354897FE802896A5FD40
SHA1:	7107BD596C205AF45B369530BC1E43C7FA83360D
SHA-256:	62F0400A843516DBA57C412191965F143B35464EC6B8E77C204744BFC1774A38
SHA-512:	18A09228C44EC62EDB6EA751E93E0FCDEABBC49366000624FF4FCAB5DDE392500653F175A56455A86D292424894F8798C7E4E172F2087E00BD564CCFAFFF311D
Malicious:	false
Preview:	/..W....(..v.(.}....&q2......y.B..T=...\|Qh.6m...P..}..~...]...y9.'...3V9v.x..y.T...d(zY.Y..G........x}.M8.}N.o%k.c.........!Fw..j.3..>...4.".H..6;....^....:Cu......Wvp...........A.-Z.....V......K..k.`.%.k.. ..%3.;pY.,..~yZ.?...j^....6(.I..<a9...\|-A....'.?...W..$...]....S.I.3M.!\G.w{.......u.H...Q'.....cV...1ll...A.....X...3.:.(.d_~..x1....v.~.G.......<J..Z2..Pd.9_.].....W.DM.............Z..5vmA...q.y..l.&:.ik.k#..W.w.#..}........4...r.....<....1..;..G.X..o..*Q\.D..&q........a0O.P..>.Y.<^..~~......J....?..`....-P..-%%.;.\&.....I.....A(25..z..`cs+.o`....&....7.}.jZ.mzK...`.n...n..Y.#.B..wA.=...Ih...EW2E8Jc.O......K;@ ..A......}\|H.JM.bF.S.....PPc....['.H.+...Ml..k......nv........... .g..O..............F.g..p....@.{V..(..+.....YF..\.......L.u..j.s.......f ..o..U...)....,...E..\|...d... H..!....^#.M.Gh..YU..v.\$.&ta.Y...+-../F=&.....jr).,....,.x..,D..p.........s..38\|V.O..,...pK...NS.u.3.ME......p.>...N~Z.9..\.k.t:T.?\.v..vG..j5...4.......

C:\Program Files (x86)\AutoIt3\Include\WinNet.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	47107
Entropy (8bit):	6.079579993675198
Encrypted:	false
SSDEEP:	384:+gRrloPGg4eA7uva6/n5HGYGQklBb7TfTuMt273Rj758VyGQQ5kKVtMIQkCAiRwf:pl0Qg1EBTDW3RP58PNqwvwVL71kE7DDe
MD5:	9EF3F04E9542F99A5912A68A2B159A40
SHA1:	9E0D5FD540F8469C95A2F6ECAE50186DB9BC46C9
SHA-256:	2D95A325CFE6BC2B137A20C32E1D712DD5D992FE7184A1F7366589BF8FF4AC2A
SHA-512:	C11453F1C3367B4147B17BFBC8E8C0A0CA97BB24E9B85E502D5D791057EFEBF8F5862A005593D4D7668CA6244E770D7398E732BC04BFAEDDBEBF557D00572039
Malicious:	false
Preview:	.b....x .~....0.3t..../...b.!..M.O.}....H.F.2.g....sN.my...T2..{..0..\|C]..":.&G\...HP..H.%..=#......i...8.9...nG..n..m.0.L..?.(..._{...O.Hi..p\|......1.`..7....eX.lk.u.@...0..!.u .Y...UD.yNa.....h.I3.:..DpC...g..?...6..a.0..u..cCd.\'..q..r^......Fb.c.7....-,.;...p........d.-....3@f&...m..v...~.).Dg.KM.."(.RW\|.y.?......JV.9.5..?.M................9g-.I......,\|..Ms......{.c!)X.n5,..-+Q.......\.E..4......e....0.u....b...uO. .K...M.WK8s.L.....f8..{D.....?N.P>/{.Q.....FS3....T.J.....N.GJ`.[...{.N.=+..P.c.#.<m..VZ"V<..ny.K..."..^hX....^.>5C ..xyI..8(I$...":..F..l.1....G5.Ni.KD..cJ....K...'.......e.....1X,..K".....y.m....2.I.....n.\|........c5.Z.^...<..Zp...r.8D...n':6 3..[Tiz,.!...j..&...W...az..cUMR.H.....K\......yqR.k.;.Pt.n.?..I.P....C....._.....{.....N\|..K;.BJy....4.#.d.O...s.Q=[....A.k.+g......=.0.H..a....?R`P...?j8M0..j.....6%.....GM.....S.n....R.+.I.Y.x......8..b.....9.o....V..........a%J....0..03.;r...1<.a.ka#U...~...Wk.;.v

C:\Program Files (x86)\AutoIt3\Include\WindowsConstants.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	33793
Entropy (8bit):	6.453028017151163
Encrypted:	false
SSDEEP:	768:1IOPtjCnGWlShFrWQXiNPubcODGY36VWZwI:ztun5SOJubcWGY360OI
MD5:	399474BEF2AD7CEB06F571559FF1A998
SHA1:	2825AAAF4EDE76BB13F8137E55E7D342C3A73005
SHA-256:	AE273EC66AECFD789DE559E7423A198D49DC87690E475FA881FAE2445291B318
SHA-512:	8378A7FF1D79F140A6A1DB239AEBB79080376EAA3BDA88EE32D04F3E2D1063EE7C9F78696CBF8C5DA38BF8B54AABDDD4C90ACD4015E85A19F08188F2A119FE58
Malicious:	false
Preview:	.`......0Z.}.....W/.}.,.=.......!.^'.\|n.1..a..KD....N..........9.GQA.\|d.."-..i.O..G-0...G1...}....l...kUx...Z...A+.8.-.o....h.C....Q..Q?......~..l$)o.q.....^..).6O...].....E...1...x.UY.T.J.p..Y...}B.W..0y/.P.4Q..J.sF..,Ryv.a..hS.......La.u...I.f@.....dutP..g.o8..Irq...?..........:..d.1......)..f.~......s....$........@...I. w#..X.g.P..rg.\ ..4G.8.C^!A.B.$...Z.P.....:...n.%....$...@.S...s.o..>l/0....R.u....&...`....w.6......(....~....M....\|.GK..l.O.1..O"E..[....3...R.L..eS.....a$6s..wY..y._......u....2.......>.NcQmB...6.9ve..4b.A...0.......xX....{. ..:.yYS..R:.]...3u.~!.....7I\U..j....E\|P.6n..6.B.To........V4TWrN.c..+.=@(..-.A..gZ..L.7t..x.7.YQ.J$....6......d.-Xp.k%T..J..H..3U.8.\|.1..Z..#.G.QA..../.^d.aA.......sQ...Y#.Dd.\.0..?...~Z4/.C...?[..O.hW0}Y..LH.Xy......#p..E...{/...O......4m]..[.....S....C.oC...z.....QA..............t.k..0...F.........:....L$............`.#....z.F.P.,........(...%..{.."k.....CV....K....}..N.\|..Z...'s"..p...9u.

C:\Program Files (x86)\AutoIt3\Include\WordConstants.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	11995
Entropy (8bit):	7.157842899897105
Encrypted:	false
SSDEEP:	192:F8UTWc4RZGMuth7PmgsES7qku18g2taXBqS:eiT4aMMReg2FS
MD5:	F92AC4792F42989EE7DEDA2521AD46A0
SHA1:	D807977A5923AE5610015AE289962E8295E67F9A
SHA-256:	60C40721F937957BA2653839BAE2602E31762B4A5EEDFCBCAFD5890204C78DC4
SHA-512:	06BB35A80CEA8BC44ACC74FAD18225525D9E84D3F0A851B398D52B4901A593A37865E7A96FE728C62168E3E19C08D394AA8E5B24961441013F6C6B68BAC3E29A
Malicious:	false
Preview:	...D?....Z.w_8.Q...Wt.#.k.d9.nh..#.SV...J..n...?O..sbU..=.l3.qp.,.N..r.)...z.^.T)g.]wt.}..B....qM..7...K.C.....0..6.....W.}.....)B..9.a.h#.q..<.x7.2...5....'...W.&.. a..#..4D5.$D.G...8=L....J(Wx.D.0...5....a.,7...g#..&.+...{\|...a.27.V.......e..L...1.Jt.J...Y......]t.?....Q.C..kgg~...X..S..2C..E..y...#.@`....@.....o{....9.nM..%/. `..J^:.3...._\.w.^..S..f..D..%.....q.(.f.S9.....w..X.HU..:.\.$...]..9.m?....&'..JL...eFac.OJ.P@..".".Crl.9...Iq.K..z...K...{.<.{./..m-.I.......)C.,..8..+........k....H. ....8.....x,.~.>..HT:.......C.A.6;.._J......Z.G.U....f..$.....S[...a....d.Ut.d>^.].a.4.D.(v6k}7g6R...C...21..d....7.'nu2u._...m...f..t\.7......s..K.G3.8../m.......'...x.>.....ds........ZJe.Xlo5C..v^..+...=....j..[.~O.=....5.......B...<.R.Z.Rl}.Hr:VB.b.nBE... ....(....4.....\|.nT"...O...+.q....m\|oP.=...{.a.U.b....:.2....CC.$..xp.g'......\|.!&.@...d..k{.-.i..p..Fp./J.v.....Uh....5..x....iw.m5X.ZJ..u)D.`..!.....}...6k.j.v(=.P_...v2.......

C:\Program Files (x86)\AutoIt3\Include\_ReadMe_.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	541
Entropy (8bit):	6.764181808477403
Encrypted:	false
SSDEEP:	12:mOHzHVaGb21zfDrO0PKwYUH3UMk5aC5e4W:mOHLVaFlBYUXNk9W
MD5:	E4F03D07CD61152309A160B6CBCCB54A
SHA1:	998BC3BE5A760C1B0B762939D995D1A9795D6ABE
SHA-256:	BFC3B612B57E088DE0234C119FB89DC8C8096D6DBA2AE7EF73D8C38D31F45C44
SHA-512:	A21A627075F145C9D8A31766063EAA164D20184333C14640049DC0CC44C1F0F81CF209FE24C222CA66CAA9C83A35A99EAAA342233676CF9CA67DD9036D6255B6
Malicious:	false
Preview:	..X.....t..,'.....g.\@!..`...0...:9$..$ ..1...).9.A.h..fZ..._H..x..C4H.K<..Y..:.G....3.[.........m`A.1.?...."*?..........,....:..C..j.@V..{a$.^.}q.......V.v`):.lWu.....<...'..z.,h$9m..(ead the .au3 directly...d.J.d..L.........X.....B..d1.].w.E5{.i5I6cZ...hfe..........<.c...Lh.....aR.@;.`)..n....ML..r~.,..3..,.qyg..C.S.:7........>..H..q.....uW.`..]...Q..EH..`,.n.h.z..7...7m#m4.r.g.v.>.S.....%I..u...%.#.s.'....................................................................................................Y@....czyzk0zzhil.

C:\Program Files (x86)\AutoIt3\Include\analysistimer.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2878
Entropy (8bit):	7.855170003637333
Encrypted:	false
SSDEEP:	48:06XtlONKHnxKvSOkgwwkD3Y88yiRyULQzlalyywReYt4/ugLBOwl8p1grVddzTOa:0KlON6xKv9uN8yijGlalyyw4/uWBOZpE
MD5:	36FF6DD3EBF562B08C148D40B32CA0C2
SHA1:	E88C22E122ACDFEBAE24E80BCD68D743199FD121
SHA-256:	20DE93E6FAB3844E81B49FACF0F8D98BC71447C6EA77F3314B1E89035F5E421D
SHA-512:	614DC8AD753DC24F22FCD910C980F1EAD7BB887BBFE7BCB138F363824B7767061D52E70BC12866A476331105C8CB9EB6C75B223614DEA2DD5B4D38F9036799C7
Malicious:	false
Preview:	...Ol.......S.?..p~.5...]^_..;..../.Y..`'..M%.D=..........t..OYjS%..)68...=[........'9VFF.i.d.. I......(...FC.7.o{..v"....S..".&!...d.....,.@.\|..P..:.-a.G...2..~,!S...{d..`...W%>..<.;3.Z....\|.:y......6.FL...\|...2..1O.....f/......}A(..xQ]..).3....qy.!Q.xt.@?......e..6Q...;#]........BJ....?..Bu..dr=....79.?.D...B...a.......i.6~R.....e......R...g....>JA...&d{.$O..G.N.DDc..`.6.-)...~.v...E..R``S:.M.yc.......p..Zo.<n..n...[l.....~N ....{....'........o..0C...>\|7nL..).....r..s.sr.D[\|S~~@..v...Xl.h......T...f.V..I.....A...N...p...F)..b`l{..UH..tpt%..s.J.Fk..k.B+$...{..R....l.:LG5L..2o.f...B(...2..7..m.B..T...w.vM.La.)....m....\|.W.SB.....^)......./......5...._I'1.'-t.&...}..e<..z..:+.<`.Y...W1&.._........72...+k..Z?.2.DM..^I...O..]..(H.g..q....KFR....lZ..3..&/'.I.....-...o....R..d..u{...eZ.~.9.A....'...mh...L.u.n......D....V.v>..!3.1.<Q..!m..j.........../X......6..QBy..h..P.h~..F..LcT..Jm`N).......$..q.{9qC^V._[..YU.Zf...].>.<.{....6.Y.cF...

C:\Program Files (x86)\AutoIt3\Include\cleanup.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1676
Entropy (8bit):	7.716519637144216
Encrypted:	false
SSDEEP:	48:0Wi8tznXlOWQKV9xtz0bTXd/DSrxF0oKoatEW:yCnVqKVn2X5Styo4+W
MD5:	400C0CADCDDA806B0170782C36D45F6A
SHA1:	C4DE4EA846E23436555CE2ADCBA9DB2F65045560
SHA-256:	C39E3EC0475C62A18378C550949988C4D26D4E069F9B81F03567B0420DEC17F3
SHA-512:	F39C05F5A470AF50FD751C2F5578DAA48E2E059AB95F7EB95844E80199842243404312587E6B70636C0EB7C064A6BCF0200BE6D341234833F4C7405D505F9BC3
Malicious:	false
Preview:	...7...13..+.......9}4.g........id.4Q...4......u.TW:.....V.F .&..Q.3^..1.o..U....dMQ.+...q.?..,...............&.eK\..1!.-cx..z..."....rq'...=......t0l.(.P.T.UD.QT...GX.].dpT~........3..........t.y.o.2K...=.......q.IT..%E7W.........'.7..=S..K..x6..N...e.c.&........l..J..".....@B..u....l.y...c\|^..7.x..k.}>.....o<...M/.U"...]y..7z......e....;`\|......;h.4"7.l.ha._.M..J..+\|...T.d.@^....:;{..Y#.s.!.'a..%1..KI.M....F.0.C=?.wt.P....%....H..v...e....#..&./.O.K[(.T..Xj.....B........aD.Q........xC.t~..Ek.s..>;....W.o.N........pX.M.\|.SD...<>....,.~o@..v..?P....H&S_......"......X.J1.........R..a...+.J...3v....HhW.y...\|#K#..E...m......N.....J.L=.=TzAC.1Vd.<Y...G+...F..hS..0..A..,.3.']...o....U..".IH...LU&.n..n6..'WU....v+..h)./.1......?...W..W.{..K...e...........1.H..X...,.Am..,_.B..2...K.j.....Fk..W.6J....".W.IZ..\..9{.yv......H..g..}gM%.7.P..E.b....4.o..lm....1...&..B..r.LH.t.S2.O.PP.6..+..$](D.GP..D.*p....G....2!..c#.MRl.+.W?....h.,.._.6M.......l.0...

C:\Program Files (x86)\AutoIt3\Include\corporate.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1131
Entropy (8bit):	7.533947966049657
Encrypted:	false
SSDEEP:	24:pDzNB7Ktfat7qx/ODGya7tmmb63F9kn5YHwatKlb6HDCia14Z/qIXZW:5xECB3GyMmmbWI+HwasJ6pb/qIZW
MD5:	F549ECC0122470E3D35160BB25ACC0AC
SHA1:	A667E1A626E5D63509D717E1DF8D03C4ED009CB1
SHA-256:	133584A5E7A99A8D9DE471A5B42F38BBE06212A3E833E51436743CABA5BA8463
SHA-512:	8DD68D17458814084B5A6CD9EEC8215B7664D65DCE69EFDB386A65990D1DCDC7C87DFD1F01A6038092684C407DB33363E3AF38DBBC43D1610AC7758182F4451C
Malicious:	false
Preview:	.9.........]W....@9:.A...Y...*........srA......;PyG/..F.W.'U.#.......E....d.....i..k....-.............^.TF....O..C..[..O{.T?.9$..Y..>.......I.....n........S...a._..'..^].7.:...].OE...z.<.8Ia.8.....W^.....1...m.D~g2..sy^..u.z.....)...1...0vl0..8y.fz..........L..}QY4B...DAGl...4YA..Z.[;.R\|.K.M.....).N....r..KY_.)..G........a.D.J...b.j.35.b...g...^p.+..!...h.......v.'-.a...K2u..\...98.............l.....<.[..~.c.n..9i~.....;..T.$.r..Q+b.Q.dzqZ{.F.......&.=8......~.C.....+.x..q..2T......e...b.......B...'.9..l.9.s...@V....93.O=.Vc./w......a..:.~....:y.....!.6...0:..~...=7.w._......@.$L...y..AS[9\.....H...gpQ.=4.TW...q.J<....c.....FN.>....Z..&,....<.w..6....d.C.y.'.p..j~8<.w.....^.N.H;N%..Yl......A..q..[..6....2..EnvVarSet("LOGONSERVER", $domain, 2)..&5.Jci.....~T.......OG..y.IOOF...g]......5s.g?........3....R...rV.......Rg.0M.....U.Q.}1..5X..L.L..n..m0...tS..).^K...i.R...:....:.C].I.4.'V.qgI(_...."....=.]...k.5]..3....#.....;J.....

C:\Program Files (x86)\AutoIt3\Include\helper.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	25341
Entropy (8bit):	6.717951084083273
Encrypted:	false
SSDEEP:	384:Elq7Ar1k/p+4hAqrVw1cnxGUAUcJBoIlkFHNaCXkpuEmWIInaO3gaY:EgEMwoCUcJBoXt9UpuSaX
MD5:	792CBCE1588AFE98D9664A94CBE431F4
SHA1:	48107698B1A05349356877D44FE3B17087F33B79
SHA-256:	F3004F9A3E0EE1E11F6890B382341006D0032B9DC000889DA64246B86F8790D3
SHA-512:	05739CA8109540A08F5EA4CC025D5AB6A6C803AE6F0CF0B6C7CB22F5D6EED896B78C9E41AD0450661A9FE9F19FA935F7768B7B64F2F67A8774CE20D04EEB1A4A
Malicious:	false
Preview:	.z..nb.j..a...\V..z....`Y.G....rk..MY]y.v....C.V....;....X.R.E..D._.u3rc.[....D&.#S..m#.6?/..CG.>..w].=.OD8...9..............Sj.`-.~.xB'....w..Y?...P._..MJCM.....a.V....J0..^..g{...)...j...\.e..{o..K...1..........,.U.....n..qxj...-.z...E..@...L.e`.V..03.1.JfS.e....7._..A.Y...x@.M....S..... ..sp/r%..].H......ki...x1"......4.h.n.@.K..5...e.\u.r.N....G.z.L.B.....K..TO....6.....".=.A..}.$.D>......H'.i.YP(\|..B..j.:.4.]..5..?P!KMX.).;.9.w.V-B.Q.G..p.~..>UI..A............-G& " ....~........gSm..c7>;)...8.).1.12f.........2..).........\|.M.f.Qb..'Q..@..[.\|.K\....l..:.o.K....S`..Z....").....h..p..fq$_F."...0.d...b....E..F.=.Hom!j...Y..M.(c.b..0.....2.c.....x\l..qx...61s-(....Gr..........}...L-.dr....5>..'p....v....4.{....i.D..U)\?.._Y.-....=q......i'.\|..Y...u....i..!J.vUq.g....r'c.....wA.t.......8{...BZ+.Q..G....W...M]..b..Q...bq ..C..B..f...0.<..y..y./...s..D%Y.Q=.}..d.A....!on..i...8.L...$.s7..{B.U...T...%.>.m..1...v.d..U...~.vG..=..q7O.....

C:\Program Files (x86)\AutoIt3\Include\htmlfetcher.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	5522
Entropy (8bit):	7.932651018669079
Encrypted:	false
SSDEEP:	96:jrhJbGFvWsxwVAaBzLYRWZEvxV1LkBPCc/mRo8qRXHCQOU3h:TbGZ62aBvYCET1Lif/me8qR3Omh
MD5:	712511441DB37316E0320B451A5A91AA
SHA1:	B0A8A575FD969D2FFF673D87E37AD8C5CB5D312B
SHA-256:	6A5041AC55FEBAF5B3CC74D8F32020BB100886C182B169FDB5826792FDB22DA8
SHA-512:	1ABF2A35BC31B402AD072664DBF7CBECB64FCFD10949839F50F1D7E454C6B202D75B5B6BA4BF55D5547697EF7688A83EEEAD29BA90185B8DD65027ED16875B5F
Malicious:	false
Preview:	ce.1t......w.{.e.d....K40..a...q...h......@ ...`K.+..L..i.R.<H~..F#...8...x......^.:.I..Z./.`?..L...,....#..M..m..Rd.UsM. ).V.x0o?........}.b..?}.b.."..`.4....7.]3....U.4,...B...^.....F....Mu.)..7....<0..8A>..L..2.......v..W.=.SY..........{g.....}k..f@r\|.[..6.g.p..(...G.S....D...E..xN....!.Z..... ..D...8m9.]J.h......N.O(.#6....... e%..=...q.I.......!..F..+/NKP..\|o..Cb...4x..pZH.U..H..h.96..y.2......R~.9....B.k.SG.x>f.M.....Cuk.....V.....d...D..w.39..Jr....4!.]..5".4B..IE!.q.q.....4C,..Ce...>w.B.8p<...Ro.y..+.0...j?B.....u.zO...z...@.{l..P. `.`.=....M{vb;.%......J.A.e..b`/...i..J..@b=.t....p6S.s...'P....(ec.....1.:.....L..nr[\|a...EI6...jjM$C.r...........t)a.M..V.....u..]\|I....j..0.PJ?..^......m?.t^I. ...s.-+.V..pK...!.W..2Q..q............6...rm{_.=..gz7.'.....5....U.-sJ......c.........v..._!..Q-N................j.:.)C;.t.P..a..q.C&.^`...N&.K.Ua.Cu..a>.(.Q...!\|.T#.../M...z..._..]...`.24.i:..".;U....z.Z......).k.}.<..$..b.m.rD..

C:\Program Files (x86)\AutoIt3\Include\htmlfetcherchrome.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	15894
Entropy (8bit):	6.965724796379411
Encrypted:	false
SSDEEP:	384:ibWPmYvcMalTamwmECf8+KnlWrD6H1XS626jBTnlv9xN:6jYJ5mj3fOnZHA626jhnlzN
MD5:	F38983FD554FADA7E97B0DDC5FEE49FF
SHA1:	6BD2697A009585A3C25CDF3E040E756141AE713D
SHA-256:	329308236F4E6817B961D33CA5120877AE1B3220F50BBDBE5ECAA4471743CC36
SHA-512:	2E91ACACDCA97D96E50304E6DBE93516924DA5C8887EF4B8627AEA8A438645F18CB8E34064E9626E5071FF8EEFB3861C2F9E2E073CF5AC9E71DF318C5284FBDC
Malicious:	false
Preview:	.,..w.v.a.\|.K.MO.....D.:.^.1(.T..y..D...y....;.w..=f.3u!..........GS..E4'.......U...^.?.U.\......\.....J......2.....k.ov...2.y.....$w}CQ.G%6$v....1.....;.^..@....iy...X....P.=./.+Jg.......ea......qH..o.E..qk[7A...!...b...n.y.[r.;..F.....F~.?.~..".../...0..;7J.c.....m.z....X]...F<...!:=o.B{T.'...n.6.X...:f...Oj..?la..Q..O...m..ls..x...`.......8...@..!...Z..=....DB....R..x.~.V.h7Q_...<IY..z...G..F....O....q.!..m.%6...}.M[pp..-?....61..6....D.}.w....j.....b!.......,....-........gN...m.!z.M.....Y...r..=,C.{.....S.....n{...dH..sSM...+..S.`...l.`.......9.F....7...........4..p.....'$.^....n.u...(.!..,.H.]G.......K$<...^O....%...vW.]....6Tu.j................6..w....h.p......i...wRs...>H..4xh.1?...0.8..#...6n..6..OF...O...X;sX.8..+f}..tT......w.......q..w...."d!..Z....#........j.n...E..g..t.K.!#..p.G..B."...R....8d...]..50....%.......kF.....z.........S.......\3>d..B....6.1\.....b.w..X(..{0=$NA.p.J(E..t.?...O.+.....K.}........ML8...rG

C:\Program Files (x86)\AutoIt3\Include\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\AutoIt3\Include\keylogger.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	6762
Entropy (8bit):	7.816394943666118
Encrypted:	false
SSDEEP:	96:AMmK/FCcMoIPlWPG45wl4pYF3q3tyNyjY+C5OrOqQq6zDzeMQa+HOyUDeqhRBd:j3MJWOKwl4pSg6yc+oOSqQqLM+OyUDJP
MD5:	13F5D2F448D9AA165494139354A6C4BB
SHA1:	A9D72B6AA994EB906DD32F9A0ABDF5EA7AB3B612
SHA-256:	88DBBD0A7DE49AD94BD82948456F4872DD5DC286FF0015AC57DB58C6048945CB
SHA-512:	8B4ABE5D0DAD20A9F3DEDB9444DE00A7E90805C535CC23AFE1711881FDE027D35DC140565C08470BEC16E01B2B106247E63AA12364242D6E4A3101EE4C4421B2
Malicious:	false
Preview:	3..va<`....P.^.OQ........j.O.q\|..L.GVK...]....x....J.x)`.$l...H..J-......"......Q.2i$3_......^..k.L(@.......7.+.vR...x..\..i.k..n..B:.N...Rd..l.Rpr..5C.n%.ZD..;L....Jo..<^.V-.....A.O.}.iF..s........l[..C.5......ii0...........r..e.3...N.?..7.._...\|.....i.zBQpV......!.CQ]..5{....+......S.w.+......u..tn.yi.\w.s+.g.8.q..>.)...z.....R/Pl9.._...... .=K.E.....s;.3.E....$.....4R%y#zv......O.'.jr..D..O.GT.V^.....`e.s.....l_..Q.....$..w..4....L..Ia)jW..`Z./.HM...}h7......{.....?..T.F..I3.k.z...K?.<....ho....F.5.j...R.#.]\|$j.....'P.sk2a@.b..y...A.......<..I...8..Tg%.e=.$.M7@...8......_.}$96.........:.....n...-7#"a...9.iy.c.F.....n...~u#.(u.@8.z.F..+f..\|..Kj...\.....X...`..g2...u..na..d0a?.v..... ..h...nr.+.L.y'S.6!..L..j.i...G....Y....Y..J...6x.s.'h{....2q.&.F.j.E.H.t\{...-.+.j.....7...*4_."...tC]....q...n;.....8.......:'...q..J..H8...g.....X..._.<.q..4.B..e..y..(bH.@59.Z...%..).\|..S.v..\....O...a..;......]........=..T.........[.).....e.R....

C:\Program Files (x86)\AutoIt3\Include\liveprocess.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2981
Entropy (8bit):	7.868543863197505
Encrypted:	false
SSDEEP:	48:bxU+im7QOMcvaG4n5/X4iyeYQOcuCJ/vdxtPfNXCpPfnhot6J2lZho1lbpqW:bxumHayeIa/V33NSQAJ2Dho9qW
MD5:	1C6CB423412B156531B049783452BADC
SHA1:	EE08EAC10250DC76AD4A343F4D787F79827BE5DA
SHA-256:	CBC825483E148B9C8A4DBFF3392618C5451DAF1429C0350A93DA7BE83A4B07A4
SHA-512:	22B7ACEAE768C26A186A3F3680303DC58075B9E6D349FA0E2E1078D1B23421EC9EEEB1D07F0383B1A4C3E171296B90631E5D31D70CD1462230363483E27CF387
Malicious:	false
Preview:	.K......3>._j'.....c...x..e...0..\....1....jR/a`......u.h......$.AY^.a..w.E.\Myh....(J.(..._..y...>M...>..JvV.a~C.....we..l.........J.........!b...J :.?y..#lk?=.~..Q.g),.GMX..O+..........@..ej...)z....M.....w\.Z./..@......r..1..pc..?...'...z.M......ZNn..F..}.t.a.j..JQZ. .c;..E34@.#L#........b.a.3....5......[\|..~...._Q.aI\....`}S.......Z.?....fV...PJ..%..H..Y...e.>>../.i...D..V<,..n...}6m!.J&O._5...-.6..H!.......q.UJ.S..l..b..e+...-..qN.s.r.p...4..F..-/Vb..)y..?.!A.'q.D!G.......'..F.e..].O...,)...=.\!..$M.R...YUE.qA.L.7...r.-l..... c..6. #}BnQ.........zJ<..0-.c;...W....YXZ?..Fv...z....T....&'.\...J...%(.....eIn.dm.....(.T..yhi .}.d?...u+...$/=..8.a\&..R-h....v..S2U.O.u6...3.....&3f.4/(.`m.......I3...r...l....".].p..L..6U>.....>..t.6Ob9..c.r=.9.WO).....&.ry{..M...du...tPJjs....<..!l.....S2..i.F..\|...J.IIZo.RiR....U..'....o^...mdQ9.}...m..163.......{...\c...`S..8.CF.85]<f....7.[.D..............6..)w..T.+.K.n61.=....?..`..B6T,..=.

C:\Program Files (x86)\AutoIt3\Include\stats.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	5592
Entropy (8bit):	7.924537048172328
Encrypted:	false
SSDEEP:	96:u4lfFVc6lYtznhbmwGhXGUwMyiEnvOwMBhVKU1psyhWXvWhFwfE9Q3HGsn7Z9Ea:HHc6lYtz1mwGQZMyi0xchVffdOuFD2ZB
MD5:	02198B5DDF6D2A5C30DEE318F63BA2BE
SHA1:	6606848E5DCBC9C4AD2B439B3F5E63792DB2C2CB
SHA-256:	E6AC9DE54177CC0DE4780D6A7BCD71249D828E80CF5EB9D4C1B98A093F1682B0
SHA-512:	9E6714AF9C0BDC67D5C85FCA186BE477E2BD9D37412B3D3604A22470B48040E681DF47F153D6CDA7D8ADBC0CFFD147F7F4363B68435FC9F98FAECBB37833E8E0
Malicious:	false
Preview:	.....g..n&....G..s.....`9..].h9W.#.".....".I.d....(>d....?T..&.Z...g.lqs4.ax.sO!.(....-5.....p....2.._...]f....g....@.5e,.3..(....\..\.O..n...U..fx.3.......8..D.X.?Q..........O..k..F....1.... ...ur.,.._.a.Pl.w...t].X8I....eZ..5X.Q..j.mn$.n..........DBE.{>.S....,0.6...ns...47...5...R.?.C..A$&...8.+st..Ou).<.......Q.....b..>.~W.x'.o.v......6.EWx..-.>....h..b............T....w.........6d..z.yx....r.)9.3H.....~.J..pX..C6Jg...T>U.{V..6.(.rG..>O.q.......... ......F.....7;.)..-...^.3..O...Xz.~..KzG.....R8......db.`u;.&....i.m.;!..:.T.}.a....=jx ..jMB.A.h.~?..VN.m..X......^n[......l..........g....v.P.Z..U. f.j.M.Au..!V...N...".).LJ..j1.....#.`..S.W........,....V..+F.........^.....o.8<..Ll....^U.....J.<.......a_](...5u.W....V..i.].,...,:.u\..B.L.;)^.)\|a.S.......0..O....{._T.OIz$~..........T........3R\D..N.0F.Q[m6T...<..`P.c..9..aV...[.@....D....iE.,^.-.....m.1...j.L. M.K;...5.zL.'..).(:......1KK....<C..z.W.#pY$\|..~~Y......z..)..V.h..

C:\Program Files (x86)\AutoIt3\Include\word.au3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	33248
Entropy (8bit):	6.282261451082047
Encrypted:	false
SSDEEP:	768:uzRrC2KqvxkYgdmdjqR7ncmI6jIwmywOHYK:yRrCFqvMEpa7cmI6jIwmyh
MD5:	157869C96F08407606EBE4365CCBAA75
SHA1:	3F44BC9104EE610DF881EB2AA61804D2F0CF84D6
SHA-256:	B7FFC5D8488B7A013AFA548A8633062BF978BC92ACF1B45F0DEEB9A4873821B8
SHA-512:	5B0530A98752A86F3DE6537B987F8DBD08E9DC40F2B2F1F4AD502B87A9F814FBE646CEDDA6B25DBDC9E6FEE1B0660774B33DD8F962CDD9F4577C1062C7C4ABDE
Malicious:	false
Preview:	.Y.8......V.D..Y....{8.%.. .9.b......Q...Iqi...>76It..U..b......nB.m..}......T5...O........k..?..>...1q.)"0v.[..F......PF.2u...^.?..).n..m[...n....0p...B.#./.. ...P.~.9Z...P..........E........8+..,.&.f...1..F...tf.Q...]tl:.C..y.ov.@.X..Xy.[d....}.k#..L......m..U.r.]Pt....Y-.x.Z~.St.1.v...l......Q...D.y......%G.~...)..$..vO.Lj.t....m..W#....+..DlOW$....Q...0-..{...r/.'.j.v..Y..y..6.. .)...?..........:.H.....A...1+GWz.....6...........B..Ks.`..CoK.h......v.....[....i'8.....`../.e8#. ..p..H,.D..B%Y/.h;.I_"2Tb..y..s.7.!W_.Rv..W...:.....9<.........O.x.M..YV.2...N.Do.......b.H..;...Qg...i...K.x.f.x.S..n...@..>[V.YC.p...BL....\..wk.....v..!.H.}M[)....R..ax..Y..{.{..0.'......d.i.u%.\X.\|..u....oPe..v.....p.a....tv\.......&...._\|]..-WE....)......W.....,..J..!"....$.$.K..CL..(.....&2FN......8..dh...<.% .,(......Zw.S~....s.......z23.xy....Z...C..I. tyP..{..@.....`.@z.@9.L`..\|.U.;VL...-....U35........5.6`X.}..Q.^..8..Blp.....=.:.7..I.8..K.h...?..

C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2372935
Entropy (8bit):	6.941962936028979
Encrypted:	false
SSDEEP:	49152:xTdahtXUzg5cDDsteAe05qB0Ej9ZwO9p7MvB2vM+SRP7M:xTEL0DSeADQB0Ej9mOj+A5
MD5:	BD7E29078AECC3548908CD13923A3430
SHA1:	D546811661A58B6DF50233F69A992A0E4DE3B29B
SHA-256:	2462F26450D4F370079C438105842E619CC604AE9A6BE64DFA54EDD61006B88B
SHA-512:	9B818FBCCCBDE0841EE7F9D443EC914D775F7F78E5179FA667D8F1CA5E802A6BC4EEEF2DDA6EABBBB190959967F54C08EED11F5F5ECDB12CA83C136ADC6577AD
Malicious:	false
Preview:	..fq........S.....".H..@..;.G.g.t..8_...^..{u.\..1gx..I.......v...~5...Q....-...:..C.Ch...>#..).L.w.lf<.w....`...8.H.."Z.....-...jdyR.lo.....q...m...k...!..zR......f..w.?...,.........]s...8\6....K.eO.8......i.\|\..^t".o.-z1!.....bE..d=....k.3.K.l=.+.lB.S..6w[=...T.5.Wp.avn.l/.....S..>0.......ZU.^......A..}(.D........m......v[..2...&J.n.u.i.Yv%n..D).u.$o.......Y.P.$.:./?...._.......5q.k.u...)...xR..P...Ll........ibm..;..{....>...',E....K.C.;.s3..D+U....`']...R&.).{.k..RY...M?.........9..{j.....]....iHP...R'..z...~...Z.%..+{k..o..N...UY.........+.....6.vGd!...kK-g...zbq....g.a....j.`rv.X....$.....zO.?7$..[t.P.7.N..s47...C....7.......f.'.d..`.M...}..-&..=>D.Xm..8..{..O..K"B<...CcN.4..o........v.....r......7..K~.8...,.n&.....Mp.7r..)Ho..t........S<F.... ....~.x.Wct..y..N..H5.K{.x.3...N......#F....]ck.....q.^sF\|8....DQn..l%....&...B.Kk..7O9E..;.+....w@....Q{yq&c....WZG.:......{..Zz...F.F......K'.C.m... ....Cr.MaP.5.\...o.O..Q..z....+..\.~i.

C:\Program Files (x86)\AutoIt3\SciTE\au3.keywords.properties

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	91926
Entropy (8bit):	5.530574527119017
Encrypted:	false
SSDEEP:	1536:vex/vaRV0jXs8vDEqlrwEUnIzD6RjYY0idK3twPuLG97BPENCbG8Ua5i/Oh2kd9v:WoRoRlsEUncD6RjYY0idK3tfXr3YA70j
MD5:	8DAB013CA3C17163FD1A91D046E0755C
SHA1:	F228B55D26778426CCE6113D884AF8CD51B807D3
SHA-256:	9E9C69293CFEFE111A417F50263262E89018947E188CC3324B82312DC6361A7B
SHA-512:	C33BF353FCAD0F8022082912AA8A784F097BEE5C8A4C26BE2B314432DEEB3EC3C7CF241A40457ECE96DE179A1977FEF0B7842AB8803D4137B869D2E0488B0E5F
Malicious:	false
Preview:	G.q. ..`,.'..y.e^.8...o..\...0.....X.U;...\|....Y11....:\O...Eem..QN......jp.....7l...x.X...GH.N6..S..W..U.....%%.$]J....:....C.Ti+.]..=..~.[%.uV.L5...(.5.#....R.n.I...x.."......g.#.9.PBh........0....<S....... .....].....c...%.;9v......T..u..l...KN(R..L../rg...k...92.U..ak..`...p]...."@e..j...#...........00.g./(J..:..v...,......@/0$...t...C.t.......}...@..9.C.8...\|.o.`#.....3E9.05w.cl.)(;......&.=_~.v..e.}.D-.LD3.+...^..FY...v...QH.1..b.o=.....L....\|FD.........W..w.....%q...M"....j....4.5i%D....<...H.........;.l.s..T...5s...e!>.e....uT}.....y]=ZX..!..:J..4..u.....B....O.7....Z...QP..V....s..p...@.c...>.\|r..w..7.NW$..L%.w..Q..".9.Ac.3....{T$.B.0D6..].;......5..*...5y....nX.._.p.;.g%..Qx..D10..UO..{6.}"Mt+P...^....R.Np\....6..pp5...ZE..M.......TQ..#.+..Y_v"{......s..e.$...Z...L..a...F.C........fsE..el[Ve..N.Ob..%.{.......}.....'....)viz9Ar....l.y.........I1E..N).......NW.y.;....6..N.......}..~#..b.-..U...kaa5...D#..-..}...3..Ifl.QvX...V.Q...M...K.-?

C:\Program Files (x86)\AutoIt3\SciTE\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\AutoIt3\Uninstall.exe

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	72088
Entropy (8bit):	7.128019580471115
Encrypted:	false
SSDEEP:	1536:DSnNKUliKnTUMSM233EUKBumin3Q6ZQjn7Ab9:yBZTUMS3EUKBumin9ZQfAb9
MD5:	F42DD0C8004BB049DDC3250092DCCAC7
SHA1:	680635FBA2A8CD3144F0D9C6BD65F9A0D3E9576A
SHA-256:	FFB45829DB859EE4991FC5855DF054BFD670619141B3410250340D3653B2CC4E
SHA-512:	C8307DC0968CB9EDB05A7310831B5C19CCD517EB680E9121F0644D17D5FB1E4C657A082E8436D8252BE3EF0ECEC01E803F29E59E5ADF30CBCBC28DC49F32D6D3
Malicious:	false
Preview:	..<r...#'>.Fn.<...F%.M9.p.....P.B..:......)s)....\|.@9..#;....f0....,.........r/>KR......U.:j.7.WS1c{.....N8r.).4.4L.l..H......$.M.!.7..m.....m...i..g(!.F..1.A..g7s...(...bG........k.s9..B6/..#$....v..E.K.CO.+...T....}.fF.>$B..tf...c..w.HiJ.=..;..%.E....U...0..+^.Q.l.\|M....I.5.(W..<.3.-.).O.......a.YR....."+..."MMX..9._.....Y.A....\b....OM.U.W.1&...K~.E\|.DB..UX.f(\|.>..C..w"S^....E.t.'O..s. ....r.......2....4...^....5m........m..Q.. ...F....,Pf"=L..Z...SR..w9...U...c.%...!D....~/...r^.ia..b....c...r..3l.X...H..N.O.....f../[.\.rX... ...z.,....j_p.....A...\G:vr.....)Ts..l.+....$..#>u;...Es.-..b......[B.'.T............a....M.9......c..._s.3....:.K...6....9.x.....#.M N.5\|.~.t.>..a.2.8.... .k...g..7..-.3...X.k........#.&t.......?..._G....a.l..X.....\...fj.....O.!9.Z..QM.......S.......I..6...LZT!.../../.C.A....o........#Z.K......o...`p./.N..^..l.1...hz@....;..e.G..k.X.Lq@...0.4.....8.......I.I..:.^._.4;\.;{.@.j..qB..~.).{...........w[.>..N

C:\Program Files (x86)\AutoIt3\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Common Files\Adobe\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Common Files\DESIGNER\MSADDNDR.OLB

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	27671
Entropy (8bit):	7.604775545565601
Encrypted:	false
SSDEEP:	384:F2x49gGySRGUvPPuabden2HuoKNsAHNN1Be8k1BuR+zPsyXFgI:8xmD9Rrfhe2HuoZmBe8IBy+zPjFH
MD5:	2F0749345008F101B65231D40E4F0747
SHA1:	A02946BD3CFD432048BBF436ABD9BA50B880427C
SHA-256:	C1D2A63556745F0FB7E09DE32EAE01C368DD8132CF50BBAFC2A54F1ED3110B36
SHA-512:	B5722CCAC7266FD25124370C386CAB4CD7AD75BA17EA4410651393148EFF13A0F26A920256166585352063A036E45E99D3BC7CFB689DDDBAD48F14DBCA650C9F
Malicious:	false
Preview:	f.j..?`.^.e....6..tM.....b...;A.jdX...Ih.4$.T.#..1.r3.y(2.......[ow......8.?..;`.>p>..8..=.s...."...g....#..,.oM.&...[..lT..\>..O8`..w..dr9..S3H\M..u...Gn...V......./...fD6..P.roW..$...~.w.H.z.....:..e^.F.}..._......&q..F....j6.....Y....j..:...L.........__s6...\|.........0...[.......^:k..L(..V0`.;....)fZ(......`......v1L=..At..!..8H.g...d..$.}w..-.gD....ji......3o.....\|..9.t;...wr.ZJ...#.L.w......l.k.~^29}...G..'D..k...8..D<.r..:...3...F1.i.F%..C..8.d,....).=%EA.....\|.r..h2e.nF......i.B<.;....w......;...,&....5!1K..v.Pw<...x....@..Zg\|.{........XY..O.H.....@....ODl..L.;.{T:.{....L.."...~#D.,...t"..zgp$bE......p..u.k.!....S.\|r.=...8v.v.......Q!..r.....-./."!o.u.Q....M.G....K..H.:..ptP..0..Z..Y.z..&`M.Q..k....A..R...Vz..$6$[C#B%..t.K.....?.:%.k...O...S..Q...=wb.M..YUo....0.\........Qj..A.c.W..+.V....:E......^%s..f.7......2z.eRS..d.{......t.t.=...^.4*.a..H3.r.i.jp.-6.X....].......0K...3C......\|..;\..j.v...5x.."^.?-...v<..:[..I..lX..

C:\Program Files (x86)\Common Files\DESIGNER\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Common Files\Java\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Common Files\Microsoft Shared\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Common Files\Oracle\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Common Files\Services\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Common Files\System\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Common Files\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Google\Update\GoogleUpdate.bk

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	162407
Entropy (8bit):	6.392560150509791
Encrypted:	false
SSDEEP:	3072:ZXlRAGke4lF0Pi82v7kxvg4vsa6EDEnHXiilKEvugWNpnC2ckqfRrLZ2NQsSrVcV:ZXie2F0Pdxm8DKHyBBlz
MD5:	AD75C263ABEB8DD750FBA9231ED04E3A
SHA1:	A474CBA20EE85EB9DBB44470D1B130BF3BF3617A
SHA-256:	8B762456B65549E92856ABB99F87A6C9204C7BA1CA2CDFC53DEEF103F75222D8
SHA-512:	ACB5403A1AC9B33BAA1E23161D2BA272786ABE2A96512FB3DEE1B0D8F32FF516CE8960E9898A3EBAFBAE8EFC33B7410BC035ACAB10C7D3DAE0C7433DFA67FECA
Malicious:	false
Preview:	,Y..8....c..Q.C.....P..+...F.%.s..J"C..#...?.s......Z..}.....D./..L@...}:Y..WV..9V......X..."$.as.f.<..h..G.W..)......`'.&..4H.:p.[Z.-.[.s..I.T.^...HDK.@A.xf.Q......HV.>...c......)T+{.Ph.Jbk.K[..`..f..ULN.i.5..@....s1....0...C..l"7.G...E2&q......F\|m'.]f.W...[../.t..... .K...R.$......N....a.N.Jf....6.:........_J.]....i[....8.%..>A.....k.u...T...e.;O...N..'}.K.....7...Zra......F!...K6+w..<.(Q..C..h.5..5....\|7..mS.r. ?@G.3.zh/...d(.WJ.@...v.....^+-]...1....L..T../Z....;...o.!....b..1.m....;5..]O.[..m...<.(w.L..2F.).\k=.?....J...$..eg.....6.G.......V?........'..E+..y.a..".\..Ds...3....F....H0....G....Bm..Ib....u.....>D.E.GT..\|.g_.X.......>HK..w.Be[.S...A..W...z..M.y)w....0k.2~...{P.+......q..........O.....>I....Z._JH..8...M_.......X.$.j.w.3..FO3>.(.A7$Q....P...i..-Sk?.m..\....Ji.\.0.....2....<.H...0.0.+.}.^j.f2m.....G`.......i....F...pys.`..L&Y>.....J...:."9.i.a..V."........u....f4.....!m.I.>..kN tS.R...Gl0?.n1....!.....+kpa..u[.z.E6C.

C:\Program Files (x86)\Google\Update\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Google\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Internet Explorer\SIGNUP\install.ins

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	779
Entropy (8bit):	7.223089688550199
Encrypted:	false
SSDEEP:	24:M7/dCuIt2BoOg0dKjFZw5KbMqP3QO8lhtfgFq5khPsBeW:K/dCuItWg0do4uMaAO8lhBgFq5kmBeW
MD5:	044B82D11C02218CB5C4A84EED2D7FD1
SHA1:	046EB16C608B01FD5EDB37AC689CD9591D39BBDF
SHA-256:	863109921F0208442BD1471B3A6185D599462D42362531293F016595162105F1
SHA-512:	F11834C02BDE3B1A9C3375EA33FBD8BF8EC7E58C852E7449747A553FE965964A951427F68130ABC8C7010F81674C59317C97C49759C1A07BFF8A8DA8C07A9F43
Malicious:	false
Preview:	.n...Ry...E.`...6#...T.....xdQM.!.....T.OOUw.8.t..+...."b.iU.'.dY....?.Luu...@..V.6B.d..Q.Q...:C.}.\|;z.>......7....M..4Lb.]`'1+.a.0Y.<.....7.p..C...'...7!.e.]..Jny$...\|...}.\..;.#-.T[..Fe.)...a...<.r.e....+..p8.$...G...L.......Ai.\sS.... ......I...P....g-1P..L.t..&..wy.H6%....6..^..o.q..+......M5....\|...+q.fD..M..r.....Q=..-.....:...X.-..t.v.O.k..z..D...'Bf)}K..A.$....gU...m....J1...DI.V.......WW."/..(.....!.o..+0.<........ ..P...f.m}L...48f..e.9.?a...e}^..[)<~.....U..4...k.....IP.[.....x^..d..)..1.....p..bL..Km..u....h.)~5).h){.%]....XX.s..b@I...a...ml.Yxq...H.)O..j.w.9.!pB..W\.\|..X...6...........vp^<Q.<.v...(...'......................................................................................................Y@....czyzk0zzhil.

C:\Program Files (x86)\Internet Explorer\SIGNUP\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Internet Explorer\en-GB\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Internet Explorer\en-US\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Internet Explorer\images\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Internet Explorer\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Java\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Java\jre-1.8\COPYRIGHT

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	3571
Entropy (8bit):	7.882769742531711
Encrypted:	false
SSDEEP:	96:0okwIW70vZnsgmlkOxBJDQQt+QIfq/kUVHXe6MgDB7VW:RFcwl7x/cQt+feXJMgy
MD5:	26962FF4C99610F319B53F3D44F27904
SHA1:	EC1F4616DE272CF90518A99D7316FEB213ED5788
SHA-256:	BCA56FA8C912F6154E203D897FE5D963C85361C1CBB3F0015BA1AA365F211B1B
SHA-512:	5ED20B21CE04BA368CC309F4E0896C43E5A464CCF6C981E83EDFDCDEC512968AE954F3DE8ED69E6D8BAC8C3CF708ADBED0837B90A5E11E4110A5528AA03ADB05
Malicious:	false
Preview:	.@..Qcn...P...I.t........).P[.?_s.J..S..jS..Z..y"..".7N..$!.{.i!.._...G...`e7e....X..._.\......y../.t.......7.........s+..p.vF...T_a.e....x....H-..;Q7.U.. .t?.W.`.;. f..2...X..c.O..#B.N'.I.f..Z4.a.^.>....v...X...^.......2..i12O.t...p..K;4.n.....E=<.F/...X{aV4.p........I.... j{3...;..au......qIPf.i.....R..[JX...X]~+ ....i...a..G...&..7.C..xu.T#8Y`...W&...zO....E...m.Y.....\Y.~.CCl...../<O......F8........).."?.~.....;[xN.P^B8.....#.$.......9G..1..r..~c.I.}.&.r./...q.p.>v0y2..Q....t.{.C.a..8.q..K.S....c.s}.l.;..5:...G.c5...c).i#]I.5l...]_..+.....PQ......M)...wp2.\|."lx....].2..y.g..e....BL.R..&....C.\|ij...m.R=.%t....B............e.7..V...N].h.`!l.p.a..z3.%......:E...n..y.7..'V..L.>Bi.f&........r.w..R=..pCj..2I.cE....X....u%..j..z.A...z..;V.xl..&....#.l...v...F......j...Tx1.6...J.]....L..^...\..&.%..))......P. @4.!....`B.....,fW.a..u.@........hv$...4...y?(V..m...1..}.#...u.....+..p._.......B.].&..K...v..c:p.f.....>-4....>bTl..7_}n.^8(..

C:\Program Files (x86)\Java\jre-1.8\LICENSE

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	371
Entropy (8bit):	5.96156268472658
Encrypted:	false
SSDEEP:	6:+GKaQa6dtM32PcBfQKR2Oklk/lVYhSkHs/DKDGxWFtpt4HW:xKa7ytoecBfZRZWk/hIs/W
MD5:	4EDA7937CB7C377318DB87D9ADFEAFD4
SHA1:	2F616AB3B9CC7D06DA8F148F258F7C6A77086301
SHA-256:	A896D2D546C0E5E2F85ABD6401ACEFA078384054248AD398EBB80652FDCD1679
SHA-512:	976DFC7C6F6F1DA92E60A1C75A75B379981A47B24C281059542A1E31BB23AF4EE8C08A938F45255889D697F2A0C4A9C9F3443DCD1538D3002B4E6C588062336F
Malicious:	false
Preview:	.r.Q..s...p.PJ.k...W.}.B...YZXT....=..D-.e.._.U....f%... ....w..\....Q'0..B.PR.a.7...&d7.G.]..7v..w......`.;.m.h$P!w$..;.S..=.j......1a0..^.G1....==Y..E../~.)~.Z..y.....R.+,~} 0Y..6..P..`..x.......k.Iy......Y..s.RT.h.._........N.oIA.y..s.....................................................................................,...............Y@....czyzk0zzhil.

C:\Program Files (x86)\Java\jre-1.8\README.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	373
Entropy (8bit):	6.0067225811130145
Encrypted:	false
SSDEEP:	6:7oFXe0b0YBxLvd/GcuZVwCSeFM9Jr2gBS7hlDi7IHW:kFiYXEcuZVzSeoVxBYhlDi7UW
MD5:	4540CC6D0C559AA47758D0FA5FC5D3B1
SHA1:	C3DE5BFC5A70D826FA37A7CA67097CE41E02CA5B
SHA-256:	DAC2B179C3AAC490521D362B089D619775F924F7F875CB7BE34B2F6B17F2D868
SHA-512:	54E9C36304BFD7E8D4206F4874F2EA7E393A56F474898E5DE36285C69A5A43043D224E08507F582B732D4D674A2C87F6E61DD8DFB1DAB35C84888979A683B97E
Malicious:	false
Preview:	.....!.j..,rK6>@X.Z...z..F.F....=...u..y ...!....d..,.9.Ut...ff..C%'....H(\..il.@.....%.. ...l...../.......;.c...6.%......@/V.H0........%...._H*k.......}oZ.MA...A..'.....%....=`S.R......j.?..S..U..W....,}(%..p.n...g\|.g...(...J...2-.b.....l....a....................................................................................................Y@....czyzk0zzhil.

C:\Program Files (x86)\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	517
Entropy (8bit):	6.577921782141709
Encrypted:	false
SSDEEP:	12:Q02jXp/gzgsvkoFgpuTUlyCVKa4uE1JDG/jtp/+W:6Xp/AgsvlFcuT6yCVBmp2R+W
MD5:	5C74F73101389C906FE3A626EE973226
SHA1:	2F6EED9F875CE437B2D50ED72187C02861D5DE09
SHA-256:	EC56E1289B6E13FCB8328FF24465653D73700F2329FC1E46D73B4E5EF2962376
SHA-512:	701F02754F076D6A18ABFB43BCC3DCC4FDCCC410479D5C7D76B1E977D3DDF0EEBC724C25E8329ADD99162787A663680904A660EFEDB307B68B7D097B8AE9F8CD
Malicious:	false
Preview:	...U.?.........&.>.p$f.r.8a..>.+.K.\..g.k..sp.(.y.$..V...4.i....f..!o2.V......z.t..#..\|.U..G...}.r).,...p..K.A.g.."A....nent's license.is available as a separate markdown (.md) file...5....p$.v-e.5..7.....<.$Y.O..p..V....<T.......t....dhk..]6...x...ip..t.$.y....8#..J......p.s...=....]..._S.6.1)w.Ca....I~..s....u......z.+%.P.8q%\.....F.A..X."4.C.1(..CRa...N.%.a........`..f..Jk........................................................................................................Y@....czyzk0zzhil.

C:\Program Files (x86)\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	517
Entropy (8bit):	6.561068938554993
Encrypted:	false
SSDEEP:	12:5OISIl+ky9LaFogpu5BAf04IhWDmaQ44GW:5OISc4Laqcu5BThWXKGW
MD5:	F81FA9CB2D786CB4185ABB8F26A7AA3C
SHA1:	AD70E29549607DD39E2AB1906BC5B006B57C61B0
SHA-256:	C88E07DDFABABA01BC7D11F1A67305AB06F524C9CCE5EF15F64026702B2CFF81
SHA-512:	900A2B128C9943DF5C70A1B40152CF6AC59A4EA41D31223BD75C15342A525BC4C0BB5C233B852D238396F19B1A1A1DEA8DBAA8D114B48142353CBDB4060CFF90
Malicious:	false
Preview:	.C...>o.r..T....S7+o..7q.MFS,D^.UR......yki.........oJ..`.o.q:d.r.48........w....W...j..p...#k.}.....x.....U...L....N..$..nt's license is .available as a separate markdown (.md) file.....S.(.?..@.B...C.d.i.Lw.<..=8..@.v...............S....X.>Swb...HJn[...d!.k.b&\|...K(.e..!v.".h.2@mEi3{.^.@`[B..CCr..]....EY.I..J...dL.........nd.mI..>z..?.....6OD..&Y~.4..{&"*..?...N.D..?..lcO........................................................................................................Y@....czyzk0zzhil.

C:\Program Files (x86)\Java\jre-1.8\Welcome.html

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	7.58779268451499
Encrypted:	false
SSDEEP:	24:jc2OZ8VhuUAjHR+aUeRvPYCuhJS9gmbB6CUc81IBzbRdNofS5hW:XVYtR+KdPYCfv6Ch81IBHNsihW
MD5:	E3ABEDD130512C32E264FC573FE350C3
SHA1:	27F68817A19855717ACD3A903AB1D684B214F7BA
SHA-256:	E7F20685D329F37F704E73E685B63DC5A68BC8C266914EAB0AC430897736E23E
SHA-512:	4F2E8FCBCE1590C8C667A023092AE1CF6EA029DAAB01ECC271B434B79154B74237B7A9D599825B5AB3A64186124AAA4E58154D7D6E600D5B42A9DA101CF7A37B
Malicious:	false
Preview:	.Q{..f..p.n.r..\............W.8..n....!...\|.o.0&`....#......w.S.Z?...G.CX..>s$....t...1f!.5........I.}..n.z.y.`....;.....^...........=L..W..Np.o.A...`.....t'..G..{....bI........Q......#J8..D5...&.#..k.H?W...,$..X..q..$.........Z?..b...Z.[o.A...../..=D..N.i{..9I.....$.7.o.Q....]?l7....\d$>.Fs...leM.FC...Z..5..MS.. -O.9us....5A....=.}....7...3cO......@..!."...b.ld.....P8.s..3y.'..8[....#...L.-..}'.H.\.R.o...wj.@....T<.S=z("..g....R.>.....1....mh..=.7.....M.c[..".I`...t...Eb.u..pB..8e.....N.@.m......L.N..V.Z.e.....(.Y.....O.....`..<...n...\.2....~....).VJ.e_W...G.;.:.8..%.]...;".<.Q........mL.X...<.K..Von..87S...V.im0.=...dj.g.2.$..F.......Ah.:...).....J>..Y.a......]?...~#...+...O\|.%.n.4n.M.........!._.a..7.a.-!<..&.<..<Y....U0.=.Wb.$.4...@Z..`.0.!..H.e...e.p.hF...f.n.80D.8..1^...0...............3j.'..E...Y..ao...W\|XD....Uh.k.J..6.filiates. All rights reserved..</font>.<p>.</body>.</html>....h:......Vx._:...j...,B..f.....>2..7..l

C:\Program Files (x86)\Java\jre-1.8\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Java\jre-1.8\release

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	492
Entropy (8bit):	6.565931812823205
Encrypted:	false
SSDEEP:	6:jruaRRVAoEb5jLmhLCIDWXhaV9WLwtKxaqPl/FwhjXPPGGf8KoxRAqg2V94MDhl3:GcRVAoU9L1+WXEgwtKxaq6zPPlf8tnGW
MD5:	6DF2386CADA64601D4D6F8E34D03ED66
SHA1:	59ED10B31971BFD656D49BDBD630C844C34D3581
SHA-256:	BE184591D76413D4350E6D9EC96FEFEBA066C45F718AAD55481C1667676CA1DD
SHA-512:	6910FCE8FC2FA89A2BBF2D3BE8ED89866AE6F12455D45EC6EAC62AD885222CC42885FFE67B0B3DDA28DB61D1DCDA11C89E5B7145BA3253DDF9C5F39865C4B0A4
Malicious:	false
Preview:	.s....W6..0.<y....jx.lp\..b...w.8b...!..^..I..G.J.3c.I..............._...G.....sm.S......i..V..f%.M.:..........?9.Ai./.}..3f7df00d44+".BUILD_TYPE="commercial"..............Q..r.T...^]j7.m.F.`Y.F.%OS.^Q..\.h.\|.U.....R...%o~..K%4...:.-.f593.~._...\#...)d.i.).#XF&$.c..L!.J.\d.\|..,.....IQ)...8a+0?.gn#...-O7.H...<.~...pX..N.T.fg....."4....H....c..z..W...<n^.t....P^....................................................................................................Y@....czyzk0zzhil.

C:\Program Files (x86)\MSBuild\Microsoft\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\MSBuild\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\MSECache\OfficeKMS\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\MSECache\OfficeKMS\kms_host.vbs

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	41619
Entropy (8bit):	6.541864566979361
Encrypted:	false
SSDEEP:	768:mr7eFZGeUgd6s2WMEFqjsSUeddAdRWHptc0Q46fVYf+QifhIqN4NSmrb4okiwXUU:mHeNx2snwdAd7IPJrMotwXPSU3JKS7
MD5:	0516C79CD2192902BDABF8E8E3F291E7
SHA1:	1B540B4338F439DF871406534FAF07501D62C6AF
SHA-256:	1973BD4CC050083036C814D6B0001F24ADB2FA4FD62E3B38B900C2E45DFAAC52
SHA-512:	68799BE9B780D9C6F2F89DD649B403216A0C131FA5EA3D99913E1E985FD70A0B736BFE7403CA36D0E0690C96223D7087BD4000FC39D4AC68DC2B9FA978508D4B
Malicious:	false
Preview:	. ....#.M..v... D.H.......O..h.s\|....(<#.A\...b.....0.u.NN#..$.....^R..t...T..P.K~.tT..x.......\|Y.W...mg%....v...B.". ^.Y1.....O...^.%....u.3.i..8...p.mN..g8.xXs.x.... L....w........-.9..[...u0FIK+.d.z.....Mp....W>....J.....5h..pp.f..>oi.T.f.G.Pd...6...]6.lA}........Y....bZ..G...%.:.N.#pm.....AW...K.U^.r.t...?.....p..1.e,/(..G.7.n.oW..e..a...'U......k...0t......./.4.>..x....).......RW....P..=p.'.#.I.E6.......~}.(V..}.....an..).r.#.R..#b...ZHB.7.....M.............$....x..vH....^..p...\.A........{`...'.....D...g.q....4..d.. ..QD-O;(.x[D3.V'..F..K...............m.=...'.s.C1}.gZ.......u 0x.l..........YEM...'.U}ahP..{...2..aW.M......Q.{...-..Ak.rh!"....e1.6...p.$R...u@.sg2Ww..z.i....(..,......&.....Z) ../G..p..l.'d......%...W.....\....oTuut{c...kjU..."...4ri.`.....Z...m.z..n.OsW.......;.??....N......z.?...........P.6).......A.R:...Y...<............/.:=.3.M.=K....\|.g...X.N.eekemfA.9.n..d...P...u.u.....ju..L;Q~.......:...O.....<L4V6gQOw...'.Db..J.

C:\Program Files (x86)\MSECache\OfficeKMS\kms_host.xml

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	3572
Entropy (8bit):	7.891414010387188
Encrypted:	false
SSDEEP:	96:z6YoxtiKPnzDXwtbZ7YGpiISXvERr5hj4vtc4ZW:mYciUn3+zpiHXsx5p4vu4w
MD5:	7B4E0608B6DDD68DA5B1A12F85880DE3
SHA1:	9B4FCF304C39F1D9AC3E075BCFB5CB4C3A21AE5C
SHA-256:	B30BE432AD5F68E8100CAD4804833CF48803A9FACB9B0A50BE34F7D73481B560
SHA-512:	786A611771DB57EE5E0C08EA3BD86681D9485E36D6143429B544DC2F32EBC335864FBE1198698ED7D8739EB718073000639F875E3888EE4E3B79779CC0CEB25E
Malicious:	false
Preview:	;..Q....9..1.NI..{J..ij..R.I.c.L9...F.Vh......w.G.X.......X...<.7.n.....[N....:9.WK<6....4.o.O(8.<...a...{..n....Ao>....]L#....82.TD.j...v..Z....Un..j....q{..."%.V...Dj....f..x.....cw..f..`ed..d.1....?......@3.l....2.5`.....F.J9{A.Q.....'.,..../.Z....w"%.g..1.L1....s..e..h\.<.B..w...I..\|.......3.@.R...$A.m.}..Q0V'...Z.7.>...?...).....Y..).0t........ V..D!..f....!7...=...q.:{.....L.] ...pX.vw...Oc...p..t`.b.ry.....&dI....P......7.(Te..Q.B..K..Zqd..&....q.._[......s...45.:Z...=m.(.e3....OM?.X#j~..3.1D9.oR..>+.....v.......@/..0....Z..q.........N.,8.nn...<.)..c.S...wk..W..}....-.....SJQ..)d....%){..n.Z2.~...af...'..2.....=j87.w.9..i\|......U2.mx.M....x.......@..S... B..i.\.7\.u\.b.'....{..jE.f..u}..^..H..8..?D.\|.4.\|.t.(B.k......b.H}i..C.W):..._........?.?..{G!<..Js..^.kk.4.3..h!n'\|\|,.B...(.i.!.}.....{..^.....V.@.HO%.t^..1M4u...'Z."FsX..T..-..3G.W...ys$.c.[.. ...^\|.....N.c....s...8d.B.X_...\....6.s`.G.R*....X.D..5.c.JD.b.6..O.0.)-..1...

C:\Program Files (x86)\MSECache\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Microsoft Office\AppXManifest.xml

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	5036111
Entropy (8bit):	5.436541352814048
Encrypted:	false
SSDEEP:	24576:zld+g7nQAosAptvpJYg0oi1eHsu6emILueGUBFySszUkD7y5UxYY3OBlWAFWSdDV:XoiNI0493NIDW
MD5:	E97EDDD4042AF6A30A5A1F6463F019A9
SHA1:	C194936456C381B5473E6AED4201F38FC6DC4573
SHA-256:	A8A454ABEA964D22BBD7AEB8AFD9BDABC61110790F272A7F17E7721F29A7E91B
SHA-512:	E28268648F2B6300123B4401B9A52F3308273C2F7538141A1EFB3B53879FED83DB453DD2A0F47469DE36AFA9677186B6D0B30147DF24E3091622003A6E68CC97
Malicious:	false
Preview:	..PA99......F..H.`.!.N.....wW _^.F...J..9...B...rj...3..r\.3.}!..6.+..\...M..n....L...A.. sM?Z{.[.......3..,.....W.......j...q6B1...y....hE....m......K..A/.T.F.G....'.C.{(\|..I....f7.sl.....G..&x..:H.D1..?...2...>....G.t.w......].+z......iY..B..+3Gb....t?%...v..#.S.].f...F.A.[..9.r\Vg..g...)........"#.I....1...I.x.@.Q2. ...Vb.Z.i.....A.-...d......x.A......].....aMv7.....3..}Y<.[.Q...t.$.H........G..G.......,...U1.......G.'I?.......2Ln.[..Q....@>.........Tq.....R.BtrQ..../......d.xe7_f..a._`.Y...bJE&(O=8".@,..T94...4.....{....})w..p7e.@..ooV.2-...+... l..=@m.z..p..u^...6.Y9..k.....-...B.h:.6i...V...%..Q..0...1.....k7.m.pm&n..$E..S..).....0..c^.A%D#....kx_...Jk^.w!....+P.Oo.A...<......-..$..S_..v3.B.. .!.$.y...Y.H.l.R....4.\|qzC.n.P_N=.d.Y..../7..CRX.h...kWH.".9...."KN.s6`..'..'[F...X&.u....:1.0.:...)w+f.T..'}.H...ag..E.Y..l.^.n.B.......+H._.06.D...9g..7.....?..&..,......ns....\p...L 6.0.O..w.-.....BK....@.7.....K-...0O.(....e.\|.V

C:\Program Files (x86)\Microsoft Office\FileSystemMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	608
Entropy (8bit):	6.927362996126499
Encrypted:	false
SSDEEP:	12:+ysI9UnofAHqnM57pZYPOuYh2Z/BavaN/1qXuW:2qM57nYPOuYO9qeW
MD5:	58CB248D84767C95ECA70DBB26CC3054
SHA1:	095F94D46E28A0ACAF3AC3CE879FE661C05882F2
SHA-256:	DCA273602754FBB75F3C0473D483C5A1DE19425D4BC52BB608530E494867194A
SHA-512:	2C2EEABDF7A94E7AD139AAB38CC419434F02B9A8D8094E8C3D65A87904882BDCF861D95B585B146FDD1B3B6753A72187045D9A6A6CFF319472E5D16CDF3E2BC0
Malicious:	false
Preview:	......{...^.gv.+.i..t`Pz......"...\|.pq.i2..u.W.+......U...._BZ..nE.._=&..(wr.;f..k.......d..@3.....,..F.q#,X. ......"...y....f"T}..,..X....;wf....A....D...'._B.F.Cu...*:.....U...X..z.s.X.2..17.?d.i...XF..iO.R...9.#...;w...S.].......wt...ctories />..</Metadata>.....\T{...c..b......@%.5Y?.5m6..6.....q0..RbvP2.mG.KB<\nRz.n.6.."...7...u!....c.hz.,..=EU.Nm:.\|..%...D..^Tcc.a.&P\|[f;.;.h'-...8@.E_.....`;....$....}.fP.8C.%..X..#j.].e.&.....m...(....(j)R......4.C.[}...X....................................................................................................Y@....czyzk0zzhil.

C:\Program Files (x86)\Microsoft Office\Office16\OSPP.HTM

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	174855
Entropy (8bit):	4.589659138940389
Encrypted:	false
SSDEEP:	3072:gIrM91Fx5IyDaBSf4Rtl9lthmLJdg54rDlMf20UHQ4xwASbzfw7vrMo+XeRv74fL:hM96Sf+p
MD5:	550751BE036DA189244820892B3BCA1B
SHA1:	AF45746714330B04CC2F7F0060286F5C598ABC0D
SHA-256:	C71BC8ED953C9FE46A2D577AC2B291B6AB58361EB213C8D0B1908C331BB475B6
SHA-512:	9641D7B6B0997D2D3BF99073FC6080618C7362AFEC5F663E31132E844E941986BC6DB98C75D87F4DA7AAAB13CEF92E201771FA5510226658CA2E0A720991FDDE
Malicious:	false
Preview:	m..-na.h.W. .........2...,2......".v.y/B.4$!F.F.?.C.....C5....\|._.,Abb.J......5...H,.9.8.....T..5.}....-.x....F......?q..Bp...?n>.....02..._..j.\|.}\|.p.0.....#.3c..P..b.7s.\. ..O....b...M..;\|2..1.....E+.$=FZlgx]2........$wtG......7.._.3......S.".Vh....n.C0.D....+...V.n+'.8...D`/n...^^...%g..Yy.....J...=.>M......1H..y.h{...NT.Fg...u.7.....Ph.../(R...M..Z....Z.b2...u;..1.g.=..1...<...l.(J.......2...)EiuE..G..q)=...2......{..V/u6.4./7..&.h.......'.I....S........xG.....O..Ca.!.8..(.`b.W.3..$r..Y/.....S8...)..h..].@^.[`J...1.....QQ.4..jp...7b....P...r..>k..^'...Kc....C...B2.d..0.fS\^7..h.V._......F.wc.o...V.=.Y.u.D....W...:..D.{......+.3..[..]0b..xK..U...i6.u..?8.........?o...DP.3.O^..(.'B..X...o.......y...Mx.$..(........$...7.n.....G..":nhrh....x..P_....@ca.r...5....._.v....0-..Pr.xB.$...t.6......H.}d.-.^.._I%.;.....v.\|.*.e.z...x.3.c.3[oT..ZOtp.n.`q.LVcC.%g...:..MCjn.....y......0....7.7.....#w.\.i.."Y..b.dU....^.....R..=....?:.$.l-j.....m..4.

C:\Program Files (x86)\Microsoft Office\Office16\OSPP.VBS

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	107339
Entropy (8bit):	5.802249918419331
Encrypted:	false
SSDEEP:	1536:CanATyhObw+Zy0qgxJI2Mo7gqkbqpUvnN+8qCiU:Ccmw+ZyuxJI2p7gqkcUQ0
MD5:	A2822F67E189A05C37A40DF1391DD55D
SHA1:	8918C0AEE439A8D8C9A7D4F86992AC6DC2555264
SHA-256:	B720E8732F598CD689B06F2E37BFAE9836501AE9B99ACF46FF368427139A71F6
SHA-512:	FE655AE8BCE91AA42F12D3368A510D90118310EEC238BB0409EA52F3B3079E4BAC8607C1695FF28F95E9919E5D359682B173E27F0E43433414C2C8B4605195C7
Malicious:	false
Preview:	B.8......z..G.+0........Rf...PN.~..D&..`...<.#.:....c,\w.z.".....,...H.}V..../.....,..}w[...g.y..<.]pb.3.h}b,f..r...._.m..W.... ..9h:t@B,...}.?...q.O..,.1=...t.M8u......=-..C...J.0.......1.....?..1.&.....{1..^K>.'., ...&><.?.Q.i.&4X9?I.......t..2.T.-&{.m...K5.u]1..U..y....C..>"{X.(..&0....>f.^.e`..,i.V..cv.b=.T...^.T....U....x.>dCiQD.d.#...v...XI....wu..Ki.1...(.}.../!...5.g......y..5sH~...X.N%...{......ZWc.v6...~.....U..1b.F.Zg.BOU.... v^.A/..i..=...X.o.........l..."....;rUe........I.M..K.:..'...aN..E,...8~......:..+e.].1Zp%b...,;.M...m..T.b$.DCe..!B.x......p..`}.%....9.i-.RC....=...."..m..@..M.2.g..u..1Y.Y.8s.7;...p`...y=...G..O......:..Y.k...J....B. .r.C.%7..>..2..bZJ.u.h.5M./..G..c.K..7.....\x5KHz<.?.u7k..'.I.?7.l';..ep..y....b...i.]...F.16......_..e..<..PD...J..fT........0...7.+...6e~.J._..h.d.SW/._.Oj.D...B..av...UU...u...<...h.Eu..!....n.T.V.]...G.!g...SLa.%.X..)qB......?CEaJ......Q.H..Nt[U}...qS.?..A...M.H$.....$...f.y...6RX.+..

C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXE

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	162119
Entropy (8bit):	6.996454364850108
Encrypted:	false
SSDEEP:	3072:38hSGWykpsE0jNFgU46AJwjhlu6S1z8l4HbDTg:3kiL0jr/4rCj01Qlt
MD5:	BBABBEB6B4B298B9C000C58D47B43048
SHA1:	02545561C225BE8E6160F0DD549C2650CD13AEBF
SHA-256:	D75E21672E1868E37BF4D41692DF1B4BF23C03EBD0D5B10AAD19AB3C9B2C5887
SHA-512:	E93CDEB9B065BD28AA64B5850B82E85137A8022D58D5E00951B77F1A16DB9EE103FDF6F7C181B07C21AB86FCB58E6D16233804DE42F744938A05BA8985451C3C
Malicious:	false
Preview:	.Piy..b9....}y\.d}..ZD..,.i<..gE+5.+B..F.z.o8......c!....\!.F..\|......~.Tk.&"E}......sVaC.3.A....K,.$bLV..YK...?AOl.v........_d...i..Q....1.=....R..1...bE.o..IG.........o.7h..m....Y..'.$.cA+....J.F.Wof..__h.C.S....~E.h..$(E.....pdm.xo.t..VEx..y#.!.w..]p.ig..T.!GZ.pK./..[y..z.G...-.....!......`.'T....(..)oe.3..U.8PjM.2D........O.^h?6t.i......L[..O....K.dzU{S.9q..>..X.I......_E..>.(LK..,..w'.K....zm..zyJ..H.Y.Z..7.."B.YN.....h.Yi....4.... ...5`.....5x7...s..7.y_../..E+..........g...8..a.8.Q..........D.'....w.-3...Yx.S.Wr.O...6..U.,.W.!.R=.......1-.d...bU..5E..6.i...e.A..........F..<...C&J.......1.....+d.2mn....P..S#~.V...1.......g.....J...-J...itv...J...b..h3.....O..w..,rG^.....,.V..h..V_.....my.H2....S..+?.\..........8....w....E.,d...'u.\G^.y}A.Cm.$.{^p..O^0(.....Jb...\|.+......`{.....X..........2.O2=.....w.ZrfI.6..+.y.....t8uC.Oc...eS..;.,..............?.i\.m.._".*..8h8W........X.6.\..X...wM.k..Wv<B.....kyYQ..n....P#....1;.\|..-:..

C:\Program Files (x86)\Microsoft Office\Office16\SLERROR.XML

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	36663
Entropy (8bit):	6.12837325504883
Encrypted:	false
SSDEEP:	384:69VZvFeSuTBCo8/q5NSSVlqVvPGNgWmcDOy+4tkcmo2v7cYiZdumwjZCG+yVFjSg:IVtFeSkbLn91rCGAz04f
MD5:	A888F1C9B5946769A039FAA28773DB92
SHA1:	0103FC6DF43F8ED844A1A174AD45FA38AB826239
SHA-256:	C8CB2ACD58376E9B58091A3217C6CD02F3EB1D84CDADD48B55DD4D8246D057C0
SHA-512:	580DEFA25B7EABF7623A6626E1B00B4F4B55EB5D3A982C45BD19222BEC165C913ECD476D325EE39CF442E1029ADA9185F308C390A27CBE0DB210D169CEEAEAEF
Malicious:	false
Preview:	...h.....0+.q....Z...Y....i.:...rl.(..!!X....j....lL$?.`.$......2..+..l&r.l.iO^74.g..-.W&.V.. ...n.H..\.z.].<..:...YQnh........eM..;...I...../..>.etv.H.!,.....u.3..M.d....+=.lT....T.o....9..G.7B.QW..\|..ZE`.w..m,.IY.u.D.....%....gg..lm.. ......-S..b,}..\.u1-c...Mk.K.?$.:.P%hs....`yT.2E.$<.......51.c[.b.>...Ux.....$..6I.m....v.!K..._zG.W.c...7..%B."...,..W0....s..g{.;<..p.q.W.Nx.......z... ....V..K.9<.3.C.(.....0.f\....%..,K..[.}#T...6.L&..>...K.......B.J{...J.R^..e...j.:8^,N....g..-.,.....p...r/..[..\..^'..t/..%.b.B....%.1.]e.Y.<....{...S........N0/{..w.....H..r......n......i....{:..%&.....h"..r......$.\|.+...s..}.\|..=.$.L..J..... ...._......vuIRQ..%zs.C.%..>..y..9.V..;yXXh ...:..g.....6. ..o.....=....../.r..*........\...B."R..Q....6.%..v..>.-.v,@.)F.,q..H..5..]...J...K....t.....+.x3.....XO...T&.s.....~.....6.I...sR).9A.'hjA........]...N.F..P.1A..x..>$..;..\..V.....p.!6....5.u.x._.8..F.....qm..$+.2..U.;............

C:\Program Files (x86)\Microsoft Office\Office16\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Microsoft Office\Office16\vNextDiag.ps1

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	22177
Entropy (8bit):	7.176069976078073
Encrypted:	false
SSDEEP:	384:bMC1bJT6ao4u10SG2rP4GBBnB4OXcvXYpBTYA6/r1kuj2nZWZyCQ:oubERWSG2rBBL4D/YpBTTWrOuKZ4yCQ
MD5:	B1BD29B4C11FE652C474422118FE380C
SHA1:	3302517830A72C1C897D32AE0B68D767E20978DE
SHA-256:	9918A133967C0B4CB89408F3504CCFE270B3C05287BD078E97061D13AE370BC7
SHA-512:	5F75852FD5C2AC347F3A1EA639A69D45EC7BE755A0A1FFCAF282132835705058CA29AB45C7910C79FC70B8E31D2461610A415F0294ACE7D9FB51414AA48290D6
Malicious:	false
Preview:	.\|...s8gwI...K+.IQ....(>...xxyf$........\|N.=<P>........q.K..x..z..L.>..<I..8M...%GR+.{.h=Qq..,.R %..K...;11Q..h...Zzv.wT...+.n.%}.<...F.l.D).......(.n.......W.!/....o;$LY.c.>..S....'./...[s.`..L...1.e.>...s[..B[.\|.....S1(7..-V...>..........b.4. v....20...0....<.i.\|.>.....8...-...e....-L.f.k=...#J.\......T..J...5;7L.~R.k.../.`"I...C..).!\|az.2....3..yI.]._.%.....=..;.E.O.k..W[8C.....x.......NxA....&.]...+p0{....X.a.+ ......+..u.%.O...~....=Z4.K.....4.}I....8l.V.R\2...'.6....Z.:W..sq./.@.1[,...a.......Z.@..\|..;+[...N.?Tx...6ZS..'...p=s\|2ts...\|..S..9PM..C=T.....#QVYR`.....R.:.X..{.@.......o...9..4q\.n.x..`.%.n.s....B,.UV.\|M[..j....".j..6..@.&....1uYm`.z...y#1..UV.W..b?S=....@..p...2m...u.3..Hr>Y!.W.y...4.....4...m..`-/....w..qQ47>D{.......ia.\..*<.W.....F<M.V.z....r&.w3m....:^.h...G.F....=l.)U.I....g...Z....%...%..W.8....T.....6..k.fA.z.b......>..e..Y..$..a..4EB..`Q.&...^.!.....[F.i.O7.......c..,.A/.;DG..=./.-3..2.q..(............

C:\Program Files (x86)\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0000-0000-0000000FF1CE.xml

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	322920
Entropy (8bit):	5.495459671754386
Encrypted:	false
SSDEEP:	768:T94Yc9REp40Tr40c00TN4Fpxa2y40+c408rCP40e40/h40es40ftl40I940P0i9d:NcEDMB6iirjV8J/He2dlc5JKN5GI
MD5:	18B775399E7F26AC34E35C8E73941952
SHA1:	8A433B45F6F74719DC543C8BED0BB65907C70295
SHA-256:	A24E9534D3809368AF9793DFB334DE657336D947F9E7C09D014983E4274EFEB4
SHA-512:	5F8D9A01C4EDA89962C5667E46A91A217A13AF18F12F6894A649846CAA49999873E43C60F76F433E3C715529A16DCFE75A0500C101DA621114CAAEB41AF0CAA6
Malicious:	false
Preview:	9.k...NQ9......D..q..!...V....>h...P;.q..X.......^..../.&...xH=.O..........9..9,.........sqr..-..r...S..5..A.Nj)Du.T..kU...@..z.....$.e.4..J.G.2n+HT..Gh&..7..!..\|....6O.C\|U...N..t.S.UAr.......!i .-.......t...V.x..y......4.$...T.F+G9...O.-.c..0.<...{...i..7......i....:..<,.....f...2.......9.tr7.}.n6R.p.A...CP$......n....ZJ<&."49y.~..W..<.o..<....."...f>.,..R..F.........DY.a..P.....V..d....h1..w.._.[.n....A...C.pQ....(..2]nX.!.......{'...Q..!H...4Q..............t..'..EX.......Vm.(./...}VV^..C.......k;.mS.?.J....[1.R........A.c../.O4...q...:.... ]{+M$..;."I_U....?.06....8.x..........}...81.7.PSV..q`{....*.E....l@..a....DV:.X.(a~..,..N/......r.K....S.%..%....J....D.eK^K'.;..t....@.;.....-..B...q..s.....).bn.f.fr...f<u6.?.2j..F.N8.o\G..?2...d.M...g.j..].r.T......?.~...~]....u.!.-d).....b7d...f..V^&.E:+..?....K...5.+.....e.l.Md...".0ULM.)o.?.E...L.r.._..n..."=.......z....=.{.0......J_...j.....4.}...(.\../v.z.@R..)I.hwE}-U...m0xK.s...

C:\Program Files (x86)\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0409-0000-0000000FF1CE.xml

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2057
Entropy (8bit):	7.776579140106503
Encrypted:	false
SSDEEP:	48:YjoIAaqzloitOoPmcsfRdQnZDFhb5Tk+eR7qW:4V4zeiSJduZhbFBeR7qW
MD5:	C9E728C87E7B7856AD9CDD1BA9F9CF5E
SHA1:	00B2655CDEC32FFE67C8647C5BFD44975E296E6F
SHA-256:	3165797AB52A85CE264BEEEB301A7DDACDBD37E87B167E8F007594E50176661F
SHA-512:	1004AD9159D47B610F96ACEEC94E5EB824A64C763A36B3425D79AA5DF6A3D33ED3419EBACBE628C31FF42DDBD9B564D5700A6BA85B052361447CC1B780D73CEA
Malicious:	false
Preview:	.S..o.c?.5B q../.l..:...O.mdr)W..V.bB.nE..`.B{.Lu..s.....+...&p......brfy&..5..S.0_..-F.@....(%....O.?:.}........1.6.D.....+V...[K..n6....jX....Co.......d....M{.b2@...~...^.8.....Y-...%.;..o......e..G.U.....F.G&w...8.T9..-.........!.8..{.~...r....7.?.8>YcX..s.L..#)N..5.t'a..2.d..J...p...V....p...7o.........p.5>..T..n1...s>... z...B?....s6.. .w.....v.b...A..V....D..J..km..t..iN...5@.....9.Nn....n.W.g1U.}..^4.....Q.Ps..K..>..+..u.^l....1.U..Y.=....9.O....+.........F.h4.&...H.'..3..............l...J..8...."............{.F....1.gI...8..Hj....s....u.,..........=\.F. r.a.......6w.\|.F.f+bX..#9..K.....&Q.N.,..c[..a..Td.......o...4.ZH~CA-.=....x...c...-1 Aj..v.zw..~.).0.K+...5$.6..^..C..Y.BQ...5....}._pQl{.]..mS)a...6.....1....S>.K.q.f.I.U............Z...c.6...[.....XoX.....<.....ZL.qs..k.!H.....q.`..~K-.g..F..."U'o..y..xaDC.\..d.o..dz.T..... AG.. L0DuK..... U..G...(........^c.K'.u.k.W%...kUE.0.%....C.<9....r...l.m....R..Q._.......!._

C:\Program Files (x86)\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-0000-0000000FF1CE.xml

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	DOS executable (COM)
Category:	dropped
Size (bytes):	802362
Entropy (8bit):	5.3153285161071775
Encrypted:	false
SSDEEP:	3072:H4eS+GyYaMmlSFAd3JGMC3i7ebcf/2SHpDgVxF:Cza9cMC3ikahJDIxF
MD5:	58213AB2BBCB65F88D9D7E54DC9E6BF7
SHA1:	5BD7FDB9BEC0128A84872604FE0AFC4BCDE55B56
SHA-256:	69B88B7F0075EE5BA2C526E563DE725465793B3F61A1F44EE3E307589D3CE95C
SHA-512:	9B76EB8669181B2CD44EB0E494EE06FEDE453DF2B76CE045EF4A03F08838DAB6E94D9260C634BE1710D91CBC0C91FD2DD18065601FD61256EC284689C7DB12EC
Malicious:	false
Preview:	.\|.........r!//.....KC..m..wt...O.#./!.....-..y.u.#.R.`.Q....gd...%B.....E.S.mZ.`,g.... .e\"v..\.f-.N........T.......j1G./.@I..L..[)yL...T../...Qh...$i.l......\|/.c.h../..1,3Z.x..)....%.Z~}..<+.' .DY.?ZB:.!...f\|.<JD.../..7.+q...9....o..m..~`!...,.9VZ.f.f.{...s+..H.bb.+......Ps.f...3..;z...E...<..=..Ky._aa..U.k$.....)..pn.8..n.x}~..B.A...X...j5......0"..}.d".dP....+...^...';5..Z.Ya..M..[.c...S....X`E..N...C................2.-.0..^...w.."i./...k=\|...Q..S.-L0.1.?.ZE.S...}.u....d.......D....>w2X.l.~W5<..."QP{.{.B#.....?.)..K.6......EK6U.`.H......<r}.h......C;.D&n....~we.....l4w.W......,.0Yvt..F......,..........".+...\>..X.A.....0a....,...e..G.85.....n..%.;.:8....H.,}N..{.4<..g-...&&.?Q....JK.KS:q./8<@..U.1..x...A....\|g}......zp........r......I..V.B.[ej:1..E.5zVvzb..a.Y.........X........zMR.C..^.3....J..1..., ....7.H....SZ*........\a.~S%.).%....w3.....P.....V....0....]..x....#..1}.....j.!.G^Q^7.v.j...(..1.6.cEF.{.0....T.u.o'...g.F.

C:\Program Files (x86)\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-0000-0000000FF1CE.xml

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	DOS executable (COM)
Category:	dropped
Size (bytes):	1855
Entropy (8bit):	7.751654213122963
Encrypted:	false
SSDEEP:	24:/RPhs/H8H8W/x9z4F1Jd7VXBGJzPkviWVXNV87+XvOHwQZWl7ldgJQiCz/BX9Cf1:JS/HCJJ2d5XGzoxViHPk56c2ej7vrW
MD5:	3F9B2B53236679610B6D69065F376721
SHA1:	FE0108F92B3BDCC2DAD72CD894A9BD277ECE3547
SHA-256:	56760CC4635898EFEF4CCA5152BE36252C0D1E8A5029DDEB5755C523600F2EF4
SHA-512:	A5DC54FE13688D2EDB95E87989442AA6E2753ACAC8E1E437901EBE31E831BBD707207CF1C88EC2AA16931429DB7612311BE223C48B7F549144A4D8E08F2C8377
Malicious:	false
Preview:	.}.].;....7....h.1.w...W....fM9....E....R..4il..$.....Y..tT7.....b...8m.I....5.]>e...t......$pd.w.O}.aT.a&..5K..RX.`.D.<.B..e.g..O.Q.d..x....!.%#{m.t.?..c..l.....Q.....".v..N.3..a@.4#........c:f...D..F.%p8.>.1,..Lc..........K...KX6P..#Ix....,.......4&.Se.B.5.c..M..'....."..r....4>q..I..........`.......nj>.+.8.....qX.....U.I.w....q........D. .S/aJ.......X.x.:;4L..0.P........Dx..b.t..&....+t.OO8j.Z=#.`r5.I*RX.....e+2lR.jt..z....n.+3.7.X0.e0H.;...Hr.'.V.C,...Q.h.f..........p..2.irv(.0.{..!...C....bn6.......tq...zJ.s....!....=..5..B@R...RG8...2.C4wdL....T.%..v...4F4v..34m.a2u.L.1r......gp..<....T.r$v!Km.........yz..b...3..`.....2..O.........gd0.[\|.q....B....V+zc).n...?.......s^6{.W...=uL.K..HD.......d`...2A..a\......g.(..w'K.... .[...V.....KZ.V.g......Z..f.....B.Y.C@...^.k.r..E..).g.......@q.j....).. ....o...6....&n...l7].P'....=J......}.....[...X...BhsR<%\....N!dM.g...y9.d.Wy....D..5.f......_......8..8...Y.bF\."......b..(.g(..f.{A

C:\Program Files (x86)\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-0000-0000000FF1CE.xml

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	496484
Entropy (8bit):	5.4692562721936655
Encrypted:	false
SSDEEP:	1536:lQ7gDwY/6xdyG/AjIjISov0AwHEFCm/ZmBOTs2Ej24SEvmXMzF/6q0adOGdZ9z3g:lWgJ8iIsSVggu1oF/HdzLzg
MD5:	5009482B6B76372F4B8B2C85C7432E7B
SHA1:	08814674BBFDF4879B62127D15B33D5B66E99191
SHA-256:	C9285832DD3DDB16BA355DF12153DAE8596546424EF14C0A34BDC467D8ED664E
SHA-512:	6EAF3400DC480D621C46E15B5247866725D2C2E467C9947CDB495AFC045576DE89791F411D624B570A2DDFD1E9C07CD7D007A04FDABA6112A4F25A95B9489586
Malicious:	false
Preview:	......v..J......\|\|..B.+.a$S....S.\ZnR.w..e.E=...,..k.'.Q}M....S.;.T<..B.....Rn-.Y>...7,..d.`.C....!V....4.....j....R....#\%C%.gS)4...._.Q...^e..y^.wcO..Y.u....<.9W.e.T.}..A5....(..2.).(PjfQuc:i.ny....kP$......]...a1..Q..W].gq."..a$0l........a.c62qU...).$....Z0.>.......-..?.e~.&LP..!l,Abt..@B.;...............".......{..d..\B...S...[.7h{+.S...z.l...@-...,.h.d..y.....2.B..9....G..F{.W..9%\.h..R.Y.)...\.s)...v%...f.-B....Y....As.....l\.bz.-jI.e.e.~......m.vh...e...y.F.J._#..F. w.m..]u...A.pSAN..EW...........A.mw.........G...^..%.Jp.9qvM..w..{...l.M5....pC.....d.l...v..".3H.+4.x]..b..Ai.... ..urD(..Y..Ly.%oSH.d..0y...A...=;.O.o..*..9.Z..G.b.... ).@...x.. ..GQ.7dv....</..%...d.7vjK..3..p..............,..a}.ua.j4/....F72..>t.,"\...Y.0.i.P~i.X..3..X........u.M...F.K.......d....8..Z..9X..I..[..3...K.......f_&.E.\|..K.6........mR..^=.M..P......I6...z.b.."..G.......J.(k...^....v.h..\..O......Uz.....qWk..1...^\g. ...7...y,.LHl....M...+....o..]

C:\Program Files (x86)\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-0000-0000000FF1CE.xml

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1715
Entropy (8bit):	7.684147211062297
Encrypted:	false
SSDEEP:	48:LOuMrLwZCXu2yXNBunPip/5bJJFdPb+bCh6cf5C9W:LOaC+2yiCbTTPbDh6l9W
MD5:	DF8307F2850ADD2B3941230C18A4356A
SHA1:	D03BFFB1316FAC5B5923859381607682E91253D7
SHA-256:	D1D670A4D2DA48BDBDF6475D6D504C81C5AAC8C4BA165E4ECFBF086B47428176
SHA-512:	810CC222C47B0A55B97C84BA2005BE6E14AB3AD860D87EE02F480F9F5027A236D8C46AD39C6A00ADE0937552D57610A4739BF647AF7C64EA7AC7354694216F94
Malicious:	false
Preview:	y.t<...l....UF..ct../....6K.7..4V7..4..+"a.?E.._...l.c.... ..ku...{/j^.9d\|.>h..T.DF.j..fw..GpD..e.tb\.....D...:....(h"0V...p.....+M+...[W..I.'.{........j.l.K....U(..\|$....c...B)..].\|w..)..'.}..(i.....x.U..W.y.[....~...}.fk_...V....>.Y`=794.>.$.....!2M@...\.ls78..e@.....j... #.$........'..L...:k...4.6.:......DU.y....(....FH..ADR6',...b0.^....f]...+.#..... ..e..s..Z.\........39.F+.8...KW....&H_.v,u.l~...X.....vh`vh..a..X.cx.V.Fc....._..XC....2._..3..........O.7t...3..k..9..~./.S Q...... .....n.....,.7......&..0......W.U]@...4....Z.}.../~..bh...^.f.}..!...@.a8(...]....YVS....YO..m.._...M.doc[..S9.,>eyO..<.....nL..t..y.~.-fv.c..6?.VY......jV .A5....k[Jj.f.&...?......Cn....S....N.O+{"n../'.........DW...8..%6...gB..h....zH.C...S.P.0/....gY.........o\....O...\|O.Li.....@.=.F....r..8.L/.N..w.....F..$...\|.X..uO^.h?...Y.J.....Z...O=^..a.<..(.....>I.I..u.8....(..}...z1{.A.....3.).l$.U...pB..}j.w.cp....j.P.G.....*....RE.z!(.V..W....4=....(...=\|P

C:\Program Files (x86)\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0000-0000-0000000FF1CE.xml

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	254939
Entropy (8bit):	5.454933557214189
Encrypted:	false
SSDEEP:	768:+KX5Qh/P40Yz0AKJf/4u4bDp2EyVLaDtqL2MV5g7zR5Z/gRzp6gusC8RjgUdgRm+:+Kpg7VLaDttM4zR5WU8JUf4G2HOoCh
MD5:	6BDF3906B35FDD54E2B5B46D6F8AA159
SHA1:	1285C8E7E9C570AC8B0C5A02E71B3E71A093DDF5
SHA-256:	577F639A027D2E1971D1E31ACA773831EB98A60F25EC74D2D10BC202EDEE556B
SHA-512:	C69872AA56A1E0DC47E261036E78254AA8BD7DCC871714534285853481A22C1260EA3A8E13CC5A55D9E9FA9FFD524465E4051BD85C624332691448E0A852D7B1
Malicious:	false
Preview:	P.._@.C......l+}%`...I.......(.S.s.+.....3..T.m#.`N..~....%..W..2.....#..q.U......~...>.h.`....&L..WUF.T.Sj.p....z..T7..(..n.."......!....`....-....\e...T.+..f.V..V...X..GQ....6[_......xY..B(.nS..N`...b.g5".@3u.E/..+.....w..[.J....Q..'..c..E.ls...E..B...&3..G......J..x......K...N...S$nc.K..;.IJk4..@.w.....E..E.06.\.s..%/..i.:?y...w.v.....SA.w...d..;......W.B./..p..\|.]L.S.R.3.>....;Y..Z.2t.;...).6C.nf....p...4..,u.~9..QI.dx...F.8I.9.......hj.e`....{.w.=......UO..<.......(.>.Tt...PV.W........z...!.H.@.pn.Vd..p..w.54...:,.....(..QC.p......y.t\0...E.r\|:...F..C7Q.[....:.%...(O#~0........jQ....N....P\#~6.m..7n...x..oi.?...... .......?m.Lg-..'\|.2p.N4.(...l....... .,..+..s")q.D1:I.....S.m..7~n.!..wc..O .D`...r.:$N$G......_..1.#.E...*:...d.~..t(}.fuD..[@..`0->.....\.2.4n!...3L>..\.H.......03<5..AI.>........h..K.G..#-t....2K...\|...\|..Y..o.G.R..A....+..Z...^t...<$.G..t...d\\|.....(.....\..._.@.......x'E....D.vKFd=..v.i.{..&f...X'...~.....@fk.f.3.Z.ZD2O.

C:\Program Files (x86)\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0409-0000-0000000FF1CE.xml

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1715
Entropy (8bit):	7.707839742823033
Encrypted:	false
SSDEEP:	48:+v5PFcAcunVnI+mucLjXrx9utgrSsdc2aJW:S9ouVnFmuGX2tge8c2aJW
MD5:	858B93D2AB13CC388F8FE022AD8C2DF3
SHA1:	DE99914F9BA7006EC62589F80C14F107E50075B2
SHA-256:	3FABE3BFCFBC31135AD32A069999C86F1D0073211A4F9D3B8456465957EA704A
SHA-512:	B3CE1E06FFF174CFB6FB339CFA3C9ECBF6AED0DB396126E919D185D7F89BA92CEB5C28B2D328867114F5928E5CABFAAA70B59E9F655EF2248598472C6C90B561
Malicious:	false
Preview:	.ED..u.....0../.y.7....r.._..........#S:......P..2..../.It.xH..A........U..q4g.A.....f...l^o.<H...+.a..U./...6M.A].]..p....6\|...!u.....Zm...P.@..q...YQ.G.bo...X..m.u.S...6....5n.O.8M.....Czi....g!&.....M.z..#....7.].ja03.}5......&.a %[.p..jS..!.C.....Jl8{d...i...x$o..r.wH'D..0.,......*O'...%.Q.....B...1..}.]L....@.....l..p.\|........8 .D m].-8e.c..O..kgf...0P.Mu#.0..X_<%v.8.t.8..~.../w. f`xh".,..g..r.....Q..........\.......%G..?.....S.I...M.,...j..~._f.....R..~..y.......gBh..1.^=t....M..%..m....$9c.l..g,..'m...0.......Z:7+....;./})E..v.{e...=s..8.i...]}.w1...k..d.^..b(#.<\.;N....M.e._k."....~........c....B..6..J.H...,=...n.F....(... K].X.F...M9z..a..Z.....j..k.."#..&q..@I1.8u....X.YM.....q..Q,.....L......\|......-Dh...o..p>.......eH....s.E.0.Y.v.?m.Mp5.&..T............E..h.\...{.......p.\|1U&/.3./..A..h.4......IQ..hg6.S8F..s....b..N)KUu.i...Gc...OA;....~k!.+.2.@...."9>....a;.w...D..U.1sV........\|.k#7..7.........Z.\.\.....T......

C:\Program Files (x86)\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0000-0000-0000000FF1CE.xml

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1135709
Entropy (8bit):	5.307667545774297
Encrypted:	false
SSDEEP:	3072:IEyLYFdiFLwUQb9acir6iie7LqMEN5c8eJ9uv1f2Qr3pu0f:IfLYziFsVaaeSMENy86q1f2QjRf
MD5:	ABE480815CDE40FAA586F6B99EFFDC09
SHA1:	F1D22A2D987222637889A02A685031650FC2BAA1
SHA-256:	C2C395C12B8CFD3ACA85DAF1A19374CDEFE10DC2A2402A3241DE305F8E9C5A55
SHA-512:	9DDCCA0471C69F1778AB407583984ACF500ED02FB69F28F58FBB0E84F9A88F77E00375CDADB0CA48115DA01539DE0B1DBC141A08F5BC299EE29A2BEF7CEA6C50
Malicious:	false
Preview:	}..7.=G......V....._b....4....'7.d?-.hR.R..2.......x.kw...7..........SLF...),..`..!.W..g..t........3..W....\|..8.^...,.D.9._....u.cl.hy..M.U.......m...p..W%'.w....>..7X.W......d).. ...G...F......=.....1u}.P\......I...Z.......b.a7<iNMg[..V^Oq..wA...N..M...C.(I..L6q.v.6z....`..t.."8.D....`..yE8.>..~9. ..!...(..l>.c!c.......!.27...u.d..ZDVod.f..l..u5.[.O.z.^7..Z:AW../.........p0......;_Y4'...v.oU.P..N.,jR.?.l..H..9.....'{8.q=Y..@(..c......."......../.im.+rP5.8.?..l.....H5.@..[G0..#.m..!.XC.N[E..y+K.:.G...'.zx.5..Q.O.....J.._L....._E7q..>.Z..d.Y}..-V.+....'.....t_.Y2....kZ.Ux..9..V4..@...x.-.r....b....g$.&s..].......iQn:,7.J.,..GMT0;.(I.~.,]w...}...Fm.t..\|Vs1....Y};li......"...hMsH..cs...bj...%..M..Ma.[T.......p.5....s....B=......L.....{......Ti..)....M~t........i_..$T.6.1... ..d.....co..]{.]K..9O......Nl...Y..t.....".f....U.7i.s......d.2.&.<S..I.O..;......4...:..~..........]....?68.6.........*j..).^...y......&.K..@..._Y..D;....

C:\Program Files (x86)\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0409-0000-0000000FF1CE.xml

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	19905
Entropy (8bit):	6.4689527234668525
Encrypted:	false
SSDEEP:	384:dGc9Z7KpQNEoYKxaJ3EHIP60fLzia2CoYZd49y:dTdY6AP
MD5:	E02BB1C382A3F31D37949BA9716AC981
SHA1:	60274926AA6F6DBE5F55710ECD1DE83623D58138
SHA-256:	A48C8146BD4823EEF82E06D06CB056CFB81BDEC34EB46971B9F1958EB8FCF9FD
SHA-512:	CE0AF3B7DD2A6B06D7D43A556F12F8EBF493DBE4413A36308824E3E437F51DFA251D4D3CF7809B38247D9639CF58444EE1114CE5998DA7B400FEF4A0B3A398B8
Malicious:	false
Preview:	w-D....A.<.L5.....NAb.......eC_c.:.vR.M,.M.5.m.=m..O...cC...shq...D..w....d.HX=i.)...@.Q.X}$... .h.L.h...1..q=........0..9c....../&...C..8....XJN........I....N.Y1)......p.......wT.K..?#Lj\v1.........bX.r...l...P..Ep.mO....p..........91.Qs..r......).....WK..M.BG.E......!J..!.....k..Pm%.....g.5%e...V.....d....r....;\|.s"....M P B..-h..CRD...$r.X......a.Nh.p...x..U0S....J.~U.K..... ...,]....!./.Z....4..l.fL.f..p....}.KF.T.E..,..G..1@...v.0M..Oe._..j..Yigt.F...Z.oB1yrr....v]G......c.]..zv.q....B=....CaL.;..*...J...~T]...v..z.8..G.x.}.r-..[.w..`~..Y..x..2.L .c.W....]...l3s...qQ<gH...A.M[...a....K.H.O..&.....z$.....G].v.L....4.......{KV......3n....!......7..n..It........{.%sz.uG.d.c.p^..N..R-.IE...1...YF}.'....G.6.f.Z...hN`^..'.+.O..7bP&.+cww.K..PQ...<.;V=....q...@!#...p@.u.{$..X../......Cp...=./..J\|3E....Z............d.}.>M.L..... .?W..+.@.......TID..-#...$.^...L...9.9w..2..\...$.]..F./..1..:..HIIo...dOB,P%...9..m.y...\.w.U.@oTX.......

C:\Program Files (x86)\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-0000-0000000FF1CE.xml

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	769157
Entropy (8bit):	5.33549574396182
Encrypted:	false
SSDEEP:	3072:ea5+7QVatDhKw8KSH9ZB3Gz2+iocMJQ2p:evGqDhKvKEfB3u2XDMJQ2p
MD5:	ACCB1171BDCF74B66A490EB239C62B84
SHA1:	4090835249F2AFC6B959A46FBC284E93DEAB422D
SHA-256:	0E96A831ED44E0C019687F6B02F0C8BFB4F8FE9D90C5B44FCC1344C81BE3D82E
SHA-512:	B3787D4D0FEDBC7146292AA8C988F19498904005AA8847BC2EADC0410E5FC0C445CF50EC2F40A70EE354BB5D795A822D85CDA09748045E74AF2AC29A85E17988
Malicious:	false
Preview:	..x.5.1R...RZqn>.!o..(..........<p.*...O......_v3gTO.....#a.O..W@.......-...6.Ne..{..^.Yf...G.'.[.g.n.q..........N...P./..T......_.v.n......@u....;.Z..tV.!A....e.OBT.v....\.....z)+9?-.$F.);..k...Z=.O0.].\.......In..>.... !A..c}<\|;6.5..#... ..x7...$....1.eN..h%..Si..;5...\.g...B...C...5......J......V.....c.........L......A.M.\..L.gg..h...:!.R....H......}..!.h..5.U4....=G~,.0...8pK...?...t....1...RW..6..4...\...........)5mH\...=.X..f}(..p...i....Bm.y8.?.Q..VB..L.....m..F/..s.a.]8..N2T.js.aB.^....(.@.q..qnX.....5..u.......,.xi%z..H.......J.0.E}.....AC.3o...$..Qm7ml...FKj....1...7l.`.ai..8..@7.....v(.#.M,.N2.F....{.H.8,S.:.g.JQ...#.%.....P+.U......q..a.. .>.....'.VH..!..R].4.`%.,kh....e....2.U.~.^..d"...\|-.A(.L}p.....k,{.\|.....1..iv.:...5.sVs..7.^.....s..(.....QU..b...\|......)f...Cg...Z.....us....%/\|!;..:.k.@F.wm..Lru.8`..@;..........F.`J..h.de.o.b..m.T..%p.z. U..<.1M...[.).....`r..8...Y.=.o/....,...R...#ru....Y.}.J....$3h.. ~.W...'...nV..._N$.",J

C:\Program Files (x86)\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-0000-0000000FF1CE.xml

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1715
Entropy (8bit):	7.721927409425177
Encrypted:	false
SSDEEP:	24:t9IWMCZ2ByWoZNYy0l0PwT2h41YCm8/mQZyLE2DHDkIfnIsXIlcR7zdtXfMcgYTW:ALCZsoZeXtD1c8/du5HDkIfmcDtvR3TW
MD5:	5E2581467BE932171349ECC7C15BC3B6
SHA1:	2A86545A7CB2AB65FE43C79B5014A3021DF7B335
SHA-256:	A452CE868A0BA48CBA16B2A95C4E8B7C53C86ADC38D5217F85FA9C30392984F9
SHA-512:	154F270D4DF557D904BDDBA08C1156466E4B2BFBF0B8E789F8FF4D37BA49549428C28CF0868DCC48190B7056672DA66DC60F06D2E33EC0BF89DE43FC0B50D43C
Malicious:	false
Preview:	PUPD...@t.5J.....S....k....&.2...h.R}1...7oi)........d!.7%.{.:.x..} !.6h..P.X3......Uq...V).d....@.....D..a.0.8.V.z...L..P.8..Z.....o.E..2F..T.D._.Y..+./@.>:j.uZ...^rW.{D.9C..728...nl....H..... ..q........$R....O..n.?..S0....%..... %.yd..(A-lo.}..."..@.0j.c..sH.3..jp#T-H......vo..(...=...n..G.....FR.:....7..x...K.m.A..p.........P..9.....A.\|!...,..sG...e.<.0.G.e8]...i..gg...n..j..r&X.E......o......A....2.9.ER..tC-.....P...f.:./Hg.s.3..^."x.....&.s.B.... .0..}a...Y...I...`k.._.n........S.z..S{.i.Z.......-.Cn../....'.....Un.o.kX.d..+$...Y....^...b~...0-..yf.....x5...:.bn(._t....P...,.=..3.T..i..iPJ..Wl....q...%....#.[i2r.2..a.cir......m..y.+......4....V..0A....]/.@..... S.[..o.S;..L....9..^8.B.....h..A.....R!Rq.........\|.....7M[N~.`xyS$...yN+.th......././....CjC.!...r\.D.X]G..<b..c..."[.....(..]..].9'.m...I...Y.g.\|.h.O.......1...,q.V.....LI.a.B.>.x...g@.~....Q7...i...9..X"T........n...~._5...m..SO...v..nD.W..M.$.Z:s-$..Qj..s...%..[

C:\Program Files (x86)\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0409-0000-0000000FF1CE.xml

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1785
Entropy (8bit):	7.735450853133612
Encrypted:	false
SSDEEP:	48:SbOj+DnLrcWeUPdtcTAqttw3/VRjq24/duz9uW:SbIGnUJUPHcTNw3/X224qIW
MD5:	2FA03FFB35FC5D9BFF0E30B268A26808
SHA1:	202E96AB6CB176F55AC944201A3429E643ECFEC2
SHA-256:	CAC427C26D31E83C0684C45816412F18D269D5EE16AA045F3AD154307B799AE8
SHA-512:	40FCD1DF8D1974ACC21E4D456F4C2C4A686BADF8DE2F4B4EF54F1C3E168B03073B407DD09DA5BA197F31BF9E8F7DC0749AE679E2DC327E17EBB2819AEF49F632
Malicious:	false
Preview:	v8.h..^Z....Nc..K._...f=o7.]<.&K.Y%G..6j..@..j..d.V..:....Mq.3W.Y.u.$......f.N..c./.R.>y^Z....9..G.../..x.\.....eZ..Z[)....,..x6..f\|..q.f......>...CB.f...?_..e...i...K(Vm.1......h.n.>..2.x.._>.V);....V..T.^=]..a...Cuhy...<.L..J.R....(..6....[..Y}F.'...s.7.[..o.kB.o..9.v..Z[...D.H...b.M4.C.ff......;........B6....Q!y..Y3...U.;.1!.fVu#.Lw.....r.8...[...Lk.....v).....5.oh..}...2.G.......Av.fo...eY.y..P..C.by.uyZg..b..... .../..d..;...x...,.T..!..Y...1z..&.W...&gz .V.`,s.YB.7.........2D...qb....d..K....K....DJuTV.jH.....K6..('.\|..~......3.e%.....m&.J+...^^.......g..w.4.....&.\.t.[....\|....o&....S...w...M...?.."C.~.9..q.M..@.V...@...^p..R~...b...%.+".m@$..N`...E.D.....,..#..3M..g...]....TJ.^...`..G...._[.Mj.Ur..Fp..H?.-.W&B.../..X...S..%-.E..cz^....x......&.=.5a,............V..H."...>>.Wq.6....X.m)lXh.9.Q...;..C*....o.^.Q\|..9.......o8.+....kX..,..V..0.9.....eH..Qr.B7.....so`A..2.n.5.).jE.S4.`.].ffn{6{=..j@N............r..@..+..B.....R

C:\Program Files (x86)\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-0000-0000000FF1CE.xml

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2671
Entropy (8bit):	7.843789661899955
Encrypted:	false
SSDEEP:	48:h/REzH86ox9zRKdgcQX4fiAW7i+nuUin82g1FkHLjKpwGRsMdw5cHW:hecR9YdJQX4fQ7RnuUi82HCXRfwMW
MD5:	B64C38D6818664E4C2D739912074C7DE
SHA1:	BD589123AC283B3B4D9F7761FBE64ADD6AD4AD04
SHA-256:	BF91B970AB8ADD37958C2135BF94AD9DC18B6F85BD8435DEB5E247214AB6B5F9
SHA-512:	7BFF23457140796B8EC013B056EDB95FA9840D3EDA16058A6673B72B3D5D660C429215F15BB64F118536AC864E6093CD1AAA10BDD463379E819B9A1EBD787D52
Malicious:	false
Preview:	.i.X..2t...J.7.V..q$_D........a....f<.m~..p.eV.>..C...'..&i.e.c....@...9..."m.=n..S...v.%....]......l9~.M..#...}.Z....pI...\|....O`...)...W..{..w..P.2d..2...,;..q.K..w~.,......:....X_. ....]...M..z......~.......~t.y.....fDk/.a;.'..",..t.S.........].zTaw J...9..+..l..G.T`.f.......J.G..........U.%......m...7..=...........3..}m.n..w,o`TS.1DJ.3...o.......r.g.R...~.K.........5...i........3...}..........e....j.`..(>.#.p..hP.d...>.Vr.\.#..?....q}/..~SI..gb.k...J-.?.....-9.4)-.Q..]..^..V...g}/N...(+.J......p....r.jZ.4Hx. ...$7g..l..&b.9p=...rc.i....{..[.B.U..NN......]^I......+ai.%.x....;...P..T..El.....1....f.8..O.jp..)..:.T...M..i....V3.aY."....6DSn.'1...'...f.u.}...&..3s0..d.8)...9.X....Ood.U1...}...%........ww.E.8.Y.,...%..@.f}...]...{..4^....+U.F.z.aO..&....".l....XC..............L.8..#+.\..i/....!..?.......n..@V$<.......y.5......@E.z.~mGe. Tm.. ...L;......i...J..n.8(N.R..gq..2....c.,!.k.(N.v........`.$.06.u..w Ch.

C:\Program Files (x86)\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-0000-0000000FF1CE.xml

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2671
Entropy (8bit):	7.827025633869371
Encrypted:	false
SSDEEP:	48:tC1Lj7s0Z/zjC81M8xEdE8dkbXWAKUnrCHMeA5ZMuc2zgOMkCpcuR5qW:tkffCyM8xER3ZUnrCsJ5ZBc2zgOMksRR
MD5:	5D8EE9FE809EF774CAA8467EE26052B9
SHA1:	F92587513D54E9A8BC23296F1A2479E82767A7A3
SHA-256:	57CEA5088D54D77DCABEFD274169851563357788700735AC88BD6A10ED4EE900
SHA-512:	6F41C09B37FE2D7E2BA52E1FB1DF24FD4D4E904246029072D8AE2FE9A6BACCB3DAF7F6D067DCFE84D0D76BC05B51A199587DC76472022F20565A41F19B5BA6D7
Malicious:	false
Preview:	.........&........).+.9.H{.2..!...x.a.f..[...+N.2.....Y..$..a..x...;....Q {...OiZ.\|...I.....Y.~..f.e.DW......K.]Y..h...H....^....\|..$.M.>":.^.+;R......6A.>.X.r....O......p>.]........hQ.U.f...P.8..!....t...lM.b.o}..{~.P]..m.....`.\|.B`....G:.}`..h....C.e....WS.....64.&.I.;.&.....q...`3.s...v....8..{...,^..>.?.Y.T&$...X..0.1.... ...c..7$.j.}zI.s..4.j...5Wf.&y..."....M...(...././.&...O.....M..4.G.w..)x4..~J.!........>p.O..U..}"@...`.&qa.U....$.....#.".n.......m.~..%1\.Jq..r..@{.M.][..nH.&....y.u..G7M..!.........]e_o\%..{.E.~[J..]....>.3.8....@w....g...........@..#Q..VN.....TX6....2-..O.?4......0...#.cY!....N....5..\..V#..6....;.O.A.'..H9.0Gig:t.Gx5.8Z.o...D.7...HR..6...3e...y..\..KE..t.!h......@N.l...aY...d....t....&.3Q.~(#............%..,3...\.8.P.......@...dv..f.7.c.........J\|.b,....$..D.i.5$##3*W....o.m....~ko.....;....4h...u.7..'...}..A.R9 ..d/...k.. .J.IXP.!.!g....)5Ts...l.Y..T..U...]lF.<N.....3Z.....Mnx....im...$...k?.~g....D

C:\Program Files (x86)\Microsoft Office\PackageManifests\AppXManifest.90160000-002A-0000-1000-0000000FF1CE.xml

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	25207
Entropy (8bit):	6.355003865027827
Encrypted:	false
SSDEEP:	768:dmq3sh940E940UD0Z9406949940q940D9x06940l940sv40l94069BG940J940Of:d/cz++
MD5:	7C932E3CB9225D2E69D697912971505A
SHA1:	F432A5C0767989DF43C2F531DC9CF08B5D6E1566
SHA-256:	1DC256154C7E177E357E4254C2AB98E5B17A87CFCB1A089D60EAE18637D94D02
SHA-512:	9C3B3C12E09BD4BFCDDA3F78CDF9F48B3E0BC2B1B38B1C013BC60677D4A2B9DE1F1663D4A78AD6F5A9B67D63EC1F98835BA7C5F57C76CDAF973FFF56D550C513
Malicious:	false
Preview:	......6+_.z.)..#....aG....h.b....s1..3.....S.......OW..........J+!.y.:..,.....:...Z.u.....X.OJB..Rt....lU.P.....c$.uS?..Q..I./Y...e...Z.t.....@..K...c...R...`X.....v.>..G.J.!8.......~cLd...v.a..x..gI..Zt-~f\|......l..)....(-B6X..LW.......l..g[..0U...Tm.3:+..8....k...E.8..Z..%Z1..@....{..F...s:!.z....F..[.{.X..........^..WZl...-.U.T....%.j.....B...<R/.....f.u.$Sp....&...9....l...e. .....;...Tg...>..4.X.....B.'..Y..E.:.".I`Kg....>n.8...<.:......#..YM......X.G.q......`_....f(.......s..1.N....>s....~.&..j.......(..Q.Xj%.7>k...1...\|.q:cE..}.(...../,])P.....{N....&p..Q..5.UJ...3.....\|c...e"...lfF...tT....V.su?..]f......uZWA..0!1..A.:=....a.>O\|b.z).....cx..l.).o....\..m".m)...~.:2..W....H...x.$(.K<.}..<.;.{n.....Q..Q..:y.,,..~.........h].v.UP..J.3.}.W.S.u...X.6C.kj......Uj..u.^a..]=..4....)l7?h...c.My..=g.$.......).\|..S.....`.7......h..s........4...t...<d`..yo.{.."h..\|vA.......Yl......B.....J.9..._R.Uo.D..3......?`.6m. .c6...

C:\Program Files (x86)\Microsoft Office\PackageManifests\AppXManifest.90160000-002A-0409-1000-0000000FF1CE.xml

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1785
Entropy (8bit):	7.725467588430362
Encrypted:	false
SSDEEP:	48:m8HE5zPoIE89WcIxHXoNv9FXyll9BN8AisQpuW:Xk5zAPS3YXKFX2lCXEW
MD5:	0954BD3FEC7EA2A48D016CDCC9862DE4
SHA1:	CE5134D175BF59430D8EF14267068DF7357E381C
SHA-256:	150C2F57B95C5A3450A32252C3303019D53258A93B34E2A9F88AF8286233C6F3
SHA-512:	2683D65C5B36B459FEA67DABB144389D7F88001A0EB14F27A8A72896B57284136682FF3A8FAF92720A040214D0E4988DB915535B0AAEA11911B7BB67DAB5BFA0
Malicious:	false
Preview:	..N. ..\.\|....2.n...f....\|...5!..........Y.{.i.]8. `.4.S.uF..^....t\|......esU.S..P~8r q....\|..0..j.`...........U..x.d..>.k.SR.w.'.;qx..0.}2v_- <..." I...h)....&`G.)_M....../...ZT...C.[.......bV.i....+.....j........\|....`p&..@...E.+....T.[....1]Rm......\Y.a...#v .%8.lf......7...7...s.Hn,`.e..KF..;0.?.7N......0k-Q}.\...2x.T..%pv,.,.k..-<}t.T..=.+?.....m...]....`XP....yZo...yZ....;.........9....}.Z1...i...c.U7..B.....&35.............-.....O.BD..j...e;..#J....9.....lV....!.W.....i...>@..T..&.2..Q..2l.r).....4-..~.!......]..A.rTW....8..d[l\|..'<.....K.S.&..'5!.l}.ZUQ7..-..j@.a.b.v.lFP>."9..h..\"...?.......!...../&......q..F.x<~eUngNpDJ.!.d.>..p.tr.SP{\|.oO....o..L5.Yn.e.-b..s..).ki?......`.9./..E..h3`.mp.Vd"...I..9.GLvw.0...O9/y..G..w.........<.....e...%}ztD...#........maW..TZ.Dm.>.y...:..)-~..Sh[..S...d=S!Fz...l..:..._....,vta{/$.F.~.F.....,...AUj.q..O......j$....i......K.qR....O...%4.t.sz..).C.?...=....o..q..*gF >+.C..m......AC

C:\Program Files (x86)\Microsoft Office\PackageManifests\AppXManifest.90160000-006E-0409-0000-0000000FF1CE.xml

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	7707
Entropy (8bit):	7.687456928049134
Encrypted:	false
SSDEEP:	192:KGalG30QVWrPazL02wO0k6B47K26y1qxhKsWJ0:KGI9Q+PB47ZA
MD5:	6093E05E2EE0750E2271D362C8BF01E5
SHA1:	500BCE71DFAAF136C72172E29677381F82554C8E
SHA-256:	80EF7469C1F1A0A8BEA118764F09444C945B2B29E29B63AD0668DA2974B568C6
SHA-512:	CD0DC7CD4170C89F13B0BE5660A741BCF6E5F47A9001B0FFE8AB99671C73FFD07DB4A69C60C5D478F6CCCB446B4BD4226C0E60C9B259A1760A19AC3CE9132C5E
Malicious:	false
Preview:	.M...s`.pnJ.P. ..[.G%.p....{.....R.\|..P...<_.....^x.y.H../#...8.Y.4..X.L5.$..-..'...S...6R....{j..?.V..7WF...._.xp..?m.;0...u....@...E....+..y......5......D'.....K...k..../.......\|.^..f.N...].E..@..~.....qn..........'I,...'Wp.......X.....HC...9...j..b..F...Z,.....[5...3.....R+..P.O{WGX.......g..\...O..1.d..Y.X.;H1.wo.4S..F..M..{..JH.Q{....n\|.:....Tq...0.7../1hj.7.O...........-M....}...M/....Y.....q...W.:.....o).nQ..O.m.?..`....k.s.0._..`...y.RPi..L.....`..t..OzcB.k},B....X.......$........?..y.M.3A.}.a.]. .m.\.T.w.HF..o4S.i4V....G..Q...Y#..if(q.R...1\|f`x.g..(>B..i.u.x>=.0....~...1...........[.+a.......$o!K.q?.....?.(.()9..J.m=......v.......4....e..u.w.\;6..I..A.j..X..c...l.N..Q.Q..Aw,.%.....f3\c.\.8AP_..~...G$\..a8}...r.....d...h.#x.7.u.V.i.'{..IM..]..'P:=......C@G...y..f..;...(R..@..q+./)V.yY.<.=.1"...8.aQh9.y..]z.S.Y.R.............h.PI.cu.wP...'.3.L.....<:.k.I.&.&Ge...B.\|.uj..n.vm.H..6M....T..6G..-..G.m1..}pi.....+&'.I6tY.....#../.Z>...o~

C:\Program Files (x86)\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-0000-0000000FF1CE.xml

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	367687
Entropy (8bit):	5.359589792716785
Encrypted:	false
SSDEEP:	768:z8zYjZ6Iy1a9yZpnZey5ZZQPmaiJlBIN9NZPxoFA2FpAwahtPbeePkDqPVQiH5:oznIozfZey5ZiQBIF9xoF1mRh55IYH5
MD5:	9B868B5E5E3B947BFB3AEE71AA1616EB
SHA1:	C90BE4DDB6688B310312E238849192F70F8A682C
SHA-256:	136510CBD7B5C23247C60D130971DE00A012E53CCBFA21CCA3A8C1EA424C61BE
SHA-512:	7D467B2DB842A0416805289470A0188E21D07CB6CA7CE781DA282305AB793BEBBB3B6E9B820821177DE01D9F8D70A71E8023345173216E09F4225F7B4C2098C7
Malicious:	false
Preview:	#............iE..%.9_..<~.f.Bb1...>1.9.V....[Q.}.T....Qr..B..N.`.U.\.<.....&.#... ~%F..9...B#..lK qm... h,.w..(......KD..Z..X...%G.B..:..b3!k....`...8..L.^...y.@#...\|.."....[Q....X~.P...u...%......D.Mt 7..0..I...K.`.[ZSZ2.B.7.@..L.z.....$..`MS..W..t..-~..e.T.)...$_.}j\|..Y.g0H^.....!..I........cdU+.b..w.lS.....#.G2.......[.x.e..........%.....+.BRHP4U~MJe..I..x.T....E....th..a..J.e.Z..c..9.`....k...<.........t.5......%_.....fM)D........I.=z..D...H..D..?.......U4.Zk.U.)(...E........!.(_..m.V...g...C?... I.].}S...4o..5.....4'...........7.`$...........p.`4~..7............&...B.nGz..T3.5........?R......<[7}m..AW.Z..%..B...@.qQ...X.5Y...,= W.+..7X...KH&l..8.Ls.a.m......k..{...."...>..2.^..E@.*HK.0")l.Q..Df..Y.WM....h..>.....\.?...........~...5....l..{5h.\|..Z......Z.\|.+..n......z.S2...o..Q..i........_.....o.... s....e...EZ.......x.{]p(.>.!`..m.r]..\..J.k.l.Rp.8...#....b4.2......{Nm...da..."HRW......(..-JW(..Cij..)V.k4.98.'.....jWC1>..

C:\Program Files (x86)\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0409-0000-0000000FF1CE.xml

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	DOS executable (COM)
Category:	dropped
Size (bytes):	1715
Entropy (8bit):	7.714317751803398
Encrypted:	false
SSDEEP:	48:sNETAaQJEKJR+vf/6l/DA6w8b9wf+RomPdvBePK42W:sNe2EC1+PmlZs2W
MD5:	074826146E089ACBC069305D5582ACD7
SHA1:	2BE1EBE8ACEE7298D82971A7CED1B50112556F5D
SHA-256:	C7C4DECEDAC6BA68D6D6C0E3D4C6DB7243EDB8CCFFE9A2AF9739801E56F5F85E
SHA-512:	9DE45549FB6092B101A59AEA39E5332F59A1EEF18C331F15A7A4CB81997318B8114792943939579AE09BF75B30921ABA65E17960C3793D83F564BAE21A1C969C
Malicious:	false
Preview:	.e./".x..~\..2.._-.Ix9...^.H=.pH.5.~..........E...P..%..Z....\&..q....b:.zl..G`#..!,&...v[...H.mP...f.!......%.jA..".....>W.....X....#.E.F.....o...n.aR)...h.O.C.+.....R...Z@.G.Qx.y_...V.-JRUO.[H/..{i\|.&.D.T([....d...i..a....p....-.:.Q...I...\...>..J...........x......nO8..hF....".M.{f7.......`r.M.F..s:..C48^.Y..fBF.....WZ..fj..V..za^Ay..6...3....t+....+.#H%_w.Y.Q...AR`.K/f.;.V.?.....Y.k6...0.........\..Q..#s..D.....;.Df..P...-.?..Zu...._......M...cE.9..K...e[`.h....M.J..%..J.I....1...e.A.B.n...2\|...2...M............ "......{.W..\|P.V.Z...E..\|6.Z..N<..,.....x=V:0S..j]..y...?X....E..b...^....2.#. ...R...+...V.nE9....{...o..#mp.%...4.G....gI.v...L.s."I.e.s....[.s.......tRZ../.....tr..Q....[.@K.E.s .[b..n.v.&0.G\.P&@$A.0.z3".G.........j...{E.....M...v.A..rP..E\..*.y......'u/]......J...7.e.......%.n3...........L.. =1...%.#U.....DS...G5...2M...=.z.:.0......C...x....SsY.!{.T."...{.....{...{.....u.V.....+..H.?g.]...2....Nv.w......O.F..3q.,..H....

C:\Program Files (x86)\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0000-0000-0000000FF1CE.xml

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	60760
Entropy (8bit):	5.922948243691104
Encrypted:	false
SSDEEP:	768:0q1qYTFo40IbK40UeD40t040C9b940E940Jda02940894q4b4F4eRR4V7S4m426d:0FYBf0+tvxfUrf
MD5:	08E8B276AC0005AA80AEB50C61BA3464
SHA1:	4422001C6C8CF12012BE47E1ED827A44005AE205
SHA-256:	4B14D98C3E70714A0F0B39294FBE0EE91FEDF93D877D28159A9DEEF8DE3836B6
SHA-512:	9CB284C075029D3866D696BB3F7226FB9294A5818F7D1C66D77B30CB74FAB3E1FF396ECDD8B62DFECD405A7E6B1E4D826EFFA8F178117091A444A628E11F470C
Malicious:	false
Preview:	$..W..H....Bj..Eq.N.........u@Y..8.h.l.?...:....F..[Nwd..../....X9....tMc.c.........[..Z..!tX.{.....q!......h......\|..~.gej[O..u}..ID.i....K.K..^.d.e.....M..+...u7W..`......Y.\|u.z..d_...Z.1...61]s..@...x.P(......jUF.........@....K.q;...W...(:_....k.m...Y..OD.1.4u.@........4...>w..@D\|..X.b'.q....]I......."..v..s...#c..I..GV...y..ff.s..Ui..J.M[.......,[....r...e..e.).f.rS\..#..%....k..yoN.6...Y..lX%c....r......k.Fq.U....7.1..\|c.Nc....S.9....f.1Z..\|.o.:e.-..:..2.+...8.x:h....8ZNU......:;.!.pYW.Q..z........f'1...$.U8.5G...+'1...n..zb6.....z.....V(..H...b=..8..w..^C..V.m..V=F.>.I.[.21.V..=...uI...l....F.y.q...9.....m}......T........K...O{.-.....s.*.E....h{...C.m.....t..v...,....E..K1Q..\s.......r.py.)7......mp.-%.\|~.!.x..t..0.i.a..H.kZO....j.g....q7.1l..1.....;.Ic..1.:5".....)b...H.n.gh.DX.s.M.o.X!....- ...p.{...R.....=.wY..:j.......n..@w.C..J..@\Yf......a+@..j.BI...!.M3.."a.....A..K;..7..Lc>.M&.I........#i8.`7b...@....!

C:\Program Files (x86)\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-0000-0000000FF1CE.xml

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1715
Entropy (8bit):	7.731111357345295
Encrypted:	false
SSDEEP:	48:MGVlkt0ksttgPbY5rPLPpTXH88UlcpAdh/dApPcghTJW:MGVG+PsCrPLBb1wcqhKPcg9JW
MD5:	9D3777C0C73B85EE32FFAFAD5A5CAEB1
SHA1:	3B427184883D045EB6D461A161A5A6729154955F
SHA-256:	5E784B500A7405A359A94B4FC7BBEAC1C69A962034C620BF62BDBC36B5D7267D
SHA-512:	8B11F9399BFEBA80A5534D50520F9519E0B3FDA8DA80F5CC6A382BA73B661D2BC416F783317D1D83493415C141BAD03EEA3C4C9042D4A3EA113D3B6E1082E42B
Malicious:	false
Preview:	v.".B.,..J2>.v.}...3.\|d...7..XVy(..Ht.WN..^.ai..?....i.g.k...+..G..K..A/...\|9..=..}X..K.Dp..}.Ca,....fA..0.^T..(,Xz.._...i.W..'..-...1h1..pD.6.....<.........y_GC........P...A..%...9~.b..\7..=..h.U....r.......6..(g,...e....%q.3.............;..C..N.k..ZH.t.....aT...`.......J.6~.E.V]FA..'.<A....8.m.B=.+.O..}....M.O.).).;...0..$:......yc...{1w.L"...$.%...E...M...2+4.L. ....k.....&d..qo.....Y%.`..Ag..[..O..g...si..+...\...Z..Q.V..g......~A..k.....A.X.....,.~.Q.(........&$..hFW..K^.....t.k.9.5...WwIc.].I[...S>..@}....(..'..A....d....?..L).q:S...j}$..3..d....I.DtE.w..l.Nk\.E.4...hS...\|S.{....$.#.....T.$b..tl:...If..N..U..N.......L5.%.}Pk....^.3..I.&H.%_..N.O...A4%Y.:.kt`).......M.....1..S.F$I.U..0.W..E.8..........U.Y....'t......eXd....}.h...FsV.DY....@w.....9Ou...R..8..@...y..p...q.].AD!..A..-..W..Z....B..N...".mM.?0............p.uL.g.n..v.)..Uv.-.fd:.`..\.7..x.&lCu.:...-.K.Y....%....Ej...P.w)Z.....u..A...7e.......6=.1.-0./..s..#;,...(~H....{N

C:\Program Files (x86)\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0000-0000-0000000FF1CE.xml

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1904
Entropy (8bit):	7.761408784791565
Encrypted:	false
SSDEEP:	48:MrXNK0k4g2eiLIb5ByOgZ5TQddulemwWyZYKhW:+X8Sg2eiyATlQdy5mYwW
MD5:	F023265D74C4A86934AB7EFACBEB7967
SHA1:	BE92988ED683BB77E2FB84E2A87BD363ED581537
SHA-256:	024B2165EE9BAD598F7DB0CF6AA199CBA4FF52FB8E527D91EAD9528C050D849B
SHA-512:	EA3C937E31E4FD86E8AA6DC842C4B955CE77B4EF8D0382FA8CD47B957559DC42F166AC1CC1EAE16E6386EBD7775E520DC14873CA3CCF7072A759B0DB1B7958F5
Malicious:	false
Preview:	R.a...5..=T\|F/&.&.{........bq`.^ ....!.2YQ..1.>..O.M{..R`=....1.&I...ozg.~..e...n.T....O\|...S....aV...1.....N`...su....(1..p.S\|.^.pH^.$-..5....4pat....E.....c_..SV=AD7.Tm~...;.x..>....V#pK...o.Lnd%.^...(...:.Y.z...TE.I.~U.Mq.` mzdX...@...2f..p...B7X.................lJL.u;.j...>.3.U z.k..F)9.m....i.....J..:V.]..h)...=.^..Y..fi...[.2.h..[...J..{...;..4.+.6..D\g.b.....M..N.....J.;...._.!F....:.PbR.,'.A..H..'%.1..U..Ee...7..r!..=dK..7i.q..r.;..D...........O....@..o.oE....8M.fW..-.9...,.%....N.j;....S.c.j&....=W......`z......4D7.u,4..Ts.L.........@..k'..#@....=...(".....H.f...lK..U.T..G...".R!...........Q..y..zo.zS..E[..;..U..&.g........=...++....uN.J6...]..-P..ls..;...2...q..x.G.,.....i....1.....6.8fOCJ...3Ss...'..6.W.k0~.....W...'.....A<..A......rmCl...T3s@..k.+..>f..8...AR.p.MaU9.. ....rL.P...4....IQ.K.....)J.s.....7O[.g...\.c.~....i..B.G...E.<.0X.1i2.....}?h....w.v..0..Hjh.8...Nf.1G^.Z#bg.R0w9.@..wG......Bm.4.T..5v....m..r...a.<> .

C:\Program Files (x86)\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0409-0000-0000000FF1CE.xml

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1619
Entropy (8bit):	7.698686888729237
Encrypted:	false
SSDEEP:	24:FnwG5d7FitK+cifUOstTpq0dz/56peqvoJ7+D+DNLoxT+N1IKSgJVQbh+c+a7jjW:FnwZt8DtTpLz/56pF2CD+Dtoc1XnKj3W
MD5:	17FA1A86F68D016A7821960698B5F9A9
SHA1:	DB0104775E05D2ECDA9A6AEF64D4E77A53D63418
SHA-256:	D4D149D8CBFB49EF513A49B2627D38C7ED25D79C7A387173B9B3475E6495868B
SHA-512:	E30DAFB477F845E1D69394D904ECFCE909F711A14B92F2F02297F83A4B84877195D223900807886A170CBA7CC0CB4748687ADB92B1697B469882AF7B36F9C4C1
Malicious:	false
Preview:	L1...V.e.;..M.........7$U.f..d]..3..'.F?P.^.K.P.u.$..L..FL "..a..m.qg:.h;.&.&.6#d2..?.%w............)j..m..z...........A._k.....i..EI-iDj.@qh..:...............r!s.F.%S#..%.r....c....6]...8..3pX..i.i/.(~.B\|.S).Q..syu..FCR.........i..yW.).A. .j..NAQ4y..ie..&...........&.._t.{...B...UC.#..y.(...Uyz9...v.C.n.=.H.l$W.....E._3 .C..C...E..M...zD.B.......Gi..'...G.PP.9..9..BU...I.<.CM...C...G.........&........9.T5..h....-...g.].4.=..l...Q.e...^{Df....'Y..W...:...X..&.a....i..j/.q.Cro.P.......-a(C.ZE.h......G.>.....m7t\..-w............>EH ...o.N..cm.5......+.q..W....;>.....k.u.o.....7B.VE\..mnj...wX.....$...I.=~fO.....P......b.!.z:.o7\|.C..JI.....Y.......T.4..E..c..j....I.}..{.1.....!..n..0..%B8.4.P......F.....[=..ampo..g.R:..CM....GK..KY../O..S...\%9..p.._..4[..q...~:xl....n..:=.."a.~......,tm..HWG.....G.<R.F%~.n.\...}.@.5.Z.v..f-.5....a.+v.Lg.p..J.Aa)y...Q.ga......de..........*?...54.U..0..v...f..X.w.n....Dz.........=..-.~O_...t..Q.wZ.....-..#X

C:\Program Files (x86)\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0000-0000-0000000FF1CE.xml

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	3339
Entropy (8bit):	7.879908569770326
Encrypted:	false
SSDEEP:	96:uo2cHf5dSX7O3UCYTDSjC9GmNrFIIDVcXfzX2gpW:uo2cHfvSLGUnTGjuGmNr2Ica
MD5:	1F84C586BC3B1AC60AB99CB1537B524E
SHA1:	D29AFA88147D1F4BDCF87519C03D44739E54EE7A
SHA-256:	4AA4073AF92FCE8E2D4F8C100DEC4BA61A447C9E4EA7706A56E41E86174BA3D2
SHA-512:	6252E0E80FCA46DEB1DE2F021C0E9152267A144718C22112C0CF52D3038751FB10ED25EBC3C9BA69128B528A8B651FBABF3C09EEBE711D7D3C201DD29A729976
Malicious:	false
Preview:	S....o7{s....b...x.[8X....^.T...P.`.7........j......p.{}.\|.U....!,B...I$..!Z.. ....ap.pu...\w.5.S....a..(}.6.}...C.nn#.3...`?.?....1.J.(..DJ..e_.V.p._. .?.......)Len......\|\|.B.Y...r..&iK......pW.8.0-....~>Y.E.]...;.n.;Wg...l%'z..6.....m2x.Bl8\...n0..,....m$../=...3...g....y..+../.Out...?9..dM..#.uE......?e:...Y..f..O."......d.L6...x......z.....X<..19..O,M7...Q&.i......W.....k....W.&@T.....!..\|1....(...<.....v..dh.n....W.;..a`_.._."...).+2.;._.....kAc.1..l....S.a...H......5..t..@.w\|X......f.9Nm../....H..b}+d....u.\B......7..)..w...W.kO...-oC...].5..B.r.}.:-... ...y.QU.P....I.?........K,....d5.xv>.....QoR.69.3yo...N..C..L+.s0DV.....?....2L.....7...^3...K.fe[..(.<...v/..2(.m!.T...oj....VuC&I......d...@n.._I.E..Ob.H~..L...B...xf..........\|w..3...Q].e.-...b.9l.Z.e.....@`Z...3........sU.........u.@j.p..@.u..4.2.&tj......b_.b...M...+..e>UL.2.Z\........PEt...$.'e...y...L........Fp....U..."..j.lW..{J.O.%..o.h....=:......7.. .....;..s.Sm.t...v.Z#.x

C:\Program Files (x86)\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0409-0000-0000000FF1CE.xml

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1619
Entropy (8bit):	7.682831031494005
Encrypted:	false
SSDEEP:	24:fwnzIDrtI5au9D49wgDggVw8tuBVRAIel5zF4AwnvYlY8oLHqptQJXM6yNW:UIntTuQbmEAVK4A5Y8CJ8lW
MD5:	BB86E0E2E95F14661AA7C9F0ADC1F1E2
SHA1:	070EBA0BF810663A7E42449395C441BE1B594C0E
SHA-256:	669D5F50F658761ECF7399DA7728A6E1D8EC1A1BABAFCC00609E008B908A1165
SHA-512:	BFC67FA17C895ED9E463300B97280FF5033E0BB635FD55DD821DA2C7E6FF9D82516E68ADF05C19C8D9E311B52042E3116D0B0E3EDB50F574A7F83651B6C02403
Malicious:	false
Preview:	..U.,..{...l8..../.#$W....S:__...r.2.8.Xn...).nV)L.8./.+\|[..O3...9[)....b.......r...&g&05.%..3{.zz...~nS.....t.v..&.Nw....2S,D.Q ..r....:2.b:.5+...X...vay..(Vl.1.d-......g..` .......:.....P..v4.N7!Y\...\.Hz...TI.ri.\...\|.........\.C..$....!@..z....M..r.ikN....["uZkT.ch...\|....k...QRVW..=.e.;`#..'.z......H....X..8.C..VA.=..9$:..w\IC5wl.jk...0..P..wi.....i.V3...N..x...c....Q....C......L^E.G.j..8.ez..l...zU..g...l.....$..~..L.iT..\.?...s......k~@,..%`...p.j...]........c]....iO$.S. .........U._.....l.W.3.H...iTE...SifQQ..tRn..N.Us.../9F......b`q..._...Y..-.d.aZ..8.n,.Dz.:4?.L....n[ec./...<%.J...O8U....A.#....Af&......e.xON../.....z.\0.....y..w4..%..0......-.}...5\...l.y..%+.#.#.>.)...[..\.%.Y.V._.=....`..U..a_P..&.9.d......q..V+..-XZ.G...W....lel..p.~...8gO.}.8$........G...\...^...{.lY..T..C..vI.9.t...=9w."(...<..b'.D...........D.m..w%.V8.O`.......t...D.q./.B.[_3......?t.+...h....m....C.V.X.\.....*\|K.Me.TT.%$.F..r-U4.h.\|..s"..M.QM.!..;...b

C:\Program Files (x86)\Microsoft Office\PackageManifests\AppXManifest.90160000-012A-0000-0000-0000000FF1CE.xml

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	551884
Entropy (8bit):	5.372917689942485
Encrypted:	false
SSDEEP:	1536:Md5e4cQndOgFRGCi1LFGb+7iBaW6XxtyX8i9Lzzorz/5om12Lc9uXq7W6VP4T5r:j1QnkgFRhixF878a81X2L2f7W2G
MD5:	FEBC208B71EAF598AF7DB0F2892900CA
SHA1:	AC0EA3D199DB013A5CC5937D9A3A0A5E7D6DFB6E
SHA-256:	535972DB9347A02D1B59CCA323C5A371F6605D661B37F02FE71CD8EEB2B5399D
SHA-512:	BC2D985380CA71A72B38AFC89FB8496878B97AD8C6A5FC49D9A12E70C209BAF051C6280B1D1B87D43D5C9C2A0DA3303FAD0420D9C7DE2530E6A2DE3D816271B5
Malicious:	false
Preview:	...T.Ub.L.....4.>..C.....E?L.+..{U.<U,..Of:o k.=l.$...(h5rO..H...%......=...R..j\.....$V....v[.vT.....G._.p.G(.mb.::;.t93t.'e...s.8...nT.j.M..v;..9.P.E...)......=!.j.oF.'....8.oV.GC..:..Z. ....GR1.8.mj .....Y..P...V..`...U..X...H/u.?.h........C..S.?,......K-..f.'`.....\........&>.C..f%(T...;.Xw.Q..2Dz6..J..L..W......@.1.........Z......%}Q.e9!.".tG.N.M.....Z..g..Y..:Ax..._.\|g..D.u.s.(.'#..M..0{.....)..I...D>....x.WZ..4{..kAOF..r6uO.c.....y. .H=......u..@..j$O...,....$L4.?ud....Q...'.fT%.[.?e./...8sN =.i[./.Z..//......I.2...\|.....c..%..&)...xF.[g...[..g]\-....6.iR..V...;..Y..<.v\..o...3...nI)...o.".1w.2jI.#.z..=7mvxh.uf..$-.p.g%.X....*-..x..>...._..Ni....G7..{:..L.EQ.pX.D._D....J.D49k3.\|./F.6sh"&..75<ji.k...Nl..Rq'..8..y..D......j/H.Grh...HR$O4......-..$...Z..F.....f.S.SZ...s+A4=`..i..b.........4...........4....KG. . .k.8.t3x....@.8="t.h.......a.......KG.i..L.=.7.e:.fX..x.<.g.U...Qg{........2.`....B......".h...d....n<.........P.j..F

C:\Program Files (x86)\Microsoft Office\PackageManifests\AppXManifest.90160000-012B-0409-0000-0000000FF1CE.xml

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1715
Entropy (8bit):	7.7037311448101615
Encrypted:	false
SSDEEP:	24:sY8fA2VbaDi4ux0AXnD/asSp+OPF7suwLewzK01IHQqeK7apejzXSJmOTNyMRHW:X29aDiVfzVO+OlsuwLVl1/q6peqJoqW
MD5:	6691BCFC56A0110A9608D3A2223F031E
SHA1:	BC595906F8A4C0F2B2846B3CA826D4963EB06996
SHA-256:	B3816F496D17BFAFEDC494256170B87BC76E4A2D76E9B12FBB82CA4A5442A775
SHA-512:	A39C0DE817E71E0DB588DF55DF1E29F8D9F2128CE6F5568B865061DAED1DDCAD179606FC324E1DC51F692DA68C602F58A6302BFBF6FB0BE91CE3A4720EE187B3
Malicious:	false
Preview:	.'..+.Q.x..Hs.zpX1....m.\|.E..`5i3...O7..l.D.M........;$0.!.....R...v..ZZ.CF...j..`.T.^.;n.G.E"H..P.#.8.aBnA.....H..B.gHX....!.z'i .g.f5)s>.z....=....!.U.n....t..U.!EL_..q.v6...c.8...6.xc+...M..y...V..E....2;.a..q.t..AOk.\.$.7g.:6J.G+.....$?.f;4...uL...n{;.pU..'...7.R...fX.bX..".s..S<q.....7)........&.h....d..g.E.1h.(t..A..5.r,.L..s..H.L......6.-%.J5i....^..\|.........Z..C.......@5........%}:)...cc8..c.[\|g..u.......r...rl.K.N..'E`Hi.....f.s..F....`XE..r.@(Rp....$...[.6..{...9.i..".l.I.La9....2.L..`..3...3..E....F..b.....S...L....E...xSx.....^n...a..K}.}>".n.w.$....$.IM.7......ET.m..Lg.3..0`.7.658v......?.gz/..../.>.....D..+ag...P..,.e......E...HM@...~.(.t})c...E..Gho.2.,..E._FT.:J.[..S.5..7.E.?.p.Wn1..81....g'.;....].....\|..Q.g..\#R.\.F.t.p.=.......e.......j......j^e`..aJ4....K..).U5),].X!6..v...y.n...Gd3.3!.e..b.ss.%.....?q.^O..o......r.4..l....2. .N.........q.]......._........'..@...u6s.]..U%m.P...._....5...D.......=...

C:\Program Files (x86)\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-0000-0000000FF1CE.xml

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2528
Entropy (8bit):	7.829663228234867
Encrypted:	false
SSDEEP:	48:ampH87buMPVtswyJdeBCs9b8yfmpBfQeh1w9yf8YMBa07LeXDjw8yoiW:aWHQDavi/LmbQg1Uyf8VN7j8ypW
MD5:	537A7E54360BFF9B4F668A22B23237F5
SHA1:	AB7692328329BB471D41BD49D182F21A4F3A141C
SHA-256:	0FF4D97BA057F14D7BC9F7CA438C28F197E12AF588306BB6C8ED6AA22A2D3ABF
SHA-512:	5B103698949BC3A6FB761A0894826CDE6D77AE0D7B052FF35FBB38EFE96EB32A56E44A80BDE4E838FA35BE27E4A7BC3540AE1ED809ED15134FB54491C800D5E3
Malicious:	false
Preview:	....>N..Hq...w..........f.....;.k.V`y`..Y@.)...._..o..U.ty.@(F.IoJn.1-Y.H.(..v>.1b..N3&....s#.g-r\..-..f.{.......':QI.0...........U.w....0.)./..........oE-...T. .........u{...N.0..z..z.;.7.#.F..\>h........Pi.....^V.1..G..d.&......w..Ob.Ii..........dG.... 5h....zL.m<.(.F..nO.y.q.P.]UiG...6......{..U..9.^c.._k.1.s.J.-.[...b.\|~Vm...#..........+.$..F...z....,....?....&.xa<..h..g%G;.CP..)RgK[....0..1..rH.W.Z...r...^....s.&.,....UF) ..q#..&^.....f.>.8.ri...b...~!...)'..B..:w..N..k5..bu..q..(.9...[C..@..Rf...%oo..!.G.Z.2.<.j\|y8....#ux.$...I...{.^..aK=.%..y...C...x........."n..{).N..Cu.RO[8f.(.......s...&........U^..6.a.m.;.x.,.aX..!2.3eu.e.C..YB.!.u........xM.!.l.'....s......h.M.o..b...&.f-..+1M..2T........Kx....j....`.\|.+...\..q".'V.....f.a.M....6..v.r.T..IW.....b{v.c.!?8Q.J..\|>.a.".].y.#.z.X;m..R...F.h...R...4..K...A.eQ..Tv=e..[aZ..t..P6~R.....@.....O?...3X..7_....#.<.`...s.(<,....X;...2..E\|....w..(.S.i..!.)h.9d}B...M...Wl."...e.X].0..G..w..c..!

C:\Program Files (x86)\Microsoft Office\PackageManifests\AppXManifest.90160000-3102-0000-0000-0000000FF1CE.xml

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	3453
Entropy (8bit):	7.8810544735732675
Encrypted:	false
SSDEEP:	96:AMhNND4ayN1wStCGwL9J2VkRFRBCeOxJczj2xgixDiW:AoEftCGwhkesxKzMg47
MD5:	28A9B41D8088A86B421FEA6C831C3631
SHA1:	DE07E386295019ABF97EC5389E301F7F73368CAA
SHA-256:	8CE4BDF524DEE308A5C74AF6DC1FCAD2B6AE39D5735AB1BEC4606ECDB51AD4D6
SHA-512:	29B953607E5338C5221D3886942952124DE91066FE6FCF27DE37D7E69E362D8497277959BC9833ACF62AC94F337A2C3ED7F698E8D8001CCC38CB7A2B5AE14DE9
Malicious:	false
Preview:	.:..]c.H..P...l7@...s..e."r...c[.........f..x........\.ZE......u....I.&......\.....68.Q....8.R/.,.(..W.>....S..Y....I..R.H.D..k........<.Va+..!......LV.....i.......c..8.l.....fSRB.....L.I8.8...B<R7.^..\|,.].......H....Ll.s....L..1[b:.GE\^.!.M.F.Bro..\S[....NA...2.P.%.^.n>....L.[%...........i.^...e..C.S.\5!.{<..eN.}0...m{;\J.cl.m..#.2...[..h.$.Rv;....01.....v?..?......h.....YcHw...g.Q.=E....Z.....]./..B#{.+..~..2.k...^..o...e-$.#.....a..T.f..O.^..h.1r..[.".a.,.DP.bq.U-h.....J.rz..E1......;W....]H...X'.B..w,WD.h9..6@.nU.......I...R(%.O.%D...N.....fa..........z.".V.......@.v.B.l.[H]x.&.6.&.=....d....~....9:Sa~.....L.9.....l...Z..6"b.'.%...u..q.....t./.......V..M3#.G.8`.Y.GJ...N;.v..8Q-..!.....m..V.5......l..V37.f..........]B..t.$...A..MP6s.(..O.P...+...f._.LV..W...M..Mo...#.~9Vo.:....:.t[.....f.Z...8 S*.:....)....z..@@.U...C.....rt..H.Ub...@...0...}v.?..@.`.T.x.......W.K[...@...o.V.8.+...7......I`......?...`..1....'.Fs?...5+.....F....n..R

C:\Program Files (x86)\Microsoft Office\PackageManifests\AppXManifest.common.16.xml

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2015233
Entropy (8bit):	4.168426735037154
Encrypted:	false
SSDEEP:	6144:+hrG89y/cUlarzLVF3BGo/TKls35RQVN2nSFS482eMsTSnpSTNSt+bnOxuNSRSVx:JbGvb/9Ss0g2YlDWS19wa1
MD5:	960FEBF5EB1DD73C0CCE1F7A4682C2C1
SHA1:	53F594141E5EBE640CA9D845B9B449D63A01940B
SHA-256:	19C3294AF01EFB11AA29B88114D01A7C8FC01FA8C7BF58E263E138BF5E128C1B
SHA-512:	3DEACADA5536CA1D7E62BCB0DB237907EAFC4122CEB252D0D5F2A2B0C026B8FD9E11E8194CFC9E81012B838A3243052A85CFDCE979384E664E2EFC2D5EB98E13
Malicious:	false
Preview:	.m..;..k.....^.O.[&..-..5..........$...1.\|.{.lm......}H...n."'_............Oll.;..h.n. ....N.....>fB..j....'.I...sY...fF9.w.d;..it...GC..y...L..i.\|..,."5zO..o..k....A.T....EvqGA.aa9.z........D.;....6l..w....=..#.H...z.v(_>....u..qUY....m<C..%[..4.P.yN{.9r...........g]t"._.c...2..>.@H.L...v0....c..x......n.q3..._..........aHf&....H.....x2..=e=J'........Sq.b..b.rF..yC...(.......A......w.0.Gj`.=.......B..........q.\6U%p.w.3.Lb........N#...c..l....v'..?.&....M.u..r.1...0a...........0....$L.dc....v.t..L..9...A.. ..og5....o.....V$k$.4...c.(.S..4H...BL.3t.Q..F.J.....8.U...B.-.n...5...W..D.C.=ksb.......\h..J}......>...\|R.~....v........m........Q.-T.Ed?......b.t...k..l3..3.I....v..uS.....X.....Y..e,....`iqCj.d.....B\b."7.g..U..?.H.!.MX...~S..u~.8?.o~u......4..4..A..7...0.S.:...^....K......z\.B.....~..#..KD.....K@.J.Pk.k..O...$.7.....o...r..a#..F.m...%..m...n-./..p`.Ms..}..>..L..>5.D.....ds...;5v.\|..AUx2.YT.,....N`..>..za.<dJ.(....d.

C:\Program Files (x86)\Microsoft Office\PackageManifests\AppXManifestLoc.16.en-us.xml

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	9417
Entropy (8bit):	7.4725149510836975
Encrypted:	false
SSDEEP:	192:7yQBqwjnCX63ILMfWF38l0D+kGTLUIDlB4:7yQssk4098l0DrGTLUslm
MD5:	5CCD79C4945D6C50D233606638314377
SHA1:	64FF59C1F8F3F0879F63FFA80BFF1C07A1EDD1B2
SHA-256:	FDE5915B65A656E1314133F868097D2D0385289C9E84E9876D1A820A16E45F58
SHA-512:	CDD22AA7F19F8D525F50D0EE0D17C8270297C4B0153D368BF9E5F62D15F13562A1BE1AEFCEFFB8B98E9DFAB19FF8E878EE19714A9AB7250FDD07AD2719CB0C46
Malicious:	false
Preview:	`...........7.Y....'!..d..8...[HjC..VS.+...?v:txm.H.'..AA..m.m.J..q.3.0..B.n.K.0.".p6=S....^E."...4.".bE.&....v.wc....K\%..~Q.n.+.U..mx)R...klu+(?$...^..d..7..#J...@.=:)....u$...1..6..7....)b.m..cu............Y........x..\L.P....u....[!.L!.....[.m./.....'.0.t.'......Bi....V..v...hE..8.o0....r....G.....t.~G.T...~0..X.......}.......CWT.FW...V!.U..j...a..o..=.p.[.F...rDH0VQE-.ac..0..=TD...e..R.m....t.*.......2.h1(....V.....V.]...Df..Y...8....~\k..q..]....'...V"V....&.GGy.@..(.v..h..pq.q.S.....x..l....V.:h\|..........OQ.Bu........7...R$.....7.....a!B.+.....j.......6.........B.....w..R..n..........D..8...q.W....b.Y.{.?...>....\.B..En..b.a.WZ...?+..........]..E.Dq....\..b......8.[.P.~_...@.....`!...]..:.$..EuEPR ..}..rQ...tX.....o...D.....I..r...x..n.....h......;.(.A...k6j\|.U....+.......T...}.O.o.!.".bm.${......:.JB..".V......A.<.4kGY..f...\.5.)h`A.bz.8.c%.>g....:..l..c.B,.....K.....)U.[..xOl..?..Y..].}....T).N.#...#q..H.y\|...y.%Y..<..x

C:\Program Files (x86)\Microsoft Office\PackageManifests\AuthoredExtensions.16.xml

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	700
Entropy (8bit):	7.057004359794881
Encrypted:	false
SSDEEP:	12:3k1y5zk6cujKv3NjqOMbkxFhtlkL8zTAPhzGQWpd/Y73xIHP7BpW:3qqk8s3NGOtltM1R7izBpW
MD5:	A7C75A4A45F88EA695E7FD94336D3DA5
SHA1:	E06F61F98D91104BB8765E038D1374BB6B1277EB
SHA-256:	BBFEADD03405228B9DEE5B6BF1783E1741CCC7C5CCE85A024BD7275CF8DD4ABC
SHA-512:	89C6E28946CE088BE7AABE033D0DF5CDA0B802751FA9854C29126C421553350222893B34D217B52A51DDC015156DDF95239F8E48E849F1BB521906921E3E7527
Malicious:	false
Preview:	V.P.(.....P.+.l..~~..z...V..1.9\>...X.dv.......e.....(.OQd..2....wv.+.a......P..3..p...n.....&W..AH.".2...'}.....V.l.h.b.........?.U5..8.~.....O.#.{.qB_.A{..w.>owC.El]4.....?...1S..s.@..x.E.W....4...k..t=.^.]e...d.0u....z..+.".6.o..a.[\|"y.2m.e...X..e.b.....'..d.........c.....f.ma.~......)..$...T...^Variables>.. </appv:Extension>..</appv:Extensions>......\%....l. ..x.e.j@W...V.Y...bH.y.p.r..{..._.;j.{....3..O..&.....j'#......<.O...8..!.o...n..Q,8........7../.\|4.O.-..`.hh...5M@9.....}...sK.H...B..P.....w-..(,.l.+m.'.j....@....7.\|q.......8......................................................................................@...............Y@....czyzk0zzhil.

C:\Program Files (x86)\Microsoft Office\PackageManifests\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Microsoft Office\ThinAppXManifest.xml

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	4938
Entropy (8bit):	7.926541925609277
Encrypted:	false
SSDEEP:	96:mY14Lh6lj94eC7Th/dOII1zXer4BEQyyuYhLOLiccvuweoOkW:kLcj99C7TWr0rGEQ/hi9t
MD5:	BCB4351BFF9E1978A989E7635E0A5477
SHA1:	DC7D1DF08ABADB11D7596969B9621D55FA92E4CF
SHA-256:	D1C744B666B2B446CF158AB80CB1B34DAD1C5D143818865878ADAF07D4C555B2
SHA-512:	05F9E73AD2B8B2D72AB8A3F0F595C383A7E837976736AAC5375BCF03B6DF73A6C2FCCCE9F43DE0C528C41FED60A6386FB41F0EAD11AF218DA081384BCA5A8DD9
Malicious:	false
Preview:	...%...........'.9.....'m.g..2_.....Vq.e.M..[... ..R\.H.8D_..bv.H......{.....h....7Lf..t..ZqyQ0.(3..588...a.....G..ID...8... M0..'....(z......kZ.'...`..( ....F.G].(....0...).!..Z>.G.!@......32:n.X. jK.8.X.?....#...=9.>O.B.2=...\|.[...)...[.oiz.K.a3~\|.\|`...N;....4..q...Ltr..q..W..0O~\u.L.5]4....$.....^.f(....-)w.......P#<..R.Dd.U_.C.3...U.u..'......oED.v.CZ....q. ....H.......2.......k.;$)<&l..@.p<J6.6c.........l...L+.....q )G....$.CfD....AD.PAp..I.=s.A....s...t...y..H...3j...?..Y.....f.^O......m.L../O...39..,z/...V?..........q.r..&xU..!$.Q.f1wU.L9.9..-.@.7Za.......f...S.z.V89.......)^).^r.9S}9........e..f.r=9..g...-..,i...9..IF.../.W...]Yh....u.[.E.'..d.....q...........Z.j.X..dq.....1.O..$=:.m[.@A?.^.....}..n..`.....1..`.4...).7.v.Q...T .:..../......P>Q...`...F..../!\...K..lN~....a.o..h[.....!......v./.^fm..t.V9!zA...W...$......._...B...ba].A...s'....X.c..,g.+.Bl\|0.l."(..w.....4W..di4...*r.O.2t..d.f.T.......,gi...4..+"../(kY.....;>..

C:\Program Files (x86)\Microsoft Office\Updates\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Microsoft Office\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Microsoft Office\root\c2rx.sccd

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	15634
Entropy (8bit):	7.3052789967882195
Encrypted:	false
SSDEEP:	384:Ti4yEPN/QRmUkMimopjBusOR9+8YFHl7fyEatBTDAuPkmq:Hl/RUk3mopjBusORY86FLwBTEuP+
MD5:	9F325F66CFAC9CE776F443DCA26F69DA
SHA1:	D10330C168451B463A0CD45A161ADCA37813370F
SHA-256:	A01654CB0872AC8D210744DCA75E70FD40A610AAF977F6C033DF877F81EECC84
SHA-512:	517AC599DCA00D158DF9E65D86657B255810217AE4B01BE9EE5A90C3E457DCAF97152A20A9476ABBE0B5AB77EF40CA7229DA3F0A071A2838F1B69345FC3F4781
Malicious:	false
Preview:	.k......n.........1.E.J.nw.d...).4..[6...B/...Z...?),^......LzS........j.5.X.3..-&.\l...P.s....h....P......#...E0....Ti}...s..r.4_....%/......E.ci.....3..8\|^.....Y@..TP.HA.$.. (............L......N]\I.m..w.s.)..ef=...Q.q.B.d..Hp..{.p.C..d...k.....P...kjAi....C.R.....{.......`E..?..~...1........{....S...b....5]...".....j..(a...E.m.....@"\.g..q..2.df.qco..R..E=;.F\|5[G..uo...$.Y....6..?....!g..R..A.o.......i.@9......RE......&y..UCRh....I.Vx.L..E].....6.n.@..4.p...j.Fq..1i9N/%.=....%<>3..W.r...c...._-9..P#&H...Jkr'#... ...q..#.q!.'.q....W.^.2.h.H....7....Xx...f...B(....>.9]..][........S.;.t......=..S8.zd.N..$HQ..j.{..(.~..S.....o.z.4.Y-.&Rf........x..k8<.wt..2.N........V.k.8........a..e-)..p......(9T..D.$.5....t...}M.......\. ........[=...z^.c..p.. .7r.Q..A1...,F..-.t:..8....vN..419.T.....6Ynn..%5%W.......S=r?.}2...l....,..t~.M.<..&zVp...;.,..".-R.AQ.....#n..0...K.K..X....X=...p.....6z.d..UC.,.....m.Ll..O..:9t.x...n..v.J.c.OYmgX..d7..h...

C:\Program Files (x86)\Microsoft Office\root\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\Csi.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	8748967
Entropy (8bit):	6.581279221218105
Encrypted:	false
SSDEEP:	98304:DEc9uv24PZNupr8uoMC+1SFDHQrLQ1zGiTQw:FQj4r8uoMC+KDH3VTX
MD5:	1087F4EB7EDABBFD623003DB74D8F1C3
SHA1:	F010362A903D64F5C2CD37D68D1FA91D05430BE3
SHA-256:	5B40FC6D92AFB7A1BD0EE921975446308BD3B3E448D2173D4493D1CF3E67753E
SHA-512:	B5964B7BB513B62690D7C3A2D20398205ACF6E25C43F616DC0D9982C00550AD8D2D0AA4D3E797EB0CDD126845DF5203148D95DD52696FE2121F288CABE618926
Malicious:	false
Preview:	Hv.s[).Z....Z...d0v.j...KW ......s[;...$.g..i~s{;........;.c!."j{..Jj+A&...B/4E%...,.6..b\|.......e....<'....i..........0Fo......'.O......M...VP1...Kf-...).q..;./..n...$.a.k.......6=..\|a....\|.C.....pp..y...B..S...Z....HAy............\......o(.)%..T..xk..1.i....Bb....=...\|..E..[A.(S"s..2+......p..t..eN@..rg..mj..p.F7(...\j.....4..a.S0...[a~}..B9.E]mYRi.......Wi.3.y... .k. ..l.'.9..}z.=..O..e.:8.y..}}.x1l..>~LQ0...c.......PP...TRb..Z..9..D{{]z.(...#..#!.(.\|.....}..@..........$i...s.Il./...dm.....:.J..0._....U......._{0._.Gb.K.[.$.E#l .Q.:...... ...Yp.mgj...X..x...].......%......#.)..)i.....B.0r........6o...B....S?....&...'6...F....K{..d..O.........w.W{.........\|.............o...:ql...^.h...q....L.JT]..b.?..n.q.L....\|....l.f...4r..._G..9.V=B....6..1.20..?).1...&... ......q...L...$...0....}.E.2..].=.k.x...Bft..@..~Z'..3..:../.[...i..]........U.....Y.....s....+.k.s..m;...o.H._..[D1!e.\n.Rr.ez.C,I.....^..(.....h281cO..0...m...5j.].St.lX.

C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\Mso20win32client.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	9109287
Entropy (8bit):	6.336233378708285
Encrypted:	false
SSDEEP:	98304:wmMbgJNWCJyc8wF2EgtUfLvG87AwGgiimv1Tj:tMbgJNHJycD2T+fLvG641Tj
MD5:	47A2C5B3E2B812967B9624F3F4A85E1D
SHA1:	97D8D33AF1B2FAE40638DA318BFF6F30379AE043
SHA-256:	24016D20A256770797564F09D6089891CCC99C5203E6EC3EC362BC5EF47C1CF6
SHA-512:	683B1DCB92B07C0E881FA5A57686FD1F47EE7D05A0B767470A27A8E11D2C518A703B2DFD066507AE48088CA5BB713404E1BBEBBCFCBB35768B77E541072474D2
Malicious:	false
Preview:	.%..=a].S....Q...mU.3..@E.v...3[^..g/P....0.k.zP.}z.YI.#..ig"T.t..'ao#.b.j.!...(.1...z...0....`...Ng?T.P&.Z.....XR.& %......f..#.......AB.......}..._.F......f.....u$.-.@.p)...eB....c.)..!.H...q.(.......y..'x"..K}.r...R.L...0....D.5U. o^.......E,uk`...,.=.v-\|......}..6.zX...y.....~FA..-.-\|P.'Q.~d...4u....@.j..................{....]q....."......G..a}?..#.......@.Ea... f..+$Q.[.Xb`.@..B.{...%5.3Z.&.y.....7A2..r.E=(..e.......R..2...'......C.c...ca...0...;.@.}...;=7.....Q....m.7...!.0.5..e...z...9.'..WgK4yr#.(W. 4..D....b$Hq...L.j...W.x.....(....#.....n.F..~.[.%.8a....:.........@}.y.)Q.............K..-x8.T.....u..k^.[...O.]....F..A.1?..YJ.?..n..9........X..xn...C...f.......Z..."pv...s.49?....[.>Z.5w.p.sf..=.\Z.\..j)."....=..G.p./....JX?.h;hRIHU....x....Vf..s..><,.(....u>W.T......pb... ......E...X. H.y.\|wRltd.:........+..V..r..4.....8.&X@....n.=.1K..Dd.....B'ar\|......R.g.#.W.E'.l.,....Z.e`..G....D.`.I.x.m.......#"^.1d.;.d..

C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	19118535
Entropy (8bit):	6.657201968112694
Encrypted:	false
SSDEEP:	196608:jFA/2A9DBLEmp9r1rXlS5ZWA78ZV5iiw4XFRto:iBL9PuQYiw2Rto
MD5:	3B8775E79AF437A41F35ED9D16039278
SHA1:	96234E8FD8E23F941E4F1CF1C590CF70C50982CC
SHA-256:	B10BCD7ACAFC98F6D20AD6538569886677C06448293653BA8E45FC4CA88985F4
SHA-512:	613FF0A73E51359242F9F375FD575AEFB423BE0C49C07629170CD7293D1F8F18EBC8209D09247368A90B3D14B3F6CF156B64D10F719425FDCC8EB1F1A3B889EA
Malicious:	false
Preview:	.F..p.s..s.&&1-..l^_...n..]...HD..).e.?\|:4.>......U....X.%.0].....\|.....c.x..W.......":.;.vw\.,.x..E.%...$j...8......~.....b ......N.\|Q..E.F....S. )5......Z.....i.[}..De>Y.....y...@e..5.G'&C..Nam..1..I:!.k..}..D(...F }z&.....@..4....F..N1...>.{.l.T{.`....`..I_A.v..+.../..q.7...d....xz..j....]......x.?y..M...M.7.T.[.....H.k(..O~X..d.v.>..a.`.....73..".~./...3"....`..=..q%:.c...1. ...l..]9.s.}.....l.....x\l.)<6.~.o9.....\O......9.....$.1..W3Z"..G.M.v>/..7...-...)..IG...Z...;z\...i...Lj{)P...V.U.....p..y.~.A....P..+q...+!.x`..... I..Q'..Rh..J.c"\|...3......U.s...fgX.. @.X...7b.....q.I....%[..H....}kQ..Q'R...^.4...J..if.:..n`...\.r.!..9.s.W..n..Z....B_zm._v.&.N.t.*+.w.z.......I]0cw..j...iXX.F`.V{.KuFE...........}..(.GQ7aZc.>.MX......G.......7.].zO...3...Kg].i.=.:.....0.......)e...>@.I.A..[.1.{....}.#H.J...d...!......D%2}6.2....z`.V... ..i..a.qNY..nK.V.....v,..ry...!\|.W.Z..q....O3....r.o.....X."]...irl....H'=EA...4....n..{.=

C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\Microsoft.mshtml.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	8008007
Entropy (8bit):	5.290580971148294
Encrypted:	false
SSDEEP:	98304:0t99w37Xvr+4124gLYdt5H6hJwfDNGAv5ltWSt:0t99w37XX4QDNGAv5ltWSt
MD5:	D93919979D37C8B8233940D271C2667F
SHA1:	1553B7CB0E161A5A2CEAB30101D00CCB5BE6F6ED
SHA-256:	C446163D708E5EE499D6606E20CEA510A9B2F712D0F1577F4A8CFACCEF4662A6
SHA-512:	AF7C091E10EFF656EEEC7C10E4FD5804766902A84EA5C42ABDEEF744960F5887A8F67C4E6CF13C8B6D73E2D02881F8F19A1C69D75C99B10C82557FEB70E35CFB
Malicious:	false
Preview:	.......Y6.WD./.]Ed.....jmQl.O.y..$1.V...{...W.,......<.q.N.&J>.....Z/.\K5O]U.J&.e...x.2td....u.p'cr.Q`JF.....I...."....<.....#....f......)..1.s....I..X.I.....Ip....-....5s./{z...r"......%...`U..e..c...&elB.z1.+..`.... ...'......3{...U....=Ka...g...x..t...-....>O.9..N.Q.q.S.'^4.........cr.?Z9n2N@.,).z.:,...y..._.Rv..:. ..n...y~T...t.V..V).N.)...2....).B..Kg.F..Q..6...*+.7.f...O.?...E.2..........J...K3.-2..L.&z8@.`..<x.....0N.B..Rj.X...W^..JpI,r..x<...j.2...;....>...o...'2._.....NG%1a....oF...vC-...c(. .....H.).q..q....xE...0.2.?.Bn6....P....D1.."..~...9P..........t]....$n.l.....k.&]c(....rCP(e...../.k..J.....$....q`#.&.....n ...~.N,......6.G.......:.Y......s.N...e.D..='.. ..!.<._.x,.u"...o........}....<.i....N.da.b.1V.3....2.......L..g.....j....$..p.`..QHm...B....b.:....+..<..K....R.......Bq'..+Q.<J.....o..5D..:e.Od...f,..U.^.Ii.A ..-.H...\F...bD^.:.'"{N....Dz.k.c..PG,......{...}n...k..j...7..\|t..zP&.f].Q\S...]..a.E.A.nK.t

C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\Microsoft.stdformat.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	13639
Entropy (8bit):	6.834039741101192
Encrypted:	false
SSDEEP:	384:ugdP1xyK+45p1D/oSK3h8qoyWLDwA/vUu7297WWdF:dV1xyP4p/ojR8qGPwA/qx3
MD5:	6390B6EDBA0253A99B25CCF8BFD92408
SHA1:	07F286921DA3522508DA9991BE4977C18D879C48
SHA-256:	CC739559291B1CCCC603E7E0B71BF164C52D05D6575CF7EE128AC7BEBB080138
SHA-512:	AA5685C108C3EC532FB234F76A3A49CBBE0415E8D356F249C201B2079D13A6A9CDA0DF490D8CB3DE81822969ADD5114DE16694C7A151DD2A4229B63A7CE88FE6
Malicious:	false
Preview:	.:c1T..:.....O...9O:...v..E..Z.._S.fJ...P......!.....j.s._..{......=.c".#S..>....~.]~..A....O..b/E.,.\W....J.d...LZ..M.."..JG.].eiHJ......R.Y..X. p.V.....(..]S...OE.J9...R......F.j..t.. ......x).a...L-P._.^.....fa...\j..Z..M'.Y...H...`[..-..^...1....SY.!o.y.. ............^./1......z..2....%1F.O.......}.K.C.Y....Bx.....<_.5[`.q.yzIC.,QAg..+[.4....;..c..c.....;.e.!@....\|.....)$....=..M...yM.......x...\|\.._...?......=.L uO).r...A.......i..>x..Z.H..~h.!zA.y.YhF...0,._......0.2w.pYo.....He..[N.7......P....V..[...3....U6.2.w.V.0jc.fD.. ..W..I.....y..... ..)....&.........@..#ILh..G.......)g.J..i.x...uR.E.....>.GD...L.J.ns._T6....c....48.5Ci.z.GPe\.,..HN..&.He.k...gj.;.kf..VF....Jc.>...F....1.....P4.*X.d.2.......e!.3]..C.:..:.tZ.yd..`.$\|o.-.+..X.v..$...b.K.%.c.Tgy.....k..l..s.3......X+...I...$mdc...=Y\.5..r.s...b. ..ba.8.X..........%.WDOD."S...@E_.....B..e...e.a.v..T6.Z0..\....m..~.XO.~.o.6....67.:X..._....Sf.....VG...c...O.l.N.....g...S..^.X..ij~..

C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\adodb.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	110919
Entropy (8bit):	6.221945850879317
Encrypted:	false
SSDEEP:	3072:LFGwvVdkeuxIQDXBLDjTgnucyMPHmGIB1YK0cge0:LUwvVdkNxIQDXBLDjTgnucyDG41nFQ
MD5:	BD7569E792637AE08C8BE9A1979AAB32
SHA1:	F8AFAB1725FC5A57F097F1117E7472D58C1B4E29
SHA-256:	7F8036DE04CE1D5BED6722E831E899DF891C5367399AD315E2290338C7E239BB
SHA-512:	C68F287412949C8358C22CD4CA1DC529429F1393734C95AF0CA062BF76990B70B5BAA9AA970CDEA5D5080588BF2DD1F285BCED26F8A341FF238609F1C5CF1776
Malicious:	false
Preview:	.......`.....KC..FWo........AG.F'e.<V...H....].T."?..1..;..7.%.+...>>...jc..+....t\|..L.7....y.o...<..^..K......!s..]..vq..T.h;...4g....2.."5V ............0.}}\e...].t..JM.&.$5.....'K..Hdz.N\|....x.N.[.....U{[.{5.....F......b....e._.&'..j.....' ..l\|C.n.;?....vcV...F..^...qf..;#..m.y.k.r..[.A.Sr.].FkR.j.t....H.^...}.U@.?....\|f.......=..?6.\|.....7q...^@.....}.o..$E...........e.h..;...i.g..6-&G?.-...8.~.7~..q..}R.2.U..)......."d"X#8......&&\|...[..p..k...S...%q.y.9.U.U.......*.b@...r.}4m..=x...{...nP...}Q.z.`.L.....;....bHG..Q...7k......{...6..$...N...g..t2...K%..S.I@....O.a.....".E.\5.......E)<..u4....#.u......u a.'tt._.9.Z...C.P....0.......X.]...f.b;.%6..O.......pq^.LE....;sQE..-.Q.Z.i.Z...r"T...=G>..._........R..j...v..l.6....c`...f..O..0.P.8N..0.1.l......`.....#...h.u.....-ZO./.P..%.'...v.7....j..~.}2..I......K...>.e.5.I.c...._y..=J....O.8M.N"FWmx....6.....S..-T..n.....Rr.......R..B..6..........T...k.'.}-.........'G+......6.....[-G&.....

C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\msdatasrc.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	4423
Entropy (8bit):	7.914915857491883
Encrypted:	false
SSDEEP:	96:9PF/ezAcBwpNagRwgzoovnULZGosaoGDYawFQSSyxC2CpNW:9t2zA/plzdULZGosaoh2yCjc
MD5:	74D99EFA81195BD2916DF04A358CC5DF
SHA1:	A5E389F656BC1FC089976C03C39B5B34367DEFC5
SHA-256:	24990D9788209DBC63D398B1EAE05D60F2A6463B993E88D4F2B081F5746CBCBB
SHA-512:	579BF69D8609FF87133E11B8C5A37BC2D8040B0FAB9A14F1E3B2374F77966498C3986055FD4B0CF8DF186D739C63724B2435C688B4F9452DF370AC4F4D425356
Malicious:	false
Preview:	...Ze.....(..$Y.........-C..3...j.T.5./.j..g....].qo.V..I.iA'/......M...r".w...~...a(l...........L....d...e...`...x.....f......"....7.d.x..7..(..wgh...VY.{..........9._.Q....x@.u.$9P....5.GJ.Y.t.c......e!.........^.n>..iBX..8.... .............Xo.b...".Tw.....T.S-O-{Q....Z.49..c:......./..wG..0)1?.{o..S.Y.k.....W.......oDM...l....b5.z.A.Y..c..O?.".....h....."....[x.;r.f..[.7..............:D.y..IZT{..@...X....S.0.nF..6~.......H..H...!..w.t..C...n. .........x.!.......{.....<.&.*.."..b....r...$.1t.=....3...cs6:...(..O.,m...LN...[?Vw.e!.=.NaecA....1\|.;.j;.V.......V........89=VE.[X....T+cN{...z..k.VNY...... 2...2.4kaGd%,6..c...WN.y.. ...P...-.4RBuZ....>.s.6.x2.p..@{.r... R..3I[.".C^.nc.V.ULx.I.i.x..o.~..4nRxCV;tH.]...Y......8t.t..2.bT...........-q..\|..3..E.r.<......M....6x.....n......&..h.O.a.j.~.1..k>....4...e!.U.....h?...U(...R .l......x....-..hg.M...~..l.......d.Q,;!G..k\|@...jS.%.........r.$.Jd.\..2.e.F..}./../.V..{?.T..w2.........B>

C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\stdole.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	16711
Entropy (8bit):	6.676066188501092
Encrypted:	false
SSDEEP:	384:UKabCxB85dpSW6cKDjia6K0eT9JR21xbLZo4vfjz6W5W8WWp:cOB8zpiDjileoh1oojz6oR
MD5:	8C5982D63090954F8D721E8199C78829
SHA1:	EA2BFE195282D54B710EB0F3033C5478D7EED29D
SHA-256:	599AA80DBDBF12334D6C9CF4CB2C5E1CC9EE0EAC645FEF4979416F456F0E0AE7
SHA-512:	88C2EBE1E3BF066BF3FE2BF4970EB60441883C66DDEDE59E6AD0832776B8BF232F8A1EE6AD724B24C4DEABAA478D9AC8840CDC0A39961A1FE665F8021938F8A2
Malicious:	false
Preview:	.-.5.6hzh.....k...maO..;..g....p...)...U........X>q.A.X..?.....}\|.)^_...n..X..Oo.....a.o\|n...?....dEB3J..8.G..t.%.t.M.F...Yg...t....Ob...t..si.a.. .u..Y......%..G4.Yt.uF\|V........X..o\|Hk.J-.....).....`.#....;.`.^.6ElVt....d..7@KC7G...~.....K.......3....v..`...3<.J{{3..p.;..6..G...M%....z.'.<R.........D.......;y...l.Ppu6....d..1..6T&X.,......J.NH_l..STXu9.-.:}..7L..7!@...!..e..Y...7s....3. \|pH...?.7.p[.K..ti....l$..$h.Ij^.\|T_....aK..+..;.......8....t.z7.vSY..B..R......i...N.X..{..a/7.6<QP...AjP..Y...o:..0.q+...H........q..:.$E.`..6......._(+c.\|.o..A......1..R...y....%._.g....>....Cj..r.e.. ..pg...:...3.U....Z.O..i.Nw..c]}.Pf...XO..#\...y...l..>..X.X..D.h..J...!..On.J.q.zt.....+..y..`.......+........H......D\|....XI.?W..Td/.\|..8..........e.{.H..........d#s...B.........R.Wy...&..P..e.......qYCV...'!l$.h.Y.&....&#..._.#...T._.N.2..t7T.r9.T....=@+)...._%......Ry...x.U...9...~)..SU......(0..O....&.Lt.._..C.W....0.v.l....7w.R.......:...}.......*B

C:\Program Files (x86)\Microsoft.NET\RedistList\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Microsoft.NET\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Microsoft\EdgeCore\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Microsoft\EdgeWebView\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Microsoft\Edge\Edge.dat

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	12615
Entropy (8bit):	6.308735143407828
Encrypted:	false
SSDEEP:	192:AzFreDHpwI3PkSehMK+psChgenXfp3hQs2nRTx8sCFRx0roODV9R:fDH6INeMKzmgenXxRQs2nR1CFk8YV9R
MD5:	E3507F27222CB71C7C226D95B2883DA0
SHA1:	E430CDAE20CC687678D99DFD819ECB7125BBB709
SHA-256:	D4B00BB6147258B2B13B63339C7D37E34424DF89FA37D5C7A7600C653D5A2E51
SHA-512:	2F6393E68603A22128B23FB90D5348AE166D47E4BED858DF166A9243D24672D78F82C82BE8AF7A3C97FF18098416C681A70034B2CF941F5951B267F6C457FF08
Malicious:	false
Preview:	...2...........,]a.1.Li.1.?]....).ZX..n(n.F....z..r..v...Xs.F..S.W2{....:.5.U.9..!Yp....9..e..F^.L,.F.>HfKH.Z.J.L@ll..?6....z.D.....oG......6....'.$vq........cy.R.$1.VB]......,jU...9^c..Qgfa...^r-...~....y.......{NZ..,.]S.n~{.$.x....^....JW.....M.`#..y..KD...{}M..m.........M... .g..].1.[}.q....vL.{3...=w..6RvH.7....\..c...ZuN.A@.%..g.&.n..}.......:..A...lFz.jX..oX.#v.fS.D...m..G.......w\.m...=.......D....^.........`l\|...;wt.ovK...1_.e...2:..7..5\|.O.P...o..(.G.>.h....&.B..,D)UD...._.`.+.^..AM.......y.Z9).....?W.@G.e\;..\|g.9.U... EM..b$d..W.I..(..<...."K..U...%.u....X)ZJ.x..7e.......M...!.C..T.....D-.JA.U..G%..I$.o.0./}..s...1.....1.cH..a.}...9V.......Y.!YkV.9.._o....vq.:.e.G....H_.}..I..;.6\|.s..,...Huy.z.......m.>..9%.d..d...zI)....x.Y..S.U..I..J..Fc.H.~.f...\|.(%..q,\..1.c..[.:..........c5...W..T.(.!1.....X.....~.(......,..+O..F..6.!..8..7..aL..p.%.....V....e.Gp.u.c;y&..2J=X.<.Wv..cS_.6'...b.w..T.4...D({h..L............d.R}.G-wH-..@ .

C:\Program Files (x86)\Microsoft\Edge\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Microsoft\Temp\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Microsoft\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	103721
Entropy (8bit):	6.43303607069961
Encrypted:	false
SSDEEP:	3072:XZhezzYLaS8u4cQPtHE4hgb5wWi46TVnXEh:JszsmOQPlrhgqWi46T6
MD5:	A916F56A9A86D65B7E7BC20E7279CB23
SHA1:	DA451839C72A5D7F785861FC26F38808F813C48C
SHA-256:	855785206572B2A2EB4689B62CFFD05186B493234912C7A141C3B254F9B218D9
SHA-512:	AB5DA7B1A2E661A422684320EE812DDA949D80310A09967F2B2C76816177A7B241B9360AF021667A1F60D9916DAA0F05B2B0A6CB2493343E7563B19CF8806CDA
Malicious:	false
Preview:	...!.}......p.k.....w~......E.{I.R...j.4+tL.:..F...Lu...!....#..'S.G.=zL....l.;Mc.?....n.i.^"...T...m..c.s.......]s..kL....x8.x..#......>.$.-..9...).P4j#{.d.2..C......Uk...W.w..,.H......m..f.2.....x"i.=...&.m`J.s.w...So}.:......Lc..H........yT.wF.d:.P1...T'[E<..^.LtVz...\.>.U....'.....N.mT._.A.-2'...._..[..q.psrY.(.4L.,..5.Y5v .[_[.Sz}M.."&76F.=.........+7...3.G..8..=..@...;X.(_.U`;B8-j.D...6...$...zR3.O:t-...P8...w}P .......z......TB.2.z.F........L...&LEm.l.....=.c?...l.}..].....)...a.}.../.[..8.T.r.l<$.k.....4.J].p`.`V.4...+..U&...J\|.....X...P.4y.j.q.L.u.vJ.[l.&..c"..Ff...T~...I.e.7....B{....j.Z..^..,......:@.D.......N.Mu...X.i%....@..H.^.r..>.3....\|...n..)S....C_jOV....c.6.1@"......!..u.....J0.25.......4.6...$Q.......9......{j..Q@}.8.^..0.W\|M.&.@Brs....9./...M(.Y.......r..%&S....!. .{.<8.-......t...N.q..g....0.x.\|....x.&\|@nFbR3.>.`jk+.F.L..M.h).y....l.d.&.f.E..)Jtt.....4..j....f..o~.j.4.}...+..=...-$.F.oB...FD...?M8../.q.]

C:\Program Files (x86)\Mozilla Maintenance Service\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Mozilla Maintenance Service\logs\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice-install.log

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	595
Entropy (8bit):	6.863125369753663
Encrypted:	false
SSDEEP:	12:uxQB0Y37KpGDJ4ZbsCjNsIsmVWsw9NzRcimpJgQOCXuW:uG13epGDJ4Z4Cj6IsmwsizRcimpVOCeW
MD5:	7D3F3E412E85198B0B290176B2FFCB21
SHA1:	3F30AF56D3CDBF2227D4EAFC47CFA48CB32B2A93
SHA-256:	4265281E354F2250EE5D061F83A78C7BB960D9F86118C90D0997FB16227A54C2
SHA-512:	F6D664CAFE300D055ABAFBC394E87583F255EF722B9A06C569C4E1898023399C7AA33C4188BEEB6096E0CD08C28068A08C8FDCD7885490BBBE1AF3A2957D351D
Malicious:	false
Preview:	np.n ...P....D.d~hr............(kq.j.a.......(A..F~Sy......r.x.as....?.G..n..9..&.l..E.....Q..xNp..kRc.?.Yy.h.QY..(."1......<..\.Q-.QV.2xi]V...SO.7m.G..z.s....k...z.g.-.....w<8O^`...b...7..>..!w.,.I..1...Z...dab4m.F...?...J.H....A.;=kB%#<).k.E...".ccessfully.....t.....l.....Q.~$B..d..!..s...D.....a.n.....R..YliD.O3..v..x...y.;.%...>..a.-.x.^..%........i.E..,...........@.gZ.E>.."(*..x&..........:..5w.~.X..z3...&[...U...C5\|.....F....J..x...F...C..H....E....................................................................................................Y@....czyzk0zzhil.

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	239335
Entropy (8bit):	6.691403127039599
Encrypted:	false
SSDEEP:	3072:pAtjtlU5dc5VVkwsU81rhMqnAJD8R4CCdNrAiAij+GvW0jeHrsJ3KJ0lerYauY1P:it+3wadKeg8PCdNrEsZfJS0lXY1Hd3BP
MD5:	076A6FE74DC5B24332E2A52A1A1F8131
SHA1:	17F62F2F30BE7C9113ECBDC6EE04B54BE4D5F581
SHA-256:	51A40A879A68E4804FCDBDEBEAB4AE2875DDA66A7E4D9ED7B3E5891290BE793D
SHA-512:	F7BA2BBF0748B86F8AD264275C1FFFA191C2070CB9CE6B09BDFF123461A203971059BB6ABCF712C691A7F45E3718C432655B754C0988CB666AD9EA3D65482E82
Malicious:	false
Preview:	.A...s#..=."P............@\|Q.S.&,.$.~....1@......G[...8.v.d.%..((.R!..].?(..(.-s.[...D:....8.3n.:-.....ek.u. ....V:.WL.[yXB..m..RP.T.".M.UC1....@.$....O.../\+.../..:6....6.}......UZ.Z0....<Z6...l._.J. Q..M1.=..$)...4.a.>...@..o...J.;v.........7Uy...aF..+Z.....)....P.])..Q/.......0.Y.a..m.G....8z.Zt..$.[.._$R.`.ouc..~..4...........F......`.w...^s7...P....z..8.....1..r.GOP..b".@.k^......_)f%R....?..D.......-.Ct.`3Hzr..&.....N..H..8@.n^...T!...X.8U.L.].w}..zt.............-p.2....(....3.........tX9....&n=.Vp.......}.?.m..m0.......3a.&e..\......l.!.G.-.L.?lbL..E.?z.......V....(`.}.P.@.ZR.&:{......+.h..Z..2.X.,...N!].....+X@.G*2.e.....#<J.vL^..).W...g...X2..Q[...F..M.2../.)6.".C.%f..x+...,....C9..M...k.+R..{.K..KoI..y.%'w;`......euf.f..T..&...n........H...K.(PN...i.._..dv...g...(....t...KQ.g.`Na..h"..L...?...tZ..Z...c....+...........~.F......a...~........2.l..^R.5..N'1..o.{.I.Ux....w"?..~...#.'?.."+.`...\.$>5....pm<.u..}...z..G.p.%...........T....

C:\Program Files (x86)\Mozilla Maintenance Service\updater.ini

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1529
Entropy (8bit):	7.669834776971617
Encrypted:	false
SSDEEP:	24:LlI5MGKMrphdVuqT31t+69IrPp/8nutytFdW6772kTUAK/H5onaqLTW:LlI5Ldd31trIjp/2utyBv7fUAKPQTW
MD5:	33E7BFE45F2AEC29409ED369109B5642
SHA1:	BB573C6E4BD35121124052E84FECA3F5580472D6
SHA-256:	12C032FFBEA1E654738589F95A8F8347320976F0021E98522204E253FE6BBD71
SHA-512:	AA6284F57D48B7808982006C9AE4AB8F0596E7BF5D778F634206BB5A61EDB4AA27AB94F3EB9CEF91D97710220649625655EE264852A0AF366BD125DB4005A210
Malicious:	false
Preview:	.....?........."9..._.h..GK..p.C0.{.H..2......-\|V.]..m.B.>...W'..5....9..J.8........M-..^C(.I.67.<.`k.....\\|.....#L..0r.....7C..E7q.d....i...G..."..._....I.....%.D..\|....a4-....(...S..?.b......e...JR.]..\..0.Bn1.g...su...0.i1..;.=Up....P.....,a.zv..2..G].6.......?.}I.N.q&7...y[.2.2.}...C.H.pK.\r?......w.43..5?...\|..&[+T.S..O..$5..i.w.I....<k.3....9t.......7E..`..A.M.C)O........'...9.Z..}b&...(.....9...[e@h4....+Y.~..SF....,....Jiv..G6.U.}l....s..N...o+.U......88........T.Y...O..e...9...}>....g....~......9....ra.;..VZ...W4..X.B...-..~.(.hCz..2K.:...8l.C.....\|W......e<.j.......T.............{~.;..H..Em.5Y6......iH..-..._l...s.tU)....BK].Mu.V..H..\|..E...A.}.oy-.......L.k.....iy.^s.6((.hd.2Fb..._.(.Ux.K.Q.g.N...1.l. ...e..^.._....7R..!..^;@.)..6....i.......mH.:...D...7....._.y6(n..*v..YS.....Y,jfuCT.sBmj.)........V. .w.6......8R..d..{...._.l...K.&..k7U.i.t;..z..R.f..c./....C....`....+.%<z.E..).~S....z5o....\...S.w......9.]...RV

C:\Program Files (x86)\QnPkEpoXWIeSCixQdcAXTHyBTwixNTfoEpzzkDkDyeVPmOZqRiPlKzGjdIBtwVSDFvxOrWrRxkD\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Reference Assemblies\Microsoft\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Reference Assemblies\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Windows Defender\en-GB\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Windows Defender\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Windows Mail\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Windows Media Player\Media Renderer\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Windows Media Player\Network Sharing\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Windows Media Player\Skins\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Windows Media Player\Visualizations\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Windows Media Player\en-GB\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Windows Media Player\en-US\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Windows Media Player\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Windows Multimedia Platform\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Windows NT\Accessories\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Windows NT\TableTextService\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Windows NT\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Windows Photo Viewer\en-GB\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	true
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Windows Photo Viewer\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Windows Portable Devices\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\WindowsPowerShell\Modules\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\WindowsPowerShell\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	true
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\jDownloader\config\database.script

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	583
Entropy (8bit):	6.853736528123576
Encrypted:	false
SSDEEP:	12:GWbsK3798Y3HUKtqCb3LVICHmyJj5ObvmKdw/GslAh0V6khWhXuW:NHL9HRqCzLVICHFbK2Oslc0xhWheW
MD5:	5CB44A65B2588D61B969D34482914238
SHA1:	34B37CD73134E49BF6164D8027882870233A4A31
SHA-256:	D3CA5B8554EE19026BD7D3C3CCB18DD6EBC538FE8E1DCAD515A4D825BE7513A7
SHA-512:	AD9482DDE4A0E369FF70C63091DFF2311F5BA44A06C444279A46B4C0E7299742C8473A210A6A376326454E3178BC0212C1BF720E33108BEB3B28975AF8FF37A8
Malicious:	false
Preview:	.V....;K......6r..IB.Q.e Xck.T~.}1...7#.@..#.#.s..J..Tj..X......n.b.?..EW....m.....o...~I...3..._.lB.......tM.*.T(I:....Z...S.T..P...(\...>.b..d.~...O._......L.O.A5}+..v..%.\...x..y..6>..h...0<.]...a8......}@.YQ.c.J.....[.H...RfrW..\.^..2S.......3B.....^...S...; w.....k.&.M...>.h..`.;U...J1.U.....W.C[.x:......B\0...m.?.;7..0p.....l>M.b.r.#Lm7).N...Yt.c.~fB:.q.._..K...k...m...t...;.G^yF.:gU..C._.<+hG.e.R...j.5.0.}]...S4.2./\.y..]..K.F..<......................................................................................................Y@....czyzk0zzhil.

C:\Program Files (x86)\jDownloader\config\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\jDownloader\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\7-Zip\7-zip.chm

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	115627
Entropy (8bit):	7.900996553450715
Encrypted:	false
SSDEEP:	1536:sGCoF+dEEow9Y5A3y6D80NT+Ggc5NTO600ctSXH1D5STucs1evrtN3Ae1Hx:sKq3peuvT9g+N6Jv0H14T7sMDtBn
MD5:	683F3D75D895EC91356AF5ECE0DAF8E6
SHA1:	92F57326C0E347C5C116213F8048D86BAAA6FC58
SHA-256:	371903735049D69559E40BDF185B1F1AB479EA3960A2DEA115D027ED914D4F3B
SHA-512:	281FB97647F56FD7F654290602D117EF57E5FD3651B996BAD2EBA08DDC3FC0A1D45FA585B7660BD035E62E55EF0367C08DFED2610EA9F22CCB5EC18D7EDE6C02
Malicious:	false
Preview:	......`uw.&R.........7...r.:....3...X.}G.Z).m....yYF.K.26........(.;u:.S.I<v.....2@.....p....p......O...s.`M.D....K...H.T.u.!.8x.;.....4.9/.Bm.i...Km...S.x....p.M.t.A...\...aT.....b..5.%>..Fw..&sw.8..i....L?.(.f0)n.q.iME..#2.w.M...J.$.n..c..5..~.Q....9...4..-.QF"r.K6 .{.'..?.1.P...{....S."FpQ.c:...X.Y..,......#.4....U{B+......b.......~.;.t....vN}1..?<....A..>..U.H._.>PUf....=....uIY9..Q.tb.W^e.U?...l..T.......0.........`..j...[}#......!...9.~......]..M...-e.2.f.F.....T...0.av..aN.p.k......u. 2..PX...........+..#.m.:...7.....\..r.....Lu..8...7..rvm......%....>s.k6X\ul..0.[.p"C..8hi.%3....=.........O.q2....D..8 D..a./xN..R{.G..6d^{~.F.W.f2../.Z1'k]..^G..1.G..k.a.md.\...G...H....]7..BbR.......w.b..Q.R.1).....JIh?H.g.5i....W.h..1.9.b+..p.F.H......R.w.d.R5u...p......9.+.....16.[.-..t.<.M....Q/..r ~....k.._)$..}c.=...<Ec.S .q"FW.LK.r.Y.C..).Qn.,.~gy.[!...".)...g......9......k..%....D...a.Xb'...........U.r....T.<W.4..F.(a.3....6.\.

C:\Program Files\7-Zip\7-zip.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	101703
Entropy (8bit):	6.2298290450564195
Encrypted:	false
SSDEEP:	1536:KRjWP5/zb+/KEAng2yy8thQ/cBX/MnjtZDplUu6KELgfVLYCLCPFtg:0jWhP+RweX/MnZZDfUBgRYFPFK
MD5:	CF3A43D18EEFC0F6C94BF26632E4182B
SHA1:	7BF27FEB1E2C3259F0A7A0CBB71DD2ACB347062B
SHA-256:	E2F72A984C9AA4DAA049A0857BB9D8C73339966836A0F631B3E2D9D99B8F57F2
SHA-512:	86DC5A2A092CFCA746B714BC3A3451185822D6B52C0B96CE08730A0A2F3F42BB0B967C69E984B227F7FFFEBC9B7E9112CEC8CEACE880665E6D92F9E68EB72AEE
Malicious:	true
Preview:	...I ..k3{w...N.(].%Y.f%.O..Uc....C.}.l...D+R,b<.8...Nu....]..{\|.y...&@r)@...<\|N1`...9[B..G.~...y.-.a.......V.....dk.:..$.....c.}4.-Q..'......j=MW.b..OXQ.%"]8.d.3...K...9............=..2m5...'.@..........).k...\..C...[O..(.^......h..E(.Y..P..D}R.W.Jx[~..`"^.x......%..n<.?2].7.......Z...%.....y.....rq..w.4wX}u......=jq.F..=....?f...X.....A.~r4...re.;..P..j.kR6h<:D\|.> ..ut.>.p.Upq......0.n.y'WD..v.k.d.=...eyx..N.L.PEr..,........cC...C...a1[^u[..d.l4.`d.......cc.....9...P'..\|.3.Y.7.....S.~.c_.k.1..ItW....( .d.......V.kh.Lc...Q.....8..v.7k..8....D...&tI..7..1.I...6.bMu......&.q~. ...t..g.>..4....CE...bL]S..p.I.c..@...gXJ.XL.}.7..5..w...~.Oa.'..&..b.......m...{...1..@.(..F.7-.Jbiy.]UD.p...o....!E=.mq.\|q.(n..\|..pt..]..._.d..h.Pq..oQR.`..I.Gw....[.....s..{.0eX.....v]..-{....[Vw/D.!.Fz.F...F .&.!..NO.dB....}..v...S){..o-....T.?....8./..^..T.../d....I....&g...'.9*.F.....L$..P..=.......v.m..L.55..D>..3">].Z[.5f.......L...q..Jp.~e.>.9y.....W.j.;>o..?&.

C:\Program Files\7-Zip\7-zip32.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	66887
Entropy (8bit):	6.353498072442516
Encrypted:	false
SSDEEP:	1536:IkHhUxWL5WohyeVjGbLVMTwVBQ9REmzUp1VV+W7:I8hUxq5DhvgVMTP9jYp1VV+e
MD5:	06A68CF4BF102FA0B5797506AE7E3E33
SHA1:	4058CEF5F6476803B674C616525B6404E1FCAE33
SHA-256:	3168D0268341F5CD291C7EFFA043BFF1109F1883D4BA6E642A56B907581CF480
SHA-512:	1FE93124718A76564BAF774CC99F09C806D250A60E590317D965888BA953ECE42DBC6A7FF2548EF5B07DB3F04B8614BA7D9E4F283BB0B0838BD96BA4BC785E8D
Malicious:	true
Preview:	e...bJ...'zf^....cL)d..._..i ..q.%....u..p.Kjsq.....v.....Qn:po.K.vk..`..0.....r....T..a..H.4.a...HM.....[...).....%....?.pl_.8.0.Ue)....u.,{e.....$[..!.-.Y...o...o.....X;.6...'.....)K).......DKh.0..c...H{.`.Nd;......-.@~...c......u...s....c..bQ4.n.F..B@9...be..M.....R..)..+.9.%F......o%....a).v)t<.H}s.{h..gG5.s...f.......X...........<=d........!.7sv8.Y\|.0..Zsd.~.0V].&....Q.z.bE%.9N.]...h~%...x.b2..iy..''/....f...:=..py...e..... .Bb.g.lM6~...z.4.E=.....3\7L."2.....,&...._.....3....:...t..q.>.In..^e.Xk..0.OT`.ex=&sf$..c...Q..Pc.. ...i.lV.").T.Y{...6...h}SotT@...WO.k..o(..q.6.C.'q.e]\|....\.r..x......L.z8@.8.9ym2...j9o[....P}.2..Ao3.:.7.V.y..P.......\.y...&...Nk.@.CP.........N.\|..k%1.P..Sg...I%..I=B.R..t!ap..D.....2[..u.]....{..X.X..xW..,tJ.".^fV.~.K....C-.=.0.. ..../..3......{`..DH............^V....^.6..a..>.]!....#H.......!...Z._.B.c.....Q...]#.Z{8>~....D..3.(v;B.o.X..G..w/...S...j..._>3.$.....4...6..,.*.$UK.!w.U...L..3,j(,E.=D.y...0.5...

C:\Program Files\7-Zip\7z.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1841991
Entropy (8bit):	6.571946929615163
Encrypted:	false
SSDEEP:	24576:Z7EIjnhGiRw/Afr3RfSdNfoXGu9bEMtyJEU3GIBOBlap:Z7EIrNu/AFKrwx3yD2IBOBlap
MD5:	B5998BDBFF32E344150905727A8720C1
SHA1:	34D085E7F4CA15C5A09D905C251F1E8D2951D108
SHA-256:	0608B34211FA15EBA73A4A00FE8A520D2735A2ADDCBAFF75738C0889CBD10D59
SHA-512:	D69CDEF28747AA5C2708C516F0504943A6F82C0EEE4C63FE8B5EB53F7F00064C6618A75368EA907F6C050D074D35834A24BBB949BA84E18D56759510A36FF6CD
Malicious:	true
Preview:	.FH..X.s......m.....#F...Cu...0z..FXvn.(......y.Li.E.a?....hL\O.>Px..A..KZ....>..w..k...hj.%.......).r..\|>.[....3\.....^..VL.>.XV..1..K.P.z\|...W._7{.(.\|.a...HO...Z.X.Q.......A. ..wA...}.i........c..d.e.....Kc.WHc...:.R/v..U[m.....b....y/2..k.....5....Hf../.yw{..3.\...}W9Bg..?.$..y..aF....$.T7......K..Es..5\|Jrf....Y.l.G$>I%u..[Z2..Cg..d....9..6....2..H...fb.#e.v.]..~.......2f...!D.U...i.=%_.......H.<../........Q...F.........~.!05......<j.{I-xK....y.56..x..T.]....._..b..........N........2.O.qQ@5E....=:.y..R.#.s......E.d.e..8/eA.F..XZ.0eqo..n@.,?QUo%{/..[.d..o.................R.5.\|.Ll..p!2.S.`.o...5..$T.FA...J.f.r#..:...m.....\..c.1..z.<..>.PA...H.(..r...".......9...L.3Jd..........bjH.....8......P..>.K?...NX..o.f....3.S...."A+\.-\+.=.......{[.vD~p..-.i".....t......&%.9.eg{4..g.[%.Y.r...s'...B...c..g.ut."...M...~L..c...i.6...........pU..a[..t...}E%.5.V.P.b...,8.....A.-.-..../..k.......LOK....)..]T.U...p42.....X.....f(...S.....v.

C:\Program Files\7-Zip\7z.exe

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	557383
Entropy (8bit):	6.516117151548605
Encrypted:	false
SSDEEP:	6144:KR15bS4q8KieYJVUdURTfnv+356mRcvWt5ov/L3uWnRXAGmMUezalMaEiAEhLEJS:Kv5bS4ReYFp/qUj3fR5mIaC4Psxo
MD5:	CFEC2E2C9F9C52D53BFA7D45B07C0290
SHA1:	78EFBB5CB8E08691A45DB05D3012CAE18D207216
SHA-256:	5A5CAE86DAC6A8DA097AC5575B94891EC38044E7B8CE757AB7C0D32A740BE00C
SHA-512:	E7C51BA704347A45854F511F389A7664B32CB5D744C484721B17EFAF100BD0237EC7774D98F9969A805F20CFE18765938AE58F45F2936335F47F1297CBEE8F28
Malicious:	true
Preview:	..x..J.+..e.A.[.}.wEZ...M.\|.....`..Z.........(...T..,W)]q1_............/.^K..v.A.N...f.i.....&.<.SY..lm..;~..k...jT..;...b.B.3...9gq....>._......k.{....G.X#!C.'.kK^..........\=.b.O.w..nQ?..du.#.<.DjD....O..k.....Z\...g6..^,....;..&../..'D..........0..3.g1@Q......Mv.....,.U..(.m....9...B8^P......^W...+kW.1....\`......_......7.TD....K%&."._.gBm...Z.o..wwWc[X..dz....l..k........8_...:..R....Tl...z.j.c.C..^.sd..R]c...s.p..5....@.v...0FJ=.5k......#1.I".lD.z.v.7..4.x.4:..V..n.W1..+..5Zxz.1r.h.._..`..(...z.G.8.ym8.....2G).1..8.....7a..6...R.-q..U..v...q..1.F..XHN2$..=s.T.9...I.....J...u.l...1.M..y:.....`s]iu..c.....?q<t.W........)ue.H..\.......n....R..};..."...qH..7.Q~......Bd..............I...m.yB...e&f.ME.Bl......#.r.4..E.DMu..31.B.l...R...O...".}9OV..#9-d.}...Y...L.)...&........ZG.U...v@.7.......LS.a.:.:\..\{.K.V4.....&.V~...Gnx.....>.eJ.............{@.14./.g...d.6.:Rj....C.%.!.9A.G..G.=...i..r.>OW.D...t;0......fJ.\I...1.=O..........;.+.^pO..

C:\Program Files\7-Zip\7z.sfx

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	214855
Entropy (8bit):	6.780213069384773
Encrypted:	false
SSDEEP:	3072:bHZQMetP7srViCkMtWQQUx9blmuzb7lske4iopNjxGpBD+FHRd5oyH01:b0UViCdtWdglLe4iopNjuBD+Fxd6yU1
MD5:	D71F635104917706CEBF034563C8C9BE
SHA1:	D511FF41B0CADE01488EB58BE3FADD9B0F65C17B
SHA-256:	1303C203F6F9E2E16A9742339CD0AE5B7CAFF0DADB4EBA46306366EC3621D3A2
SHA-512:	43F725E18F44A435E502553C5D18BEDE6EB7EAE92C222D8B9EA515A61408A72F723A6190BDDA8B11467A78401AA2741A9A4CB511B6B599CDAECD0459DF5905CF
Malicious:	false
Preview:	j..........w4.....G...4.{-./......p.2..h{.F...6^J..]A..l.....z8Xm.;:<.....i..L.)/.L.R..0....Q..l..M....nF.......E}....n...fx#RWH.8.Z.q.QD................J:GX....7...6..[.'..M.$.0..4N$(..$.O.....,..N..q.P.f.l.....U..H....@.5..v39.\|....-D..Nd...+.[...=?N......~.6.w.!%..v.....&N>H..\.3...M..JG.BD..R>... 8z^..8X_.p....^.)..C.....GS`.7..z[A\|..m[...D.S..xW.p.G.l.......n..w.UH...+...."..-.{.....M.}j.k.."....c.....o{,.d....h5/..&1....gJw..f...QxC..)....X[df.u.+q\M.@.U....2g.......^.$X...r..'.........#.tk#0...........[.. 5.e.M'w....qY...#..{. ...9....,...c..+.U.Q..-...M...qq.,...h..A../yp....a..0.B.%.......g...x...~.$?..........>.0/5....'...h.....0....6'..1.A...Nv.b.Xw...]...HG[..~..o.G.. ...H6.a..=l8......`..../..N.\|........UO..x.....,.(k.JNv7-i.n..=..A`.A.9.../...\].@.b....dU.g...<....q.&.T.L.......5..].....4.....0:.@s....6.....,.GAd.s.~...I.3..}........@.@B......<=...Xr@..%.A[.lS.C..L"..z...J...JF\I.1UV.?....S..<.......Xl.d{...MC..]...^X

C:\Program Files\7-Zip\7zCon.sfx

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	193351
Entropy (8bit):	6.849042667765099
Encrypted:	false
SSDEEP:	3072:WTMZ7ssB+MKtXyJAImbl5DshqZNNDkdggbzWn4d+A+Wr0mloyh9jtwaogAD:3+PtXa5jqZvDDgbz6U+A9xayh9jttoBD
MD5:	E0A32A2E0BDEC6C8B274658E7142EBDB
SHA1:	34FE627110B46C168BBF8E79C123A05E295DB3D2
SHA-256:	26B4C7EBB144FB61D46CD276A472B2A32221947280E6D81FE4C0E0172EC04DCB
SHA-512:	EC9D61C9CB7DF6894F2295E3774C0EF6FED2A4472EB767CC2DEEC22B2F6DD641C056B7DE86C71048B20FFA693108A0AB871802146FF7C82A172FDD44DA5FE21F
Malicious:	false
Preview:	.Je..YE.Kph{.c.2+......n....!Q.t....0.X:...Sea6T.6(.Z...@w9#.......3hyP.2..\.}..8...D+hL..^....?...s....p......S.(S..(q....d..z.O......;.w......oN....Pn.:.Qw...l...[c./9.W..L.?....s..h......).= ....\|.......!...Hh$`P. \B.#.....X.......G.........FYE.l..[.3.B.@[`..&q.F_... ?s`.............{....8o=M.o[.a..n6eF..5..cP@...L...G.J..z....;'<\.....T]H..0...pG.#..hx.C>...o..r..R..g.9.k..W...+.'.5;.OZ...e..\|H.4.P.SD.....IF.?.....%8V..Jb.:<=g.<K.}&.y......e;\.=......B...oX..x..C}.<..m..uPZ, .Vm.......@.sR..@2.7.h.l.....s.....b...gy..e%.y8.}$#..b...\~.UMT....PI.nZ.....'.~.`_cV.u[UJkh...;.lg.lWJu-#.f.....V...2p..<..L.......?+1Z4.rx...p...T.v.z-..n.V..-S..n_.!.l.A:7S......e..._<./;...S_Y.(.B..=".v6.$.c9..y.......q./<.HXw..W.(.....,p.H.......^.*5..?<....S.p.=...N}..........0w06PK. G.\|.C...z..6>)..e.Fp.2..d..... ...6uo.8.A[..w.C.....(Nm..R4....\.U2.C=...L........4q.>..-z......Af.H..Q.$.f.....u..y...1...Z......D....azC...`.\|$Qre.l..j..$u.....p1./.....

C:\Program Files\7-Zip\7zFM.exe

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	953159
Entropy (8bit):	6.469564516057283
Encrypted:	false
SSDEEP:	12288:RB2Tm1/u2VjUrqmiZ8BPKVjAhLlJdhwcN1YnLFeBjJnZ8JREEe7X5QSNBR:qqvjgqmiZ8BP0Mh3LwQYnIj9O+X5vBR
MD5:	F540802BCFFCC26C05E43509D326D187
SHA1:	8AA280FC4BCE6370CC453040B545736D33CB9D82
SHA-256:	F3269031DF62F31C7F5999A969F459952B9D42352A6D0D6EB08359CA2DE06B78
SHA-512:	31E970B1C988B62830154C43188EA713E83711F74BA2EDD2EF287C945A957915B55974DEFE1D5309B4585572A136F15C4D648EEE0232421407FFB7098CBE40EF
Malicious:	true
Preview:	xD.m?]..d>..C...B.....Lt..%\|KY....?....K.3....e...oxK.a.h.M....QV..R...e.....ri..b8..9...\|R....T.I.......],... ...^.(?a...f.~....XH...........q.0.......o....L....-..!..5.. ]..wT..V..$ m.-."z..8.`g...n......Wm.Xf!...G...] /....... .R.kdt.__....8.+.?..\<P{h.F+....?..-.b.Q.N.j@H;..X..`.[E.....t.....3.z.Cao.i.,..]..\..C6..Qr......P.`L.....fo..q.n..K.......B.6.Q%.p..kJB.!v.Z.......s.:..So.R..$.........e..P]....... .O...v2Jb.J.j.$..."...c{....?...8..%x.R.?9.0S."..N..B.Q.\Fb8.J?.......M....U.Y....~\|.4...o..x.r.....Z&....xN.+...I.J..db!..p..$...3....U...'.C.{.9....,A..'....K.@.Z...F...>o...^.3..XY_.....<Am...#.(...P.z...7V`.y..2z....Y...p....H..Nv....X....$.G.../~.z..R}..-#.F..oS.....k!~>U...+^.....q..Ruz..3.S...I'S^....N.A.p.e...t...9...#.b6^.J.D.8.=...s^.....l..bQ...=.e]F......~.>.aK...d...k.U..]........1&...u....,.$....x...$.-.D..C.!.svQ........$.i/.Fq.r..Xb<_.".-..h....%...T..5..7....!........Q..RY&...4....H..$.l:,....X...r.`4).h.

C:\Program Files\7-Zip\7zG.exe

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	700743
Entropy (8bit):	6.46310852893977
Encrypted:	false
SSDEEP:	12288:QKPTL9PI3BWqTXEnuVY//I6p/Wkrk5wngfkO9Dh:HGhLEPCQ0B9Dh
MD5:	CDEB1633D8FFB2AC35C2EC8265336BD0
SHA1:	E0BF2473CEFC5CB0E25B807D94C45BB449A4D6FA
SHA-256:	F82D284DA0C63B0B62C9660852FA7FDB3027CB043771B64B6E9B2C176575503F
SHA-512:	1B4CD5818D3D6505799411F9DC3E21750439D463B451CC2F05D6F8F6D2F197003AC1036D05EE8B750A6959CF3055681FB3704B6CF5184C2C7421ED6584AA02C3
Malicious:	true
Preview:	........A...{........'....+...v.......G.I.Ar..G^OU.k4....1g.O`.XgE.(...vfL..e:..8..-..Q~.VAL\|.9..M..0#...r.5....W)w}=G..O.....d:t........a..q.A.a.>....>.../..;u..`.../....Yx.YUb..@.&..~t.....2b.,....r......q..d`.4.I...S.....4.[R.F.f.Tu^...jO.d..F.........).(\5._.y,.>.VUe..v.%....HR...p.(.Ue...=.eG..Z\..._.N........^..BUX.8.4l.va.m.9!..q6.l..s7.b...Y0......ia&l}.p....5S..Y....HE..xr"!!.X..._-.[..F...+...4G.n.X.xw...:...#...B.J.`f\...=.:.kg...T...._..-d.$0"]........&.\|..g...Pm!...)L...n.......t...k..X....?&..I.c..F.....p...R.r.-. ..G.o.k../x.7?...F.%".).Z..q.S.z...&.#...J...Y.f1m:7.E....3.G6..d.i8..h1.Vvv..ak...j...\|...-.O..!4...M.I.'a..c..M.G....+.......C$sl.....E..\|C...]o..s.p7..E...J....q..#.....+...R .#.F..Q.n[...;S...~...Um.^..Ur(......Y.F........%..[.../...1..0T...kN.,X...I......Tnyy..oM...v...K..Tfdf..O....H7.t...hC..7..o:.....FE......^F....A~..[.Np@E#...0....D5v}#'. .tr.b-.:......&%.z.qv.T.......H.GWyF.TM_gzN.x..O.yJS.

C:\Program Files\7-Zip\History.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	58632
Entropy (8bit):	5.916132296530071
Encrypted:	false
SSDEEP:	768:59NMX85YF+TG/nh6fTvBdo5PJuBIuZCw/VC/gZBo70vi98aUjFbsM+aC:dY8GF+TGvh645PJD+vCIZBoB98vF4Pt
MD5:	AAE5D5402E740C0C96537773399E7D8C
SHA1:	D30C92EEC489BAE41693398E1EA1646F685DD4C2
SHA-256:	BDA73EFB654FC99531A868E2C27CE69B261E586AE6ECD8024E7BB351E6A20ADC
SHA-512:	57CF1A9101E1955EFBC93BA3DF9011949D7F1BEA0B05D3E7EBFD523940D68E04D59766694CDC42FCF1C1D575EE9C62E131BE6FA9EC5EE99706A5033AFEE08C5B
Malicious:	false
Preview:	..t....K.T_{...M....f@y.v..m.....%.3c:.~...........R.....U....%&.C.)..w.:8...$.T..7.d%.N..t....,..~..t0.WX....K..L.....hN.......X5.X.}.Zd.....c".l.24.>.c.}.\..0..ok0.T.fJ_...B{.M.zu......5.k.b>...d'..IczK..x..hg..T^?z.Ph?D9p!..^]S...V.^...z..HT.0..z..i^..1.....K%..?a..<YY?....yd^....L+...pn.b.(....;..Z+U'e......j.1W.a+.7....4P...h..........8......Pr.Z]P.....=>..$...)........W.`.ETD.o.A@c..B..!..=-...nK.'........Y...../...:$..m.$...i3.m....."..Q.g.a~..).t.u@.A.G..gS./.+..KQw..]....Y..++.....vt...+..g..._.@}....Z.D.VL.k;..p....'.G..%.Fa..2.v2...6.e...~&=..G......N.^..b..$.?.I...>...Q@..i[...V.....$.....Y..[....\|...=b}.h.\|6....T...ufE...v...C..\|%..R&.,(.wf...G........$N9p..Fb......V.....P@.........4....{#.E.&....<@.e....}..........xX......e.T..U4&..L.:..&......N.....":.r...#........#\.]m;Ht....o.x.I.TI.R...........A..Z/.....N$.o...E7...P.......SV.....c..Qs.+J#...rn....V.h9u...@.......T...nc.V.:..NSLB.-....Z#}.^.l.5...n...gY(....q.

C:\Program Files\7-Zip\Lang\af.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	5352
Entropy (8bit):	7.928426438464138
Encrypted:	false
SSDEEP:	96:v2WBtxXeffJfOXAP6VGobbC7pE1+NZI59sTIPxX8EP46qZOPi0nbtimSV26HaYxF:eWBLeff5P6VBC7p1NcFZfiCxtDSNn1PB
MD5:	1DBABF768E4918B87C648C17A8A08D0F
SHA1:	EE2C254FD672C1DD86F57139A0750B008CE58A81
SHA-256:	3F4CC0C9CB99FCD589346474444911DE71C0E60D65D383943EA66700E5475E2C
SHA-512:	1EA848F11FF5F709678EA1518DA9C9E56BB0C1BE7ED5464DB8EAA4D93A9523AFEC9E2DEEC31D9F8C37C3E4180AA6F2A76B6BDD4A86310CEC6C6C4BAF597B3E87
Malicious:	false
Preview:	....t.....gFj.>....lW.M............Xv..8p.\.T.......{....T.C..L...\|F.}.[....D.-..#L.Q.+.".S>.{.X...#e.>...~........,../U....UR.........Y....5..9t.9.{.;.....).;.a..E..{.XT2.....}.#.$..u;y^...B.W.\|X..M.2...r.S>i`...Saj.`f..v_D........H.'D.uv({....F.+.:..J.w.u....J-x.qOK.....es.3....i...R.O...Js.....V.isN...q.....2.(i...u.f..@. 9.~>...^.....z..A>..W..OoY.......sML....6K...:........v8.3.n...b./~.$\|.m.K...~8...W...R.I......N..>...;U......I.F.Urv.AS...R...R......b...A.B....~..4v.f".&..V'h!].....X".1.....Y<G...yj.p.T...`.D5r.>,.=..<.....Ro.b-.Y.(...4.'.Q~....'..Z.QT..c..Wl..Sw......?1w....U..5#...W.F...........xS..o...v.....7.d._.F.V.....%d..........h.o....#...8Vv.\S.L...R2.....C$kV{.U.z..a.U-.H..5I....$D..r...-.Wk.. ..L,.Hr+e....v?..#4..wl.;..9...e:..E..&x..oA..y.e.Q..G8.....7U..$.7i.7:k.."..Z.7o/\..zMO.@,.M.d.W.gG#.R C.n..dW.DJ.a.+..... G.-...y..J..3..TK...F*U..R.J.....!.a].]c....% ad9...].N.%..vS..9#.!..p....udhu..A.......sa\?A.q.n.?

C:\Program Files\7-Zip\Lang\an.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	COM executable for DOS
Category:	dropped
Size (bytes):	8103
Entropy (8bit):	7.571355965612096
Encrypted:	false
SSDEEP:	192:ektyIPV6N2z79t4gLeuVbo0Um41BXgVdQ7IGN8yBOOhZ:ektyI+2z7IYuAX7y8g
MD5:	11159D533FC7058C064DBF8671A0D792
SHA1:	C43BAE4DFD28AED2FA0FC32223ABEC69A6F417B2
SHA-256:	9E8C01D71A3715726943FB082387F9C27B6EF92C2D73EE2B69D3E4C0974F0688
SHA-512:	2A759F36A9ABE12096DCBBD89D6B4B17B6AD8B18C3AB6692E72822981551F3AAEE401030F455704BA599BCF80C1F9FD6DBF172D1F08D7437E7DCD6322624F2C9
Malicious:	false
Preview:	.A...^.Pz.....`.?K._M.i...6...2F.............q.P.+.nzc....D/..l.m.K.].B.w..w.u........p.X.....?.v...,N4...C.....O.Ev..z....:..v-...$q...n}.i.>.3T.'......B.C..,2......j.......3.L...:n...K..wS(.I.#....N(.:.q... ./..2k.....t....;.{.U.`.R...d...5..W.Q.{..).!7R....Vw..~U...3.8"-..#...a.?.._.0=.nA2.i(..).mn3ZM....nk1L.6Fwx+P.h.X..&....M.:e....l...d.x.y...s....E..Bu._R.b..D......\|..2D.i%.T.d,...(U...9.?.z.G^.[../.)...OR.>5+.._..$.u....e.h...RQ..k_....0....L..D<w..G;..P..f....~6.U#.......c..B..%..X.....Z"n....R.#YJ.../\..7a.z....6.iaA.....0k0...^}...I....../O4.....R.zx=qW.....B...h.#.....2.ULpw.M.`.Z'7.Oio..:"...P%<9.`e.T..V..e6a....V,6.,Y.D!......8.z..~5^../....0.2.rc7GBb.mo!..q....R...Ju.x.RK...8....h:..)y.....{%...Q.}..}.d...H..}.e+.g..u.......N...I1..G.o$P.E...4.d.....;..Wd.qn[.v.......L......Kr...1....Q..C..\|....whh.....Y..4.OzQ.%...XU..0<+.......Kl?F.O.;dm.L...W..C.D.Y..*U.....1...G..p.....&c..i...t..2..3W..t.....%h......%.NG........0

C:\Program Files\7-Zip\Lang\ar.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	13121
Entropy (8bit):	6.69250818974892
Encrypted:	false
SSDEEP:	384:nbrpkjn/U6R2FqpLQbB7ZeWN4Qy10lHPfcxpVp4V/2Qscs:nH+nnR2FqpL8B7ZHNrS0lvfcxpVm/2QM
MD5:	AB45DCD8310647D472FC5BC54D4B4869
SHA1:	7F1E1E99C92215F0F585631B20EAD955FF2A26BD
SHA-256:	F8EE83C83F6C06298AF8C8ED72AD5768BB465A4B046F39B786ED8308059EA689
SHA-512:	C2BCF6A1A956949024548557C85D7F1DD0C0F27C0F8C6A60C8FB8134B702E2A5887E8B8B96F425BFCCAD824CD220894C4D66A09D2CA5EBCC72129A58DDBEDA12
Malicious:	false
Preview:	l.^..8X..@.dt.V...+...t............x gd.4....J.!Y............J.!....xc.o.g....~.}Y.....`..\2....@........w.W.1H..6..t..3..#..[..j..'].....ZH"..f...&W...c..G....f...;.....LYh.b.d../....Z6HOr...G]D.....~..,Y.....]..ctS.)......F.....l.Zw....j.\.h.I.I.f.J..F.`.U.X.H...'.P.8..f..^ ...^.o..+4...b./N...7......g.....@...?$.(\?..I.^!..p...3...t.j.@k.{.q.4.)...g...m...Jor.....\.....u.3(.8.....Z.p..j% V..R.b.x@.=...Oc....R2.k..2....9A5.d?T....... .D..#VH..w^..0ZcJ...2...C...v..E..i.>...2+Qp......A.N....,l..#0b.....di..wz...B[.. ..l..+ V).$......FK..g/BX.../L.FO..rU.!j.....Z.P...S..c...?.Q.}.^..~...n...@V.......;..jHH.>X....\|.a..pO.S.=...w=...H~...T.`........M.1..r.....g[q.;..a^[.5.2..........}.B.. :...%!..qfL.......Z...x.D..7...g.=...+.BhMX.p.M.."..~.Q..\|...e.........#/6..y...\|..b~x....G.8..[..2...Z.....YC.3...9./.'../F..&.e.1E.&+.~.U)...z.o.<c.%.z..7.m`.s..c_r...S.J.A.R.?.B.....Pe@.4.GQ!/...z..$.`..,3....i4r...+FD...9.+...m.5....W..zB.C+.a.....D.

C:\Program Files\7-Zip\Lang\ast.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	5698
Entropy (8bit):	7.908376450041065
Encrypted:	false
SSDEEP:	96:LLN9YFKrJQEPAHmLJmiai3p2X4yjE7pwhRD48bhvfCZO9EtAEAzRC8gXinpedv:L5GFKnwmLDp2e9wHmOsAzReigv
MD5:	A96E12D256BD41D9B52D300AF124E1E8
SHA1:	43E007CE5D087AB65B94931A97BAB293612123C0
SHA-256:	1C90B63EF91012AE20249E4B9024A7F08F8AAF431356DAE0AA8AB8DD9CF1CD2B
SHA-512:	EB138D96C68E51C0C13BB17FDEBED9D8B316D9EC9E8074CD2D12B3873FAFAA8EE1902BFE344F8A9C32EDC2B3404351D84ECED9100EFB5ED47F54EF378A558241
Malicious:	false
Preview:	...c./.......\|.zi.Y.v$..{..fN...>5m..RUrl.;.!h../!.x.gz..7..N.\..:.....\|WUo..8U.=x....j.2.<.Y...4..P5..)..wz.>..>.`.0}+.U:.B\|C..v..\..t5(..9......d..6j..<..U...gC.C.v].5.J.VN0^R.....N/..b.hntW/`..?...J(.,S.k.2-.....L.P........w.GP..UkE.....`:.O0.....,g.....'q....37..2s.....dA6.2'.P\|\|..wA;e... .3 '.d.S.6...!..._r..8..S.L.....\|...>.;.~@..]q...K{~...U2i{...0_....\|..bE..MM..1..G.e.e......E.As......`a....g,..Aq.!&...J.=0......6...jM..1,2.H...A../.f.#AIp...y.g...5yKr.H=..._af...O......A.B.r.rgH.JG.z.~..t<..\...}.E..{k..j.z]?...AE.;....g....H;..j...H%.:...V>.3.h...$..f...u.........XiF..h....98U._..>....!?..D.........LR....!.x..;N)\...)K. .A.w....3.l..\g....S-.g...y..5.v..^....2...t.q....6.f&.A.e.?.:....<Js..q..j^.)......`....W,D..8F.G....3...X.G....+q...o.Qa...ie.G.W.w.X.Bb".Q.0.d....Zti.a...5.J.....5.47..@DU.H.$...t..s...X...{......B.....B....j....V.X....-C/......og!e:st.BJg`.Y.0ou....F..v\|......U."o.+...f0(...sL..;.......b.W..v.....H'...

C:\Program Files\7-Zip\Lang\az.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	9946
Entropy (8bit):	7.416454223318521
Encrypted:	false
SSDEEP:	192:tP4OzAfxB0FBDmZ0f+nuhV4fo3gXjmloTPCpvmZ5wtHa24y3:tP4q4xB0PmZrcVsggXCQCEDwt6C3
MD5:	597DED8C9C68070C78D3F6875EBBB999
SHA1:	1DC8A8758CE5A01B28C86961C61B52C4FAEE81E0
SHA-256:	E840E8B6E8D6ED21AE9B86BB7984D3458CABAD73BE93A6DF31AFF7244A3DF13C
SHA-512:	4994725FCD2796949D1090541410368B54FA6F6F8D69850D43EE81B1686FB331FB50C22635D045C73EA4D5F8B1A262CF8B68C4A70A5EFA0B3D1BCCDA4A31808C
Malicious:	false
Preview:	...g..).z....5.;}4.Yr.>...v..U...!..?[p...]?_....,..!....i..+..a.......M..]"....`.....P.lR.....O.......M.) q.\|......Vk@...?"(..@.....M$e...I.R.0..........r.dh. ..`...Ib.a.......nO.X.N..x.0b..9L....tF.S.A7"%hk...Od..1-_....G=X&cI.X7..SzX. ..t3...d...N;..f1..........p.\|..\|W.....#.:.`..I.W.lN[....6\|+..._!.rW.3po.B....=Q.z.6..!...o...SO8..t...Cu.'X.xPl.GPO.U.....x..`....m.#B\| ./...Jd.\.SY...l....)......'F.}."...T.8.P....i."y.. ..E-...iA..`......6.#.Oh9..i;.....I..XU..t.(......L(W....\|..AL....\.y.U#.......TH,/@o.....6 ...$._..e.e...C......e.....z.....i...iFR.Ab._Y;..?.X=..Y.n...%.wL.....Go.?.d\....yF...........e.U...I..'....N......^.y....z.h]...%..Aa......R..L?.P...>im>G.f........t.Z..:....b...{2G...]...l/.......Q.....a.Ca....r..X.>.......AM...S...Wc..!..a7.c&....0..m..;Q.......zq"....a..I.....`P.V..8..50C.....=.....lQ...X.....O;.....&..@..h4..F.N..N}.X=.d..&.Qn.tGYT0...P..X8...m..e......0...8.V........{k(...z..O.y\..yuH..G.:...

C:\Program Files\7-Zip\Lang\ba.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	11568
Entropy (8bit):	6.988362226052375
Encrypted:	false
SSDEEP:	192:panCIoMFFUv1ZtZPF+LZejuyFR9LQavH4dxbtXuBIB4zBWz4QnlBJ7CNMIv5afhJ:8DoOFc1dFjuwL7zzU1kNMIsfz
MD5:	3AC2AC56C2FE09BFDD390E88EA17F6F6
SHA1:	9B87FDF92B282B161583817D42D9540E553BA691
SHA-256:	4521A95709D93F53EDB2C3E25C50635EE52428E4C8E40E46A763E12BEF4F9416
SHA-512:	2C5BF8C9804EC07483ADF3ED67F3347566DE0DDF7B170B806A99042D65EE320B6DEE7E8C6DC700A223ABEF185CED806FBDD4E9BEBD94DDDBECBE265574F537B0
Malicious:	false
Preview:	.....'...H.\|.e~(.5T..Xq.>..w..w....$<.]...!.Gd..O~..y.f(RJ.=..q....sC3.\|,..5.V..8.x...u......aqm.O....U.b.d ..q].....^..>.`....b.....e.=.yDd.Rc.o....A.;I=.\C.0..\B..q..2u.....\+...d.K=R..OoL.....p"4....k.....l...\.\|Os..{....'w...q........A.....w...;.%D..p..K....z.$F....q..8.!8}....%.H.'...Q~.?&...4.....:g..ovJ.>L.b.8p...Th.M.!{.t.S...sO...)N..#...k.~.0$./....Xr.Y.QX..F.(}m.~..:M.M.xg.R...p]..8Pa...Z.d.D...9...(.)...,..D....UW..l..i&.rd/..4L+...n.%xSuh..^.:.......:.EH..`..K...%0.e.vx..k.X1.&U&..K....r..{w...S.b...JI^=.k....b.9 .....!!.S.S......s........C..C....R.!.f\C.As..H\|.g..@.eV........I%.w...41!5.!...'8X..q.[.N..1..<.[g.......vNy...byC).l..n.{?Rq.b..C.0Ok+.....w..v.pY.v...p.1.}..Z.c..}q..l..5.....(..Nc.X..........7...f...............W..\(.d\|P:G~.9hpf!0.\|.!.&`~..1.../... ........K.L...\.....%.........2..3....4...r._9.....X....h...X.U....Vx..7.P.BAkii...{.A.....#.L.s....@.....V8.C.3......+.FP.A.....u...?md..6...@5.l..J...:.]....3.m....y.v

C:\Program Files\7-Zip\Lang\be.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	12188
Entropy (8bit):	6.814610812150663
Encrypted:	false
SSDEEP:	192:WUIGMLF5pOW1T8UAD8cOGvnVJ1AMxQxGxq/JuMCQIghO96bhjPr19XC:hIXLFa1URaVJ1AIsqiJutgo96btZtC
MD5:	29658F812214E0C3535542C83F05C317
SHA1:	E0D70655690EECA133146480BD48DA24D37C7972
SHA-256:	7B8091C14E3919376FFD9CFF7C9C3480023CB347CF9DF730A701400325C4263A
SHA-512:	F034BC3090A0D51AFD0E4D788DC2AA9DE23224AEBE9CF282F2C5F4293F4AF1203094CB66328DC69F3A46297EDFECAAD9B755C6E1139A7CC05D0A75C4A0205C25
Malicious:	false
Preview:	.</.,.....Q.;..c..dE.Iw5.X:..e.R=.I;.....q..?..v...vY...H.".....,G."D...S....P\|Y.E4.D..Z....3u....9.6.Uw.x...zR...c.H.w."._.m9..1IA:.B...E...:.m....C._A7...n...\'W-..R...H..N.."(}...y.k.Z.}.q=R..5.....B.?.6.8..!.d.8%.....k.p;....!..c~.am..... .e)..ND..rN.>2ry..?.(............5<.y/...%...Vr.^...f.......Oy].9Q....).S.G.<W..j[._.^..c........1. ..2..N_vEH....:].T....A.Jz....E.C..s..s&....o........3)..1I...).'[.%..2r.38.s_..n........A1.W..>.,..V.g....J...3......~. I....u....6....k..y....b...r.6...\|.`M.........H..9i........_..,.]....bH...Z]....D.&.t2..j%f...$.4...x.d0......<.S#hs.../c.R...,...[.........@...++N..C.+\|...o.....8c@..............j.vS'+.Y..'...!..Qxm....'.e`.......%l....G...G.....B.Z.....(..eB.....!Y.i.`...R...t...3..B....t65.j...[. .p.P.+L.7l.L.4;....-..C........"..wK......p.D"..h.gh..'..... ........O~.]f.k_b.K.,......V..s....,(....C...].......k/.lA&.N.$.(..\|^...PY..&..k...SZt.......;T.....AV..@...._x...*.P.. .H.&.S..##u.#.bd[Fc.+.u

C:\Program Files\7-Zip\Lang\bg.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	13423
Entropy (8bit):	6.5920966272834995
Encrypted:	false
SSDEEP:	384:mCrL/TRXmMMQjji/Kc5FqWMslHdrDoHwmCSrB:mCrLtXmWQgiHdrTmCMB
MD5:	5F35BBE6334BB34DEFC292C4D9D6BC17
SHA1:	FC46FCC54E9A1CD4F6B52BB68B0791376EF2880F
SHA-256:	EABCEDD508F5DF06081921118825EEBA5505ECD46525B66F0A7114D82951ED9A
SHA-512:	D985F46E7CF29121C4F9F010AD0E5D86C523FD038F63385DBFA12A43596E5CA405827E268419D9EC5C28F44FFC2EAB69D53F5D187F3ABBC897E9764D5B8CBD52
Malicious:	false
Preview:	....@6.p..`?1.s9.hG.I.={....FY..gS...1.yD.-q....C.^..Wa...;w}....8B+..'.g"....~._.GC...U..TdS..}.HF.h.&...yD...6J.x;9%gq..W.O...,vId...f.E...>..........y.........CW.K.:..wp.i2.g.qc;3...6..2s..J...dk9B.....I....Me..:...[j...mb.Q...8.5.....N.L#....7~~..D..W.j...&.5......Go..6Y......B(.d.C..G..>.S...'...\....V\|...'....,..mF..pP.s......#q;:.(....1.Z.L..".Dm.D`.z..:.ZT?g...(....#.J(5i.......2...m.3.a1....3.\|...xV.....0P..............6..;....Z.0-k..N.1.......".....f#.....'W.....Z".+..[.W.p1..}Ga...Fw..]....d=...._...Wo..].....F...e.D.O...+..W08.._O.....(....0......#......z.....;.........J.x....=T....8........RD.......\..q(...,..C.[9.z;......7.=...j.^.......i...=..a..H..6..fk.x........N..!..F^...V......L.FUX.6.P.H../_.CyF.E..!.D?..&K..;..G.A..LB\|3.Av=.:....4`.w.q$Q.....&.......\&?.e...t..0..D8.]...\|..g>!....K...yc..X.Gs2..Os. .k...G..3x.~.FHA.:.P!....8IG.L.?.7...'.M...$....&}<...>&.N....@O.r...R.......J...#.kR..sf..<_T+M.`f..e._.[0.(.

C:\Program Files\7-Zip\Lang\bn.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	15364
Entropy (8bit):	6.305800716298222
Encrypted:	false
SSDEEP:	384:yWyfQB2vkRO69zLutg+8r7B018cZ2DY+4exXWk:yWyt0LuqX0mx
MD5:	AEF8FD4FC05DCBB958959F4D61FE2BD2
SHA1:	57E148A4CADFE1C1E5AC58FDCF48FD0B8E393FB0
SHA-256:	8889E46C3C82E10DE0252F921A47B19C4A111D06A65EE41F4404D40FDFF05CA3
SHA-512:	A80B1F1FB619070DDDC0ECDD3F80B6D8AA4636C77C2DD70C6B5C7AEC0ADB674F5E861579AD96696389F5B09B03860EA5F052C5B7A3B294611F00A235FA5A688B
Malicious:	false
Preview:	...b./...f............V%c...xb......g.......1+.)d../..."...L..Y....r..L..G7..Y.s.~.#...L..$..`N>.K.<.0n5Xq.5.u$'<#Hzr..l..^l..9..#e(P...wC.....,.a.9..\.;.c.......F.z....&..\z.....I...vl.S.zn.}=d.....Y.`I..,9..R.H.:..{H....~.k.}../..Z......L.Mg^:.o[..oB.9j... .B.;..m.....lbc`.f7mu.?.. ........K..:C.e.vp.....bM..5..v`..............BV...y.rI.......9.\|............=.....t.@0..mI.j.......j.......).%.U&.....GA.V....)....{NY~.Z...%MTO.=.Is.^...s.l,.J...j..H=.2....k.}..8.p8.vJ.g.+.......y.d...8.....V.Mvk...x.....A.I...x;,.~..~.".[Kd&.!U..4.:9?.l5c.i:..L....m...O.oZa.k.8..m0u\3...v.f..J.O.U.b.d...`q.......J(.P...N%u....H8-I.{.Lg.....5.p..J.....z..'Fe....W.`V.c..v...j...VV}.j7..._.)vg..ktL=....c1..>..0!=.7Au.?.........i^u..W.V.x.IZLP........iq{Ui..#.$.-oP..wo...EX.N.yU....0?.......7-..@..TwV..,.. ..s.E@...C..<<&.'_.+b>.../l..$%..x...QU.....o.!P.`-....cI...h....3 B..Qf....j....~R.?..~......I...b...\|].%.6.<A:V_~....._.D._=o.........Z.=y..0..b.b$.L

C:\Program Files\7-Zip\Lang\br.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	5684
Entropy (8bit):	7.914081500540578
Encrypted:	false
SSDEEP:	96:6PiNTpGESjaCdO9TBxiBUwQxbZnB2uQyiQyDjVYzS3rg4cHwBbOgilAHJXGWa:nTQESjaCdO5jiJQzkV1qzSzcHwM+C
MD5:	2E36194BD4CA6451DCA86DD443A67D73
SHA1:	EC79AC1D1EF1CF05A00E35AAEE798A25CE9151B3
SHA-256:	F80AC20894F32B532623E0E08C1082765F870D743AF97E213676DEA0D08C74D9
SHA-512:	553A44C08D1A33F0D983D2D210FE76B9F1420EE786669BC6198ACBEBCD0D3BFA7F9D90B51353539633D1D189A62AB6C3D8F2C7830B135E7FCB888A9318E27C30
Malicious:	false
Preview:	.v.,.cZ..%q.Pl..$."... ...<.....4.......l..P.5Y:x.<.Mh.j!....)!..LS.........,N...2...p.9..9<g.P\|.6...c......e......b0?...O1.<.c..P....&.:.#S.WH:8.@...x.......N`.4+.....z..m@.rC.>.........T..<-.F.F+.......M.....p....H....)GJ....O...F.9.A.l....>3Q.....}.-W/.^.n..w..YW;O_.4L.#J..JO. .A[.p....$..\|i...7...rJ..i...K#..oD..M..1./2.r....&..Mg.....9w.2..X...0{..d.v...G......Ma..I6.S*.!......sq.X.).d.e.\|.v...7......8.g.>..u+kr.......e....1..a.. ... 8.dN.).WHn...A.[..P....N"_..F...F.j.Y.a}..{.}"uJ.,B<i.~.rCR9E.Qc>..j.0...V....1....k>9.p....g...Y).Gg....j.$......-..R...$.S.Z1(w.#..;.."k..,z.u...F0..j.8...l..x..<..&s{\^{....d.l..+ps....d\|....u...~?...@C.j\|..-.g...f.&..q.lB.G..6..W...6......6%...9..l.n..... ..jD..cq..Q.h....S..u.."..9....p4P.5v.....xN..rD...{.\o+.9...>.....x.D...0sq>....l.L...B'....v@:8.\|...V..._...}<b.AQ...>.>....`...G.W..)...J.Sb.~s.WivI.S.....%..w..KYW.J..K.z.......#...l`...O.j....e..m5.`..?zy3H...0.]zZ.....T........-.c

C:\Program Files\7-Zip\Lang\ca.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	9625
Entropy (8bit):	7.358438267623846
Encrypted:	false
SSDEEP:	192:pTSkDjl9CYOLSv2DgFh9rVzasZmpkrPPeNJUML/w3M0ZeKcwDWB1BUJ:p2kHyzSvNRr0XY4K3wBUJ
MD5:	00498DE3188DD90953E52EE0EFD082C7
SHA1:	A4035828122D56BA3AC650822201B19C60DF09F0
SHA-256:	2F42787E04CF7911383EB9290E801EAF773E1B42E96C0C3C1AF11D6738AF585C
SHA-512:	F9240C650FF0D105126382D407DBFE93B811FD913E35DB3678F81573B68F9472E85FE1777A658A18A1BA8E25CF4E33EB33C05508F9CA5FB1868441213A5406BA
Malicious:	false
Preview:	.2.n]...iS.[!..\...(}....:....~.}<..u......O.U......yB.......M......bf..cK.x].zl._`6,.....L.y...K`20jx.y..I.E...VE.e1@..@453.&S..XK..6M.%o$...!.~dm7.i2].i...m9\._"C..'I...>..?..'Iq..,.....{k.....n~..i.l.V.qr<.&.......O.$7...9ZQ..e.).....%~..aO.P..E.2l......q../....'.T.O7.$..e.#.."..p........n.....Xuy.w......!.y=.....'#'..S..A.t{.b..i.S...RB...g.pg.~7e.s1.n.G....g..k....v.)j....;.k....\..=O.'w.169.....H.1.~..3.."..$.../.pNy.........)..it^[.t.eEZ..\.9e.'.q..Z8.%....\|..y@.U./.0......n..^..8!.....f...n......X...Y.8.L.+..?..t.......e6Al..!.HKc7..{.<..#..f.. ...bk.V.3...^. } ).WKU..S....j..(..vy..E...F...{5R.j.2jB#A.{.....9......Nx0...}.......(...X5=....LY...WB:.k..^...#..}..0..t.e....P.(...5).....`!3........A..Z.9.=5:...D:.N............z.a.=_.5... ..c...T\...$.q..1.M../w.t.....>...<K.A. .6.-....Psc.0......S'..l....S.y..=x^..r..j....#=...&1.D..}u.....?.{..F..)...(G....Z..... ..W l....YK...&&.I..x.$l.7.'X.=..Q...N3..Y...R.....

C:\Program Files\7-Zip\Lang\co.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	11279
Entropy (8bit):	7.173061389751837
Encrypted:	false
SSDEEP:	192:IEX2mB3z5WYBLqmx9gh98FdYojN5/4r2LbgH9ytisEdAuq:pvUY4w9g34FjN5Qr2LsH9xAuq
MD5:	D70C6BF2F103C9240F7CC5CCAB741F49
SHA1:	C7BEB5E7B523F5B15D57901CDFCFAD9B6A195748
SHA-256:	8DE81B4ED7F0A4C5016B9CAB0F99FA7DC229E35429BFE4385BED86BE899282F2
SHA-512:	EDAC89DA628D2E22FBFC48A8564BF2C443F407849BD3E53E73518EE2447907D36A73CA4C7D76DADEDEEA9C578CF4D4E8A29571D451A4A01F0604577D3C6479FA
Malicious:	false
Preview:	:....p....8.......8...M..........0=\|.v..i..N...=....4.qU".+e...... .. ..p6......../..............I...`.)e..o..^E..n...qg..{...l_...Em..Vn.M%..H.9G..7.8.C...=.....-.=....Qb.k..}'...[.../k.........v...C...Epr..r......B....x.n...........w.2\V.w.:`......E.x........:..}.lY4.?.aO..j..L...Y.........0..Rx.f..KI#.vl..i..J@......0.Z..._......._.....P..D:...w..7.m-..<.J.g...."@<>.8{.#.j#L.4b.z..J`..n...2......Yg)?..qSAp...zD..F...2.f.z../.4.R..v....{w.X.<@.\|].-!.7.x.A.N6....j\|.C.$..L.9..r..].x.6..2.\I"....=d_.P..a....fo.'..n#G>..)..iB..z.\....P..Jd...>`IH.B.c...&.e....d...\|W3..{>.....cX;3..P...O.M........(...^Q....[..w9Q-...1...\|E......u9....~],r.?.V.R..D..+....;.K...yaJ./.O..H...J.z.C.{..A<.c...<CR.(..u.};.U#E.ZM./......u1..N{DPS/....F.....DD.-...1....bT.E....$\|.!Ms...O\...>x..xu..qg..z....c....Xt......[:....^..Wr.....3.Z................8&. g....5.#X.............,.k.F.qx.yu..Z..-[.a..Z.)D....+.;w.D..'.9...]..\r..b.A..Jj.....mJ...@..l5.-..2z..\|.6

C:\Program Files\7-Zip\Lang\cs.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	RDI Acoustic Doppler Current Profiler (ADCP)
Category:	dropped
Size (bytes):	9477
Entropy (8bit):	7.499392311721265
Encrypted:	false
SSDEEP:	192:bl5GazWRnCCRVJvjvYMioCB3Ig+Bo+SXKbWIm+JjOvcQcfuK/flB4:p5GJYYvjA1oY3+Bo+SXRx+Jjq0uKl2
MD5:	D9F5E31FFE4889BF12CF34DBB07EA90E
SHA1:	7CE5E91704D78954EF37A0E34DD31049DC452DB3
SHA-256:	1608C0CE4DB82B206451FAA64C56F2C43ADD110964D51C7171456BC06BE136C4
SHA-512:	E4A55AD0CBEB853A54B6004754045960A52072B95D0D565F29B73CED69382E80A700760CB63F804BFD8BD17593189A1855954287A6C87EC246BDF2186F075CA7
Malicious:	false
Preview:	.......I............N...X....+..D...@.Nw.K..1..\|...r.HN..,..!.b.1Q.Y..h....A.[4.b{...uRSU..[....\P.M....e..b...cJ@cT!.. .9c............rj.......`.t.<Y.(.o^H.'....4~..-..A9.,Y.!o.....lF...:..........Ix...H...8.Q..J=..8{bo~.k....>W....ET.m.+..d.A...B.5^.o~I....-.O{.u.m....._..va....._V.b. \KP.tJ......P....$m.AKL..}....\|...)..?f.a8.j.T.k.f/..i....Ph...}.}....7\].U.k...=M..^.N....k`.Co..i...k........aE.F.F..1....:;.(...a..nBs....~(.......@....s......>..E..;l..a.=..D.`=34.+f....R-6Pc.R9.Ya.j.8Vx!..h..eN.=+.Y.+.QQ..\...m.Ed...,j. .j.B...,.........S%.$.'E.G..;.DD.L.H....X...V...d\..Q..Frt.m.E...;.....B..U.X.....x..8u..(..........=0.....-...K..^2...!..,..To.x.Z!..~5.._3...J..3.3....Z.3...(..=0..>:.kZ.I..Q..._\0 +.........s........}...+....I8P^.Z".-B.... Q.......@......W.KS.........&.N..........S..]...x"...... .KS.MG.e./..sD.2..C1.aM..Cr.{9?...H..{r...fT`..H..K(..b.xB[Q..-r<N..T:..c..B.......v..E\..S&...h...'.u.."......7k..T.0.dL..

C:\Program Files\7-Zip\Lang\cy.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	5543
Entropy (8bit):	7.926252123232198
Encrypted:	false
SSDEEP:	96:QHZCBPucb360S5wtaM/jhRWnkUhjt8MRU+qTuT3Yjo49PZ+fOnZiK:QHZCxucT6fQaM/NSlhRXRU+qTuwowcK
MD5:	26C972C53EA4D9303F3D48863AF559A9
SHA1:	7CEA1E898B7FC5159A36F6450B4B5D719CA9E087
SHA-256:	DADB5E802E2FC2F91316D2AFAA579EE4AA616300D158A843D1CAC31329D42753
SHA-512:	2D68239B0B7331235AD5565EFB2EE66AE57A357D967A788E7E6DD15F1FB7A2C85B23A8DC5AE1B91DE07D7DD85FB26355CF349DFA35E548B7496634AD8F0D96C9
Malicious:	false
Preview:	.U.D!..?..dA.S.}.ok.~......l..s......]?.....L....%....M....@.%.t...wl........5 ...W-pR.....%....8..<...W.,../..F.f.4.P......T../.....r.26.~.....V...v+....!....a..;>+.\}.-B.k2f..d....@B.......W....8U;.LL.z..4.fT....b.<.Z.X.JS.P}c...#t5..78l..(...}2L<..T....B..hQ.....?r...m^...o6]..0...jp4.G..g>2P.....<.....`.)R.}$...r.O.:..n..\|.U..Wz.l..x.yQ}>Tp.N..x.C...$.Z.a.D7WH.E@......dW.W.Z.....%.W....d..}....x.......Q..%...1H...%q.m....pAS...U.....b...F~..$..X.....s.X=d.......v.N...O...!..a;.Q.Mv@....vXURO....7..8.q.P5.4..8..vS...+....S....v....{{.<...N5.....H.. h..8l...)(>3.r.<a.nPm,..)\...v._.L.6JG...e...(..0w..rW.D...& ....v6.x0}...u..}X.B..%..d.../..`.r.......v....s5.G[.Bkq>Q2.....f...z........v.../.8.....,._tb...[.Mb.K5.X+..>T~.a6...>"RS.f..ku.@.;..?b.....c.A.31.(....lJ..S.......O4.f`m.F'M.^..5.2C.#.}P.7.<.^o..tV.......l.......EEX...n6W.S._....r ?..X...._.$..i...xr.Xw....;q..lz?..p...T.w'M:..+...S{..n...wm...].....0..D^f ..X....g.......

C:\Program Files\7-Zip\Lang\da.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	8692
Entropy (8bit):	7.506746951902779
Encrypted:	false
SSDEEP:	192:88HvR6xloTNCX6QxPhc1iA2JEv3P6oxwYSqLCaQ+SYcdD73Q5Q:/IMkz9qvfTjSOCaQ+S/B7L
MD5:	67E6203727E05129855691898CA13E36
SHA1:	F4D3F491497D0BD62764545CD53DA6E397105AA3
SHA-256:	C231BB59D930083CE71DACDD30B55380A9712083952E5D857B036C70C6D8F6B7
SHA-512:	6FC649485EC264B6BB93AB4B3C3490A8D6AA8D089C6A5EB331F26B673B119FCDAD864B4770FE4B0A56B2E482DD2F88404E0898BE7B8D509CC7882FEA4F04193A
Malicious:	false
Preview:	..P............iW..(#....i.....&s.].........1,T.9....\...{...5#.7v.h.-.H.Jv>2U.".9...Vn.s....e.G0....d.ndL.,..\|....:.......W...Z1......x-.Q.....i"@.......ntFOg......q7..L..;.q.A>.<..i ...HL.....,.n.7.......G.../.K ...HOw......!.....t.....>.\|%&...K...=..mJ%.).z.....q..}.>..Maw.A..Gd........Xp.V.rB ...c..d:....h.3~rc).$.j......F..q..n.a.../W.J^.D...t.Ob.a..v..{.....5..!.......\|......4..n..d}m....Y....n8..q?..p..u...w..l7.Qy.i.}X[C....g..}.......[....WOs=...I..oS........J...p5g.h....G...u....X..aS2.5n.@.+.[l.H.Yb.Pp .E'm..(.. 0<....mg...vZ.44...[K`.+..m..-.kJ.y.~..,....&1D...;L0].......V.a.............S...g..^H.Z.......a...D1..W...\|.QQ.Q....L.'..6n.....bp.A.%q.n....k8I..+:Z.7'?..._...[...<x.W8..\|.T..+...)W.=G.....!^s..1Y8.z...I_.c.b?...#..m........3...ya.J-._l.......,.g..}.EQ{/.....+..Cu....Z.g..._Z.#.K*,n...3.e-..J.......+...)j.....Z..q...y".0.x.t......\|i....Fk..Y....P..C...S...wl.._.c..Lpv.H..Hwu.5............>.<........k@g4s<........

C:\Program Files\7-Zip\Lang\de.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	9894
Entropy (8bit):	7.344399910764424
Encrypted:	false
SSDEEP:	192:H+wr63q9aOlp4BQZegztYmHX/jLFL6ZgJQboZhULeg9oeJjZDJupulR3:H9e3q9fxrbLV6CJQxegVjlXR3
MD5:	A407D20D40429DCB9AEAA34098506FAC
SHA1:	74C3904621CD416E2B4ADFEA77135C298780449C
SHA-256:	31E615C6EEE64FA6922291F22263ABB16DB048AA7139BED5EC93023AADA38744
SHA-512:	4C7FEF6DAC29A3C66549AE7F48C97EE25510CA6932D451D409326D7292781DC985DD63296ADE6D4C9C7F9B83A7B2E9C80552BF626260EA2001159DC99D93DF87
Malicious:	false
Preview:	...T.!......7...M.6P..L.I5.7...u~I.d.0.T./............RR.s(avDl;.9.j.6....4.6.7.....U......9....;....U..Q...<.=\|...B].J..>.52m.......I.#$Oy.!9.`......<....~..r6..o^.[H{V%.K.....{.Fa..mT%.>l...c...0...!.f7....=..c..#b.k..>....h1.c~......f........M!..XE.Q..%.BZ.n.........$.m..w..^.1.$u..R..K... .e.FD9.%....NE...<q.....l...C8.f.c...Zw.....=...w...,../x.........~.q.lt(vP<..!....0M....O_r...B..B#.}...C.z.c...OFp..E......]vz..n.C...#.\|.....d.]=..)c\|#...S<.NYXt9.l<NU^:t1...c.1.3.Y)E.C.c...A.1..T.D....&O.U"...........f2.........b..V.\......_].Y..\...x.%\. .a.......o..c......\.L.....d.:gX....y._..o.............J.D...S/.L...7.C...TA...\SY.J)....82!ZQ.S....9.C....'.%ywB.07&o..8rX.D......0a.D....$.C..."...?.?N...^....&...=d3q.>..b...........N..\|.Z.DR.....ir.y.+...q.....)..x.pg.\|S,......e#.\|e.....0.0..z.O...mE*0..V.>..K1............~....!$b.?(....7..............^K.a........rl.j.8u..d.A..]....^..{..x]...$B..O....81....Xv...i....I..c.p.Z#.Z.k.a...F.

C:\Program Files\7-Zip\Lang\el.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	17224
Entropy (8bit):	6.361130831953334
Encrypted:	false
SSDEEP:	384:3AFQ1wlvB0OKCiB2RHWvrBj7jfnmRcC5LBLouNptz:wHlvmOVTolvjfnCc+LBLo4ptz
MD5:	0A6D5315F226C5ECBF9485A1E8B54BE7
SHA1:	FEE43B875C1F472150A70BB8F6DF0C1E9BD300A6
SHA-256:	3116B0D66499F6976FD9DE623D69F379AB5099A4374318B5373C22FC8A2868BE
SHA-512:	E1ABD93DDC50502EFBACB37DC758715AE30CEE5C2245B56A7BA095E0FF0FDB508F18E10F159E90516E7BF4CF270525F033221B45562FA0A453EF40D90C5EDAA6
Malicious:	false
Preview:	#.wa{.j......@.=).?Wt....e_...5..(...!.{...3..........&.^.D...l%..~u..F.../}.7yx.@..'"...-..3.7.pD...B]..^.k....z\..!}...M.z...E[..W.......B.%t.R...%..[..(....rc..GK.Y.LI2.-4H..G5..na.O......H.w....ee...rl.fL..\|\R...,/0....>..r.d......<n2+.0..~c...3C.......Wn..=}y.c......<.....OJZ.P..HA.........K..R^.U..=.+x/.../.P=.)in<...d.O.H....2...C.A.mE,......>03..q.b....9...-,..zm(.n,X'p.."..i.tSfu..R..TI..,M.>..\.p.;...7Uf\|....}LM.Z.R.$.pS....Ag.U..E..W....S..DF.~....:....mI,.F..Z9RG...........gL.5..T=L..@..CY...l....Kzd..2.....!.y`.....=......X..d.u.f.g~....B.?...D..p.....I.m{......rO.O.a....<.6X.......5..>U..*..K.x.J.....?P8......A.5..=..V.3m...\|....b..[?...#2(grva.a.DT......6:1..f.\|....-....\..)......U.p...x......M.mhg...r-.c...$q.C....3.......~..$mbz.-E.1..j...H.kp.A...s.yZNV..J..Bm...J....,.u....u.....C.z.N.."H.....:...U.n..{d.R...........j.M...Gz...M.W.1..c-.1Wq.........%F.#X...,.......Iq.7........gK;..d...3.......y'.)...v\\8

C:\Program Files\7-Zip\Lang\en.ttt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	DOS executable (COM, 0x8C-variant)
Category:	dropped
Size (bytes):	8237
Entropy (8bit):	7.5561381773981315
Encrypted:	false
SSDEEP:	192:bUMwZg13+72FgogtWIByZpMHVD7qH61D02G/:Iw5u+gPWwwK1D7RXo
MD5:	71105CA456B7F18479EAD2D539959C1A
SHA1:	6F2DAC066056F75ADC038D16E3C71676451B22C7
SHA-256:	3485079B4BFD2E323AEC619450161239237F1E99E0C0A2C4D02806E806A45E51
SHA-512:	2D0584D6E63C552745EEF17E094178DF8DBA68316AB6B0E4DE0E0C13B66135607C2AF7683D84368DCD7EEC05F91D0400611E65165ACE8AABFE41A18CE32F8D52
Malicious:	false
Preview:	.@.....g"....n.3.B9Vv.w....'(.....}U.S.......I.)..x.2N..\.p.........B[....).Hz.F..Rv...i..BO.~.......z.)t....4:{G.1D.gt....h.e..`.1X.:.-o..s.Ae.......8$....q.<....!.L....1'gt...g..N.5.L.R._...........5..o.I.M.wN.eM....%xq"`V.x.\.K....Y....j.......".......q...n..p.G.....MH1q.1.........H(.6.bwr..q.3........gd.4...$)#.(...a.1........nN+.'..f..y....?S.!.b.~..Ba...NV....r.R.........94\|.k.....;...$$Tix......_.ZmB(/.. ..:o.........U...Xx...0.^......G.cTX/.f..)c.0[Z..{..NV.....\.u............/...,.^...B.a..b......2.%5........@m~.E.C..<6.D...n..2.Q.g.C....[...4.<j.........X..%W.V.4{f.2..Q'/V.cPy.D.W....c..Q..^.+...u.{...t.../...t,B.r...+.66\.&...1...r.....;.mZ....K.6.6......s.\|G0b...h...3K.A...]$%...M.w...Y.....w./.B....x..{...:wa.RTnj..i.o.l!..]u.Lq..?.p.^.t....."..H!!./..jJ..LU...}*..N.17..oMx.U..^...=$.j.....c,.u.7z.}>.]....5.;@.. ..x..&..9.}....x.5..gK.)e...hZ...{H)LH.k.^.oU...#yx'..:......J..<..x..~g..H..%.H.w...&4.(....7pb.

C:\Program Files\7-Zip\Lang\eo.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	5579
Entropy (8bit):	7.921984940352337
Encrypted:	false
SSDEEP:	96:kZ9zUww07hmFztYHB1phFgMb1gLr4i24DDL6oKvBRMKR+iJ7SINZwAyUsb:kAq7hKGzRgMb1bMPKvBRMKHJRNOqsb
MD5:	E94F3DE62E1730E8A5C8B652823BEDA6
SHA1:	F374B8DC0CE8AEEA6E29BCB01CCBF3C6D4E3F25F
SHA-256:	9067584B5F1BA8A0EB9F1D5A057BB8B7A23EF0F22F4E3A3467BAD2B9A1DC610C
SHA-512:	179BE8F587BA89E35F6F9E31F87674D0BF1E03CE92E5FE1DD794D0171979B35856E82B5E4CF0A513F80CD910EDFE956DE161F155C1EA96CDF4F1219E6A786E59
Malicious:	false
Preview:	....H#...e."........].,p[.... .._...?..M~.H......D"i....}S.A.....}...\?c?.y./.im...x#.{.2"....Oj,...a 7..7.N..d..1.......a.Sr....s..K0:..?......pO....<{.<.....1..... H.U..7.Z.[..S....,"...7.L...%j..y"Z..b5c.i;h.O..)...!........t......[c..H.'.2...Zh..............~<..?.Z....v...np..7..3...$.ja...kq)...0..1.v....t.).m@.....H......j...x:.o...MI..4.B...m...&(..%7....q(FX.<M$..N....g...v...hT}....#.:.q.9.....<.k.p~....4.<..<&.-.'..D..7..q.\|B.y.......s.e...e"Vv%5K.j.....j..#.5(.._#f4.\......Q.l.I.,......b.H..Db.M?e.........]m..WLU.~...c..Gj.c.7-..n%v.S..._..Gq.MM.lR..7)].]..v..rC.Lj....._0.s.....q:0..:Cbe....m~.r.+..5..+.^...T..u.R\|..[)...<..SP.9...e.}YM.{.#..6.....D..'..q..I....i..^....Vc....Q..n..,c3m>/.....`#B......$..ut.'.K.D".N.)G....F~."..#J..Z..;.....n....dT.X-....u]....b?l#...?B`.3...@........3..p.>#$..W. ..`.......0....W..-.....J.S...y../..../.1'n.x..Y..V..D..q0..o.#..1Q5..{.!S...I....`2..#.a..N.r.......J...........=0.=.7A...I..

C:\Program Files\7-Zip\Lang\es.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	10366
Entropy (8bit):	7.239845991081937
Encrypted:	false
SSDEEP:	192:anRm54wmDUTo0w6bnIyFbJlle7hX91llMzc70VGLuW15WaRkO9swB:aIbmIsUkyF8bgaBs+
MD5:	79312FDA106593ACB75B705E3735CD7E
SHA1:	A8CFA48FDA1877205ED74CA82EF32FE1D49D1467
SHA-256:	61A543CD97368DC8BB5EB87F7A183727F1FCF1E1D6901187C465230266932377
SHA-512:	276D744875F6253D5F8B024054ED289B4612F1F120620AA821EB9D2D0C2A0C82F916A0C8C237163E724795C9076DA6BD65BF293570E62F2497C337FE35C3B247
Malicious:	false
Preview:	$S.3./.3a.....NI.Oc...z7.c]U...-8....r?..w.u...b..OlN.Leqz...:.E...ArJ./.Y0....UD...4H.$...U7.D...+..?S.g...umq....!...../k1..3S..!.%.u.%.r.w\|emy.cI...\|...Fa...........w.......FE.....n./......lb.ziey\..C.u...D...I.($...6....T.K....).;...<'..@1jeL#H...p.@.C.6s:Bb.7FMd..D.yr...x.\......4.d.L.._n..b.T.?...V%.L\|A.uQ.Y..]..AE.!.@....p...Mg.e..1 ?..w..."s...U.C..!.men(...?#.KD4....vx....v=k...=.Bd..A.....c..W.S...l..t.H...N..Bt.B..H.C].B.tm.m.....:...YC.oLuPQ.+..47.L.%.._.G%+X.......">S.G...W..{Q...`.....y...Ho..Vn! 9.8........8)y.T..ny.a?.5E..c4.L....8rZy....\|.C.V5...&.Huq...Z9...eqq./.o.kl..y..h.r.zMy.._.m.T4).).R.H.~.i.f.=.Mb..L.IR..+B!.....wq....+. z......E.d[Bf^x.^T....}..2......O@x...f.......?'.......N.^;H.A.+..=N. ....o....."..(......w.rH...[.p..ir_..v....T.7.`A.u.n..Y.m&.-q..Q..e..F....<.1KHm%.?........=[......4.S....C.3.O..(......[:.....39.....O..>..e.NDZr.K.0.A9wyG...;W.`.K..E...o.#.p.......D.lo*...?\|......G..\....h....Z65.;\|r..k.V...D

C:\Program Files\7-Zip\Lang\et.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	7398
Entropy (8bit):	7.689509537388961
Encrypted:	false
SSDEEP:	192:l13DXoB391S3IA+WzHGcBoaXD6fH4XEEcamF:nTE39E4oZT6fH4XEramF
MD5:	C7AFC9BD12E8E11776C2F652AB9DE00D
SHA1:	EE185D4CE9B689F7F0AA40DC7C43170D0CB632D2
SHA-256:	33BC556364FE6FDD971943D80FA6C6F58ED4EE7DF84EA38D28322612376BEF26
SHA-512:	1F99A2D1E6D1E117D2055D8FBB6AB36ACAB1C5CEC09CDB7E88195343136EBDEA0851803A5954F087FDC769B30B78D41C2EF4BD9A0832A4B2C47711219D7C7971
Malicious:	false
Preview:	...M..h..Gg.N)....J..z=t.[..E..$..]..u.z..r^^.^'iwA..Zfq.~!..h..H..e}py}6\|s..Rt.~..3)..p24j.. .t@..m......An.c.QjA.......'..ZTz.]$'..k.(..F}"..S.&...d.].....N..$..\...v+....d......_e.h..Y....4\d^1Z..j......Y..<..=7.gk.h.$T..K.j.W.bH8.!..u.hu.<..z...T.....$3H.p..c6.y...j..G.....W..b.[.!...W)..N."]..5Ev.......'}......(~...$<K^...'Op..L...$.....{.p.zRw.......c.A...f..}Is......a..Ev.6.K.t.8....q.h..5z...O:{....,.....F.....=...#...."......3'F<~..,6._...........I.$>'h..m.~.a2...X..~..XB,.W).9R.{.....}....<....C.J.GCn..6..3G"u..vNi.2f.TQ.....EV...a.....?C..@..V.r;.vX...).T../c...FPk...T..U.):...L.s..BME>..@....].--...Y.]....~2..y..J.,r7R...)-"J...V ..].1.+8...F.T)X.xf....+....3(.y$.h..c..ipVl.})....1?nl...7....8..-....=..x..vHF.b\..]V".Y..d.`%.2VF7M.....93AE...(.@~wP..[i7..-....t\u..J...:@..PS....U....nQ.n.....?.T....J. k.\......}..z.n.8.. JN,..Z....8.Gy..."..e.V....;[x.[...Z...s.i.3.....l.1'rp......q......m.xC..A.8.=.BC..jJ~.D.^.WF.h...+.dEz...&k

C:\Program Files\7-Zip\Lang\eu.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	9221
Entropy (8bit):	7.350118261692232
Encrypted:	false
SSDEEP:	192:UFQfZQ+N4aSDROUMtEWpFBgwl8J1J16koZEUkDO0YU6:UiZzVSDROUkEWJ+HAkoZEUkK46
MD5:	BA64F0FB164721100FC206894C7C16AF
SHA1:	351E9CCC7001FC48C006EC34B6695C2BAF8746BE
SHA-256:	E095BD07AAF2E9B58CED1C201FE18B3ED00DA8FFDEB81CAF424C5AF5D49EBD7C
SHA-512:	A6A04FF1DC019A68F51D3EDC49B6A5D3FB10A2D21CF1361A0AF7D208568B594567ECC49D27D3729B6648388C3364D7140B15960F3527413F772F0361977B6106
Malicious:	false
Preview:	t.....@......j.....o.k.....H.%.....8\|,.....\|.Aq.N....E..9...qZ4..:..^.5?}..F.n.0...[...:.[....E..i:o..a9h.._....U,PY.o.R.G...@@'X..8.6.7e.@.`v.....&......,......I..5T....A.\|......u}.m_...z...q..}S..w...7.^.)....sX._..x....G..a.. ......AR.,@.d...&..........9....X.\|..lw...Q.u....{4......ml.?ntY.r.1!O...]....2Ot....:...V.....xd2.4.2:..}.'..:...I.......;C.05..B.....m.<...M5.y...=E.2T.....:...tT..7.0h3?y.h..\.....>..#s].,..W;...)/.......`..DC.....6...4cm..G..d0..;...Qb....1...?Uv..WcHiI}'.U...R.H/.\..;.....VT.Sr........a.k.6.h.l.I7..)~\..M..%\|.qc..' .\|R.\|.i....8.:.]...!.Z{.R.*Z..W..-F..!a.T.FWU..KC..I.u.4.T9F....d6"...o#..sH.N&..W...D+....&e........w..}.{Y...Ou..o0.E..6V..d....@...V......yF./..=M.j..."q?.D..s..NH.).....qT.J.....TZ>.V..+....PzT.M....n...^..sc..D..O.J./....rOJ....:..4.B{..f.^q.}C..w...@..G..?.)..p.BoU~..........?.q....N...A....c.f.X..N0..!4q.5...i<.....Q...? .{..a.....xCU.C..g...>#.!.]_._x.a;.R.....5.......om`.....Zh.Pa.0RB.g...S..v

C:\Program Files\7-Zip\Lang\ext.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	8048
Entropy (8bit):	7.583541072293965
Encrypted:	false
SSDEEP:	192:nDnDPXO5kgPsBbdOb5bpfhR522V6DRbXkD4ojP3eW15ZmFIluBacIUmPVC:DDPWPuUpZN6DRkD4oPHP0FIABKC
MD5:	C4B548505680598F536F4103AA6C35EC
SHA1:	462F5E7BB1F481DD21E5AFA09D4B7089C5C10AE1
SHA-256:	BF83D45AF3435511CF7F1F0C96996DD174F2E05FD3F76593AC56518872CDD3A8
SHA-512:	C8FF8F25278B2B4465BD946400A7B23D4F73D0C0A4A28B344B183C1B13AEF7DAC2E42132DD62935030ADE7BDE7BC51644A56D0A34F8D25B2CA3220679941F1EF
Malicious:	false
Preview:	....Efy{_.."...q..T2_.Z......ktrqEg........eC...g..~$....\1.q..J.jZ2L.a....}r..=.&.O..Z!J?..I&.J-..Z~.l\.:.....&.u[......0<{j?G....M....G.U.....O.^U.=ph........t....,..r.C.,J&.$....1X.:f.BE[S.vw.....s7&..R.q0.D,..X.....<...,.:>......c..n...0OUC$.(9.p..L.\|'....0.Q"....e.......Y }...d5{h1..)`'J.F..N..K..8....q.....vv.Z...L.7.<.......o...>....n.j...B.+....].d\ rk.&..b.4};.R.c/.C.bQ.t...n.......N....3i.8..<.".<..X..E%.$..R%.li..r'......s.^c....9.._..v.s..+5[.4.}..d_ ...>HK.ie......Y..2..5.%p.W........[WK.L...._..&..FX.....]C.l....4..;g.U.@>.....s.......[..=.t.......@dp..w..y.~..w.]x...~...+.k.....xJ.....w....XY:a.3.&.`..f-I.?.!....3......s.Y,{x....X.m.S..../V4.(.i.t...`..B`j...@@.<dnt.Q.....;..R.CY....J.&S.i....o....1..34.j.j.v7....q..E.\|w.,pd..f.Mi4.K4.E.k...q...1...>..f..M>$......1........."..8.`...h.....&..Q..a.(E.7b..A....g.../..3...*.;W#.F........x4w.. 5...];...7z.8..DS.......c../.rk.MU.4.%..e.R...Y..3X........XBc.D.{.D b.O%..hRZ}.....f.

C:\Program Files\7-Zip\Lang\fa.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	14123
Entropy (8bit):	6.669472469656721
Encrypted:	false
SSDEEP:	384:UjqRbo9Gk71fih5PciZqi3xHbWDiMmatd7MTC:Ujqk71YPci1xHbW+Mmatd7MW
MD5:	A501313DDACDBF92307641423D2C4C71
SHA1:	77060CEFB11DA6384363D7B4E3B3477103A4412A
SHA-256:	DA487279841FFAB0C3B131D63669520AB757C9AD3DAEE24D6ACA11FC8A9618A9
SHA-512:	3F9E25DDAB978F491F80C2D7BB9AC8A904B0E443DCFE3579C02B4B5DF7EED90C4A864F3416C5F0EE9E844414461A521AB2DAEB0C0CA5E2283056383B1F037104
Malicious:	false
Preview:	..2.......<....7..'...!.r.....H.(_.D.D.....}k......g.#.?.`.+..`.D.N.QL........dOc.T.w\|\.Q..$h<...@.........Bv.?=l.....R..0..l.)...<L..Qv}b.......yi.....H!;K).K. G%C......e..X}....(.oN.5....v1.2..ON.....\|..=......ByF..%YbC$.t$P...Q.R..n.jP.H..Y....U.?.wme.....8XS...hC..j..i..=..dU..k...!....@..1.w...\|..hm.K....g......8.^.........7l.vg.y....JPH..W....X(.#.L.n..#=...-...E.....a.f.S.F..F../..z.1j.L.;k......m..t.W.=<..V2...:s9+.@..Pm..SK:.M.0Mm.}.3.Tq...<...(..'E.1..........1.a..U~.d..+...(..j3...m`..9.w+.6.I.Ac.haa..5RgjI.....9sc\|.R.zC(..bF).%p.j.rn.ai<..t....`.......'.T.....;..9.9..u..<.61...D.d.jYj..Y.d..`...x.....f...#bF?tsb3..o.-...ee\.I[.m.......gC....X.;....>.r...Uc..}..=8.S4k.....(..7e.t4.].C.P=..{....n.(^...C3._.?..F..G.)..L.`.OC....sur.$.>.<s...z.D.A.S..T.......H,.4..pJ.I..+.5$..Z..^} .7D.^.,.SP......yy..4...8...a.P.}.K.(p.@.#.W.tS$..8./........IWv..MP.#..*..^..h"....i..IY....U7..d..(...wHH.....d0.k...1.,&[...#.p...........?

C:\Program Files\7-Zip\Lang\fi.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	9358
Entropy (8bit):	7.362957212667911
Encrypted:	false
SSDEEP:	192:udbRi+TUjgeEvFWXmzGnNIw4m4wn/59Bbrs3iT0XPOiblpwXqFjYAa:udUgeEGnN6gx7sd2iblQqR6
MD5:	48E8E17C510D28EE55BED9107815C836
SHA1:	F55680EE2995913330287DCC4FFADF0EC67E96CD
SHA-256:	3691FB775D70E3BBA8E61C45888FEAFC2DFAD5005835F8C6765CB301D2485F59
SHA-512:	DA1E52213652BB7142540E507298C81B7BE0514BFE20EA5F0392F02FAAB8E6B382667BB71E1A327174BD3DF3368FF2AF10CFE9063689F2AEC3143804B483889C
Malicious:	false
Preview:	.X.<.._.Gv^..WT.\a..k.^..a..@F..<q!.`V....'3.X..a...=..A......1..\|.8.?.g;b....-.....#..f.vx..,.Y0k....?..\}>...3....e.M..t..,..WH.9.....4..N.Dm..Q..,j...6.l.J.....,.t...k..8E...D8.....?Q`^z...f..(.@....K6I..XI..gyo. .w5&..W3.......Q.7.agz!.....f,,.@/....e..\|2.q.I.(g...2..w..bS..n..>.u ..%....6.S..-..p...b.i..)K~`@.H~.Z.<.#'..F...R....!./.....q.=./H....@m.h...R..).}4.....Y.m......nf6..../......Z{.".y...%..Ui.+@C.f.A.....W..7.$.<..fX.{...Z...F...<;..!.U.T...%..M`.@...........{..m..Nv...cO.s=..._:...F....1..0.....Q6.f..>/ ....V....AJ%.........T4/....k..m5..6.a........=..lIg......+.}m.s_.U....&.........".5.G..~.V..s.\.+4.8..$...;p.<..yG.........vq..[..i..s.sJa..K\o.....ibM3V'L.b...A.....#.....}..]..9.s.G..-./.#9......{.!.j..~.(..I@...:\.N.:...H.z.Kt.\|.:..Z...z#E.d...Kh.......ok.K...g....g... ..". .\M..._..V...nX...9"......Z.P.J.,U4H.Y....".Vj;..K.P../.C9.{..z.[....?G...Z.C.."....I.i:5X.LD.2....o.u....~.5....6....D..I.zX... ......^..3..s..$M

C:\Program Files\7-Zip\Lang\fr.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	10237
Entropy (8bit):	7.272847404391983
Encrypted:	false
SSDEEP:	192:BCeX2tqkW0Wop2qLcU11UTcPQPn/FsfqNXRDH2oZ5aLM+78+FFc/AfABr1aCg3:dqWgg01KcPQXFsfEhT22q978UFcEABr4
MD5:	BFDC1B1FA92B51D7336AFD9ACA5D80B0
SHA1:	89ACB2AC01BC0430149BC3DF5A73D490D5B92CFA
SHA-256:	2DB631DB88065A003E1120403BBE5F4752AAACC8AA30EBD5112BA71DDF6EEE69
SHA-512:	57ABE88F5D8C9AAE7515C7FDF5B75EB03E39071CCAB90B80AF45200443D9E1248D2357957DD4C8712F9E51A047435602F597698DF87CE737F40544A868198879
Malicious:	false
Preview:	.d.....]...H.{M........R..Fa>vX...$L...(.>SR]s.%..(..F........'._.K..`..L...P..d.....Aiq..........T......O......6P.o..Z.J%4......9...$>./.`T....) .r.;vC0.h&R..D...[.$.....Z.w.;f:...........;..Nv3.....n.c.E.QQ.J6.$...B.........E^.R...u....)T.C...~j..mR.H.o"&Zp.'.m..Q.0K=.2n..a9.3e........Y...A..p....g.W.P.P.;Z.R...Hp..'..8..6V.3.....M.2..&.....;..~.Qe...~..I.....[......m...h..?....@....]..H......O..3...q...:..>...Y....E<o..}.H..h...0...erPT.@yQ\..31..o.....Q.M.a..G;%...s...D%.......B_....2...o.@....d..}....t5!...6..O...kT.....[.P........Ak.Gf&....".<..%...w.....va.3\|?.,.9.\c..}..S...W+....Q.......OK....l..N..72.Ouz......s......V..W....0..JV.O..XY.xm1Su=+Z..=...{._..=.j..}.\......_..._.IE8.?V.T^U....z.,k....#..R..[.{.p.f....)F.Y..._....UA...g......6Y...z....w.......jai..-.....:..`]78....qzx.N.S..."+Cq...g....q.{e"m...[h.Md..=;......{)...Ff.2...N......U!..?..X.h...p..5j...._.....<j.oOz.s#.D.o)\.m.3...f.*6..l.,.Y3....&r.{2_%..i...

C:\Program Files\7-Zip\Lang\fur.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	7844
Entropy (8bit):	7.5829874086209
Encrypted:	false
SSDEEP:	192:ID2kg7gu5cpcT+mbaMgULtEydZyx2tzP/:bAqcpcCm2MgULtEydk0ZP/
MD5:	E1768AD08255F3730CDF50E0841EE8B5
SHA1:	A3575B832E4A668A20C0566AA03C4FD08DF29512
SHA-256:	0C62F738B831AACC779EEE39073F3D4F460BA138DB4E213384F699436912F75A
SHA-512:	5CCBB78075FA5F721F3464C5C2D93F2E0BB6271D5512A35E37E71D8F13960321A240D993D2A81D2EC0B6EFAA8D9E7F73A5370C89C78BDB8364B88B42DD67E22A
Malicious:	false
Preview:	.2&,%dU.I........g."........xF..Q~....m.n......gK....\|.C.GpA....-20.H......\|.L.c.#1....we..v.....},.... .r<...1.v...)z.c9'..oo%.P.)........P~...._~.;P.U...>Rv.......~6R.0.L.9.c:..y.a.JT.S.tj.`N.W....C..\| ........ X.kj.[..}.pcS...uP.yW.56......j...k0.l ...4...".......x....`.%1^..Y..c..OU.e..].S...k........;....."....{.h.....\...........9.......5#S..E.H....A.OB/..o...o."...L...w.......?+u....&v%........-."..dE..$E.W....b...\|.u....4!..1...r.E..<\ ty...F....+.f.-.1...X....`.M...0....f..z&eg.U......c.......,(._.L.....hN.I9.<..AJW1.....8..#.x.v5.....N.C..Zc2..w1%1..s.@.........+.u..c..J.0....1AG\...y?...)..C..O..!..,T...M`!jB...,#..J.+..q.....@Q.A....Z[.N]CM.....}...........6A2...]cKk.Q.........Q3P.m..z...18d..<f.5...i.. ./:.Ody...v..4....}.........^S./...(.\g...a#..W.0.R......f..;.\.RK.M.?........e/..*...=.8.Y$'X...x.......e.7.....V......L.{....C..el...[jsk...$m...k.e.a.-L.qJ.7.H.c-..G8.e.y.A...A..#......./J.62.4.p..xD?P.F]..9.6..Zl..^.M}.1?x

C:\Program Files\7-Zip\Lang\fy.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	6760
Entropy (8bit):	7.763361309786367
Encrypted:	false
SSDEEP:	192:KgH7he3Q7g8THICEa1dtIlI9//mG3VURfIfxVo5X1EVULfP:Km7hG8THDEajtd/mG34IfLg1EVQP
MD5:	EEC5C96BAEFE1A9275DD186348C84B0E
SHA1:	218621669968839C88D45FE3C761DCC0CD3D0092
SHA-256:	8E5FB4FC5D50D582CEB57F5F0653C1E5D85B378046F119E6158B330F07A15FA4
SHA-512:	47E6C970EBF1679B75FF36AE9AD4A8F491A8BE21C379F20F823EF43FF245298EEBD3B484EDCA7559F230AABBAB7D1DEF11ECADB9C27F1CCCB719C5EAEB6BE50F
Malicious:	false
Preview:	X....;..0+.....m..f@..m.8i.?...4O(l.Z..iS.rD.y..o\9a&:s.M..V.\|x...._..o.5.Yw).........'......8m.....n .0!..x..je..W5...gPa.n..9n..c...N.pC.....eq.V#R.mSQ...R..../....U`..5v..=.#..=W.EA......E!..:.v......../..z...Q\..G....j.v...X.-..k.i....3..</3.8...+PFs..... JY....Y.f..........b.L9.p~....y.....4pEu.....p..5.......W..@..8.+;e....DX....5h1.J.....N............Y...})3.!?.nd}U.....P....g..A.p.^{4{.....E...,#..q\|...B9.&..!%g...... =....i..........:.r>j....=....;...r,.SYY....<;.....k.c..[F.5.pA I...s.0..<.v.e....;0GL.d.._.h.'%...%db...0..T.dh.#..nj..^..."..^. ......8^r/..s.@..~....4vJ.8..r.j..>D...t9.w...A....M,.58.......R9,f.@~D.P6.W....X..<8..D...s.`.Wr...).C.{..xV..5.....{...1""'j.E#..T.....f.}....$x.:.j...xx.A>....Ac.......?.d..V.....4`...n..S7..U%.q.3..`....>...+.?.X>n.:.....m.HX..H.J.Z.... ..._..l...!...........A#>.e....lH........m...^c....%;.GX.U...W..&*x...N....K@..d....Bz..............p..~...Lg...AD.....4h....<....(.."

C:\Program Files\7-Zip\Lang\ga.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	8637
Entropy (8bit):	7.496116980288902
Encrypted:	false
SSDEEP:	192:Wlu8TyI1QfhlNA4qy6iGdK5j2FtsQCbDs10VbY+sYv/:D8eI65lmPy6i6+3Y+P/
MD5:	947B02D089BE5384EC323031D55C7835
SHA1:	55D6F98D72DF55DF705690C71D1FCB580716D46B
SHA-256:	08D1370F8476A244E466592F61254E824C87E5443A5B4C7BA3B41AB88DA29381
SHA-512:	C105EC094F24CB9B920BB74E382AC1203538B26AA56622F5F651019069CF1477C1CA78B9B700A4A4C5606D3D00D48233521899438BD03F2A3801BB45B903E15A
Malicious:	false
Preview:	../m...5>....Fl.j..I.(UK..Pg).4Q.....sf..<41Zj.#h.....{.&w.w../.\...e.B....A.].NC&.d..i. C.^.CE.Ch..1XgPS.......D.....[..5.hW..`.^$...Je"..?[.P3...B.>.....!.u-'r:....$.6.._..K..."........a..#.8.k..%.)'...4..........#...)....U..Rb..4....Yj...&vP{.m.E..[&>.&W@._..2......X.....vQ..O..y.v..v.~~.........9NLW...H.~..L.[..K.PE.v^..1N.'$.a89....Ia..{.d.0........\m^....w.YB..1..ng..)..E.C.J..1.b+U/..0V.y......{.i..W3..........~..j.....?Cu5.....Ba.+../.9[&.@....D]..M.L......[8....k.h..m;E.Zj.....G..C...ox....5 n/.R.....s.f...4.......J&K>.xN.X..7..h..C..?C...A....4.w6B3Q.....DH/P`..Ny)...9Z.`..C.t...P..t-...o...J.,m..'+....G...0.M......fLy.w.lI.C....B..W.....A.f..,.>....../..{...8.N..T...-.;<...(St&'..X_.0W..t..p{.5q..j. ...4.y.._..4:..E,x....w^.P.....i`...{.L.{..``1..[q,o.p..6..R.....V.:...g.d.U..l.?...".J.x..JP.CaK.6.\N.@-.Lg.:.G[.ug...$.t7..e..W...D...h..i...nO\....5..q3.>..E.<-8...w<)y.p.........5R..Vhx>/..J..$...o-ke..a..\.2..@?.J....:ukn.a.\eO..

C:\Program Files\7-Zip\Lang\gl.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	9940
Entropy (8bit):	7.314156453395369
Encrypted:	false
SSDEEP:	192:wMT958CXZ9zYHCEB8WNwTiQLhNOC3iAB9yMGZkDmKwn6W5HOnuBqm5OlJaJ+Rh3:w459rsi+GiaOaLB9yL+bwInuBqRKJ+RJ
MD5:	18EE17E376D49771E7E8BF8B3A067939
SHA1:	B5B788BEFB7D9A0075E5F5080E108B7DE8DD5D53
SHA-256:	A40505A77109108741B2522B3DBCB76D57FDD54A878DE55DE650EDA59DBFED4D
SHA-512:	6BB39E8A3FD8BE8260E18FBDCA35F6FF16DB568D4146D6AE61A940405424A7BA3C47C385D928E0DCB93908CE83131B7DBA464C851C70A56375A8391A6BCE6CAE
Malicious:	false
Preview:	..h...k.&.v..^.cdt."...f....i2.u\.....N.r.,.....z.9a..........Jls..M..o%fA...0L.L.?..+DV+i.+..-i.P#;.X.Ws.+YPT.....5.[=......;. ..]/.....ZwZ...&......<..&..&.cj...}.....j........Uc...P.X_.....O......wu.;..,'...n.^n....D..(..(u.y6(d.w.....E....Z.H.._$.w<..\|.)/=.^......0...k..(U...}.O[...G.:-.`..[.......cw!..Z.yY.._pU..!K.....L.?.y.]..r.J.UA?k).\..+.^....+.:.z_X].Y.lL..[..9d.....\|...l....E...{..rJ'....+.c:.{..4VO.t.w:Um2.......k@..T0D.ob.K&R`.?...:2,....%..Yc~r.#..P..G...hD.-\g.Q..CL.+..<B2....@qn#.\|.Q.....f..tH.[.........O.{..I...W.&.?l~T...I2........h.R..4$.-Ph..F...!.{.\$.r.r..;x.j.7;o.(.....?b...m.....'1......(.....h%5g.....X.au..N}.4..\|. .......z2.....O....Q..F.[.....8........E.^.0gu6e.v.t.L...#....C5....S{g...J..=.....Q.....S..%r..(]...3...(...B.jd.6...j....O...r{u...7....%.G..Q....3.=UZ&..u.....q..lBE.+.....si.x.X^.tD.z_.......5.qyGy^!..d.......}...._i.0..Bt..O....Ah..}*..Q...g...kd=..#..='.S..&.M.T......A.e..=.uY

C:\Program Files\7-Zip\Lang\gu.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	18096
Entropy (8bit):	6.051551518552394
Encrypted:	false
SSDEEP:	384:VinY7+Rpite7v573dcwXw/D92O+x5KTrG242BO7tXMLaa1dLA52hYV22b2dRHPYe:JacteF7tF35mrI03LAoio
MD5:	A434EDA78711418FE6D71B00970DC8AA
SHA1:	1BA3FEE46DF2D481198CA686FDCD3E798CF5BF0A
SHA-256:	7D6B7B39D3951BE8F3012BE66F087E062E1DAA81449E752F9A19C7D731D8DCE4
SHA-512:	8C19EB2644AD3EDB71AAC98650A0CA00D8973B76F9D9C3413CA301F9E7AA2F750297B3F6DAB56DA3A409FFC7312A7663A137AC896E33204ACEA4172355C5E4A6
Malicious:	false
Preview:	#.....s.^{.>.G.........w.QX..... j.$..7.Le._......Hii..r..6lq.;5......hlc.....O.a]K..V.q.....n....._(.N^s.k.....e.....a..#..1..X.i..`..G...}.7:.n-..........]..J.2.7'..C.._........6)QI...#.$z...i.M/-...Ej..~.#.?..8..P.3(.W..j9...c .\|qL.....i...0...B..DX.P!@........8}D.!JYm,.N@.....R...5.A@G...V.e......W..[.M.F!.)4......$...H...G.=.8...D......k..T.k.H+Zi.....V..~..Ci ^.%._..Qy....{...Y\|.(n...@/"h......RL6........v......P....F..9.A@.;....c..`.~..iU.<...A&...E`9...H._A..N..(%=d.mH..RT..>[\|.)...uc2en....lG..P"...<A...]....-.H.;.>..i.......O...........tt.....~_...wA..$Fq.... .9+.i.].....f...{EiD.........r ..?V...6..K..wmc.T.8.Z4...[.M?..#.dB..Y.pA.,^2{A..v..-Rvx..O..$23..7..l..z.i.m.....>...X.5....9.1K8...:Q......:.......d........`..P...c.u;...h..J.&..\|Q..~;.5..=AP(.'{..p.r..~.6......E.i....g.....\|..?..d..b....m^/..?...9.Z.:.N.&..i..e....f.Vi..ZS..j-y......$K.,">....d...O.....,....3..rc..."..U..P.@.yN.V'....>'.A......R.;{........'h.A

C:\Program Files\7-Zip\Lang\he.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	11731
Entropy (8bit):	6.670552018243116
Encrypted:	false
SSDEEP:	192:q4n+RnZ+SbIyjcywyfi7u9btvQPyZ5f7Q/Y8vFBYWrWxkSjCP2N3FSxaXbhNXfqY:q/RnZrNgyoiZFQPyZJ7SYGWVu2N3FL9b
MD5:	06298402D7529A50A02FD9FF5A931AF9
SHA1:	09FC0B0EAD0204F06D5AF056287A03B9E1CD7696
SHA-256:	07DAEF1D59418B62C14597209961FBDD8CA94022C49431CDE96AF099F0FB018F
SHA-512:	2F6E7E3CA1DECA16F2E16C670819304F49688EDB93E449C9EC49C53C3C91FC7949553F9B014E094857DC3FD981B9D629E20F86EFCC1099E30BE3483995145D68
Malicious:	false
Preview:	c.WO..I....7c....5.}.2....L....q....^....t..0.D;. .\|..........`...._x&)t..*...S.{....1Ru.f>........<.].%O.+...b4pL.3.2?t8...........+._J.$.i.H..Bn.Q.{..D..;...{......T^D..h.V.h..=.~..x.3J...S.....i.E...S.=.!N.E3.9.>!..u...xi......\.I..3.d@..8C.......V.b......TL.F9.....F.t;..km..........Tr...F..M2.5=.Z..UH..).7......nk.I.5}.'.y.B.`E.k.......pH.h.....ixk1......F...uzva.M.....>.....y.J2.G;T.h.Sv.z...g.,.g.....baP....+^).I.r..\|{.<q...o[....u.)..I.p......+....C?.#.=..G....V..4..-...OP.r...8)2e...[H...$..,.[9...v...s.8...8\P...>..m[wC...L..9.r....RKi.Y.\.C;..A&..J.L.....i..'...&.G_.44.a.bi....S...!%J...s..`-..G..@.....a.w..&..Pz.-..Zs.33@]L............'.........X..........+r...>,.v.E.Y.F..lK..-.W....L+...S.&`/..?....W.c.s'.&.7....@.B.PX...,..?....h..+{...h.....&u......J..I.M. ...Z.7..-..`..B.O.i.....QJ,8..hA$5G+....LD.j.P.r.&..7.T@>.x..-....c......W...y..`..8.A4k.uwG........CRj.xk.........2.V.>.#........}..lOdM...[c........Ju+....K:

C:\Program Files\7-Zip\Lang\hi.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	18198
Entropy (8bit):	6.034040608911769
Encrypted:	false
SSDEEP:	384:dx3i/Wns/szMD/xsPFkjTQ10Ip/huj4nXJk0qVQKFOs1SOH:dc/WnbE74Kv8w
MD5:	422331B937F60AC613F7C924548070FA
SHA1:	5ED8916D3E23F171996DE9BA300FF65E07542A81
SHA-256:	7A426DF514B50D7D97BAD0042D2BF2A5CCF9D7F9EB41B0B12F517CC2B11AAEA4
SHA-512:	0BE81F305898F2716F9C8FE60BFF89F967D31E6262CE2BF9752ECFAA46D0355DA85E91A020032CFE46F2AD0609C264DCE986F690ED7032B1C3831701F7EC8F63
Malicious:	false
Preview:	.g[U.6c..b.1...T.m..."\|..w...0Hb.S..D..J....+.p...3.r.6..v.......%&.....}...!..8..Vt%....9..&.:.^.....qX.\|...5\|...o...8.6.l.c>.2..S..>.q,b!p~..>../...\|.:U..9W:.-)uN.....E...~4.l.WG3....,...B..z/n....>..).h.@..4(4.......;@.p.a).K.r..z..]U$.p......bL/..$._7....T.....Hm>.m......_.....9..0...@.II...?.Z..<.L..z.....q..E.....%.8.[.l.E........e..X..........g]..37...j."....?Ip..Z....vy.=..\|S....f.#...7.1v...u. ..c.....D....fa.Wy.7Q..5....a.z.p...)T.......Mm...8HQ..W .@!...U....[j."v...J.).7...xm^C......E.d...6z.O...U.R.e\........O..M...N<...F..S.I.Y)o#...B...u.0.....v....\|......n"5.36sr#r5.uR.. H..p..My.. ...,`..<@..N-.....r.p.(M.X.b......5...M.W%..4~.. w....\|.\|....I&.3..5{@$k.\..E...\|.s..J*..%.....%~(x...'a <j....J!M........l.\.......>P}.;.O4..(..y..7.Yv.....2.B-U.~.....y~1...@x..',l..xr.jO..Lf...+..6LJ.&.w.!...6.;..J...K...G..v.z.....7....?u.AU......a3&o./....np?.qB.1..>....Ee.M.....Z..[:.#....c....h.G.&..............vA,.....Lk`.

C:\Program Files\7-Zip\Lang\hr.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	8944
Entropy (8bit):	7.458178020457695
Encrypted:	false
SSDEEP:	192:D8CbYGW12Rf5Au3jKcyJQQ3Me+R4rFkk97XY7zinbeQFoyKNzzD6VMo:9YCF5Au3ecUcR4Rkk9TUinKyKNPD+Z
MD5:	B734DD724E01FBD85A5F8AD4FA0EE553
SHA1:	B9808F40B04211B98ADBC82097B7AFE0E1999907
SHA-256:	AD9D11368F56140187C2DC10BD2DC023CB05F47C86B1A0DEC69F98931498C08C
SHA-512:	C8BBAA1268142B7131880C1A1425D16970D793ECCAF70ADC44A5CBC557C9C96E3B69142F5F6C65B8BB20B1546833D2EC5E9C5838380AF86E49A9020915A8ABCF
Malicious:	false
Preview:	...8.H.,;.tt.ho....b.zp0i/....j.".(.......)Q.?...6.!....E;.@'M[..... V.<..).....2P.Wg.....)7j.=B.~rJ..l..i.K.}$.}....j..'........`v..'... W.;....NP..xZ..H].....q.P..'?T.Q..b.V.^..L)b.a..6....J.aoj}>........X..}.H..!..35....]s.(.T.....g.....u....\.O}Tt.......E.Q..w....b...C;....../..k...t..Z".xM]I.#.8X..;...y......;K^U[...p.S..5'.@1iF..o.<ab....g[......E.._\|.(e4.{.o...L..$......Xl.>l.....'mb....0..2lG.B[..9)!T...b..1H9Z..)e.d?6......wk..n...{..J.q..G.....(.....6..<m.....3...A.(.......x..B..l....Y[z0...Rd...gZ........im9..f<.....p..m.....\..[n.K.....iB.fv..S....i.5....a.4@N.R.x.dau..Sz.P..pZ)..P..9.J?,.#;.0.C....`.T.O.c.....X\|.!.`.js....rW@.*.r......f.hP...9..V#.@E...r3....Y.!..C%..XA.\|......ZZge7...<X..K6./(..A$.....Hj...b.G.Nf..Z....../;PN.#P..!!.m.?x.:...2?6z.0..S.&.h...K.".\.$.H.P..cA.v.x...X..B.o......h.2.__......o\|...a...Ad+.....e.......k.Y.Y..w.~v..wk".....X..S0.U2~.@XK......cwK.:.n3...{f%.Y..F.I...CY.../-.F4..F.r.H.Q...r..+e<.0v.PO.Ib)..&

C:\Program Files\7-Zip\Lang\hu.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	10504
Entropy (8bit):	7.340871865304966
Encrypted:	false
SSDEEP:	192:4RF0LKVn1iWtu3ljsaFBH2Bvmod02wB6ksQA3wb4oV66fCVSAPc03:YuLKfleBHuuQ02wB6ksp3wb4oV64APZ3
MD5:	C2366CF7E5A9CD893AD85C958D033387
SHA1:	4C8AF208B8F06A63F2BEC656F4B5A6BE4BC72856
SHA-256:	60E7039AAE2389ACAFA1EF835EB968CE976F580B9C8F3C83A2BA01E84EEE6A06
SHA-512:	C70E0F1E3FC34BD92105ABC00AC1F78F3C9B9F695D62FCA1F47984A046B49351DC28C09C3BA2B48E4BA8689E11E7F7474C993D94B0EF7FBBA008150789611F9F
Malicious:	false
Preview:	3................Hg-..(.......F......b\...vo>..uQ.\|te..\.)..f...-.....Mi.H.?..(.H........Jn..S.<.......(<x....."...`...S.........z,_4....h.dU._....w#!].(....~.?..R.%..j.D..P..k...:...>%Q]z..$.X..Q.....\|..c.G.".+J..x..u.-..b."h.xa....Q.5.WOl6.Re....LZ,...2....v.x.4s..$.`'1]u.....DHG.<s...F5z..+.D....Fp..H.&..H.&......B6r.5.<...8H..!.g...3.d...4.=A...=iW......=....x ..^ .(.E.,.{X..c,T......or.j..KvG^.8.0:.3..R..W_..w.B{....iwnm\|2....Y../....A....#.=.N..H./,..s..Z,...HO.Z..C"...$`N...L..X.....a8Hx1.L.^.].Q@..W .._8.(....$d..$.{....o.p.A....XX.A....!./...P..My...Zn......ME.EHT.............>..+..cepU.w}..i9..I."<X..J:uSR..*.\.......Y.e#p...L.z'...D..~....L0....a.fE.......Z.en......;.C...\~...R...YdM...R..b@kv.lB....Mg.....#C.=.a(?.....\AT....Y.8....=ts...n.L....'..Y.Ez...kV.P..}.Dd.2.&..p >..xN.F....f[.>......{..UsX$...f....&.[O..d..A...@..iA.?..r@S.@'...n..x.X%:..D..Z.fAF.k../...=.e!R.M...U....HBA.......C.?.4.....[.$..y.....SuT.

C:\Program Files\7-Zip\Lang\hy.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	14464
Entropy (8bit):	6.544962897824717
Encrypted:	false
SSDEEP:	384:wIRCEh8YGCc53D/4PwwYzawqs3lGFYfFo:wcLh7Xmc4wYzawjaYfFo
MD5:	4DC7D9F462F53278A8FCC33611EA17AF
SHA1:	A941094C013F3D1CFDFBC017AF9CA83C6B82CC46
SHA-256:	6429FF7D8DDD220A460D728FBD520E157A121B08BDE7F7F92087992BAF61EC87
SHA-512:	EF511F4C245C11B1F3372877294FBF9132809D5B12BC728AC6FED8ABAC893EFCAF2BECBA8571DAE337B376449152EFC7E6A91CD40B5B510601B7BD344725DB06
Malicious:	false
Preview:	.....Q.#..a...~.].^5...z.[.~.io.R.s8...&\|.v!Qt..0p...'].V".<k.B1..76GJs>.7&b..0.\..go..ybw..._.G...9......h...O.)....~2.\}....z.......:...\|!..%q\...!..H8p....2.....c.Y!.d...e...dU!;sH......8.C.)>..k.P..56.. ..VC."t<._.<..?B..k...D..a.1y.-..O.........&S..2.I..5....9........~...'b...bl..H...u!.!./o..m.......^z(...Ma3.I.J5.....M.(U...u...\|w.&....U3..hD....Nx....]8F.4B...d..r..a.2\..rg.......0x$..E.....!..6.W2e...'.w/.F}...M...~.....m<..d...R."n<.S.Ph...x.a&VV.,S.,.\....V.9........5..vN...eS..`b+...W=...x.f....(.*.tW!9p....(.......V....9.Y.........Q.FM....yf..[..Tg...1...Es.Q.KD...]..R....vDM.+.v.R..4.....}.jn.W......?...E..?..c.y..b.yL......}.3&..#..X...k..p.W>.+:.....S..yA..v.s.?{..........>..r33R.8..Ok.+.{2?..l..l`U`...h..\_....IO8U.%~d....._...;.O.^....m....Ze.\|.M....r./..r8S...C...i.9Mt..E..!..E.gP.F..............5L.CF89..S.](w.....P.....T.....94.......hM. ..0XH....le..GTT..%.2...$k..^..N..;,....\|.g.o...b.%o.`9...;J.-.,..]...!.........

C:\Program Files\7-Zip\Lang\id.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	8989
Entropy (8bit):	7.4103306000528795
Encrypted:	false
SSDEEP:	192:ON2A0WJphoOexa2zOPsUGXez2eNVQrCJCoF2:DvEho7xzeNVoCcoA
MD5:	FA71009F0D88DABF8B10463A3B24EDD2
SHA1:	F9F8EC4DFDB8291023761F8BD30B4080E590BE3E
SHA-256:	B3B33FD89D71D57430A497C24D3309A3BC8E2D91408E6403733BB0D4D238787C
SHA-512:	05FE0CC14044F837D6C4E82BCFE7A2C5AE06B852139097D6AEE5346216FEDC9EB5BD7470AC42DFC451FE92B70094F2DB9605A90CEDEF8DE4A57601DC0239B693
Malicious:	false
Preview:	.L.b...^...L ....&s..r.[U3.:.>.C{...'\.R..4.".,......tw!...{mw...\|..%...NA7.<i$./.+.Zc..........Tp?....M.1OuC..I...q.`o!.-G.~h2C-..~)wUuQ..0t.8..ym...l.)_w>..T..9.}....J.......Z..~....d...d..X@ ..o{X.-..I.7-\|u./j..~Fx z.k......4..Q.A.#....6.z]....HU.3.......A...<......y...B.......K........JbX...Y_4..h...%.z...#R..S....X.=...2....v......5..-....&.u?b.....#Wa.XG.v(.$.M.^R....{ _.!..nE....$.h.Z..A....43..9_..F.y..A%F}0.].I...uX..0./..~mM...#..D..F...u9.l.WDHY...X.......d...,.^bH.....+@.$4..4[.-8...qD.6....-\|L.A..\|...&2d..P.7j./.A.9..z..<...F8.`>..c..n...B\......q..#....u.$r.y.ma.h.P&....n.........D.X[.'...J..&....+...l..+.I...N.. .`....zBK...X`dH...$..../.).....9.H....0.31..'G.-...HN}..sk..y.f..m....\..!.hg..\|..y`FL[.y..b.S..~.G.N.DG.u.. g]....`...6......$..Ydai.h..yT........X...z.*.....F..v..j`_.z.Q........7..A.._......^E;."b=8..6S~$>...D...ae.........].6..}....@U.\|..+.C.;.r..~n....BL..A<...{>$...wN.F..KE....3\..7...

C:\Program Files\7-Zip\Lang\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\7-Zip\Lang\io.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	5335
Entropy (8bit):	7.930731256039572
Encrypted:	false
SSDEEP:	96:2pKe9waQ/dcii/3SCRSxXjTP4lTktNIVTzQ0C+1V66VFJhOFti:cKeGd/dciifSxXjTCktNIVT/ZVXT8i
MD5:	DE33BE92E2CF5C848803637C7EC22C1A
SHA1:	B3A70B7A0C66DEE2920D920E3723143A3CECE1C2
SHA-256:	E61C29BE09A7C3D6DFB83CFBBBD0008EBB13199545BA971750D4E7DB15DFD9A0
SHA-512:	532574E4B91193B6D239DCE1C9E0495D64007091BE9DAA3BD2278EB0BAC78B94433E27773F6301DF8FA88BD38B9010B515CD8F817FD40D763349DAECB9AC1E09
Malicious:	false
Preview:	.rI_.j....-\|....!.........$g.+.s.mW..%.}^._.%...bfeay.PGi.O...e....r.JK.[w%FJK..R...&'.;...Vu.x..Y..._...z........=..?N.?.B.e..Tme...Nq..9n..J....m..<..5e.)EM....{b.^.j.....tJ[..D`..ir.....,%f?..wj...0....lJ.y..v}.U.o.X.HH..1%...G.....b.........R.<...i)..j..Bv+.mi..w..S...............u...?..9.t...D..._S.?.X.o..'..g...@(.z.gq{O.uR..aOg..5.w 8M...~A IP..1...6......:..!.x.gBB...:.W/...............n.C....;'..7..p..Y.-....l].V.Vq..t........{.MM..pr.~0`......7 T...._..+."..A.d{Q\|u.\e{+.o...^...&..Q....F5(o.f..S8.......n..hq`!...p+.?.9.W...l-.l...6k.u.I.#....+.u.P.rW.+......<..y...N+?........Gfu.;9..4........_l.+~...H......^\2.......4U..B.`..2..y...v.VC.N/..y.X...E.y"...^......<.....-'.D...@k...K.=..?......TEA.%.d.s...R.Vs.N.".......@=w.'Qa.N.Vp....6...=..Q.M.8v.'Ne.H...n..i.H.nf...}..!5.;.>p...iE.P.h.R.&....A.H!t.;H..HL.....T.,5-......{1.c../.."..16...I...X..j,#..l.#8........D-F...64(5IM.n~_R1..B....rt8x%K..+SJ.Yx...g..l..`b..}\|.:Y...\

C:\Program Files\7-Zip\Lang\is.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	9073
Entropy (8bit):	7.474186206816924
Encrypted:	false
SSDEEP:	192:TMEc0JZPkSSyuOuuLeYYX53OlLUaEZSffvYqBmHjLBSw33txMTB:1cukyuOJaPX53+PTpB2jLBSKCB
MD5:	941506490CABF17C063E5D5DB0B4E584
SHA1:	5024291FAB4975D0A923E36D6FD2898474A876A0
SHA-256:	874EBC8919CAF6F858EEA31FF5340F883CC755634941ED66F8DFB04C07C00E18
SHA-512:	EB635AC2E8D6F965C1429C46407E2F99CD4D0F4D68B7F8CC590DF8E2BD82F243BA0E98982FEE4F773A5B857CE4F7F4908C49BDD6900E265185AF5D0DAB9EF7F2
Malicious:	false
Preview:	..I..KX<....?4S. xf.g..K..C....8.<E$.r.6.9'-./Y:]rd...p...\|....&...mu...f2.,.$u.."..N..kG=r..._B6y....=mX>j.0...../.."p..3..6.<.."...&.......\.(E..c.Qj.DOJ..a..}p......9K....-..v...Rm......"{.V..-.Mwm.....2F...C.G-........._M........O..ky..S..!oPX.V.<rA.,.S.]....c...B.?8..tih.....W..P...`....q..6(K.$S.....=....>.....P..B...+.F..>...Q......N...@.....^-..Go.....B.[q..g.......y.......Q.BDP.~.82o`... .$_2...O....Nb9.2.....POZ.'9..I.;...a....S...d.}nq..9R.OA>.u....%nU.K..u7.{.8;"%.&%..J@...Q?'?O;OW\2............ .yQZ./M@...<.r...7vO...eO?<}.h..fW...jg!;w$..Z...H...5.B....{.Bm2....~.h.bO..P..n.M..Q..9..6.............U.".lE+.#h.iK..j~4n_Z.[....}K.)..V0G.+.^t.Us"X ...0V.Q;.#...I..d.\.C.p7{w..d.....'y..u......J{L.z.rNo4....1.....X.l..4\!..?.n...j.w4...E..P.C[/..........s...#.@R.."av...c....uZ....xNC....8,C.V...n...M.......z......shy[u#..........M.7:......3.*..t\:4.. \.t......+...C..<.Q4`.Zm%.k....QM+i.....M.<..D'.;v.KZ.l<..G.W5...#;.............

C:\Program Files\7-Zip\Lang\it.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	10077
Entropy (8bit):	7.266699280373119
Encrypted:	false
SSDEEP:	192:5HJ9FmoSliPOeYzBp1dFVQbF7oTRHcJmiCcaqOV8hUgIgJgCgDRjgcQcEqdb9y3:5uxHp1NsklqmUavuhUgIgJgCgDRjgcQP
MD5:	412A0A5AB3B5255D838C81F55514BFFD
SHA1:	FA7ACED0CD3778352AEC5FC7954E98BA6883B9E7
SHA-256:	6CA112E1AEDC558E66307DB1E594DF7EF8646CA696CA0F912A308787046800C2
SHA-512:	B5826310EE60B742F4BA552946B65951B79C3D442E15C4826EC1C1CEB2B216082A43EBA0A11F0C6EBB468F57DB856D41AEEF4778FB425B4C274978E0B49AD16F
Malicious:	false
Preview:	......{j2k....0)..x.H.....f...qz...Sw..K..&fE.[,V...\|Gn..L.M.J..(...\|M..]...E..l...$..sdt......(2T.Nu7.S...X.4.6......PB..D/.8.......(>+E...?.4.8.......Wzf.1..\|...T.x.%....U.$.u]...O..X...t...&..x3..Ks.".E8..X+/.....!..../.Dj.....9 ;.....Tf./...w.)[V.u.bvL.ZZ.^&...> .'mn...z...`.fP.c.q........5.>..}TE.93[A.....r.g.F...9...'9..a[.)E.3Uw.'....-1.0C.aZ....../...g.8B0\.$..}).3........=..L."..bX. .@..]F.l....tV..h ..v.....G8.yF.>-G..W9..F. ....{.+..=.T!..b.Q2..tq.,...b_.B.....".k[. ,n.P\|..y!Y..H..BT..,..&..B..n+._....`..Z.j+~.7..1.V.<..J...q..#...-..5.. 8A.p].........MG...Cav..u..h..Z.}...J...ao....&....eV.....b.D......i.g..C.^.....(X..2........).[Ug...^.~_Y...[H.3.4E...0i{.....C....l.e=.CY..CO..8V.m..@4+'.$.3[.X..@.....y.P.1.B..[..]:...Ip.0..L......%..#..f9E..."...;...w...Y.n:./6...........pY.g..W.IC.. .\..Y=.V.[..8.D.n..?..1s.Z...l..>....$bYW8vs;....S..n\.....J...<.9..}e6SA5..prQ.M..S..>\|..[....M9...].g`.!.#.......=.D./z[.G...J(..;.

C:\Program Files\7-Zip\Lang\ja.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	12544
Entropy (8bit):	7.105743097963691
Encrypted:	false
SSDEEP:	384:fGV0VTyWit5E5FOGHGoYQX5U0H78dQRmMGyW:fGCVuWikvxRYQXlH78dQRmMi
MD5:	57E4BA81293B20F7EA6D5EBFC054B1FA
SHA1:	B046EB8332F539619CEDECD3AD6FC43A659F1F78
SHA-256:	8B5F9C944B8986D2B201A1FEC04460B80699A10CFE3A64ABB3C5FA6A512BD23C
SHA-512:	12B874B2B1DE2E705195E352465FE444C96601597109E0053573200217E16D8995D0D0AC5443214405F722F6565A2E2577D67C0FFB078BB8F09F61D7E32ECBC4
Malicious:	false
Preview:	,#.......r.c0..t/{r.MdX...+...-S.t.Cp.!...s...t}.......3.T4Y.z}PU..;](.....j...a.""..,./.s..NJ22.:D.$. {.........QSqJ..NM~w..j..~B-.U.......N3..S..LA....`.".S.....f.......Ju.e{?F...u.[........,.;%....-i.Sf.L.)....pH..g.t....z............F.....\r%.LoC....{.$..q. UR.u......;Be..8..=.....d\\|k.n."Aq..".(+.{...tY.n../}.....3.?q...~.Y.z..b.0.l.....D..5.t(~.....!~D..V......[+.K......q........$i....k...4..7.7.(+]..4....+.^...uQ.Q.....NPDE.6.8...~@.C.)..1...a1x'..)............\|..v.DDJ.8......`.2..Q.....d.....K.j...tq...g.yJ....Y...qK).......0.kM!_.7.......%..L7M.^C2S.G.?=g.e3..o...h.~...J(....u....DR.1....:......A.~..iE.]L..3.F.._.g}.?.`..X.=E.el...O...O..7.....(b.f_..8@-.M...-^"3".%~.mX/.."..K..+.Y.).2.d>..w@=G..{..Ud.#8!.%GXO.N..w0..Y.&.^..b..!U~.@KT\|-.x...u.tr./....<......&....bY.TY......Fw......z.}.Z...1..@....b00s......%.....{8..%....\|..-..v..S~.t.....k.....y.R...rE .9P9...10...YY.)..4L.....g.vEQ=......(!...]..^....bo..../...v......)J..

C:\Program Files\7-Zip\Lang\ka.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	18530
Entropy (8bit):	5.800803931426713
Encrypted:	false
SSDEEP:	384:aw7Tm0ae4I4oQn69JC0twqiJxtgr61+W0Gr37Vki9bScR5yFJPNIazm7:aw7T5Zc691tV61BT7Vki9z
MD5:	43F43AB10677F75A3638D1F919F43FE6
SHA1:	A070AA897A920711B3AEB0E76DDFB44150DF8F5F
SHA-256:	2A672F45C11DBDDD942604DA41CFA67EC1EC486454C00D542A013291913DDE77
SHA-512:	8B1F49FD1CF90366038888A48FFD73DE7C2CF2388D0223C3A673815E87D7C3465F4CC352B2F2FADC3AE73F55A9044AC3D8F1C23A746E7C239763234F6835B4EB
Malicious:	false
Preview:	.i.z`b.`..=g..=).<!....(.uq$.....sx..".}.{5+.O...f.A./yIt.>.+..a...P. ...A>t....~[p.2R.X.).h.]...h..Z.%.%X2.E.b...tg.92...Sk...dt.+...@.'.L...mE~r.o;=]...D)'....NB....../Q...+..I(.....#.".....x....x.^?}#..%U...t.}.....%[Ze&Rn.Vo5..n...^"W. h_.2..f........s&..F....=.t....-.)..p...\.b..N.4)g`........F....K^..:.j.GT......^...i.'...&........J...'.Dg}.t.....[..U+0.5.c.0....K..!b.A@..O....`._..3......(..?....4..U.z\|5..I..!.-....@..?{.. .h....'%...!u.:3C0,.W.D..x....I....R.....S..W..c\|..v.......k..D.j.m...L.#..T._E.Lb..)0..l.ZL...t.%W_d[.7......,..5s5.{..F8a;~........Xio.&.....kZ..7&...^..^.{.........X1..k....~Q.'d..I...C.rEE..@..)<..B.$6.\.2....../..... .....).4...O@.r...E)C....10..iQ)-..G.....@.....=...w...@d$.....s....}E9R..Dcd.....f..c...`..B.?.}'.Y.`5ra+.q.A.aov.PF..pBq....7..Xpxn..J.{vy......aV..w.......H..Te...k.0.=.~......Fa....u.'..C.{....!Nr...~C..'.-}....v.;..j+d."hR.xj.....S.F..:..*........Rr3..........tszm.....h..^

C:\Program Files\7-Zip\Lang\kaa.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	8429
Entropy (8bit):	7.532134339734567
Encrypted:	false
SSDEEP:	192:I2y+qF1XgCPKeABipVzauyzNPZ05qsU1Ok/cO1rzce:I2yX1vKzkja3pB2qslk/bBwe
MD5:	A8AEE3367F463A4ACD8A98F7B88B6859
SHA1:	EBA1012AA311E2B9071393C8EF34479E6780EC49
SHA-256:	487CEC2DE35DFD44EB1A3C4D65B7B5FFCD6C4EBDF7B57690A6270D2D9076E60C
SHA-512:	32B1E1D0F8FE0DBD767E010E8D9206905DF341329F24A00668D859AE234CB626ED595CB49CC5D8443B2803B090E58B62A19F84F6DB7289C37D387CC12B215808
Malicious:	false
Preview:	\|....Yo..K\|..(/.~.WA...k....#...1.`....\4SM....O.AK.(vn.U1...!s....J.Bs...t....K....e..c.q...~..A#m.4.t#O.!....>..!ST.!r...ND.7....wue....\|....w.........Y..M...7.S...)....."<(o1...u/..K.......s...M.....?Ff..<.y.l.V.9...>).w....'r.W.q.>..3.7....!\|>.+.(.........J......6.[......bk.I{.6.d 4H..\RP$.<..m......^.. a....F.u...}.O...V.P..5#......:.9.....\|.....~..ZR.4Pb0.r..drk.4...:.c.Oo..P1."../vp......".....Ml...........q..X`.....q.....K........Q.m.JI..z.FS0......8a3.s....I...9......y......F~V.-B..NqB.........63.O.<.gR.......0"...T........+_T.L...9.,E.[.,...t>....KdWY...5Gl....<8.<[.U.w.T........F0..F.m...ehb.\P...m..8.I..:..9j.{=:.O..%.a...~...n.s.G...w..Z$.>.v.......:..qk..h~..;<..i./46.lRW$2[...@..W..E....ag.P`.xvs.+x.^..p..s....Q..^;.Y.k/....k....wZL.8H"..iX.....N.C_tv.w...0z....f....q.cR.{........MG..}...FfEU.>.}x..O...)....`.A.,. .j..T....uq$......L.i.....b#.......&.A3v-..S...xN....4.......o..5.I[..1n.y."<y`g.oK.....t..L.\|.......8..

C:\Program Files\7-Zip\Lang\kab.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	8916
Entropy (8bit):	7.5051174415954165
Encrypted:	false
SSDEEP:	192:6E8ZFrG+q40W154m47VIwhx3XbnFJhFFNlFxC2Jo+Msp44ndk6:+ZZG4585IY3X7FJh3fCWBPdk6
MD5:	C0247666F9E046654378D337FEE407A1
SHA1:	8EEF1313168D23308CDB9B74A6D7DE7CB814B403
SHA-256:	12390C11A1E63F5B9B28B9FDB3B93084D95DDE6031332D3EEEAE3D2D78D50CC0
SHA-512:	D6013763460C519E94B58509FAB2CAE87E2F05BD75707B3FE9D4DAC137F369084BDFF0B008F1DF5366E59B4AA7844D741B175B159995482275F78D74259BAF7F
Malicious:	false
Preview:	8.\@.......6.'..........L0.. ...Q..4.....0.8.3..8.%...e..,5:{. .Y... g..8!..<.r,V.....v.q"..RAU.~)..J.r..D......i[.u..x..y..:.K....-....=5&2....[..CA..._.Fb..N....{....S..6............>v.../.!.'K..5l&.0...y..E....FG...I...H..)g..2..q5;'.-.......9.Q...H.A....z.[.iK.0m.v.'...\|.r. ..w-.G.g7........h.X.....=.......Ao{l.D............z..iJq....1-."..,^^..D$..{.V).Y....1fx3... J."?.Rh...\|L.d...B..BE.V..}c7}\MY..Jc..s......?.Q.v=.:...'.-...f[.T..........).R...T.\.....Z......{.Fhdp.Q........c..Og..:#[.W1......i.K.S?k...4.?..0.w..fO.8.(-S.[.NJ:wD.......Ly.obEF..t......U.hZ....i..\...u.4V..H.4...........Y....c.......(..6Z.BX<.....yr.?..#Q...$.........#....c#.hb...?'Ch% .>!)..a]%...y...3{0..*.q/0......@w.....Z-......p.D}..Q.>.L.....&C....2.(.3X.s.M.......f....\|....L.Hm...$.......6.0}."......P...0...v.....ub9j......)..p...k.....X..{....t(v.;.kQC%X~.8z.s$.M.\|&D...\x[.<.... ..w'......k..>...pF..-.s........SN..#nC.+DmV,..`..4...0+8....0....

C:\Program Files\7-Zip\Lang\kk.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	11059
Entropy (8bit):	7.040583682780064
Encrypted:	false
SSDEEP:	192:33zOdZgGNmljsltA3S3SqfAY40EI0l0MPK+dvJ6p9dMMW5nau4a:zwSla23S3Q0MP6qMOn74a
MD5:	170B71F9C01EA7CD779FBAE963925FC9
SHA1:	9F6C728CF9FC1504DCF9908F3233A5AFC3FC9801
SHA-256:	9431D6CB7FFB935E778AB010532BDE2DD1387A7A436747C187B11D4D346DF410
SHA-512:	E52315A30AA7C6E02D97F6508941E321770EFC00BEADC4BD77C8D269263AD5142E21D7F33DB99BF26D237EFA7435BFADB1C4E14F1E45E5B9200ED39CC8313A04
Malicious:	false
Preview:	...G$..u.....+..&Frt.\|.A3..$.OM..)...ts\.....p........:.8S.VF<....J..H.2.b..@H.....B...\C...z.F..zp>.N..h.T..@%%..\fa......Z..\|...zk..~(G.....d...t,f_.6=.I.i.${W\|......B...6.L...=.!.6...A.#.i...ZU.mv..^..u..n.u.........~l.3... .).B.:.^.:...%.P.'N..........Y..........ir...&.G...In.d)..a?iUl.$.yZk..J.=.9......G....U........o.....YK...u!..X.~.........m72`.^.M...qW.......1C.?..tZ..V..w.....[.e..:.I[1.RJ......50........R....{1......9..{.GL.1..^..j..xWr.2.:.R..j...O..../.......J#..eww..a....C...P.>._4`..)T\...^....N{1-..YU.E........{9.....Y6.4&...Y~/..J.....'...@.......??$@.]...n.GS.a.......X..f..Z.#...RH.....2L.'..f%...9..J.^d....i%...g.h..h.=.....?..@1a..E^mY... ....Z...}.{..q....zt......uT....&g<.....C...<.......o..m....(....z...J-..g..2.u.2}..&_`.....8..\u.x..!-0...6Yn[.x..7..v..3....... W..aHn...m..8M7....Z...3z.y..x...6(...\|.H........t....\...k..c^.f../a.HJ.$[...2..U..".!...\..K..... .Y3.PF.g\l\.W....0...K'.oV......,~.....R....NK.R.@R...

C:\Program Files\7-Zip\Lang\ko.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	10616
Entropy (8bit):	7.4035089088176385
Encrypted:	false
SSDEEP:	192:8FTqAhSgrja7a6eAlxcIgCUNr3pmR/T7ou0Js40u8Kna36jy3q9FduidUaUl:8shgrWakSqUNr5mRr0DehKaXA9d9Ul
MD5:	E2F8445A503FCC2DE77FAFAA680C7AE8
SHA1:	C1E67C6E9C79DF8BA412C34A2B943316FAFC0DA2
SHA-256:	61D855133204ADAA6F94335E75372D1E995AB954032A884DE73E104990B41863
SHA-512:	78D211600269C95B03D62A956B92BF6032CAE63CBFE217E2C0DC74FFDAA8DD782FE16A54CFEDE555504446B20F6A0EA75218E0E27F5C32284C5A0D07AFC6FFF8
Malicious:	false
Preview:	.D....J........`..+..R5......b./{.2.I.\tt..C.......eKd..}.........O,....<....sW....7._.gr+.8x.................(Pyl.X`.Jv.>.=hL....<k.r..x'`A..bb.ru!..Y......^.P....Xl..].-.c.?...\|.XO.Z....M'...S.4J.?Do..A,.].I.u...\..t+_.{.`R.................%..)O.0\|..Q.l..sd...c?...:e..-.5...w(....L].9~v........qu......].v..Wi.J]..B...P...1.oA...]....)..%..;5G.6.]...t.R..._^...tyWy......].......N^n...T..,..............S..zY:AVs+.~.7....U]X...E.f...s..9...{...;+G#.2.o.....F.....)...T...Q..C.S...`.Bm.:..l)...\|..M>>g`.?..`3;/6....i..XOU.k......7.vz=.....G.6^$.F.Nz....F7.YG...........{...L..6=..B.G...R.uQL..].M..z:.o.}..M...f.......m..2.y!......=......>..24u..\.}...Q.8.....",9j.. ......T....{....H.....:.z..)!$.P..Y:LVC.k...L.yY>,...;t.{._PjA........S..{.Pi....e....=M.R4....-...h%...c.e.ZS_....!...L.".:C.s.v...S...l+._.......<.......G..h.Ex&..........*....~.!1.....q..%...r.d..#.....3.....9.....~Z5..t........x.}L..D,..-...?.KC.e...B..0....o...8....`..#.]...}Z+

C:\Program Files\7-Zip\Lang\ku-ckb.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	12664
Entropy (8bit):	6.837974574632524
Encrypted:	false
SSDEEP:	384:qzMw7fss7AYVvWLBjiuTijaTSfSA90sDPNSCMoch:Iffs5BbTEGSfSAysDPNSCTch
MD5:	D94B136ED417ABFEF9627191D4618C34
SHA1:	3D18A4DB90365FAFE0302E103DA802A78335100B
SHA-256:	E3F122EDE2671011D965D4E75C1A364042BD674AD2FE7446F3CC6A250647F930
SHA-512:	240FE234DE2724A5A037675D9FEDA39E3935AC628932AAF4CBC08EE686F736FAA691CB38F9A2ACA9F9615D743424648BD0D0E838EE539912D6D3C2F1B746F29A
Malicious:	false
Preview:	t...n..3 =Mn{...V..N.%]...?....=..\...~\..e./v..m...C..p...~u.y..o.,.....C....._./...'......D_....LO.`..-..v.R.V.......=.#...eUUA.d].....q&.).y.U.....O......K..;..j...O5.IZ.9e..ZI..E.Un....~...=.......9.....u...W..\.....t.=....'(.4....0.].W.]...4h...K8"lh...3....1...y.......?HG.[.C.G0.....W..iUf...x...C...a..IT..o..u...h...R.jf.. .....\N...a..k.P.`.CZR..(...Y..9#p...B.Cg.$+..4..@.xv......E..[......c.:G.Vc..Bvy.M$.u..ew.;.&..C-R!.(!...-.v..".H.7rkB......5Y...y?.O....^.g..^A..2.Z..zK.R...^./\...X...i..u.O.....7.X...V..G..a/}.[...M...Q}t...B.J.\|e.;.5.N...oG.....%9<#:o..L....F..NM...Q~...0h=...#7....~ ".....u/..u.A!.A..$.(.......P...a. ...fkGM....3B.5.@....\.)M.........A.oM...f..Xs-...C.....^...e..;...f...z........8.D.[@..(....S.D.....#.. {m....7...$.'......lL...........{..G...fBk.C..y.I8...{,c.......y..@.K.g....f..o.E.{F......A..._E:.(f#.Q.n.bxD0.;....0....?{.p..)..g).....Kv..G...`...!...F.....C.9.......m.N.z.....U..a..w..7

C:\Program Files\7-Zip\Lang\ku.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	6101
Entropy (8bit):	7.866852072581135
Encrypted:	false
SSDEEP:	96:vkze9OMr5we81qfVXzbfJtqe5Mu/VaZjfcIq7AQMmv113q2FWIVtCufsadIXJiXh:vkC9O3H0fJbfJtq69+t5813qQ3GUQJYh
MD5:	366EBC2C852CCDFF538B9451020F8F6E
SHA1:	802F4F7C0F6EC335A5BD40E196031E726BD42935
SHA-256:	C1D3928F82A961475B4A74433533EA2B6A86E92541312BD9D6872E82B7FF2C41
SHA-512:	D946A2F08FF7597BF4E0959397781AEB1BFE171EBAE13B27C96FCA6F4675E06AE7C4AC7B46BFA03B8C1F485273035511FB0B21F1406F6BFF55105EC757019926
Malicious:	false
Preview:	.=.2q.M+..$.Q.=..(,E...h....,o..(.5B..]\..Y."...[..\|...D..dl..:.G..=-.o...;"....).a.2&......YD....-..5CM1Z..&..@...:........(5...T..z=)xK.7pdqXD?....#.o..aq.\|..b`.X..$e..........(...]....NP.....u...#..`.^H .06...M....JQ2..6.!.2.c>.......i'J.U.[j.. ..a....i....m.H.g.=.?J.Du.....B`..Q2.Ac2M.:.....sQ..&j?...+-..4.F..Qm...."...H......X3.....o...,...P.W..mr.79F..coR.q...X...w..Gs.0........{.5_'../.W......#.0(PN.......'w.,.^M...Z.6....^.......l&...3.!.2..c......p...Z.5....q..J.A]g.hp.}.6..G.....mx.#f...~d!.m..A....WKV...{...J$R.i8:.......}.......1.;.].v s.GLF(.0o...&.O..fs'm@V.......Z..L./g..........OH^..Lt{.....0l.s..>.....A..\|.A......K.d..i@.A"8.....o...-..6.k.&.....[...........zp........m.Lg.u.Af.]3.g....l..X.X....5.....w.....t..g.v?..H...F........]\|........)..n}.=B..=....x.....Lo.( m..$"._.+.W.....^p.K.=..<...M.%....~...W.....}p.....IIC...5.."..<&......:QI..E.6..)..<...y..k......IhHr.HwuK$...5b...02.../?.8..~...J..y...^..i.e;.{.

C:\Program Files\7-Zip\Lang\ky.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	12783
Entropy (8bit):	6.852504164860274
Encrypted:	false
SSDEEP:	384:mk9kmbipWpC9tL3JqVMLO6a+aoWPYx1jqaxY:bCmbioQEM+Abua6
MD5:	2AA116DC1256A6CE9FEF5923F54D5D03
SHA1:	67426CFD641800E8594F2B7C520ECDA7116ACE29
SHA-256:	A8AAE264601D132B8C075DF36945C3D3E7AA8D9B2C37933CBA6F6F93F37760E5
SHA-512:	82E239BACA92406FDD0163957388260CE9AD0BE10D54E1AB06F27A34C6CFDE08E7229B6147CFB0C994C6D5B2FE174A8E140D77B8AD48FBB2B9CFD94FC2199828
Malicious:	false
Preview:	...R$...1....v.XA....)c.......<.h.......Z,....jB.)...6O.I..v......V.y5An_.lp.X.b..y...k...g..01{.(....gV?05.c..N......)../..........+pl1.8.Qdfq...3.}..cxK..a.......'\......,..!..U.@o.(.n..0.Y..\|..s6....Ag{.J...)..Z[(..O..Y..3.G`.......A.#MR<..?.s....cC.nT1r..$.....1c`#[.7'.c^........5fo...}.~l.4......?L...'......8O....j_...Q.\[o{.)".,...>......M.^u..Jt.l.$K..(...2m.J......eO.i.}...2..#v....e.hp.o.K..R./7._].3.W....g,.u>...~h....P.A.I\......AoH.._.......%...J.......K..Agk.t.:H.di..B-Es....O.{.8.\ 5.!.....j^Dp.d..<...D......VT.l@.......w$.{l../....`;........7......'..........F.@.=.....zC.....m.W..@#.,Q.D{0.u....N\|&....MSx...ot.4.C...2e..$_...~/..{.IW..5U....}U.T.0..lO[..b..#....'..D.$6o8.m...F.{,....P.8....`Z#.9...)..XRH..Q^...)P.Nm5......T...V....C.5.A..D...p..g.....d....S.s.......O0]V..+..w.=L.......v..I........YM.1...KR.@.>..{.....Z..z....y..w,...0.TT.R..Q.H..\.....1..m..E....X..*.2..>Y....p.~s..V...~.W....y......8.....p.}X.9~... ..B...X..u..

C:\Program Files\7-Zip\Lang\lij.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	8202
Entropy (8bit):	7.543947136566218
Encrypted:	false
SSDEEP:	96:i1GdiOD8sieItEmnVTjZzwdAFBc2kSHlRGYmUVYYQxOfUsz66PxqwNc2+9Dnoiy:i1w5IFd8W7XrmvY/BRxqwZ4nny
MD5:	B2A45F7E8C52B0657B959EA748723616
SHA1:	61D925A6E26F2DC0CBEFB156DD9D6DD927E6100A
SHA-256:	C283FA6598E1D4A634B76B24EC4F2D0F7B7E3188913E6818E096CAC920573C00
SHA-512:	27624EC032FCF9171C43099D48920C3AEC43402CBD8E8C07CF9DA374DEF33962CE2B4858669DA9C85C14A335ECD9CACAE33A8C7F36615F0E7848E112839268F8
Malicious:	false
Preview:	.z.a&a.a\|1...d.)).<+.%(.!......\|...n.....3..J....h..V..3.....:kW0...L:.>...#..z..T...i.3c....W.}\....9.=.G9E..5..#i...a.,.7.o.6...Q,2.....m4......i..5...z...h...q.0F...y..y$...I...).1.TR..t..F..&.A...hH^1O....W.8.11..`......3fG5@s..X...0+_....U.$....n..>.e.Y3^fD.....A%..1...N ..'...........40B.L......&i=.....zS./..&[.. ... .A.._..v.y...9...B.f.........Q6...6........D..T?.`ExZ9.U..c..ob....6....1.l.Ew.2..@...../..-..%..f....(#.....9r{d'...o.I.....Gt...TU..........6...v....y...6.j=Y..H..B$Y..z..m.J'Z....;.......0.......$P...~..=..F.x..E~3..@.\|.....\|7....:I .TT....9..=.\......z4%..:c._.P.#.q........Z.q.l3...IO9.)....B....o2... ......Od....X....q.......%Y.V......w..E........:$.Z;.uU9.f...C_....pH.M..t........w...S....1.M...../..N.Yu...a..s..A.j......4?`.Bbk.R3I\|4..$......~..3..HT...>;o.....y..........t...I+04M..RX.....A.(E.u..@..1U......b..F.B.R...[-.......w8.P...A.. yu+...J......d.5@ ..fw...s-..4.... @..$.,...,Q.p...TQ0....b_.'..,.L

C:\Program Files\7-Zip\Lang\lt.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	9852
Entropy (8bit):	7.3637593472881795
Encrypted:	false
SSDEEP:	192:i8UcQWBATw0+/abMcmMDVfRxL51Ci9gePo9IXU7MDb:4rKATwmpdUePG7MDb
MD5:	756909B587CF021BC590DC5E05E2655A
SHA1:	1599E58A1F61411200CD611D3314A33C9794D194
SHA-256:	64D15FE17A72FC0E6873E25C780E39091F441BB4BEE7ED04C791910B03F06D0F
SHA-512:	58144FF20B8FFA62F97FEAFADCF8885E10804635666E18E16FE73BB1F6A6234C13741BD1C13F5CD0A943DDE1F6B2084CD23C12366E86EA18A067C165DDEAD09E
Malicious:	false
Preview:	L....#.S..\.......R.... w(...I%9e..y.(.m....#n?Z...?.......N}{T...wt.f.W.d.2....".z..!...Q.....e..H.tk....I....#v ......q.MX....F^..b.3.W3..e....yU. ../]mZM.....L"$x..R.5.0.!..\|n..9...-!.{.([G....wv..u.F.......E..-..]..#X&..(5....3...7.P.D`=:..>....04....+.........1..\|...2..XJ.ad'..@C.Z...../7.....l....$....1.7.h.8..{..7...b.f...p.i.....`2.J../\u..LS.GZ.,(T...D^9..vR...,c[C.L7.6...y......p.Rrf.H....LB...5...KC........Uj.'C.7.7.h.U>kKcq........;92.K.?}w^.S.s....(..{.#......c.K....eh.1..enL.......;.Fe;.M...f.H..5>.w#.T...i.....I.9..Z....W7.. F.....i.U...=..jj(.&..i".j......F........,JE..4E.......p..t.8.P..Y.:X......~..".....C.=]." s.oo...F]..M.nYb=.....I.e.e.-W.u.....g.v...b....r..ewd...............D......^8J.:I....u.M..q......O.2...xx^.D7.!...^{..M.=..f..AWn..#d.....]0V.#..^d...D5V:..>=.&..w..J.+......_...4....1.Q6.0.9.jf...H&UA....\^53It..f.3.uE.S(.ko.g..BMz../).m......_... .\|a.q.....].....myQ.........1.sJ..;C.V...\...1..i/..

C:\Program Files\7-Zip\Lang\lv.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	5747
Entropy (8bit):	7.903307456791895
Encrypted:	false
SSDEEP:	96:DuGQGCy7Zl5kr2kfS21ACG2XID8rSfQWJmvEDkH99FrVkcKI3uw/63dKmdTA9:Ch67LyBS2142IcTjvXTXKrs63UmdT8
MD5:	DA651B5423C0C03E460EBC171A959CD9
SHA1:	E8D07A6B563192F11888D91A6ACC8DEB61F66ED3
SHA-256:	0216BC757477577F8DD2C03457809E7B607B0CF933BBF0A56A1C62A01C6DB49F
SHA-512:	6D58A6F3EC0EAAB79C17E6401B914E0552087DA2D665CE80A0E69CFA156B4BCF3C5D267FB57F391FF236A2EDBD8A5E3CB08CE0ED316789B3ECEB15C829B2E25B
Malicious:	false
Preview:	..)....%......]p.(..<t.XX....Y..f.Z.w....d._.4...^..X..J.D7}...".....{.... .b....g..>.T..]...[J D2...R&.a.....`.]...&.8ty.....1...^`..J..,.gG.<l.2..A.!./2$...........p\|xj.......-....<.hE_.G..J9.@.2O.,..:..N.".;.(.(..\|NC}...&Q.0.Z...[......8....-X.+S.`..:/&...=...6B.Q..}...~..d...paP.......7..8.V....P.J.T.C..jy..U....BM2.7{Mw..E&..5Kl..V..v..Y..v.2..Pa..x....ea..n......,Lr.k.O...@.y.._.....x....2.v.H."g..P..\wi^.}h....S..r..$..a.....P8..}......S3.............o.]..[.7....Ewx...0x9..Y..QK6pwD...2,....[...CbL.9.h...mE..B.p\|....H..7%.!..._f,........7......&[.2.)..7...<.W."7..?.q..X......g..)s8\{........].R..]._j...'....l.P...g......=.....K[.J..F,w.....t..v..LT8>....&X....eMdA..G....J.QD[.....J...............,E...x.........3*........>.Y.j.m.]2^...8x\|..c...kc.q<.;............3..MiW...z..4..~fah\o..1.yf/..'p..>......5....j............!:.:k.T9}G.[O...%w.....>{^....Y..,q...2.g.!X2....h...J......VA......HX....q,1$+..Xy..{l...S..rfc.g

C:\Program Files\7-Zip\Lang\mk.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	9083
Entropy (8bit):	7.191696858705951
Encrypted:	false
SSDEEP:	192:U3/isCSZ3LVfflUpiuJhJklCgGo6fGNMll39oWkt/i4axJ4xJrZLSWN:UPiVKpffurvTgN2mWkt/i4wJ4xJNL3N
MD5:	B43B76FE712B01076B91C0FDACF2A697
SHA1:	82CC514DA0C5D04F42AC3C5427020E2D69A69C8C
SHA-256:	85C55B5138632E442DA9A3BA226C661703B5A24D144B5E84B3D61492A9296B3F
SHA-512:	EC1D47FD6545BE22E8E20AB99E736D9AEB69217CFA82371771050D01D3A6B97C84D11C2AD6BA1586D7A32B933B934A645F5BB52CFDD19880C743EC9BA4F5E659
Malicious:	false
Preview:	..4.0...i(<......rq[fI74....pcI....+....>....Q.}Q........rD....G+4....MZ....q+98..5a.$....<.H........Qz.I.m..wS#)O.....w"..T.F.....n..hVj.m...m.,....\8.,).....bo4Q.l...f..Q.A..d...w.;..Z.>..D...F.....9q..5Iz$.....Mg.:......Y=....C-..QA6D......5....`..?...K.....7.Y.O..h....p..wj...b].....a'v......WO.}.6..qw.......y..A..J.t...:t......+..;v1=./...\0..,.J3.,.&uH......k..o..u..#QW...{..............r].?^....f9\..I......sy...C.Z.M...D....$]....EQ\|......@u..A}.b..6.....'.H..`....0...."........#l..]^.rs.......R/p..3..F%.[.X..b..'J".......'.b.@..#.0..!.....9.8...D.g..-.=.H]].....k.<pj.......3.\|#.=. ..T..NO..7....V4.O...;.W..9q..RC.K.....t.....3..VM..!>.?..m1.S`.z.>9.k...".....F..L...2R=.......j..$.......v....y.. ......o..(?d?..UYjnD:"..._p<(.p._.1q..I.C.._..."....].=.'9....3XD../.xi..6U..9.i.....r...y.^ZJ.......N..H......G@w.Z..^..rkI...........U...H.....,..h.1.....Q.O..c.........[.....b..r....).z..:....kV.....{.......C....=

C:\Program Files\7-Zip\Lang\mn.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	8800
Entropy (8bit):	7.307238329372124
Encrypted:	false
SSDEEP:	192:g6BOgYWFDPqwhhp0SIW+QezuVa8M6HCwFxhjB4nQtQil1d/R1JQPUOtG:9OeThP0SInQ+rr6xh14nDwZVOtG
MD5:	4F4A71936358E1DEC958693DC97720BD
SHA1:	B66C4C91E7EC2C2E354B545635A643E15175EF39
SHA-256:	B158FCA48D7837373DF9894FAF2E403AB5580A97D589EC67106BF37D0EDEE151
SHA-512:	2FBE1BED00EB3A758F5473E48DDDEA7E534CF0D475813AF55CE5347DDC04588D43B00E1706090698953EAEA3D74CF23FDBC70592A7EC1FFFB9CFFE70626D2FAB
Malicious:	false
Preview:	(G.i$I..4m&.[....#.Wi.7....P.l.........'i.2.........I....<...o.$."2......4W...fZLP.8.a..4.u......O2+.........u...Eu.=..X.d...4/.H%....9.......;...... K....S.s...#.k0#.>.Zx\.h.[G..].....^...d.O.w .p8=...N".G..8...............xkvHR.'.0%].;T...l....7i2?....[.W......g\...P..mJ+i.R.@...~./B.O,O.=../q..;....1.>..44..7]3$.{.q.....H.`......jp.........z'o......l.QO.L..6.+.Lr....d.'......LP...D+..L....Tm..`~...,.....[.pxR..^..@z..6...uq..s..B..w.;.n..l..6T..p.X....i.bu..m......./..y..\ .>...R..h...$.....B...u.U..Sl.-...\F....~5...Yp...b..G...Q.M..V\|6...$ c.N .\|n..D.z.%....q.@.x......O..qG...@ .3....=vd.C].7....}Mbk......jp..+&..........a..._.M..t..l!.A~.C.p..X1.....V....J...y..X..T..m.n..e..j`%y..e.r...Y.F.p...#.*..g.7.!5kb.0_..t?o...:.9;.t...1.V.......669...iw......e.PY.....!9.Q^}v....t.!@...!/..?....].....{l......q...}Z..$.W.A&..^....P'.._.R..../\|....e4j......I.L.x.,.[o>rT.%.K.K_...^.h.0..\|.9dr4.......w.0...AH.......`.^}...j....L...p.M.

C:\Program Files\7-Zip\Lang\mng.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	20517
Entropy (8bit):	5.669654354633146
Encrypted:	false
SSDEEP:	384:7J+g0CUTn8DsC3zV6aVVFhMJBJYwgXoFs8NCAFqF7qVp0yVsoljZS8d45daHRJdW:7ggUTOsy6DZgXWEqVpNs4tS2Zwfs07JN
MD5:	FA4069EE6E1F7D7CFABB289E4B468224
SHA1:	5BE08316459573CDC413B851101994479C9D180A
SHA-256:	1FE3F15F57EC5B169C65BCA7471FA56E5778ECDEBE4A85EAB2C1FCC39DA5B111
SHA-512:	12F8450DAB2AF0E755664BA83BC2E036F66CE0E3998B7AAE12C3626DB549F340ACD2B0FB85F2C7037489F57D1E7FD550AF94BFF4A666758E6DFC7048AB9BFDA6
Malicious:	false
Preview:	.9.}...2.zGy.N ...z^.e.}....D.D...&...q".P.;.........;......j.3.7.....$.....H.B~E.x.X..a`..:.......o....r..n.....K.^...f.XSc0a.Pn.l.....LA...Y...D.i.......weox9.......:..!......%s..Y=...\|..........n.b......\...'.QB.:....d..xF."......5/EBC...<...w.RUl...q.lh.v.".O....q&..<.p........M.\..h.q...AAN.@....]-..\..x.zDh..J...._k.$H.f%......W...0......^........O..5.K......6-. .kv.Y.[...^..x.%..tA......PN..O..OBA...."./P. 6q....z[pnb...Xu..v...u...kg...I-.....-..........K..4..a..C..6Ac.G.t.,.7."..R@,..Q...&^.....2d4.........)..r^.....4...f..'B..:.OF6i.8e.1.......$..Z.'.G+.2....e.v.P...E.Q.....x...oD....g.-.)...]....~...F.@&.fB...D8....W..K..g..h.9CU...:..{4..i.sB.;x....p,sR..r%...s.kM.....q..v..j...y\].....un8.......?ZIi7.f...2.=....>)..`.g...v.Q...'.\|..W..N3.X,.".8...v..)y..fp.6...P.S..o...'..6f.j{<.v...1...zW><..@UKC.s.6.9.k.<.f.m.2.K.....h...<~...y.6..b...)k.P..V%.a..*......g.j..j.u7.uw......12?z....1......i.B.;..r.._.6O..IRHI.....C.-9,6.

C:\Program Files\7-Zip\Lang\mng2.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	21900
Entropy (8bit):	5.671648814425748
Encrypted:	false
SSDEEP:	192:X+kYVRm7DFO5nWGNswYCpR4N7jgOEwbRGst9Px8lrCaLVQG/E3bRWstUxV4Q4gLO:ukYVqc5nFNswupEMYjMNUx1klL
MD5:	B6B4C0E4B80F87236773EA95CCEDFFCF
SHA1:	52FBD23F2BF0DE426A2E2B4E3D449192B9B4BDA5
SHA-256:	705927978D44A647A58FBBA692DDE6015FB390AA21EB35C0045198721AD6AD73
SHA-512:	23396FDB108A417524E38C2D03E449D659672BC97F22B3EF5CE6FFEACFF891846FF8F0AC0422AF23A620526999B116FA5EAAF4EB34AE1B076BF83D8E83AE6502
Malicious:	false
Preview:	.@.?.QN.....%.mz..3J..W...o...&.op.$.[.../.}u<._d......A^qd....Si.........P_.\9....+T...1..eU..J.m.-c(O..x+....&.S\.....v,Y......A...%\|t.j?K...y..Sy.?..oz.,.3.X..d...:....(mQ..1..c3.........6).6.gy.b.s.=jl3..r.]MI...........kYW.x=.].?$..{...;..&Z\../...3B#.72<..5@.o.:...<..-.-..)d .0..x....e.k..F.M.....+T.1O.. :G.,.U.......0Kn....3.._V.@.9....X..S.r.`;.....MT.}..$.s..(..........}%..... .t...._..>,..0.'...B...j.h8.....T". .t.>=....=o,F@.?t...;......q`_0.......,.)Q...trK.G........p.;mXXe!.I..GI.-X......oE.u./fE.Z.V.Yf..A9.....].-..!.V.8.:...^.....E2'r.Q..n.n..h.......m...P...8....__8G....y...Z...x.....L........'z.9.#..O.s....o.i.......S..........y..Rk..3~....P.c..f.1....f>....3P.J.....<z..I.O.o.&..z.\|..G7..o..MA.._...XoX.L..f.2.~M*.i../......Yf..d....Mm.Y3..6...q.^..^..l...T..N...6v.i.XY."....I.J....V..<q...T.."'d......'.]{.C..a.....\|..............M.<.a..5t\|......\.y`.......rja[%.Z/..b.\|.k.,\..>.@.%.a\.....G.5$:j.B.J.(:.$.........

C:\Program Files\7-Zip\Lang\mr.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	11126
Entropy (8bit):	6.769145561675521
Encrypted:	false
SSDEEP:	192:WIvfZTm3bApY0BLNLfOSNeGd07I7ybpFefTAi8reINhB9:jJTAbApYILRfPN9diIjTCVb
MD5:	1910BD97AFE17C03679DBEEF8F56A36E
SHA1:	A558A222911ECF24826C77F0B3736784741A2C34
SHA-256:	80E583B110BABF7A3B16557461A10AFD27612E2B120634385142EDF56B98B6EA
SHA-512:	E0BC063D0569B144AE633BEC6EE62DF41F89643E0D9F16CC385ADC503C3173E79EE11A6100E28A3D1BB642C350A65E1940306E30E53FEFC7F52551A1E324A1FA
Malicious:	false
Preview:	-.$..i..".%....w%..n...n.p.....}...z..<.%.L...........x..k....\.\|..............&.....F\|.u.r....)........O.^.R.]...M <..R....;..`.../.I:..Ug.1.......'S....z...;68.F.;"-]..p........I.}y.]...j....7.cMz...l..~lH..t...z..H....n....%.x9.X..4..,.c..}p.09..&.8.C\...p......g..]............).....,O...S..'.9.&G..Z.N....t.[.7.zx....K.\|......./.....y.!.....Z3.B....9.d......?i..[.I.9..\|....H...Y.;....?,.3.M\|4.W3b........{..G./../A..+..'=G.6oL/..AYPt..a.`..R...K...l...{.......-..XWEW..H.._.F..a=.@U..wn.F../.^...@o.z37r....=.u..~..7.......{..Ui.)......o.o..\n.r..............TVx.V.......yQ......9.+.`..".....be.r..>.=/l.g.8!.Ji....r......u$.L....i.../.~..8...Xk-..3D..'..f./[......,z.y..Y..3....HEP.g ..C.L.X..+bW"......c}7_P....!5.K......6...Y....z9..}f......G.2.8K...'4aV.......x&9.h.W...Vd....@.U#A%..x..".29crw.....4..x.s:.#.+t....bE..@.6N.....t$......7..._o..%.t.V...Y.>.s@v...M..V...MH!.2Y).$D.!.w...s.B..G.J.J...W:.1..Lq.!..u......A.f......../...1..j.

C:\Program Files\7-Zip\Lang\ms.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	5516
Entropy (8bit):	7.929068921343778
Encrypted:	false
SSDEEP:	96:5D3h5sRGB79vl+fu+95P0drfzAN3d6dsXFfA4FyGMBEqnudTQn9koq0niFyB0nIj:JhWw7rN+9KdrfzWN3XsXxutXFQASB
MD5:	20670956AAB8C4F7939AEC0EE2318D91
SHA1:	DA721AE0A9D7B714B81CC0F5381220DD0D0DD7D4
SHA-256:	4707FEF770D7EBCCC0E61974DF5619BC66C40E7EB6280E973E6537F3425A7D11
SHA-512:	5ADF153C111FCCE1116BD367884B211B6D01AF7E08BB9E737DBA038C045A38906BAC86CE2B0305A8B127DD95FB11B384C28401B87B4580B852DCD58596EEFD3C
Malicious:	false
Preview:	.]...d...p......q G.?.b'.. ...7..)X....j...D.NrS7........R.[...=...tb...`R.J.A....(...H.WM.l....Ia.]}.....'.u.\V.z.<..;..d2......O.....4NwY\~.......U...:.J..I.......x.=5T1..EW...{......tM...Aw3.t.H.}..;gt4<.2.q."....ta{..?...!....i%FX.j......<...'#.9...X...l%Y..R"..O...J....f..X.)..4.zT..........g...Fz....&....^...p....u>Q.dl.-y..o.,..d......{.b3......Xe.....6y..6.v.r`...g.^..K.^......~A.q.l..F._X.r.Y...W."y.r..Kc.}.PL.Y...Q.x.FBU.^......b..t.u.l.4.........,..h,X.p.Z)K^:.vG.I=..... s........V.8...~......[..._/..M^.....G/J..........h..eH..B}.K..F..1...3M]{....V5q...I... ...$.C.....`U_.Q.....m..G........v.-O........y.Wy.d..h..H5....N".....P..y....<9&[.U.....b..ip.H.(M.i6t...}..KI.........p..7X.fgY.{5.W.7.{...!&z{..a...D.h.3.}.0..H.p..a..l.&..4...D@0(#..&......(...T.I..'..!..<Y....d+..'...v..9..9\|..$)G.-p..h.;.K)...8.V....v..... .Q.SdJ9.o;$....C&.... l......`,.xoi%...HA..(?g.#yJ{]..Vq.............,...}.Y...V..7u.\|..g/.c.;.y...=........t."M..*

C:\Program Files\7-Zip\Lang\nb.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	6380
Entropy (8bit):	7.831467489997782
Encrypted:	false
SSDEEP:	96:377QbnsrA5GhMZqrN7V0PS6CMn4gOOhyUSH1wjIVU221xHS0fegfwtbRQr:4R5GhCOOa6R5A1ddmH5fegfwAr
MD5:	FB9EF8E88A043DF543886BE6DA44597F
SHA1:	18AA2BEA75AE9C437953FF7E32528D7044EC7FC5
SHA-256:	EBCD5675A095BB171ABC871C5DEA241D2492A67AA9656A35520DBF13FD875088
SHA-512:	FFCA13B0F717DE9CC1CFCC0214C51688E004F2E9B311F6F9C2089DC6437629FB8CAB761CA0F6EE14879833503D258C71A83A5703D4D3DE4FD8DEF63BF7E03A94
Malicious:	false
Preview:	S>...G.....0z..Zn..JUR.KTn&.\|..G..a......?..h......\k.J..."..IK.Gmb.q..F......n.......~.:.j.E.......Q......R...p........z.\|..UQU....g}..&..;j.vl.u..S.2.W.....)..u..&.";7@^V..L......q..DN.s4b.4.d.e.;.....(.....j.a...X..q..p.....O.u.K..f..^..nS.d.H.........x..A..I.A-.5,..H.sO......).... ..t(l.k..).....u.y.R...N...Pk........[........9"(.x$g........C......c3`......3.r..v......M.....E.^.d.&.../#..n..j\|.._GMC.1m0..?z....?N.-...2gh..;nYV.b..;1.5...6.%.S....c.9...-PZ..r.2...a....f1s.=.q..).p.....8.....&E.[.u..).o.B..gf.LY.E....{~..Q....f.>#...?.3C%..s....[..;Ic .tE{7......SO....Z0`.'.NUaG...aF.]).wQ..).....j.1..F.A@Kv..#..J2..[...A.8.^Y.S..!.Q..E.."T..L.b...n..w..$.C3..!.w,-..M..._.C..4.u..U38O.E..@98.`..dQ.P.}..p..Z\|...q}.q..........D..[u......r....6b.u..=....m....5l..j.=.8..>.......H...4.X7..'..Gb.'.\ .c.<.A..D5....l...K......#.C.>..6t3...+.}..j.<.M/C....)..\|H'......0..#l.>.9.....j<..!...&..`P..+...+6....qcd.}s.)...w....W..

C:\Program Files\7-Zip\Lang\ne.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	13781
Entropy (8bit):	6.416536147761112
Encrypted:	false
SSDEEP:	192:9Nd9xMpEis2kmmmcScyVy1T30iXega8kTFYY5L99gMPZjGKsKsb:9NnxMpEn2kmmmqp30d9PdgM7sd
MD5:	0172893E489A30DDFD5204FB94226ACD
SHA1:	A8C4840772E7142E8AA1ADAED742DCA25B8A1C47
SHA-256:	E33DC46B838BF11869B689DBE5BF3977D3A05C6B1377E82808C57B5C89A38251
SHA-512:	0B6DC3DFA1AE4EE8EAA5DC6255783A669E97672BD1797C19C41AF9525F720E5466B8DE088362E716BCDEC9E544F68968DB9C6D1631E51245164EF4ED383E3618
Malicious:	false
Preview:	yjL...L...y.....'";a.Q.DB.z.5w.fW\|....S........nMvP..63...T..T......q(..$.2...>..,.w.'....D\|.\.Uyj..$.~...{.b;g?9.a&..g..S....C...^......w...j).'.I.r.?.\|c..?.c..7[PH..;....jW0.Z..Z6.b..k>m[1..s.\..Jj....W$....y.O@%...n.?.....S.....I+.W..._b.?;W:.W.>#...+.QaS.<./8.Ym.2....p.l..%.....@....MA.........fT...B...3..3a..)......Jn.[.SFh.u<.`.I9K\.v\.CEh......\|.S....P.N.?m...........g.g......^.... ....b...<>.[..>(..Re.n..AJ.d.........DM..y....8.u...."M)..8.]r...%..\.m.....%.u.B.,....g]v$I..,......tZ..u...a..Th....K..1......).v..h.......-.#.....[..>6>zN...j .4..#.t...1.....q3e.!.r...B..9...@<......f.....1o...wi..soQ?.z.YE.....\|.$.e........".tO...M.&Y.[..Y#1...v7".....5.e.)C........wN..4..E....'M.s..[N....t.._...d=\|.b..qh.P/..PM..c.N..1L../....y...(...=....t..Msx/...).h..w.`.F.."...H]...[n......3..].a.....U<.......4<.......Tjn.ah;lA?.). .....`h.@Ccq.Y9S.)b_....)....Rj.G..^....6...A..2cT..k...`.u.u[G...~......V...l...~#Pk..Bp..".."LO5.)aNc..[~.

C:\Program Files\7-Zip\Lang\nl.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	9856
Entropy (8bit):	7.31727142477377
Encrypted:	false
SSDEEP:	192:DEIsALetkFr5D4uAbqwjwYf+TfydOZhxcicbHFoXnyrRtUBacOw3wNjGWAJ:oIhLDRGuAbbwK+js2kuXy54sGWI
MD5:	4F2F7AF5C351A25BEFDE6E5253406C66
SHA1:	E78678766CE4CFE4EC10D826AE975BF83DA6B076
SHA-256:	7D5B9EADF3C619EA4B3E1AEF14E23E7E6F3410D33EA5D44475FFC27E93C32920
SHA-512:	9A8A7A1580276F1413D30913C38D0F7885A34931046EBAFE5CFDC779BCCC73F9D19D8441CBBBEACE044530B3FA6DEC18CDB8A9EEA92434F4B9636DC28972D281
Malicious:	false
Preview:	..u...)..M.d5q..WnP'..qo.?.....2l....i.5x..0\|.E...K!E....tE&.V.y.m....q...MP.%.....a.`.....I..=m....Z..X.\5.):).d..K.....m.....T.-....g....$H..d.8.R...dZr.Z.~.#P..bO......1.(q...9.A..M..,/..~..$..(X>...a.....N...Sr)T.+.BY..x.a.1...3..F..\|T...l....W^g.z".a.1"k.d.....<J...FjH[..]c...&.Ke.Q....[M.!.....&}.)..}..Eh_.......B.B..5C...JQ........S....Z.6c=o..../.$_....r..n..>..j......^.R/.=g.q......v K........`..x.>.d..,.W..O...[D:... .1#.%J_XC....}.]b...%..!E.f......s.s.+'./.......v.4.i....S.X#.d.nO=...p^.s...G...4.vq...=..C...l..r..,"..+ATY.......?wG[.j....-.,.......7..p_.x...0HL.......k....hQ....(........J..3.?Q.r.....t....N........c....jO.J..$..>$0.\U....@.P;..e.....6f..L..4...U(.....h.t.Q..is.Y...}..8z..0...?.e...TWU....wFDi&.R....<.......>.TW..$..N%w. ..1.r......I.....Q..i..s...;./&..p\..&jF;......O.)...O.?....:..up..<...'^A.FE...T..^.I.a..-..B......}....1.4YB..,.Q.....T..h.(..hu2.).J.;y.T,.m...............\|,SB..w.p2L^...pY...._.9....f?....

C:\Program Files\7-Zip\Lang\nn.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	6256
Entropy (8bit):	7.842697711685291
Encrypted:	false
SSDEEP:	192:UeSRRhQY7dIU4anlkyZ3q6xznIxysf+2f5V:UzRhh7dIWiyZa6Z0+2xV
MD5:	DD344B3C18B54F29608F4F981AFD34EF
SHA1:	1F1AA8D6ADDDC93E9DEB07D4E8810FFF5374D1D8
SHA-256:	BE0E45EAB27FD02E383C24DBC277397FC49ECDB0BE6B6D408E719F1469689C5A
SHA-512:	C4551DD470424388DF9C3C0DA32E6359A76B1BBAF5E5C136DB08DBADE7CD7F8FEF71DD5BA9BF9AEA6396AE69FEB3037B83DA50E6FC45A9D37584C7BA4B22300A
Malicious:	false
Preview:	.U......P3/...J[.Nf....k.d}Y.."....AuFU....]....`.<I..Y.o.J0...n..b.....3..#.[.E..8.\...P..?#.5GuT.t.<V......T..3H.p........63...[b...^F$0V_M.~.......T..8Q.W......k.@.M....K.+.$.$........\|...x. ......WEoj......r....XBp...B....?T......D...ss.....m...H%.....GN....#...1.1..mq.T..c1.M^.5.d...' .1z@K.D./"....o.1...Ze..d....2.b..O 0Gfh......N.k6..a-Z.^...C..K3..eI`......$Kk....E@.J.gF..?....+S..}.OE.s..w..%.d..'#..W.B.!.R.(k......ZoZ.Xi..kj.R.iG...V-LP...c.nD../...X(...{w..X.\|.6e2.o.~...\|{..@......w.....:6.9..o..Z.....Z.f.......S...s....5\...m..Q...t......L....Y.K...&.g.).B...OGGKE....F......Re.cL..._O...h...h..].s.q(o.....%(...^..\.....m6...L.Ip.L.....v.D@.\..`.,~..aUa.....P.JR^.....:.<u..($..F.F.d..V..Y.._.x9..p.p..e..hb...Z.pK..K6.L'3../.R......D..C...5.6....G..P....>..Tj.0.-.=..9.&..+......e+G..v%n..s...C.1.e....<q.....Mt.d\|..`..H.z#..3-.\...JX..q.Gk...l.).....X6A:CH$....I..}.:.....YpA.$b..ZT....P...*..1....(....B.Y.Z.Pl[.Nm....p..

C:\Program Files\7-Zip\Lang\pa-in.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	14990
Entropy (8bit):	6.325984853701634
Encrypted:	false
SSDEEP:	384:+5lEi8m7fzAvUhp2yDNe/pivXjsDjQK5Nt0wNN+37Y:+v8mIc2b/QqcQQwL+LY
MD5:	24EFA1A61403BC997E6CF34C297E45ED
SHA1:	49B2D070E1E6CB2EB9D18CC9B21A16AD116FAE04
SHA-256:	9C78CE013FD66AA9915D03EEC1A2D7350FFC8AB5359A23C8F569014643A69022
SHA-512:	F36C286312113766D4DE49323FCD69AF6B622675A69BE08F6F71265C4D26F38149589A6DC3768E00F633E0F64A354A20B90F2034BF542AEFBD3D4BD256E0F206
Malicious:	false
Preview:	.o..s..ss...&h.j..G..w}}.B."..wX....N.9.~c..gc\.f.}...].C..:{hM.Q..B.C..>8..p?5%.....`.f.V.K..KQ......"..........i..'.]..P.b..b...T...j`2\..<.....d......{u+6I+QF5.D......0...)..i3....f...>...eb.t..B.p.#...bN...%.....[.....iYOk.....~..7...0.]+.5...3....x.\+....R..y.0n..K../.a...9.?...+...3D.s..B........._(.cc....r.i.6?$...k^4.GZ\..6..LS..^.C.6_..N.~~...aL...h.........z+.2lf-....b9.....L.......g.u].......wA%.........N. ....X..Z(.....371\.....w.....;J..wc...vbf.....>{...1.Po4..m....Rx..w.0<...F".j:....j....=...h........2..+."...J.6...F.-...f......=...V..X.D...(...n.yg..m..U.ZH6....M:/.$y.o......oV....l&....]{.F..l..C>....M/.."l.No'..u8.kL.^}YE...V...4.z....."Go'[..w..&..2SQ...Y'p...E...~q..6C.".........$.....'g...5.L.k..k....G.I(.....Y.ox...".Sy...&...b!y,.>./...I<".B.[........!.~.^.'>....X.yi\|..o.r.Z..u.aw.......p..?.R..dy...3\..@.X...H.$.\..X@.E_.>....Q.....V.\.k.....+.e.A...,.q.R^..Q.f.\|.aY...(.........3........\..h.TA......^..:....R....

C:\Program Files\7-Zip\Lang\pl.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	10138
Entropy (8bit):	7.415260528683913
Encrypted:	false
SSDEEP:	192:WsH1FyJywhXrhLQ2loiFQO+an7cG5zE7nUfoFyNESceeNRC6WH6uOZfUp8u+La9X:Wgoh7SXQQO+an7cBnUwDlXD8p8nLQH3
MD5:	4720DDB9D81B39BD66B71647D6421097
SHA1:	7D5D2884777C4ED52F638239EBADD89FC9D073F1
SHA-256:	7038F8A2D774E9B28FC3B05C25FC0C6D629C4FD1B1B143E2E3995B6555D72CAE
SHA-512:	EED7DCF9ACBA203849855F726FB780E8F0AAD2DBE691467E0598F0396B5EC28333D2813D8F15471D55742D24808A127C3074ED5CB6F934C3E451B4729011A82E
Malicious:	false
Preview:	aP._d..6...).I .R.&d.....g.?."P.......#...?'R../9.r.J8.M....UY.HW`1.......~z..b..R.}..4.k....PW.$..]u......~.;d.jB..P..U3z..,,....B../..T...n........7.!.\|...T=.FJ....?...O.l....7.'............t.!..u.eZ%...,Q...s. {..b...8..,T.R.p-.......d.Jk.....(i..u.M+..L;...........w...?.....T..D._.{...]]....06.....m......'..:"..mk(.J...qv.RH..A.."....B..s.T....FG>..}f-.q.(.e.S......_..#S... ..A..na2.#g.UX.[^...V.q.R?)yN...3...Q....;.N...yJ.^..^M'\|.k..E0....fr...Y?A....#7{.9.....q..1..:..$v..?..]:?.}...L..B..'.@T.....3..;..6.B.....i.c..I.g&.8.......^.f}.._...]....DS.......I...mK...B.l.G....?.U.PS..X..gc..".g}..P.6.Zc.O.8.$......)..9..r?v.....t..b.5.....(D..`..!C}...&...Dj.....WF.....-..v.z...0`.).MuZ$..qK..\|.t. r2+8..h.N...My.9k...D~q=.......0.....1_.Y...w.o..XtPP...`L...@..a.Qw+......4...........h)......x.Q.v....]....c..\..^_.....a.:,E.Ab=......m.b8T....=..@...$......H.W.e....5o.Yp@.r...@/w.....@J....O4...4.Y/....u...P..Z.....d%..t.a`

C:\Program Files\7-Zip\Lang\ps.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	8967
Entropy (8bit):	7.33909567894325
Encrypted:	false
SSDEEP:	192:Kca93dLdZdkAVrE+xMTmn1bM1SUSDHayYqB6yiYJ:KP3ldTPVA+4mnHUSD6PqB6yZ
MD5:	1B5ADC2E34472D7668C87DB1CAF725BA
SHA1:	983BB8D75551C45437B4E0C581AE053DF497C806
SHA-256:	B2BEABFE3A9A6AEB8CF21919ECF5C6B3557C1DC789C708370DD316EC4931300F
SHA-512:	478DFACC9E4795F52515B17C97033DB310C58A9228211F8F0C8F38FE13987EB778E5A984A4FCFFBEEDD5BFF14FB8A66E92037A03692B70AFFCE020AFC2984C48
Malicious:	false
Preview:	...7&..J..U`.$........51...T..."...q3.B.........J....'.7_V\|<G......a{.!.~....,...Lg..#..@..F.Br;....;_..mw....cy.[(0............TL...KP3.:bb...V..Lg~...LS.....K..s..I(..^.....=SK. ....\|B.?..Jl.Q..<E.<.....(....a.)G......>w&..hM.....6 .v/e.D..N}..>.......a..X.............tx.N.G...~d..",.t..+)..Ga.n._u.....3.....U._. .H.0f..(.,/.....I...F.....0.Y...ie<..e.{.x...W.k[1.,gHvy}...'.....>.k...".5.h..n..+....c..G.k.VcU..JgB.)...u.....L..U..9...D..[+G.....Q....E.&..W.d..V.B.........C?.q....{..J...e?68$...BXc:.....h..3.....%.P...../e.0....Lzx...'5'.3....._.{P.%.fBM;...s.OR`.nb.......bR.<.%Xp...i.rd..+.^.m...E........6..I.]b...fp.C......]...x............t. .\\G.2&'yx.../M}^.".....2..D..f.f\....\|@..^..bC.n..W.:dF,.......[...".!j`..c..$v)R.+..c.4.....+.......1.p=?.+1.y..k./E.:....yN2....v...g<B}.#........$!.[.M.....'.][.5h..&..T..w.GM..A...3..]...;..........?~..q..o.z.R.1..u......E#/......q..m.a...6Xl.....xVL_z..O.b.....<.......'.......?v.

C:\Program Files\7-Zip\Lang\pt-br.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	10250
Entropy (8bit):	7.291652120343214
Encrypted:	false
SSDEEP:	192:KHb313QgHig08dgKXqPKYefobQqfaaNQuG3:KHb313xLTCzPK/sf5QuG3
MD5:	FA77ACD3619A2E9E588D795E4F30FCA3
SHA1:	E70BC118B76669D732DDA0848A080271C66B65ED
SHA-256:	81772B36060F87A3DFF5D5DD753DC33CF14E78A7FD53B76C4DC49ED9B3D4FE07
SHA-512:	B597DD1FF3305543F2F116E7B3B348BA28138B27976C042B0F9D235CD794AD4680B645EBDE2395EEC426EB4CA19CDCD77BE18FFDE462C9C7A2CB3B76F9415BDF
Malicious:	false
Preview:	..~....n.F=.....\GF\|.w...0T.M]..Y.....zr.A.y..{..S.8......U....X.cD....z...P....N..G....q...K.%@..Q'...,......}.0.s.......e..D....lj...o.dVE............)..h./t...V......,[o.......g.d.I,.=rZ.........M4..5...../..b.o.............a...'d._..u.O...Q0M...e.....2n.1.:.....P.9.....v.a<.....^p....v./..4...;.`..a.\|\|..]tw..%:.l\|_a.4.1/U..5..<.i...2..".Wq..d....[S..>8..!....H>,9F...!t..^i....e(......."....7......YZ.S&...;}9....t)B.0gC.Io.'<R..@c..>.9..d....i..i.P+.....}.!.....yS.+:Fh...@i..........?"..0.........;.Jvj&.........$.....`..%R..7J3D....ujy.O.A.....b...<......XJI.V.m.3!..}.QV......1..:..c....".-.J#A....K.....9....S.-cQ.X.}........^........I...0d..i....p.j...Kn..z0(-.........W..BU...vu2..k....7.U)'b..fD.Asy..s..&yBZ..b.#x.j.l.d.z.4.7o...iV...H.....}6.....:.....Q.9....y..$D5?.w.c..9VxBy...(J.4m...0([.a......g...........L#..r...4.#L...X.5....C..?-..9..K.....b..!"L.iX.,...3....Z. .j=i...WL^$q.9...P..\|,.W.....cJ.EL...}G..T....4..T..l.b)s...;...b.

C:\Program Files\7-Zip\Lang\pt.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	COM executable for DOS
Category:	dropped
Size (bytes):	10216
Entropy (8bit):	7.286907595540105
Encrypted:	false
SSDEEP:	192:VhVJvAIoPBDli5Ob5N9NSYajXnj0aQ1KXqIoTB8mrN3:VhVJvAIoPBZi56NXS3jXnj0aQ1KXqNTt
MD5:	B4201E9C3F9B3DED43B073B5B6035661
SHA1:	666B6199A2AB71DB2FD93E26C64D8C7256CF0B22
SHA-256:	1F949AE2E8C861BD52F25186396DB88238362BCA8CE84AF25E74F980B996FE19
SHA-512:	AEF0507409F75F66A2D322E0D350E8E532E335B0C17D64C8530841B90AD90ECEC853F35BBF1757C7CDC3AC4F3B9B3497F11370BC6E2724A0CCC69A0402BC8B8B
Malicious:	false
Preview:	...YP..].?.,.3..(_$..q.....!b.k..[N.t.{.....j...L.W..@..U^.\p.rW.....^o.L.B.M..p..X.z..e^.a.Q.#r"..'..KEu.2.U....Bk+..ug.....l..5.le?...p...Aoup.~o...7y....GL..h/..E../6....g..?....n.YEmt9...d)'.....e....=\|.....2.8.d.d........Z.Np...c\.c.m.X.C.!.I.z......kIAW...>.....;.~..e..........~tB#.h......0B.....,.).h..j......az..g..-!~T......-.........m..o........q.0.J/.j.k..$n&.X.).3..a.Mg..N..p.F.osUa...*.TA.\.R.b..(?.......K..Id.s..X..x.z.=...........h.{a....le....n].Ss.j.N.]...x....4. .,...U..o..w....=.........s............d.L...^.:..m....<.S~z..BO..A(..`h....w...9.^.a.....R. /..#...x..).KS../,.......i.`....a.."...n5',...(.,fz.0\|..8.9V.4[X..[..9...o.f....CJ..\|....Ob......5.q.].....:.K"...B... ....F.g@V..6W...PX.....m[I#.....CQ..P..6.1...`.=......]...m..w.M..EM..Gx..,....9.....uK...n.......&....G....p.U.goa..4..Gs%d..i8.f.F.9.....O....?G.>.p1...?.M.(...G.........X...`W._:....-.v17..s.......U./.......)5...-......Z.]r5.v.o....Q..........

C:\Program Files\7-Zip\Lang\ro.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	7900
Entropy (8bit):	7.609416700872363
Encrypted:	false
SSDEEP:	192:ylNTVdbwb5t0u95kzVPmcl8H2hbo8GGqZfGPC8YiRVCP97o:ylZOD0u9eucnRQuKmKP9M
MD5:	6E4D8E71B8DD50BB25681505350F062A
SHA1:	26CA0315E6194757DF2E00EDD48C597ED9AD4A61
SHA-256:	4F6B9E59BA13CF5DC9EDB1DFE802282D4222E73466137E2E464319DE37D52ACB
SHA-512:	AFF35BF6922F019DF4B3374480DA0B07D8D0F7356F173F1CFE669C7BE7B9491C5C61846D3AD97A8F33337E8B86D95B28A85918FBDA216A2D18B670E6C79FC1A3
Malicious:	false
Preview:	ETT.w....L......bTl.l.m..JP.q. dQ.....f....."..g....YS....s.?.X./"b\|.0<.Jen...9"T..y.y..y....W.\|....K.S../;..z.K.Hw.....uo5w.....I... #D8>}..J.J...,g....y....5.Gx..pa.U..........._.:.@......OLM1..naF&....<nD;nv.k.u.R.]...Y&.e..w....].....y..5&...<@..<.:.0.Ww..Rw..Z..h..(Uwz.N.._./...q....Z.k!k...w...6q......t.C6!..%2.H..n:9.!..ay8[.?pV...3......{...l.2.oK.~N+F.}CN....8.......j%.\.&$....j.n..1.....>...$.3.m..y8\|r.W..<p....S....x^,..<X...`..L.N.E.u...Jh,..N...@.B2.;\|@.c!i...~..R....L\|g.......@_\|.Nb.\|.Yk..&.$...+...{.+%.%..CU..](.u..Z.Tjo.@'.1..\|...a..U..f.T.-....W..[D................q....2....wH>.&...(.....1.&d..k..G.}.iP.....}OZ!.....>.a.2...6..ma6...n.....Je...-.'..W.T$.a.7.+.b...EjN.a3a....m._-.C...f.N..Z..pn.H.].D..)D?c.%..H.n..q..B...).....k.....f...C].N........*Z8K.y+g.X.>6..V.=.....)..hw..Ih.^V...,.G....`>.,)Y.ceD.L.o.....zr...o$....c`...r.5..S....Y]f...L....-........:s..#.F.gl'.~.7l...WD.N.}<ci...o...H.].&.........G.. .A...J

C:\Program Files\7-Zip\Lang\ru.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	15693
Entropy (8bit):	6.455200188193261
Encrypted:	false
SSDEEP:	384:Xk6IFMrLVdYpY6xOOF50CYjOL+vZ+K0v5It4:037pY6x750CYjjZ+Zv5F
MD5:	AE816631B7FDE7AD0B8D5683A445D166
SHA1:	E010D54A6AE5571953E3346E2081A122BCEC5C2F
SHA-256:	5419E722C888380675AD08D3EE052E991FEE10CA2ADE42D105A44005FA6E7BCF
SHA-512:	6656B553FDD0A204EA6CB3FF714B26952ABC6647AEC64A680F0E9686CB36E5C02BB689C293661B21285C8CB8E67E83F245F095F420FBCCCD8586D98C6F1F5B75
Malicious:	false
Preview:	,...5......p...:.{<-.PMI.Dd.n...X..9.;.$.v..^.-A^...F"w..j..x).m<y.....T.;.-.u.@....-w..5-..Z\Q.Q?.(.....a.-.=....z....i....n.`1x.../:y..d.(..(.&.c.O}...vx}v..i. .r.da...\|b^'F.r.3.m?......+k....;..<...~fis....v.d.d..]...:`.z@.(!.k!9....b..5X6....'.....4....Y.DOXTi.B...h...y....pH......f..[.....A...u...V...Y.r..h.....r.u....\|..>..."[.@.N#j.e..g...6...$.<.].Q.......{...W=...P9...Z.nun..L.....s..3..x\|O.c.@\..)....w..J.g.c!(/..<I 1..g.....Q.$....R..x..b.{...a.....@s}z^s....?..@^W...<.....K.B.12....b._.[...~.....iz..9ED..@.d.}...]}!(.$..X8,...5...ia.u4e..........O.......b..........-cub[".;-.........o..5K...O..../".F.......9..o..~..:...V...h.%..ly..Q..MG......j.....a..P.q.].ts.E.....^gA..l._....z...6.g.-j.{..Q>-..8Q..S..;.r..\|..z....P.)Z ;#._...(.3q....O.{G...<...:...}>&V..-v..s.0{p...<....=.....m4.......V(.d......{w...\P(.?.ZH...Cm>.i...X.....N.@U.........]8..t.[.....p8Qi..wTl...\|n<.b..4V.>?.w..........u.+d..'.K...!.......YJ}..7.

C:\Program Files\7-Zip\Lang\sa.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	19565
Entropy (8bit):	5.920169069120802
Encrypted:	false
SSDEEP:	384:XiXysrku29esAeYute60FxA/W5FGO3/0F0DvLTgRf9a+yiO5dv5SPwd:Orkus8NutlyYYMYd
MD5:	EE9DB02DBDEF0AB6DF8DE06E2101AF9B
SHA1:	D2DBAFB4C9CBE012F82519AE68740E69D346419F
SHA-256:	91B85CAA01ABB32FF91C711EE2D947D078CA5FAAEA639AAA1014189359BA326D
SHA-512:	6E176F736205FA62386691BD9D77A300BFC89E96C152DEBDD76EBDA180AD9A67AC877FCAFFAB2148615751A6D4884E9C6D51FEC3D998220EF3BD5C30B69E61A3
Malicious:	false
Preview:	..bb<S.uMxM~..:..S........1.e0.s.....4q........l+h..C9.Yh.4...9.0q1.r..g.u...K.qn."...^.M.8b..W.A.\|.....b.~9....0.e'%....j..Kc.`..0Z.......r....{..Q....bw.M.1...r....\|.8i...(.....@...,..Z......X.^h....C..,`Cja.`;.T(z.Vo...H..X6FOF.xc...s.":M..Y.Q.5....=..&..9......u....N.u.P..o..s.bj./.c.R).Ld..K{q.3Gu.7.J...V\|............V...u%.(...i..,Z#....Z.e....R.o..S-B-....t$..C)..8...'.c.j...1[.].=..>...g..Zo..o...:w.........]T.4.;-.r...J..I.....o<og...)..i.5.w.....+...j..n]gEV.,..HGR.v>..6.m..........>.+y..M.3.vCO.5.iN....f...(!).:.....d......n...X..q..;.N.e............}.mM8s!6L>..gN..K89.O.~w.!1.P.(..Z;9....D(6u../.o.8.x.t...x..e~yW.d..}......Rx.y......J..s.O..O..y.w#.dYv6.(.l+./..]&......Z.......C...<.J..y&.........C..X..z..(Dl0U......e.a.........y@...............E.V.....cp.....j..R.l~..B...\..{J......J.M...d.....WJ.......%).$...3..pkh..0.M.E.".......g...t...V..KC..?._P.....6\...D^.]E$@.U.z...z.:oX..MY._..Ak....w.MM\|%%G...D$....H...P.

C:\Program Files\7-Zip\Lang\si.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	19528
Entropy (8bit):	6.055760952383646
Encrypted:	false
SSDEEP:	384:NATSNm2E2YnwbkkI0ak7c//b8hgE7W7rrcJ4XHxzcBoaF19diMu5XdzPn8jCPI15:RNmD2QfL7WJ4raHiMQNPnWh9RU+Hjv
MD5:	08C8E8E8263A20A7236322A1A59E7D0A
SHA1:	40552F08DDDBF6E899D62F4903A64F1FD3EEBAF6
SHA-256:	130CEBFD69E659909B5E075D6164710C12E9F9610A70F804F6B543E99C22B5F6
SHA-512:	C9C7025212915F733DE7EAA50EFDE7B79FA18099DCC9C77E206DB7CD406D462BECFE4FF09592C9B8EFCFE61911549F2D1F67A4054BEEE3DF6383E4F7721EAA53
Malicious:	false
Preview:	.?....P.NQ.)...Z....\|.i.........Y9r:"^...j..Sc...@.....7._#....y..3.-.8...H..&E.(Y........D5...=.6.j&m.7N..SN.......{.z`&v.yr)..D...2h.....{H.....1.4...+..k..K&...Yv.K..e.....^.'),...Cf...Q..E.l_...xs....j.....<...X..`.g.8.......N..PG%.~....3G...l..c.E.S.../....I;..zc.(.8.r...u2...h"0.oi..xzE....W..i$G2@WHe.L.z.H.`.f....4.^\.0.~.,...R....G...5H,[...-p..f&.edq..Z...2.T9.gP..5.s#.h....k4..T...gCX.7..#...Ov..v.=...V..T$....JM..s..`..J.MR...[.O.\|5f.w042^UO{I..%3@'........1.C..D..s.WX~..~.8........Zb..d...O...v..g.....F...-~...P{/8..R......W....90..\|.8.'.d....9d].../...{pH....?A..O.._.....KO[^f.j..;.}.l..\|.T;^.........,..^f[...e/.&....4"..=...j....z.v...R..16.....y}...a^u.3.......o......Z..7/......b(...8.!J..2.,.LI20....Z....%..9J.}.<..r.y..,..4..7.....G.X.....1.t./t..K.E.h.I.`.s..o...k.....O..L...D../....I6.=.2-...p5g..l..p.1.dS.t.fow..q.4Lh....a.L.j:.[...rU..V5..0l.^r.}cQ...#...w.Z!.P.WO.!.W...\|#.)j ..t....<P....u......$..6.o?.c...^.W...j%H

C:\Program Files\7-Zip\Lang\sk.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	9699
Entropy (8bit):	7.464775022235414
Encrypted:	false
SSDEEP:	192:HU7ooBh0uMQzU/rXFKp/c3FkvkvafF7/m0zzqMLFK:07LBOuMO3Zc3FvifFXz2MLY
MD5:	2DC6C6A3E6A6340ACDDE4E14992DC7EC
SHA1:	7E95AF29AACF16E3027215DE6664285C936C6D59
SHA-256:	9526FFB0ABF44C19713341B13B05DF78FFF0704627F9E27D1F9BE2E44EEAF48A
SHA-512:	639B2E40401125980FCF1814696343F90BA24CF0638BCB43F9845216FF95A5B18B3CFF45D382A512C4520D6EB66E8ED341D1DB6F98A6A0FC3626349F03DAEE8D
Malicious:	false
Preview:	<.......@.5..1.&..A.93l.q..w.z.#.V.{.K"..0R...]:..}]$..q5h....m.G.ruc..n...L.n.R..1..C....r....u.....lR.....g..mmor...D..Q%n.Y..pa.. ~..'2.\|....d......0..d......s.AGz4!.....-..E..I.=...}..r.F.....lq@...V.q..q.L.+.;..vQ.....q;....O}......R..5A._3.G.%k._..T...e.L..a.@.[...../k.g %$..9...k.=kB....D...!.7.j.....\}B\|v.~.,..VY.n.....=.....3....).6.q....zK......$.....9.....={..z..S....F~.'_7~...H....b.)..FC.k..NKqR....8...{.n....j...6....4U.R...(......<.~.....i.............v'.M..............os/..A...i.}e.g]Y.."-.2l..?.\|......NE.'...b...p;..7.....jF..`>v.C&....P8=...~....5.GS...0. >L.....oY....\.V.b..H....go..;.X..[.g,...j.[.....T?dpt....pb@..../NaqL....&..).2Z.R.n.....$.^JI.TcO...:l..4.v.A...bd!.co.X..V.S.....3m..{..K......f,..b....k.......ps....KR.O..:7.Rk.JyHcC.=.].+b1.+jo&/...0.U......C...}f.......H..oq>....T.f.......y...2...&.?...+...!.[\.1.i,..3.e...4..w.X...fpN2.cl...S...L..q....t/z....e..6.`'.._.f.I..l.....M/.;..'_..s..'`.....&mJ#J....7.S...

C:\Program Files\7-Zip\Lang\sl.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	9248
Entropy (8bit):	7.4231304388557415
Encrypted:	false
SSDEEP:	192:oWHq3y1NONZX12UrGpqusDW7iKjqkqkZS8fY1oGdGAvu7S+pVsszqrtmXXF62r:FKCe24Gc0qkq54h+tmXA2r
MD5:	DE6EB5CFDC2FA1F976D53DEF9659A67E
SHA1:	A83E25F373EAD00996EEF8D81A780B373687847E
SHA-256:	171D2D962A789E3C65A308C3FE76256D483A441FA314CD1385BC4190A7CE4438
SHA-512:	41F80576153616AC19A9E571002C503F0F1CDF927B83C0C176D45376701228A4A72D6703925787BC2AC30A68C4A08E9F58EB261C35C691552814D4A9379E20FD
Malicious:	false
Preview:	...0U..+...Q.f..D...+..)Xs{.!..l..].<.......=.....C=......'1...S....cG.-....48Fu.Gy.{..;....pR..5...9....XIT.O.....X.~fp...4R..........o`.<=..?c...<..K.;.....<=....+Os..{.S..M.tR+..?.....e...Q..O.....P..Rd/N.A.8.y...%...!U=.R2../hH.y~m1MD......Ig.a..u.c....9m.x.X2I. ..s.~"#.kK-..LO...........%.c[._F/....<.\|...I)..$...0=.;.:.XU.!.....;g%<b.a.x...w.U..aUv3%.=BU..k.).&.....u0...+.B.C%a.+.61<.]u...N..M-7.....< z._}........)..C.h.N(...@L=..o..W.nE.v...XU@n+.k."I...PtX.V..........6.. ...<9\...<...o..BR....6c.`2.%b./#......J"(5..uG.NV...Z..5s.=.e.swG.,...B......6.A.h....?]Q...J.\...?..!.E.....Fl.(.=....q:F..}....lUe{.F..!...d......qD..0.O..&.........'A.[......k......J..3./&....a.....,.Gi.U..v.u....M....).......J0.H}t. (FuV...x.C.h....4]...3..U'.<.y...57.....VM.WVQ......b..S.>2....BA..-.q..-.~/....w....n\..!....w.?..o...m!.......+..R\.Z.(....\i......P...."....q...h.<@. ...N_..&..r......P....(...........j~n.v.i......AN;..K;JK3..[....s.......P.../

C:\Program Files\7-Zip\Lang\sq.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	6310
Entropy (8bit):	7.842530902546888
Encrypted:	false
SSDEEP:	192:0COlWOM0yvmRR9F69mbMHv8JbHEVs7kBttR/JqTz:05WV0+A49HP8FHEVs7kbaz
MD5:	11BCB4B28499506D993B4C7DEDEAE787
SHA1:	972B8DC01AF018445907E9FD502AC4A79A9655C4
SHA-256:	9979851597A86382FC80CA275969594FD88B008F1FFF2A052A6175CDC7D997F5
SHA-512:	A24A37491D5E50092E0B8D9A4ACDADFA1B5E5806C7B1EB156A70D3FCDD7FFACFD7DD9E490057ADCC029D3EBDA2E82582EA201933CBD81AE2E2FEA23299C1AE94
Malicious:	false
Preview:	.`..F.5c.".......C.....R.n#.[..,.,.6kW.B..@..qk.W._.r./..q.q.P4...E+?...;.. .......B..\|^......{N.......+!~..o..g_..\|..c......2..A....D.Si.\|\d..Q..#..D..Ef...N.9.A.......x..G..K......]#..e..[...v....4...j6':9R.......F)......r....r..q ..I.a\|_m.$..).O1.h..6.U.Lt.v+.%..".u...i)...qlN....i._n.r.......,N..q..B.^K....K.!......]H...c+Fg.......$!..e>w..u.......M..e.\|.&G..R.K..N.4.P..=..d..../.5r...Q.+.=.p.qW...=w.PR...h.O..s.....G.g.%.Y..9.T.".T...gE.W.$...d......H.. ....h6.Ts...oa.D...-.."...I.:....j.E('...N2.@\|)Pf.H.,{.2.7....Q.p....\|..6.3:....[.-.&.H.....&..p{4....,.`s....N.D.!R.h..4.I.:..!p........FX..ni..0.Z?...fm..u..*.\.j...}....=S...{=r#8.w>4B...(M;..O..a...=S.`h.H..8...P-.2.Y.............qy.E#.vU.}...^.X...z..ug..~..-..T....,4..2.,...$sn.....hw....V...1s..1)......%.q..?G].NG...=.P.....6.g..a[9qn[cR.>ov.N...9F_ZL.p9..?.........`]..8\|.........z..!3c....z.q.....\Z........[3...$k.'...k.<.....rc..H...Z..A5...'.<o..b.C..i..P\|.H.vF..A..h.X.S.

C:\Program Files\7-Zip\Lang\sr-spc.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	12320
Entropy (8bit):	6.726458484702671
Encrypted:	false
SSDEEP:	192:024By5/NyAAiSf8H52NtwU5od9u3ZPA+sOVbvQz3xnvzeaIqLm3HzskKiLaKbiF:02LKXi52y9gZ4JhnbeVq0zsHC2
MD5:	D77AEDC653D5AC125DDE4C22E6C4D4E4
SHA1:	15999A6A374FE520B88F36FD4B33DF70E3698892
SHA-256:	5B5257FEC70D880EF4B93B91E9640ABF38A44453CD3162383363506CB22617E7
SHA-512:	C1A678838829A6ED64A932A8014CD99AE04500FFB38A99C22807172C6AB84C0E9FA3F1088693604C91D582CCC19224EDC722A3E5F6A1BD48279F6C9385C45F11
Malicious:	false
Preview:	.<xV...h. .....D!.O@.Y..4...;.}!.@........p.u.........^.R..[.......%..R....\..?i.6HVC[!..\..M^..k..\....A.Aa.Pf.......X.9f.].P..B.f.%/_R0...O..d...F..=`N).f.".-..%../q.."....P;....`^~.....AIE...K.'.8.2.a_.R.ur...%G....qq.(o.P......).L.=..?.;\...d.(D+..Z....;0c.....Q...=jC.@;#.m...(.Q.G....J....oVP.....}..%iW_.._...,H...:.\'. ....d.....\|.n.+......z.!.9O.&.. .C.=..pDy......?.....Yn.N[.Eg.....wl.@).......l..Z...K-b.....st....D....2% ....).T....x.K%... l..Kc....0...~...~......;.Os...B..:ki.+.4j..1...dqA...Tv.D..uX.Z(4g....1:.;.......c..:.}s ..P4CU..$V.e.....4hd.\.......X.i..Qy.R...E.h.~.B.pr...._%......O4.~a..6.Z.3Z..a...q....."]!.1!Q.8.......<$.iK":..<`...B.Y...9....1..h2.N...D.....e3....d4u....{$4R......C...5-......"?(k.......y..~.7...<..M...u..VH.e}8.9.\..P.9}w.bkv...?.....kK,..[.s.W.../9.T...u..2Z...R..Y..!..E6\|-G.V.....K8./.....92p.hR-..[I.Ho.h.*!.Y.[I....]\..1....Pc..5...<..!E..,.@..s.mQ?.M.o...w....c&C.......+............cU

C:\Program Files\7-Zip\Lang\sr-spl.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	7496
Entropy (8bit):	7.645189584470158
Encrypted:	false
SSDEEP:	192:Ax3z9fh9kqP1+F+8wjjejQzbgBOzeVOs8DmXab4K:Ax3d+FS6QzbK+GXasK
MD5:	F3EF35953AA7FF8AD716692E4E1E3942
SHA1:	77ACF63B1864771AE8D857F746B816D1A0FE5A6B
SHA-256:	4446ABCEA4BFA5F7D6A1AF3B13CAFE123E4826AE09DE5006E539D024A0160EC3
SHA-512:	07FE395213E6366DA297F9FA9C04394BEEBB27DDD7285D1B122EB4D2B1FC1A1B7C06E210D1E81E938EC504F7644648D92251D122F56384B2425197A09B4F468F
Malicious:	false
Preview:	.h..Z-3..p..bg...6.A}.JzH.z(4">.q......r2T...E^.7[....Q..qh...J..JRw.a..E%_.3.E...+%.m^..k....W...Z....\|..N..-.V.`.t.x.N....z.x........z..o5D..>........!.w...k......<.v._......W...J.?.OC3...[.i...-..R8id2...d...+`.(....8a.}a4X...j.&..(}depl...S...W..5qb...R.F,P.u....J{..cC......k...k[U>..C@. }(7..Y.c.....#I...+\|....{6&.k......q.R......h:.Ek...U.........X.:.e...I..1.}.)Y_^}.....U.r.i'..?(.........c..f".g&........#..oy..[.Z..!.;....n.%i.l.=mi8..6..".....0b);:3._Em.l.R.....H...'U.H..p.<...BL.e.K......9c..l..<_z...;....T3S.......Zns7.)h.F..5......t>.V...Q+28k/..w..u.${..Z.W5..Hd....7.;r...p ...<..+...p%9.....9.-@.zv.....v...h.V3....tJ.h...H/%N.9.O..6wE&.A.j...x~...!..@.4.Y....T.)............T...T...=k..MU(.K..Yp..;C.-.......o...2.R....8o.........E"y.........`.t.6T..ru..e..oKV.Ao.....j<.....I7;.....+E...I.3....\...u...Y..W.na...\9f.........ZY7R{9ZR...h.!lD.%I./..L. %....}.LVg.t.3......]..(6...q$...Oj.x6....!..Uq..T.P~Q/3..aA[&

C:\Program Files\7-Zip\Lang\sv.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	9552
Entropy (8bit):	7.378362838169899
Encrypted:	false
SSDEEP:	192:wM+e0GIrgv8vQ/QZqZh2gDt2cSsoJ9/FLF80Y620XxHdfKkSzuQM2MYilbm:wMl8gv82QIZh2MbSskFL+0Y62aHf2yo
MD5:	CB18C7AA5AFC6802CA2A04CF32D3924F
SHA1:	45EF847EDF58B43B3A450F2A093F617BD5368117
SHA-256:	182C15289DFA12293538506B7D6BD791D89B7BBE6B88457B8A4BFBDD3953D666
SHA-512:	E35E62545600E45CAF0D5B2BAD19F455F522FAA412197285056DD32CEDF3079B050F6FF463C2F76CC6314F1421904B06F540EA04ECE273654BB1AFB35753D353
Malicious:	false
Preview:	.....t..Ybb.n..at.6..X.....{.D(.aF 0.{.wR.....p...5.....~@....,.......s.Y".p;.Le........9..&Hq.@.E.{..].yT.......0..N~...sv.l`_.D.A1).ue..y.....s...E..<O...@.......r..\|A7..Q.q.YJ.:......y1~.{...lt.v.......M.`u,...vm.jU..t....G..eh.Q..)./....\|.'..Zk.k...."x.@R...S.m...i..p...o.e<..%........S.....B..0...k!.q....+8...'/...GTV....C.\|..P>"...!.@.!.#.&E.p.m...J..E......[(.......1..#S.o...0....xm..p..[...`....M..qS.7b....7..........Bl20..7......N;4.Z..90...s..T{a..s..r..~..... ...X...c...eKG.Y2.(................<s....v...DO>.&n..Yw"..=.....4i..Q.....9.H.6......-Af..].....m..Q..Ue.......N.Y'...C.)N...f... ./.p...D.JUl.........f.yw{..R.......q.&......}.v...rl v=~.`9../.c..3.^.I.'*..kLy..Mj..W....w.....F.eK._...0.7.....RD...%.6P0.{.gB.....V.2.'l8^.^A.(.\|vL....V.P.._r...$...w.2.8.%..ro.;..d(FU....l.G).....a.6....2..q.....OOz\ef...J.m.K.)..6.0..7.C.&..).W\.....+....k...._.....u'...........1...F..?>.....#+.....H..7!.f.X...S..>.4p.(..K.D..

C:\Program Files\7-Zip\Lang\sw.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	8861
Entropy (8bit):	7.394635429742353
Encrypted:	false
SSDEEP:	192:dbQ2g87yE1RIb2dKhTIYBpm5E1ZtL9WC9MGM0fXxlyEedQnGzPC:d+8RrdKh+E1/c6XxljwC
MD5:	4C948A13B2BC15AD315D36B6D141BDE8
SHA1:	22AB4C2C94FCA927712EB3D5A34DE058104A7726
SHA-256:	603BAE3D0523649E146AF74E01A345724CDD70E20EBE54F4CC4CAFE2E6E22462
SHA-512:	3AA9F584B7D6FEC8FD1F94E7C23B3043729E8C53CC28ECFDB1FF89BEE387CBB82A71B6D8E02DD7DCF2B0153062F03256EF0D05E5F5F3CE440AC6A303DB826A30
Malicious:	false
Preview:	..z{....!F.{.&F...zXr..zY.p..-R(c[....X....d..+D.1...rI.l.EP=....1~.#.iA..s#..b....p~.....!.L.4..).....z..n3"j..WA8..{.?...)..t.x....7K=c.c.w.Ka..........ZB.a.1&...'..'Kk~U........~..H..g...].....kk.... u@.:V...j..kc..I...v58.aO..._.........x^....\.R.:.........R.h.\t\.m..OD]..y......3l!.....L.....:g+...^...............\._..G..[...T{.;...3.....T\|..-.H4.M..#.....T..Z...cYC..E.>.h..]....K^......\...4f.....G..u..M+L....a....$In....J..W.>...M.....kR-...@g..A$....+r.2.\|......).ru..6v.&#.r8:.n.T=\|.......oR.s...=\|.f....BJ._jp..t......M......G.G..A).lw...f)I.p..Z..>c..O.(..P.....Y.A.5#..=."r....F?}.......e._ .`......A...$...........<"u...R.../.7.f..5,..p..&.$[.u.e..4.5..8H5.D...i.c...."..^.M.F...u..w........r.M...u.1.`...Zc..5.i.fS.SW0\| O.P..]6&."-r.jx.h.js....7.Qn.....;....h..?...WbH....n_L..p.R........O.u.f..8..[...&0i..R~..Y...~T.......T.g....-..q.K.PXI..;r..,..(........'.....NX......f7O>.y.i.wM...g82w.$.3.....sMOhNY...r.....#..TX.TA

C:\Program Files\7-Zip\Lang\ta.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	12788
Entropy (8bit):	6.4841993866908405
Encrypted:	false
SSDEEP:	192:ao8hrz4PfBqS4UwaAGBzlbcHAIZY+rtkp6Pnbuuu7+ARw4oB1nfhT5p:azzufBQahlIHL2p6PbJyE
MD5:	7F1EAC325E97668C7A80F04A68B0BBE2
SHA1:	5DEF558CCAAAED0D07AF3737879C04F41C8BB4B0
SHA-256:	7B0D462CF9678B4C951B4CE2ACE368AA25E032414C0E92E73395ED7C1FA604D5
SHA-512:	B2AF080BBDDE38BDD9F5F97DE8CEF99E536EBEAC7216017EDC1A9F11418C81595AD344A9ABFC2193E4F8F879926A2A82EBB840C40022A68A3E7BB7EB65189169
Malicious:	false
Preview:	GK3.....=..t..v.r...FUn.'........'.'..l{..m..%C.kB.....v......S..d2..+...o.......,.......{i.}...............C.L.)O....LC"G.p..^.3.L. ...h.j.g..+......\|..t..w.........qx.l.....M..S.~RYE...j..b...g.&..$gE.s.SM.j%..a...Z~..y.#.d...d..te...a....E....T...\|Wi.jk..h.2.....L.,T.<._#....6..._"C.o...C....e.....?.D.%.+1.t-...w..fyv.sH.{.O..[].XH...+r..i.q..s."..y.1i...Xb?\6G.....:a..o.\|........rt2gl.P>.Q8..uBd\..".^xx....C{..8fH.k.%.`l+aibWv...#...(....+.3....!.FY.=...8..I'x..~.;.KD..9......R...,.i..X.....j.F....'.YM..e...>.>.....O..A...R.1f$l:.%E@...M?.~\.Kd.oU?lF..y../05:/.;..hBY....T..o.H..G..b.g.8&7....m@0.s.'.!.-..c0.v .P.I$.....J.~....eo.."...\....4-.#....E.o....G0.2.~.'N.2s,61....ET..Gc......Te.c..m/...y...[OpF."f..{.F.....uC>..L.5.'..cA^.x.....1u..FV..W..o.U..f.3....y.&yhf..D.zf...?.fXuG..[.4.#......G.7.>.H.XQ.3..B.&...f...)........L`!s=.B..oc...k.#\|...Q..\......5.>..5q....s..[..c..:.......rvA.w.FeE]aT....j.. ..'....V..`k......._..

C:\Program Files\7-Zip\Lang\tg.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	15454
Entropy (8bit):	6.4806237904356685
Encrypted:	false
SSDEEP:	384:9IX2OCQ2WsI5f8ERFWU3oyTceDyGd/F6vRllqzDu5Vz:EpCnWsIDFWU31TPOGd/GRlluS5Vz
MD5:	0B3FDD880B235EFC034F86691252784B
SHA1:	F14285790B5689A102888D2D3709FF80965147A9
SHA-256:	E5458C6F699D4FC6C87F5D2AC92F9F21ACB5606C8FF9C15A69347A898EFEAF28
SHA-512:	400606433B8FBB6783963707048EF5817466561F081B39B6B5BA5BE82BF559BDDA7C1C980F69A07F801F73307E244824B9AA99C85C76F919E992BA913F139352
Malicious:	false
Preview:	.%.]... I9M.....&....H...]....R.L..d...Z .$..G....._..8.....]..J....t...f..ok.......~.QJ..c.S.!.....T.!N.....#...g?..e........j._.>....}G..f.Q$.... .......i...z...k..........I...l..^.P..YN....Q.e...h..F....o.@.n........l..N.2.%..\|.v..."?.x.g..O.<.........w...(9.....)y...zG......8..pw....Tn....c...f..8._tq.D..1. .~...s8..]....7?'/Qh.V.T..t...,.e[..\......~.....~...ls.[.a._@a..V...>5.5......E.73p.e}.B.. Q>L...~..T...+>.o.....%...l.....6......C.;.,%.).{9.....x..w.7/.M"CP8.......g..4.^.U.&.W1 .0...8.......B..d...Y.M]Y[C.f.W'I.....2Y..\|...UY]....$....<k.{./Fi...y..T...#-.....'-s.=..L.u....c....w.A.f.N...,3...h.T..'O}..)..`..u..."..~A.T3.)f..tZ..#.'.i...?.....+G....'j..b....3.5.Y."...`....%.(Lw-.v.....Z.O.\|......'.y..8..."..,....Q....-.'.. ......n..#..kP.R...7JN.Ad...kMs......m.....:.w.26.z..E../.....E.n..'.>..y..}...U..b\......CgJ.+t...;.N.....%.7....dt.1a.a.in...K..Tp......r.R....Tx..".......m.6.FD_.fR...".x....%)..._...jRu....

C:\Program Files\7-Zip\Lang\th.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	16181
Entropy (8bit):	6.197046346678615
Encrypted:	false
SSDEEP:	384:qD6U2RnY0lPD37TzsPOYfHVheXC6sOwjSPqIpqINAgf2JS1W3FUVhmZm6Fm7YdGo:qdUD33zsPOYf1heXC67wjSPqIpqINAga
MD5:	E3C31ADAAA0AB1E126F766C236969C4F
SHA1:	4A14C12B06682BC615D676F11DA2405CC5AEA60E
SHA-256:	53E7731BD9D0D412386328F39C75E4DDD15348CEDF33971E40BE02DCE7596099
SHA-512:	FBC5BCB43AA8F9C5471805FC7BDAA70EF3BB2ED00DA23F80431C5F32067FF6CD88A04BE3B877573A4F57DEB67AFC68BE56A79770021A6CD3F1459E146F9ABA25
Malicious:	false
Preview:	F...&...-....4.^...Q.uP.M..1...@....8.B.&{..L....iSpK...} ...y.....P.}<.g......+..E.t.M.......WGP.Y..Z.J."wA.#O........(X.z8...m.>.'..'..kZ..kj #.1..t....3]s@.)..#ou.......9....c\|...\l..B..H..Fj...R....LLrF.C@l..-./SGt!.bW.6...w..\|........./ZF@.`.l.\.?.@.3)...y.8...M...Y..M.4.6.'!......^../..."e.7.,..\' ..)....5...Dk..4%...:8)b....xw.2.....9W.O.\..'J...=.@iT.i5...1.............19v..\|-....(.s#_'......s....r..z.^Y].FG.u.r%M....G....% ....%......J..... l...L..i.....h..:j....s%.G./!..GYTK......U...my...n.^...-..`3...z.f.x>d...T.tl._.'..B..%.!.....6.9`.m...r%.e.mc~.5-n..O.h.............y2....$..T...l;.........O.=xymVl.............Ld..ql.Z!...^...<R....9...y.[i..v..._d...<.L.~a....UB...+$!...e.<.rgKa.-H.F{.u.........6.z........~..(.S..F4&....I[5..L@0.a.=. .(.W.$$6.{o1k....6.f......2.....e\M...V..{;z....AV.1.<iF....eB......m..K.x.o+.m0...D..C..h.....1..'...Q.{S..?..h..._.;...qH.....!.`Zva.....b~.9..+...i....i='......~!0Z\|.. %

C:\Program Files\7-Zip\Lang\tk.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	9558
Entropy (8bit):	7.435356620503375
Encrypted:	false
SSDEEP:	192:XaXYNr3Fo9dXidR3cb5jrkLPFt8BJzVIjZX6dYqxMhQxXDqiHv:Xawo9dSdMxmPF6B9VYJ6dYqxM60qv
MD5:	083A9029BE73821DA5ABCB59D5F84401
SHA1:	E7C803B61E8EB2878D34BB36F45E248B2E4A6AC3
SHA-256:	B435E04D69B44825C41E517D9337E895B269ADB39D15B22E5B84A72DE3642609
SHA-512:	2D4DAB3DDD61ED22727C35F2F862008F73B7F033474A30C567F74FAC548C477BA15C476CD27779C005D1D6BDFB82208B7DE62E5BA914000FFBC44BB355F271B9
Malicious:	false
Preview:	yv....N...p.H#yDA.i.{..]..p}K...P9Z5.7'.`..[.b....b.h1.s...1.8./.L...........kn$..a.4.[L..G./j".q....c.8.....?............q.#..3.W....K.....\....p.>....4...N....nZ.1.l`...?..bkw.\|T1.OY.#......d)..J.6./6B..i..j..</PH ..j....[^....fb...k.^R.:...mnO..".........f..0.h.<..h~..........cmLt............y..........q.A...7.f<..u-a$...[.D*..r.z.7..24.Y.............R~T.(]..0.I...`.ql;m.....z.....O(.".S..$.r.z.2..k7...\|:.8E. ......K.9.WvfY....\|lw....6&.<AN...T6...?L.In..I.m.NJs.....T...I.....K/...\|.zT..;.p..-.=.Od~.....h.q.".E.Y.F..`....5<.l~..k....E.....,.Ijb..k.....:'.".I..d..>,..'.T..&.'..........T\|..H...N{..1<...%..}{L..lY+2.F....O...V.0..+j..p.}......w.C......H.v(..>P`TY.<.^`C...f.#..,J.:>?...+......zD.9....:N....;._:.&.\|.i.....~j...X(b..m...N.-3Y._..j..N?....D...,o.r..+t.^....\|.k-E...y..d...g.?M.A.(7..Y,w^?..t...\|)\|W4.R'...C}\=E...a]H&`.v..Z)@f.Q...u..oC.!p..5(...Q^......)K...8..A\M.E....o^..h.H..i...c....3T;%k.`.G..4.4..B..pf...A.h.rY}..5.7

C:\Program Files\7-Zip\Lang\tr.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	10174
Entropy (8bit):	7.3607908397194715
Encrypted:	false
SSDEEP:	192:KscxuyyTv9gN9AaRKT/PSD6guNGSxLH9228ULfdQ46RU956daiwacCa3:KqyyuN9BG/VgpiLHvxQbq3
MD5:	8C42B8B308A7049B161DC64F84F58453
SHA1:	4C1D83B93CEB7B579F8A26D31B66B98F81B21E66
SHA-256:	0D86A65CFE83B302701A48F25946DC855F675B47BB836E225C4BCC04081E0E7D
SHA-512:	32398F035229A5D4ED82E0BBDF1E1F7D42CCCE4356EAF214E3104B8270F98986E901723849E0B4E9B1D1018138788F714B2921C67454652A5F07F00FFC075142
Malicious:	false
Preview:	O.>.e...]^.;..)L=.H]....4.`G1...SY....~(.7..S g.t.I..\...`..../.........:..VZ../.LL.:jzE........j.n..BL5...#..0...'. .gF.0..F..:...1.Z.@..QB.aB...~...v......qg.4E2Z...>...(..^.y..i0..c#`A......8"U..f..L..~5...((n.'.?E....Z.7.dk[.j`..X...8M.Z....J.s.....n..W..b.j.<.\|$[d..F.h.X.s.2...FT.W5........E.....R6.pD.].;..... .'X'...u....M.6s.n..F5.ho....].)iW.`3.7.]8...6i.....Y....0.?.o.....v...p....@:.5<v..D.hX....p..8g3...w....mc.O.N..(f.t...".mK6.gvR%S.4H.-.!.JB....2TBr...S.1D.W\.\..oD+..C......5N...x.\..i...MU..a..g...O).`S..../.~,...Z.,<y..].nH.8h3I.o....n.h.[@.....\|..<.n.....9.Z.......-F..A.q..G...p..z.U.3.:g..`m.[}..I.......Q...f...$&.p......p..7q..r..Y.{...h.b...@..sbY.2....fn...D.J......i.....d.U..%vH.j1+&....(..>..e$!...B.5.n..F.'`i.X.....h....#mB..i....!..l+..S.}.p.V.Q,.y.%.......NT$..."k......Xg/U@....+K.E..q......e....rk...l'Fx..s9.KKg..d...W.g..V.)."go...^y.._$.rB..8..E.Z.:El.\..7=.-......Fe...v>6.s..:.8.Q5.E..W.<_BY.....V.?p@....

C:\Program Files\7-Zip\Lang\tt.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	14528
Entropy (8bit):	6.665855658427258
Encrypted:	false
SSDEEP:	384:7GJccPaUOqBfIV3cFanqd1u/o9Kqa0B9bp9GSLO203a9JA:7LcPYrcFMqzu/o9DtD9Ga9K
MD5:	C8A0E1B928B816735AA559200AFD7061
SHA1:	1D5C9F825E2C948C05F34B8540F6D6975E1F4B79
SHA-256:	6E25BBF547E5143D262E9B961E61CC824D8C0C94C7A3E96FE7D3D26BBD4C6890
SHA-512:	D9F321955192394E85C7F2173D15B1C3E3376477164B4E254B8295B2F50E69E9BD3E28669A76D6A25D94EC91A0CC6409AEC16057498C762E292D66EC13D53545
Malicious:	false
Preview:	5.O..ov}y...x..8..5(...!2.........i..t.....}9..=V5.f\<.......L.O.....5=.N.m......c$.....?.........6.nC(\{.B..Q{..Us?x. .($.&..e_N&..c.U.w..,.j......e\...PM...l.76S`...&.F.Q...z.U......!.RrH>.2u.`_...8.b4...h........1...DP.`....)w..z.%..R.\.P..\|.8Z.'...CLSg.A.>f.;t.SCs\|..6.U.q....Z}-kPz..XD.b@.CyH'.......P.fR....2..%...&..,U.+.Qm.6P.......... ..N].WT...C..(..CZ .3....5-w...#....y..4..k.b.o[.$[5..]!........x...>..z...#-...p...A.....k.e.<F+.k.....U..t.+C.?y.Kf.=.g.w.l.o/fS...h...v....9m.}..0j.....Mu....w,...>[q.o>=^...s}#r!.)a7_v?.n.\x.&8....`...y..F3.X....T.f.Z..;..c..m...1\..~-.....f..s.C.X....6..D9'..%.S..w.U.\>..%.-j._KB"Y{Nz.....G.....: ..%h>\|.f;..#...`5...AWx&T;w.../L.4L.k,.).S....P.'.%+.?.G..Qg9O.$O.Mg2yD..qJ....$...<.~U..............e..f...gik=.\.$Ave#.Wi.\|J9.J1.:e.=.....x..........'.$v._..,...r&.x...S.s}^....h......t..q....g..i...A.L9...A.W.0=...`xY.o..N.)u.o..Z.&...[....'..<..+4h.q.n..Wg.CQw...Yr..%..e+.~K..$5'sF..Z ........

C:\Program Files\7-Zip\Lang\ug.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	11713
Entropy (8bit):	6.977423210792847
Encrypted:	false
SSDEEP:	192:N2P7t9LokHOX9t9b7VALMLT+eZT2UZirMCuX+Nq7YsXDL:NY7t9Lxs93PTPZU0Xeq1XDL
MD5:	AB84C916018974C02868C4C0CB324143
SHA1:	8E64CBF9658D9FBA82EFA5E86D161946E9E1A757
SHA-256:	07927645C8C6091050EE5289C574C67CAE72E0BB818B0C36154D94EA443FC79A
SHA-512:	909F79FD643FFEBD00EAB9EF8101AE634D5D084B3D55AB9DB85B7A0FBDA78D7C31259E70274F4D2AC9A5B88EFDC23AEFB4DEF720D183C237DA3AB5DB33022740
Malicious:	false
Preview:	.......@.&.1.&g...~:g/8x....nr.....iG....K.4..9}.o..,.z..Cs....Z.3..\|..,j...F..6D^....5....}.K.O.T. rm.X.Fid9..^.`.P.....~...f0.?...I!..h.............FV2...1M...3..a../%FE.ie}r.C.[......K.o.H.}-7...]...L!.T.../q 7...m^,.[.?}..4..3Ld.[...8.!. ....T.ko:Oc..7.]......kbm.@4?.........y....05...'M..R.1!.x{{x....R.....%..?#.Z..K.........t7"B~..,.6.2o.._.).1.N1"..j...%..2...SE.x-<U.<.n...%.:...<TP8..B'}&.a..v.C.......{...yw.M.e.h>..e.+..Z.GKP.T...w.l..m...%#..yv..c.u..\....=...?9..FM...2....4..Zz.......7.0g......a..v.$.$Q...s......[..<e:..A..CC.K......)..)c......k.u.2A.x.......a.j.v.R,.X.!.n."udV.<..C.,6.......'6.......1..e........q.iHx.=_.=....vS,mFJNr....g...(......}....R.c..`.\|..}.f.\@(.......N.m.7....K.........\a.*......3L.... $.{Q.Q&v.R.T.._H">).....C...x:.9$C.t.RA...K...id..a.j..% wW....N...~.h.9.Z.......\BcF....B.....(vo......:\|..:t.Js....h$.M..$a?P.-#......$..$..T.5.E..z}..).w.y..6._.~.O?..1/ScP..M..}-L..$..c.........q...dm#....

C:\Program Files\7-Zip\Lang\uk.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	16089
Entropy (8bit):	6.44476963116504
Encrypted:	false
SSDEEP:	384:o0T0hfIS9reU7W5bakkb+6tx68cS5SKPEEkEOqoGxX7xFxjpK7PxOide1P:oxQ2Ob1k68/y4P
MD5:	5A50D83995B7C97152C0AB3C5641059C
SHA1:	AF057ED77E2A86ED97EF21AD09FCBEF2431AC690
SHA-256:	2A7050DBCB0D743B235D109CB8F6EB1CD032AFF7E76D77A65265E339803259B0
SHA-512:	D22449102F4E5DEEFB320A87FE6C606A97AA150D27961FA0AFC01F4AA098AF0FAA2937C058F7CC62D0AD8EC1D1BE98EE4F48A5506AA782D8E9E103514315FDE5
Malicious:	false
Preview:	..U&..7.3mn...{..m....\R.%..z.}.H......\|....\..c?0..p..I.../.).+Fl..H.....pF.5.s.JG...C......h.\|.$#r.1.$,..F.U.8.............$r.\1...6...AE..#....#.....Cu..-./.ve....J.$...~.+..=.=...fpu\|..N.}....\.Y.....j.h!.dU;'....Lp.#.e..K....<b....q..X..g.6d...Y.R.y....Y.J.Z[....ZQj..kD)%...........x.,....gP.q}Wj{...../...>.>+....N..c.DY....}Cv.9.].......O0@ X\t....~v(..,<.".".f.........\|...P..Q... ..^0..:.YmC{..\.....M.+..).t.8.u...#..X.....S.....h(...A.._P.W"..........-N..Z.~Mpi....eaWt3;...'..sJ.G..K..$5..(Q..:....".+$gp...b.K..$...D\..e.s.Y.;.u.....W...kO.xi.qg.u.E..+.pO..~.%{G.d.".....vOQVM..s.&saI.e0u..{.S.......DZ..T....z...5.;72.k;.f}......`=.x.w.v5..B..J.+.F.JB...m0.3"\|sK..4...H.\.o`).0...m&/Z...<.<.DU. us.5\|\|9......w.....a.=".kH.c.F..v....t;Z...?.x~......c.Qp<W..f...V....[...}j..O.aU.=..j.(.h...r.K..S..so..ix.C.........k..f+...Nr.....I.".ma.....{P.Q..Q...G.....\|.x...B..l".%...]...8.[.N. .4.r.R.B...<....'.a+...Qbf_ie.$/..sD.._W..PZ..o..v.<.#.

C:\Program Files\7-Zip\Lang\uz-cyrl.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	15494
Entropy (8bit):	6.455628530361151
Encrypted:	false
SSDEEP:	384:FYfghQGGaLFC4C0KkZGmsPhGuzEVd/n/gSfWaqV:FYsFC4tKOGmsPhv2/4IWV
MD5:	968FE8C9C20657022704B3814F355732
SHA1:	E1EC6BF2C99727935C77CF01A0C58EBB2FC438CA
SHA-256:	C85124EE254A12AE3B3744A6DB561126A829663E23E2E3D2A8D412F88294B647
SHA-512:	162AA3BFD14BE028A3B9C1D18590344CB91E079F55DDAF2BD04CEF21643BB2EBF4300D4079447C979AE318B756E82938498B08FB7D6963DCE325F50CD5B62505
Malicious:	false
Preview:	.S.l.4.Uk..j...o.A7.{....6.%....m.7b..YJ].?.>.Y.V(.\.h^..T...S.P....b~\|.-.ww..b.\...F..k...;...w.Z...<p.....Y.X..b.zK.....9.............1.^.,C... ..^.6...E....g.OK.G.....k..g..[9l/..\...+..}.H_...LcGZ.(N....;1....T..J........K.j.:..9...-,.&{7\d......?.^zA`2D.....G.q.=.F.S/..\.R...[.9.....Vx....9o...0'.....{I....fi&......'..T.Q82..o..El.....y...AW..zl...y(..U_..k..g..2...>........\....`W..>../z/....f....<......u...5.+..;....>'..3..%G:..M.a.K.u1...=.......x....s.YOt....U...8.......5.6.4.[..........:.].I...........Ow ..X..E?..<.(>.m+.......s.K\|.=Ce7i.rh.3.u..&...d..V.?...........].=...R....)&e...T.O...v.+...IU.;^...LsSuh...(.j...64.....V.E..<...~..yQ] .rC/0.+..J.E.Gq.Aj1.?..-...`...wh.^..{..y..J.0p.S.5#..2...8...0...Z.H..88.wf.e..Y.=."..E.Q.h\|ha..B.Vy.!/...=.5.KN..E....V...z...".g.a/f...{x..26p=V..@..Y?.@.....D..N........&x.?.!1...2..........7 .U9.:.^.v......DJ.a.Z~.%.`=....D.HHk.sc0.E4.".*s..4...mb.Y...o..t".j..+c...$J...!`..,\|m...m....j\|] .[.JI.

C:\Program Files\7-Zip\Lang\uz.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	9710
Entropy (8bit):	7.377905067717532
Encrypted:	false
SSDEEP:	192:JRobf6ZyaYccIUAjy48UteRcu4pAFxCg8d4/7+2W2DHiz:JmYyHIUK+UuXFE3eTVW2Diz
MD5:	C1F3338E1D8B20E06BAD0E230A60349D
SHA1:	11515FAD5AE3E9A85D98DC2B185112AD45A64530
SHA-256:	BC986C22EAAB57B893A28E48451085DB3A03DC3EA12E924F97375D420A6C914D
SHA-512:	C8CA68DF8E8C3569D1A15D82207E24BF704ADEB160DBA5A0710EAB576C4A7AF9517B84F8B28E834A6F3EFD4E7FB675BAC79C33361AD36ABB7083B0376034A465
Malicious:	false
Preview:	..e.3[G..}.$...Li...kT...........bA...]..<P...jo...3U...CG...p.1.L.X.8....N.I......v.@O.9?..."iA...H..rd_j.G.'...o,.;...H ..XD.....m. ...B.n...U.%#..ds.C..Q...#..\|N`.e\|H.H./&/o.....+.8R..)..0+...........q.k......s8R.z"#F..lA.5...T/..^.U=..q..\|.{k..;...j..n......z...wt..\.......].0N...O.......rD.3..H..k^z2.k..a1o........F..L...Ed4...G$......s[I.J.Q#h%..BY...m.....Wir....^<.......^....L.7......_..&......rH.........W...n<....3...>...6.....p....f^.Y.s.#wx]...X`.P.o .T...C...~G6`15. 2...?.:Pa..1c..a^../.........+...\:..n....9.....{n..E...t..U......~....<..Y...O.\|[t.5.alC}...'.T......G.....M..D...\|.w............cZ.l..1&......V.w..W8....cG....os..3...8.FZ.w..q..%6.4....(...R..2.8..<...Z...L8..xr..C.V...Y.e.......e.?5...P...ys.,tV.Q....?...y.....p....g8.\..O.X.nNX..?...x.F....p.}..?..a.J.or....p..O"...wD.....NF!....P..jv>...,....aQ.......P.>.w.......uN...5...;. kn?Y..c.K~.z. 1!.0}...ra7.\.Z.a.._>^B....J21..J.<.%.HH....6+gZ..Pxu!....L.&.].k.F...e

C:\Program Files\7-Zip\Lang\va.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	6749
Entropy (8bit):	7.773949008603485
Encrypted:	false
SSDEEP:	192:RsgwezcJtLVq8GSJCaT71GHxFjmGsCMu/2cb39v/lGP:SrTLHT71G3Epu/Zb3BNGP
MD5:	6D61E8E84ED3828ACF8A0D25BFFC8E70
SHA1:	4A55B1F21B0944308A5EB5EA9040E7920FCEBD54
SHA-256:	C676C4A70B9CD0D995A9075593D0A51C18DD24FB255A95D35E03554460C8C334
SHA-512:	E6BC9B43511CF5C83EC4D290E55AF2FFA775D700C9B4D25A98EFB9AFF41ECFCF362AE8DFBF99811101D3C38EBC4948DFF34E9D880389ACF2B41F7E278633DB75
Malicious:	false
Preview:	\...vz........o....\.FR...]......4}B..a.........Y?....?.y.Xy`.o.M@i_.T.A..J.)+.S5...<..#..u....A.L.....juh.Wx.;q.."..r....pt`\|.z0KNr0...0^..m+.n.TRLz.c!.!.....].K.;......A.. .".x...o.1..1....qc"u.~I.+7Y....!....X...H..6M?&.....+...N../..a...\|....l.v....dOJ...E.>.d;...... ..S^...y.9...N.7.O/.d.o...8........c..x}......7c7..A.....9F3W.....\..,..52:.QV.W.t-/.REp....fa\|.+tKq..l....0gx6.......Z.....S\...5.[.TQ...oQ.g..jq.....Y...8...^....._-j.V.8.v.CT.1yW.......\|..Rx..{;.......u...{.LxH...?......q.M9.P#...7..[5a.I.....'r8BGx.5......\r...;.#R.A.SI......&?a.y[..#&.B..4..`V.s.....).rh....-o.[.Y./Ja.1..../W.(..i.7...%[..F).2.RH`.R...,....v..#K.._7..m...W."q..m....h=4...u...!..'].....r.:.....g.{X<...^..T.!....U..YP..5-..........]..QN7....>.v..._. .6..........t.yC.k.m.....r.c.....ZA.H.K.&_..j.k~.8.LV.-O..t.....-G$...8..DqG.J.;.GP..3.3....D.....L...."5...7B.......aq.&.\...qzp..$M..y.....gX.N.>I.w\|.B.s.......@.i....e.....P.:...kD[.../&G.].M.V.r........5

C:\Program Files\7-Zip\Lang\vi.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	8842
Entropy (8bit):	7.522643919457031
Encrypted:	false
SSDEEP:	192:SFSKxQjsqvMM1n6ZhEBcXCeiyWxhWCOMFc5E01S3rJds:SnSjPvhN2scXChxgv5yY
MD5:	44BB85CB613D4B4AE20C1271F5457FEB
SHA1:	5E39A5A7B5376CB96F4BE16086C8C6F659E247C7
SHA-256:	D219EE85FC8CD30BBDBE62DED082B00270BFB5780EC61E38FF2460F82AD925B1
SHA-512:	F69F93935605D0E1EE206F17B25152A34C7A2006EC1F8CD1B898044BA94656208F85AAEC0741200EFB9FE254EA2BA2F0D49F63546FCA7F727E985A6CE1BCF814
Malicious:	false
Preview:	Q.;.......8T..8.sNkF3..G.q.u.#.W.;$.d.}..+'f./.Ry.j..-.B5.~.........p.o........$....6~....x....{h.....o?Bd.]-..'.'%.w.D.....S.n...../.u.6..(X..C.K.....\.....t.......Ag...;.'...i\......0.....~........R.>.9,.J5...l=.^..h.....o.g...F=.R....J.e..+...s4k.}r...Dk_&y........2L)..q....S.m]L.j......>...j..k....0.".7.....He+x..\|;..J2..n....[#........u.G.....A...j.s..o...W.....9/fr._.A.q ..UdgT=ETO....!...c..ALZ......1....."...D.,L.$q.@.R.....(an....."Y.)...N...9.h.Y.X..r.3l.cq..x.#...z.`.Ku......&..DQ....<....J...>...q....nw...'sO..W.~.v..Gci...Qk.,@...R'\....zN...<pn....<.h._>tB.0. ./+..t..B.\|...$zX......p.1#..aA..3.Ms....R.8...?.M.4f..'.......:...3.B7gA....X.;.. mDY..x..h>..qs.\.r.%L.S...P.#.t)........g.%..{^...Y.`C....%>....O.......]X.....A.k..d...5..o..$.G.aIV,..5..$.JcT_..U..../.....?$'......T.s....5..%.8......L).+)..Uq.4.y...x.3.^.s..._..MI...7.i....`nAc..s......)~- ...[z.d.[....s.`BH.v..d".....D.U.:-......%.Nu...H.O..z............~.r.

C:\Program Files\7-Zip\Lang\yo.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	11291
Entropy (8bit):	7.2836431104555635
Encrypted:	false
SSDEEP:	192:2JWsCdYmSVjZJeRG8K8Zvyfi80HC3plG0v6qELoWNuB6g1TihH+XUE4zVK1TUARU:oGYmKbeRGQ+0H6PqVNufkBzV+euFzIv
MD5:	5B1DD2869DBD7553E79C95D420BC514A
SHA1:	7EFBBE3FD8A3D6E48412A5313E767181002183B0
SHA-256:	01FCFA5E178BF27470055F53AB313145A2E7DDD19951CFB7C64B6CBEB4E9BCCC
SHA-512:	7EA31EDC939277AE7136DB393E1DF25D1B3CB081C80F032A460D316B1916C4F5CBEE505359354F74B098AEA06C60C04F46E2935F43C8174CDBC5F9D5FB76134A
Malicious:	false
Preview:	u...\..x6.......qf...=-..d.~...<1.l_...p.._6...w=...}..a....]p...12..$9.Q..B..V..#pl...,.\|.L.........Q.Y......e....`.N..v.C=..S....Q..x/...I^....\......A.q.........u...B.G.....2...c....G...:W.....~x...m.X.d......F..Bc@.......).I..V.....J.m\.ol..,.)...8..l.1.Y$.d*.8....@{.i.fcI.gp........Z+....Z...h..:.j.y;.#..a..X,aW..8.....J...;..vS....(0$.....p4.q.'......E.E..8..+...Y....Nu....x..7i.gv)U..6A..f.....b&.(......(......}...4..!?....Q1.R..~. .P...B.#..I../.........z...P......dH..}%AJ..m..z=5)j5<. ..(...^.{.z!...M..{).+#-^.........D..\|.L....8...)g.......b....!..lH.... sTS.4..!.K,.....:...YT...R./...p4Z.!m`9K7...jI..[...'..T.^.....;..m.w.....>.f}.ZQ.x<.D.?'.B.........,.,;DD):.d.vw.7-E.P.....6..B....Y.t/....E.P.....S.C...y.v.......m.?V..d..x"..mwaj..4....#.&s0...).....Dr4.....v/....\|.A.c<u..DUG.....7..B4.Z).OKe......:%..kt...?..C.2...L....C......c..j61...5.M&%...Cd^.o..(.F.,........h.^.].{%.Y....eI"....t.b..:u...cA%.h.~#X..(.

C:\Program Files\7-Zip\Lang\zh-cn.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	8594
Entropy (8bit):	7.666047843295777
Encrypted:	false
SSDEEP:	192:OokQ/KubkAV3I9Xui+mcEK9xYQsVCr6j+vXreAT21ph4Fiu:pXyub/W9xBcTUW/freATk4Fiu
MD5:	87DB522B0D5B475E8442DE021E8BB1FA
SHA1:	1D0EFE7092D4F86E2932405CD6B40CEC9FC3188C
SHA-256:	E58EF1E3B27B499F331B56A0C2168BFE574DBA4D5F55A99EC27D794973ABA9B2
SHA-512:	AA7FA3BB35ACB5DEA90DF481A9FC60D7CBD6DA9212337B19E75A7E45DC956F68784E2DCA422912AFCE54B67B2D48D968E1D67180284BA961C3B7DEC48E2AB4C8
Malicious:	false
Preview:	.8..nV.8a.@..bS...hD...$.l...DsaF.jL.zMePb.v..2Qi&[."....lw.../.k...N..$.-.w..4.W....e.$....O.._..W_.\|..q5..;......=..?..-~Wj...t.U...V.d.n..v>)l..s&......!i.......oa....5,...U.......-.z.F......v.'.(.R.(h......u.Z4.\|..R...n..n7...r..h......1.5./..~..{3j.....?..O...)...w3....s..CM..E.,....Y...D6...."?[...)..J.u%:......\|.Xz....#....(.... .!."a..2.2..AF._.=....Xg\.!.H(..P>Q.ztI.Gi..U..f...kQ..K..3.....e.V....k,...=.d....~k../...3.e.F........\.9....}.@..J={.Q#..k.v...)....MO. .B.%.....s..w.Xp..o8......k.Y6..\.B.q.NF@...ab.....Mq=.k.........J.-=.u..r.M8.2..UM.H.1....S...9I(.3..J....bp..r.....7R..X...u=...........8.Q"f...P8..t4...i6..[..BM.....9..z....n$.T..;.@C.1....'..]._?S..P........%r.Lw,,G..0..(.-.....-..1]eW\|.X........`%x.{.\..#gI........U.!...A`.S:`..U.nOO..W... }.J/7.l...-.G...>..g....Z?.wv...4...;.._OH..'..t..P.......O...m9....2.:S..:..8I.CE.F?;a..}...>.....Dc.X..}...EKf^a..b..Q....*.,......o.TSSH......z....6.`.,1..S..5..m@..?.{.<.i..

C:\Program Files\7-Zip\Lang\zh-tw.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	8681
Entropy (8bit):	7.667752432566091
Encrypted:	false
SSDEEP:	192:fuK8krIYoqCBCPJsyv/H9RKPwxRo7AJ8pGRcmYyBs2U+XdDpL:fHb/ozCPJsyXL+R7t2U2pL
MD5:	634A4C246A720451B668B4F85D1D5CC0
SHA1:	F843C7282C50BC9DCAC03B6595E5443F94D49759
SHA-256:	767C396FCF274196C4FC721DF1FF31CB7A9F99E6A486CD31CB4D78E3F3D3A7E0
SHA-512:	13101DAB7AE8EBD0D33E8AC5C3659127AFA4BEF78281C4DD5DBA1155C21FF783920C7FB00827D8ACE47E834EA0A8A5D0705D49402B0C2D1CDDF54EF732BAA14A
Malicious:	false
Preview:	.. .............C..y...\|...m.".....Q.O..B.%....=.\|.=...-..Os.........$.....1.........v..O...{.."Im.tq...l.S.s..k.X..,%A.\.;..>.X..\;D.............K...Ow..k.$kfk..qD.7.S .__{).c...`..I.....z...............S.s...%.n.[...p[.j..U/....]..i.....I.nG..Xo...!..K..jT...W:.......nu...b,...L.$....h9n8..G.j..Z.......]..N.0.)Db/W...}.~..#(.....x+.x...`..'..../.S..W..h+P..C....C...+...7.u...T...#....)..<I.PF.&...rG......]7.."...q.YK..... .E}....A...!.L..jc.T1..oX..a...~.\mx...3pR<..h.4.)O..o\VqT.@.m...\|.5y...\|.LL...H..4..w.J.L...Ws....4...e...o).<-.....Yoi..g7 ..o.....+y..u...oE.......x.i.....8;......Oh4.7..ad......,.......'b...w.'4>P.OWM/./..c...-%..[..V..k2...C.7k...n......-Yf....Z..Z~..12^.3.....".\|.H.}.... {.Rn.t....A.\|k"H]M.r.\ucG..E..U.. .E.!.S..=...}8TV....$H.&+*A.."fJ7.q...+....U....~.ee@x7..5..uL:.n,Z.?./".b.&M<R7.....W....S$.w....J.r......f.....M...........c..i:#.g..e.... .C.%......./....r+..O.....Q"...$....n3b.......B...D.}@.)\....

C:\Program Files\7-Zip\License.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	4317
Entropy (8bit):	7.91626190201434
Encrypted:	false
SSDEEP:	96:RGk7h/Lo8vrcX2BCdsNs+kl3NOACPxk9YLr0mBt2W:M+/L1D5Mdsq+i9fCPxF08
MD5:	C7EDAA731CF6C54E76BF228E9CA1E64B
SHA1:	E2747875E1E1938FE4B5EB7A891026F583EF4BFB
SHA-256:	AC4FCB7D5A0B2173024EF548C5D92A8A482A5ADD4475086091C1592B6E02F646
SHA-512:	B707118DDB59684D1F61EAA282B3B10724C590975A7F5C2CE8C44B2217D798D39B278C3457C3CA534C5CBEA621BB4E35D00214AE5D886EEC863B290B8DC62214
Malicious:	false
Preview:	.j.......2m....l.#.....j+gKnT%..j.2..........\....g&([#e.........y.sN.D....a.@.l`.x.....J..}..X..U..+.?7.bt....vy...L..TQv:MM..}a..[.6.l..I...F....H..t6.G.P..7....n.E..L..Ss/...\|..Lr.T\|.L.......;h............u6...I-C.\|.T.o{..8.85@.i..<..\.C....C......c.I..C..V......h....G.....N...1.....W....s....y.P`_/?my...D.H...H..e.P.e..m....#m.Q.K.7.;X+$....s..9.,...w....b.L.6;chz.k.`.......D..w....Z0U.S.Ea..3.i^......).p..n..g..y..[......Hw..........[q./... .&:..b..d...VD...e.G...2.Eo....0....H..........U^TI....v.&.?..e.'..M...h.!..#.......K..e.RR.D#.6<.W..8.Fz..T.#.#O..h34K.Z.c.O...zf..!...W..U..Dh.b.6Rq.z..DYg...v.2..cw.#.b.K...$...{P..:.%...<.m...<A....m:@..%.S.2..>.....]p8.#.L.....9..O94..w.....i,`#..t...'.5............Gh...\|.hY<..\|...9../`....m.!....1..`F..Nao_....Aqh..x3mA.....M.....<.sc.i.....&.......l...~f.<..^V%.No...2tZ.7I.......t...X..T.iX......%...h.S]4./..5.mxU.R).us/c..L......1.`.`n.U...X\|.._.:.[....}.FMf+*....K...E]..l.A..Qz..X..">

C:\Program Files\7-Zip\Uninstall.exe

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	15175
Entropy (8bit):	6.602099219561706
Encrypted:	false
SSDEEP:	384:e/zkcAJQFWKKpRV2lAtDETXaa+yJ+M9CbT5/:eQBJv/F4TqJ1M9uV/
MD5:	00D8018BA524D5C74467FE2F9F462954
SHA1:	6BF3FA34F3710E8A8350F1F5A768F51A40467045
SHA-256:	3F6C1F5BC396E3197C18ECAB6BB0D43C3D3F91F517B312855C19E6CD2A7521A2
SHA-512:	B1EB8BAEB2AC6D1B9346E53614206D2F8FBA86BFDF5949C18FE16390501A78AFB2A0D79B7FD3D2233B10E73B12D24FFCFC5A55634817559E68E3777530D03526
Malicious:	false
Preview:	..{...r.n.=..q7.&g.H8.......7.ZO....J#..3..`..3....&^P..t.!.Tx.3....}L....s.fz.P.7..d.G..x.D1...U ....T...5\|...R&RQ'..B.X5...S.QV[C.B.B.;...V./..Br.ye.0..N.@...N7.2.* ..U..=f@..#.7.....]...d.<.x.d.DI.{.../..Y;C.t.R,.i.."...F..;2....J........=.8u.n.d..5.j@7.A..D9_M.......z....N.......w^BK......#PB....G.F.O...n/..../..P.....X....6...h..T.c....\.h.1.....V\|R.{.7...+.j-.G.-~.;"....q..5...C........4q..(a$..' .B.n.z5.Q.k..V.......IsV`....9.5..Fy.wY......D(-0...5..pD.C..$...}..k@.K....E.....7.6.7.....8......(i.G.N.......Z...l.=h8D..r......^..Y\.M.3.....>........:........".s..l.R..n....`........#v\|B.pD..."2..dh..ap...F.>.~..h $......8_...........'.}...V>...5.$.tI..Ef.2....)..Z..w9....o...J.y.0....`.[.A4.....m..l.q.A.6...$D.f....;.E..#z8Z.s.>......Ul..}..R....P........<....."kAj (.A..u6..._.<c.....i..).$;NMi[..~=VN.T_>R..Fx.L.1.(..OiY.r.k...#.....=..j..E...x....v.R..kL;:p:...6.y.....>...K...]1Z.6.........8M,.d.b.N..].S...9*cI..H..

C:\Program Files\7-Zip\descript.ion

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	693
Entropy (8bit):	7.032160477947597
Encrypted:	false
SSDEEP:	12:WTZ2RAWjpUa4hGMfXeVPhJn2IgzLVs86bzevw2f5A1KW:WT2Uav2XeVPH2IgYR2f5LW
MD5:	4CEF9EEBD5F24A0DA0142FC92B8E216F
SHA1:	27434E0E86791D4F552EDB6E4663080B333A413F
SHA-256:	F86125BA33FD19B7AA0668E808564461F312171C24732F9C9B9E39D209CCAD66
SHA-512:	554266F495E694F09D2C10B1D2DC947F07283B17239DFC1905AA4AA2BC557761C64E43BC5D0745E5513C324B2F896C5C220B7CBCAE1B4631DBEBBCAEDFF2F28C
Malicious:	false
Preview:	......I(S...v...9.J.2;%m.d...RC.F......2\|..2..b'.J:...3t....['x27.......,{..m.09.@.RT.H....AF<.+7P...2.\|....Z2..4.,.0.A..g.J\.V.2......s.o.8.5.'G.5.3.!...-...T.l...+.o...?l.b.......!.0q..f.@...........){1....&.+.X?....q<..+...d..w....a{QNTQ..vJ...d......P...X.v9.u.ida.$.!...J...68.l.D....zv.v..A.....#l.Otxt 7-Zip License..readme.txt 7-Zip Overview....j,.....u.c.iRe.............\;..c1.oad.D._4'............?..........K....\^."..f2K..4+f2..X._.lkVj...xG..V.B\|M>/t-..yu.p..QY...\|0I.......[..4!.....e.>~.x...@.Gd.c.I...KQG........4..v...\z4...p...R.`."....................................................................................@...............Y@....czyzk0zzhil.

C:\Program Files\7-Zip\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	true
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\7-Zip\readme.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2035
Entropy (8bit):	7.779496881648905
Encrypted:	false
SSDEEP:	48:HvfvZ/zhCCeoRrDmUfKBrjghKu3cIiPNv+W:H3vSsrDmiKBrjw53viVv+W
MD5:	664FDA0937DF951009CC992A4F29D9E9
SHA1:	9C0532B647149A38AD25559A84C2EBC976DB8435
SHA-256:	6AE0BB8721F305AF08A5BB95196C6549A7D855B66EC5F1AF46AB97E7F476E6FF
SHA-512:	5D1C7DC2DDCE53B2A5BB0FD3114CA76C6D646985C7D6CF4400148254A9ACF006A4C646EFD7F4E26AE6C2DB6FA786AC5208B7E5A00CACBE93E068C958B8EA32E4
Malicious:	false
Preview:	...-..T'.W.10.cKa..:\|b.m]pD....................x....@\...v...:\C.+..........j...OJ.w......2..0,W.Me.....o.r.J...>...F~...0.......x....M."..Zvw..X.e...+S.E7/.D......).\|...1#q.=q.).K.x$........Y.......PE....I.}..O_.....2..>......>...\.5.).'..O.X..1<.J..2.]...J.s...O.....?Y.L.!k.a..b...JU9..q(...k5....(..`........#W}...i.VD..B).8;gI.5S...S/..<...t4...?....!.(..j..\.`25x^X....^.....]S..#u......s...em.I%....i.}/..k...J.5.u...!G....D.N.o...z..~...rY3..A.}........\......C.9)..p.(;KR.%.......y.....y. .1.#>...z......GK.`.O.f...z.v.Av%..fo....Wz.ct.Q..E.......DiV....&..$.......fkr..G.PIv.9..w.7....,7..).A.....%...5....b.......>...4.F..d.[..lG.YA.D^X.v...+.I..?w.`..P[i..8.]#G.3.....Qx..&..QD.7.i/...<........p.MX=....fxv...}9..6.....1..........JX......j~Kh..;....b.Y......3........!=...nh/:.,...C..l../.M.`VnO.."M...P.j.$/...Dq.....a.pQ..\t).....!.@....EU^sSY..R...m....0.Y.+..~h.xF...<K...Z.JR...X....Y.R...K.50, 5...ZzD..^(....K...H...A.o.vo.Zf.

C:\Program Files\Adobe\Acrobat DC\Acrobat\1494870C-9912-C184-4CC9-B401-A53F4D8DE290.pdf

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	187164
Entropy (8bit):	7.978634287844466
Encrypted:	false
SSDEEP:	3072:qYHaMBn8pWeRdeKz10OCzEe5zTfgBiGml2wir2SYgogtWxc8D:qYHa4nsXfmOCL5vfgbCKggogMND
MD5:	DFF10F99140CAE8E748E48719A19C423
SHA1:	EAB5B7C2E738BAC01F182C1AFB95775970D10B46
SHA-256:	97366AB0A21EEC8AF303AA58B69535C2072DE32DAC20797DB284D547D65DD0D6
SHA-512:	D9679B50E1395E1EB4314C2D15B203FBC57FA1836A655F12FB9C13E811BF217963053280FD906043879F06FB482E94E9F9600EE7B4BEB3457BB74AFF454AB845
Malicious:	false
Preview:	...\|.z...rM.s#...78...1 %J.:....=.....Ao...v..$`.^...T.Lt:.....%Z:.X.....Y.FdX.....'.ii ....bPi?... .O......hW..Q.5.W.e.;..V.i..2."n...+t...j...<..d.1m.,.`t...A...._,...%.$..V.p..D..W..f ...&!.....~...D[A3;....=X.K.N.=..........K0.....c...p.R.p.X#a...P.m.u.uu.....GP.~Jo..fD.PJ..H./z..)..o..\|.{Y...}..Z}.Q.}...Vr....o..zH.B."m..y.......[..\. ..F,'.....Z..;Sf..o....qL....H.]Hmr![....D.Q..%.....tY.U..t...B...i8..>..e. .%<Z..Y...._p..o?+.2.?....;.-..C\m.M.?."!..x.".U.s..................[0.,.h..ZwJt....x...1........My..\[........:.p..71J...nuW.....f.v..G...^.'..u.......qY.\|.h..sw...W$.....+..s.....W...)b..R..u.}...q.#.x{.......%G... .;.xDed........g.[.vl...H..N.~aG.Hd=k]..7...Q......\h....:.x...x........{.c.v.k..s..V.......:^!.'...9&..;._Y}m.....%......v......"...WI^......l..%.../.C.7.^...W=8....!.....q...5r..w....no.G-..oj..PZ.>......8....0<..a."...V..+.&.....m&O.S...eCR.L.8..'...-.6......t...3..c.r...S<..M........[.1v.#...-`Mp..$pd..[

C:\Program Files\Adobe\Acrobat DC\Acrobat\A3DUtils.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	213279
Entropy (8bit):	6.658708133031473
Encrypted:	false
SSDEEP:	3072:LsWLV5QH1w0GITfO3giAIZPCTskLaS0LRl5cNNQ/d98wi7gO/Z7WAYTXsD6RnjEX:QWZ55bITJ8ZKTIZxSN63R9LAOx8
MD5:	EBB5D70F2B45C2D597421CC7E084DC32
SHA1:	DD8AE2712A78D314552C9B7753E8D87A496B9DEE
SHA-256:	74FA2580E84B6819B7C8D8B1175F6CE696838D853B7706478A351B1EAABBA170
SHA-512:	FB34DBA694065132072FAAD069895EEA85A052E402AD4954A6DD5C668E9C2DD53E0BDB24E26FEDACC4223B36DCC92F6EBA4D05FF887C68C765B62727218C0112
Malicious:	false
Preview:	.!.IC..(=...m.=.(...h.a..=N(.M;...kuD.]_(..,..g..g..cQ$.....-...-0P)L....P>...R......B........Pk5...,i....S...Jr0..XI;g].#E\|n)m.KN.!..g..6p.g...Y..\..-F..GW.k.Tw....#.Z....h.mW..%...i.M..C...'.k.Y!v%..Z...e..^.Q.I.T.o.q5p.....G.M.(..(P...Y5.>c.a..r..)(...R....o...D...R.F;h.wP.#..Crs..Nx.r.........(.nr].}......L.......Srl....u..V...n.")I.....=f.`a..7...Fl...&....)GJ...9H-.....).h..6H.4.\| ..&. 9...~..R.9.?.L.;.........d.tC.2~..T;.15 ....0."}.J.....s...2.L......erl9......5U........d..2.2~@:..7{p3.#...:)..U..@g...$.....N.\|..C.R....;%Z....1/z;.>..y%.....M.."T..U....L.3...r.U..Y.4D.o&....e..n.....'~..+.....K....n.P..6..F.$...\.......+...i.\."...f4...F&.....8.{..8h.Umn.......uV.;..4.tx..\.$E....../_.m.%...NRt......R..6.w..r&\.]K-A."..!-..q..Nm...(.k.u.\|.\..j/.S0uA\.SFfB...\.-.@Jz.5.....c.....TX..M...[.\|$..Y>...WP.....#..wE..2-.p..[......M........^A..(Z...^..V.;........`.i...B.w1.....lX..0f.Y..3.8...L/9..../c...Z..~..]......(.m...(...a.?...4L..2...Xa

C:\Program Files\Adobe\Acrobat DC\Acrobat\ACE.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1227551
Entropy (8bit):	6.851318644998436
Encrypted:	false
SSDEEP:	24576:IY9uzFnskmU58y46n1857MRtb6qVdV+8CpVnfdCNDNvA7:9uhskm44A+570Cr8vO
MD5:	8DF6E9D78BEEA06693AC636FA69794E9
SHA1:	D67553C83502E69D7F36F5F50FD62D39110A3B5E
SHA-256:	DD1BFF15188E4807BD207613316B953BB181485D0F72525F0118F9CC3638B5AA
SHA-512:	4893A4230EF811E168783DC3055BFC70949F3C58225E6907CA31E27B1D1522844AB359FB1CE3427DD759361AEA90DE0EAE06F2A90BB698CBDDDA860AEB354EDC
Malicious:	false
Preview:	'............Q.v...k".v.......d..7&.W.F..._..M.(..j.....[ag.MO...F...#@.-.<.$..5'7J...M% oG..K.q.E.p..8..I0..Gi.2XG.)4....+cL5J.C...Y.m@80Fcv.......`......e_RrN.o.y..Pm.........hf.[........>.:6.Q..`.E.?..9..........k=.d...".fs9G#?\|.I...\.;.~sX.......4...u2W=.-..s.>.s.5..+..&@......0!3.sY.%.3..%%.9..GW)e.. ;....V.......qJN.....o.../........T.@....}\|.g..c.Y\b!.V..y....`..}D.....-H.j..P.(........wM.....W.=.7=.I..7.+.p.H.%\|.K.....4..,....Hjh...C+/A...6..0.q`=.F._...K#{.IG....,...-.JC......W...kl<..=..0...$ ...~....J.i.._.../G..I.;~iv#D..........xv...E. ...P.._P.A.U..O......@....]...X.....8g........%K.....Tu}..Q....@.._D...#....D.[./3...(C.o.\......4uec.....Z.:..v.....m.YR.!.v..9D.p'...,...tM..Ir.>...5....5.y4I...B.c/.{*W...Y......7Lf...=.....X).....]...xc..W,.H.`n-.?NhF`.....bS....l.?N....n ...Yk....G...c........^...U.$..5..../.)......Q..z\|$5...@.V..g...f.w.mX.YC3..P!...!se.I..%Z.a.......K...^..R.[.,....d..8YN(.W.....K....{.q.O.q.}w...

C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	653087
Entropy (8bit):	5.335753879156041
Encrypted:	false
SSDEEP:	6144:t2xEqeN58E+QK/JP4UFmFPO6EY7hSe8z02BzNhAp7ZXdC8z6RHtNhAp7efzFRys8:t2xEvqQ01k+4Au
MD5:	E7DC5DE6CBFE975FEB574E52C81CF2EE
SHA1:	42896EABB12696A6305890843D18D4589383F73D
SHA-256:	2CF518A1E306F91B47E86C2E6D6D6E2A235E45E9F9E9AB4F73E769E270D9A472
SHA-512:	61029509E295C39E4D7A7097D3F92F3F4F768F07EC94CAE9719D9F1FBBBEEE97331F9178DE9226BBA7953E749D9A4201699484D2C7CC47C2F47603D5A8D8F13E
Malicious:	false
Preview:	.U,....x......P.........<K.]...53..H.n.].Zp..7.YVg!.=%$..O..>w).x.-...<...M...f..k..`..+5.\|+.BYt.Z.D(.^.:.U8'.....CD<l....:........n.<...B...>2.}.Dl.m.@fG}g.....k. ../.....{_.+!.c....8...$QT...^..{j.@..\|P...4.LA.\..x.h....3..\|.....jB,....a...........BA...k..I.L.l.k......9..V!m..W..y..w.~......)..$.......Q.md...V<.0.._..i.....d..4...R..y.v._1y"#.j.g...W..G..]C............i.....4..&O(...Ub~nh0..x@.....{.q...5.yU..{.G...u9..{...f...n...5H[..M..C.....x.....H.i.6.$..X.-....3@.;......X...Ad.X8.2....u.;.!U]t.@.#$7...a....%z....\..Q...?.v.fn.H.......O...h....9G........by<y.D...G.f....5.W....7.o..K}.....p..:..h..0.b.Q.....r$dP/d.\|...e..64..~ }..... .....<>.....A... .....u6......V......"2.0.Bf....c8..$l..5.".B...2....S.M.r. P.....b.p.N........aJ...j.$.M7..... ..G.rNF....Q.h....-.]...\|.^i..]....F.k.J.Yb...l.........n.).[k..u.....=._..H.o6...o.?/.q.mM..V..>C&s..{.......1..al ...e..#....u...{e...5h. ....z.....e..L8.Q...q...V..~.........G..r

C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	339231
Entropy (8bit):	5.415148453469253
Encrypted:	false
SSDEEP:	6144:Q6mk4Mr/UF9pO3lngMd35rV4ArYot9u/Onu1g8cG4isDIWJeNAG+FMB:Q6OoGf
MD5:	13F776EFB5C9064F1996015C92EB3B87
SHA1:	B9FFFA087C04FB53300CB245E5116FEFD167E0EC
SHA-256:	425E89F09DFB0017631AC49BB231B2A81281A0A57480B21DA4D9217D100DBD0B
SHA-512:	AB2E8E50E82F2AA7F878C9A7C1E7820E420FE71C3A1879B22861250F2915268A3CD3F97496D2DC739CE11AAD287EE2DC23747D6322C01AF7BB96E044AE4BB5EF
Malicious:	false
Preview:	L....b+....>.f&.....>..~a.....2.t...@`.$. ..$2.......J5...v..z)C...!.6..W...8.G.Za.6.b......J..:&.........2x.3.}.a..R...X...\|..%F..y1.Vu<..5A........r.1.K....04....y...7..u.Y...65.R.x......,v!...dd#.8J...D..[.Xc.yB.G.M.`......i...H4...?.}.K3......~3.....ok..}...AV..3.".a.{.AjQ.n...g...n....J.......6J.O...d.....A).p.....9..Lw[.f.........a.a.U..Ml....s.......j.v2..<..B..M...!....~..!.w0{..sC.CE k[..Ed.htSU`k2...a..>.\.......QV..H)....M.{...../..".iU.r..g....x./n.8=g...a.1...6.....?......GA..c..y....C.Z.Q..Y.#..l]....^....'#_6../E".-.7@...y....z....Q..,..35..).c....@.].L..r..Q#.>...x.=...B.~rg....d;...X.y.XOzcn.L.....q...<.....o.h.A.+\|.$.`#....?lE..@b..oBB.1.i..f..2....\|,.j#.<.......[..vg."Qa......0@?.....0.....1&g ....i........h;X......(.`;.H.2.~.8.aS...8 Q+..9)..........L...o\|.-...=~.....RS4.].@7.s6).Wf2..........^..i.A......g..7.\|.T..S.V^...K.....v.,..c..D.~.....P(.}...\..!...t.........@....Y..l3.h...S.&Hc.OE..d<.5.*..$8^.t,.En..?......!l

C:\Program Files\Adobe\Acrobat DC\Acrobat\AGM.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	7146783
Entropy (8bit):	6.6376918498952255
Encrypted:	false
SSDEEP:	98304:bwlXRYX/rmr2JfYOg0ZCIv6My/K0V5sDGgZhiWzOuB1uwous:0lXRS/XeOg0ZNv6MCK0VGo5
MD5:	52DC720994E9599603D6E35F819DD050
SHA1:	DFEEF07C4D07E6ADA6631B81403FA1E32BCBF162
SHA-256:	6E3276F6E75434868395C18C9D3EAF73D4598ADD80EF009EA4933044418FD80B
SHA-512:	D1814E5F88C86CAF301584546625F5B7B35BD906CF9448D9FF273E9545B3B83DD1A6AA3DDD5FF17F932BF907DF7DACF3A55AD806A56C3DD0602B02A6B194ED6E
Malicious:	false
Preview:	.....r.L2x..0....C.@.i...$@..yR7\|tI..]....\x_?.<...?..K..&E..l..kN.\.].w..93......C.Q..v....7..<.z.E).4..'......a..Kf..C<.@;!.\|.........cX'..<..G..0...Dq...$`.).."..C.1..h._.H.....Q..?\.{.2'.F.i.....n.]o}.c.%......$...AJ.:;.D....?..~.8.:......q&w..[yM.AK..Wh..C.....R.4.^.ae......F..R[0..}k.....}?+.N\.WG.V..J.!.P..r.:G.....Q.H..NX...w^.W.V-W=!..q...M[.....gEJkgI.Q;.."....OEj-U..8..5....MI^..o..)..p.7h9>_Dy.......p.R.[......[......H7.zc.=F...E..{.....k(....-.G..`.{.eB.0.....ts.l....8....E[.4E..j%..t.x..uFJ c.akGOE..4g..?C.;S...5.....;/MeX..l.+'vk....j}/1.nlJ.7.{.P....w....A.M..5..f.M!/Z.I.#$...t.(Y.Z..7p.....f......H{.!.o....y=.<.4......a...={W.]!.?..`...............S.M...[..0..!..{.P..$...k..m.bI+J..^.a..-._y..G......VjH..xi$....fkh..n..~2...%.).56B.f./..R........^snS.8....fR.>..x...cA...Z...L..^.m.L...u..5w.CK...+._[....s)c HV._........O......j...t...0.I....}...DV)...2t@m..T....3 .3s.... ........}#..FQu..m..@...B.$...[a$....x...i...J... *

C:\Program Files\Adobe\Acrobat DC\Acrobat\AGMGPUOptIn.ini

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2054
Entropy (8bit):	7.74427206376932
Encrypted:	false
SSDEEP:	48:xxbvHerbYUKupgzQ7SePES25rWTBi1yP6Az74CfD6W:xFGrcuqYE5r/1ydz74CL6W
MD5:	6B952A2968CFAC20C83F7526F85E15A5
SHA1:	0DF443C57CDF854CCADEF101F15C3677849737EE
SHA-256:	3D097E98A9FF26D537476E334D351992B5472BC914127FADC81903A99860C1FA
SHA-512:	499BD67078FEB4B968467174BD7E2C8C1ED18E44EA4ABB37FDAF51A1278D0DDAB438401C4D046BF9CEA4B1FA262890F7E825A9E9B8545921267383004D467284
Malicious:	false
Preview:	D.aA..{&..[1&.8fr1..I.7...........A\|..~@...^bk..pb.....N..X..~F...b....r..._Y....&.F.Cv.....}..&....9@)..9OQ..^Dx.I.,g[...<\^. Vh.c.K...j&..!.CPq....,_K$.#}2:Z.3...r......\k.K.&7..........2..B..E.Qr:c.L.0....J.{s....+P .......l.qSr<\|..M...c3..hI8>..!An.-......j+....d....o.(.'...z.h.8.....W..........^V..a..G.8.,..:.'.j.....A.}E........[...=4.H..]m...Nu.Q...w...$O..u..7.0Qh>.j..:...Y.~E.G....e/nT....J...h.......oEn..L..~..O..._.V.2..G.Y~N.~...r..q...2&z.3n7-i.lN..\|....z[.).&M......qJ...v...f......,.../@.B.V.Zu..:0...O..D...R.(..{C.....D.=.1.....iL0.f....#.1r..KJc..wQ.F_.1.7..l.".$...z...m_..u\|Qm......M..X..<".%.-}5......Qw...b0..Ild.U.0.Zq..<.5d.K<q>...7.V.L.o.U......D.w}...m...n..#..)].r..<.X.....4.).m\|...>m.k..1..3.....Z..r.Z....,...Y.1.....[.z?.7...b.G....c{....w7..{+^.N.ED.a.....f.`.9.j.m....t).....h..k.G..qg..z...9.j..k.N...Vb.'.....>.O.N....../.j.p.....pV.^.U9..s\r.3......v.Q.z>..r...k.L..\|.\|l./.V.n..I...W.....q.-...+..Pk

C:\Program Files\Adobe\Acrobat DC\Acrobat\AIDE.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	9668375
Entropy (8bit):	7.027535215158937
Encrypted:	false
SSDEEP:	196608:MePKzh1iyzrJiXfbTLeIEqMosn8ZF98CjHFSTHJgk+Zc9AelbLc3YPpcZSsTUkVM:MeiznrJiXfbTLeIzMosn8ZF98CjHFSTb
MD5:	8637C5123FB40D06E4F6816625A11E96
SHA1:	EED8FE5BE8874C2C3404C86B48075055F9BA999B
SHA-256:	E286D6DBAE8B9CB02AA63686271C27086B3D853E63D4792BA76F82BAB82B09BC
SHA-512:	F5D35F4A87E2B2A3C3B106146FFE9EE37FBF2176F2E1E523DAFF1E2B0BEE474F8CD0603B6D1DE6AF2CA363EAAF2E3337C6B4E42836D2D092950744E7A5F355AD
Malicious:	false
Preview:	........C.....$.....p.&`.`l&B\D.+.K.....b...#.."x .R5....i.Z{..:.?42K.}M..lJbH..M.B..o.r."...GX\|.<#....(..i..o.;55..i\.&.. M._.w.....'.]..~....O..8...k.7._.._....r.x.........CR..O..n..._I..O...#..C.1....m0.m<]l.Z....B#BD....B{.:.......tu.:..{xy..B._{...!0..<...h.Ndp...6w..._..V/,...J.....Q.nN.7.9.>.."B......s3`.f.V.p...3...._.=.X.fPUOeg.(U9..a.pt0...o...;.....z...z.1.z..]w.,.o...(..a .].......T........^......ra.._./d.Ti..Zz(.{M..\v...B.\..'.,..\T.......H...w.m.....^....r.C..t>z....~.#.p+@...x.f...e...l...4.....pU..N#../..6...3>;..0.%....K.T.G[....L1...n.s._...Z}DP...;OqT.-Ru...d#f......^Ej..?.1.......'.#U.FaX.ZL..y.0.......{J....a..b....a.^.z......>.Br..~..sH.....f...F.L..&.)hL1......g.!R.pL...+(<..m.Z.[..W......L.....Ud..H9..x.P..lZ.`.w...K4.x3..as....+Q.*<..h........u.R.).4.Mq...>3.W#........b<`..Nz.g1w{.....\<'.gta)j..x^.....-T...j....#b..M...;b5.v..).;.M....'T>...(...HjH....Zt{?>fk.P.!?.f3...8.N.A.....u4..Z...P..NC....i..c.:......

C:\Program Files\Adobe\Acrobat DC\Acrobat\ANCUtility.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	121327
Entropy (8bit):	6.292232819929744
Encrypted:	false
SSDEEP:	3072:02xt2aV0wL1PiPCwSQih2yrIvkz+hbrzX:3LV0wL8PCfvh2yrIvk6hbHX
MD5:	9D931CE243F0933224FADABC8FE034F6
SHA1:	D7F203DBBB8A8A0A5432A57B6D5058D64B3C5D33
SHA-256:	2188D14630E0B7084BBD5D769DAED2A65BB17D373C249E0EB580343BFD806A2C
SHA-512:	AE0F08F010C9BEC55D4ED9AC8BB0C96578D4DD218C91D324F737F5B1C2FB4970661155B02F80B7D283BEE95BF4CB05D2FBB69EA42A541CB640F874A7E8FC32E1
Malicious:	false
Preview:	.....pQU.O..%.......!.d.S[.ng..x......`.I......Z....m..v....HJ..G.lX..p\|..rp. B3.w.+I`.m.i.6.x.r1...jQ.X..ce....Bzr ......~.7.....9. 7.....N...LL.t.$94UG......@...\|c....D......2,\|..@b~jYa..g..9+....$RD".-n..~./.B._]L...?.wP...i....y$.T..}...].....)..aC...'...<.}....OE ..z...Mk.K..5U....V.Tt`.!g>.u9g8..b.....e.f..3./J.try2i.$....T.Kk..+...'.A.H...^.e.v.b!....(. .Qt..u/).MrYV.... ."`......L2C._.....,.X3:...g.v.._.9..U...[...3.2Q.B.\|$.....0"x.n3?...o...u-s..8....jQ6Qz.._e{.4...b0l..._.o....MY_..,...@5p .....8.d.....qY..>......K.....T...=p...E...~..}[..+..P.........v.....p.Q2..O...CK.[.r.W.?.A%yLtc...<.P..sb....7......k..g..=......P.=s.).v..Z..Q...,.....$..g.O..m.Z....PN.W....;.OO.@[..'.:.>+..._.{.h.(.q...)...2.............f..T..Zx....R\a......u.x..e.1j8?..%-....5TTu.e..2J.............V..#..=.d.~.<.7..-..^.=..........}.4..q..........<L........,.so.4.\^..X......GZ.x..o......(..S..WC...-........%I1.(PR.d..$............Z.....Y.

C:\Program Files\Adobe\Acrobat DC\Acrobat\AXE8SharedExpat.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	169239
Entropy (8bit):	6.708298732406019
Encrypted:	false
SSDEEP:	3072:pvnvCDT86eilfakh/CgSYcStq9y8stbSGylJi7NROXZ7DAYa33ZfgcAHt6Uxm:h6TqClhvSYcStqpsYepAH+
MD5:	5D87AF78F9193D50A3669337C89C1F51
SHA1:	FDE2BFCBBF0ABC3000004BE84D85E0CF43F02B93
SHA-256:	8216FFE4D3BBC5EF5BD7EC99A1CDBD1C742EB253E940B43CC7923FB5A5BEC406
SHA-512:	8277566454847108E8F3B7C0CE0D666A6B8E7808A26CB757C6C09198968879B8ACAD824AD7D0B84CD6616CFD577167C5C5DC155B66AE80A36F4766A4AF8C34E5
Malicious:	false
Preview:	.....IEz5..a.\|...Z9z. ..^.4!.....A\..C..........E..M.>....d3....r0.C....Z......n....`...(...&4".3.5..Y>XqY;...9q-4...I1.W-.)...M..ydSS.iY^Q^.....OF...Y_..w.kZ\._.I.....:zp.+......F.sK...P..iu....i#.9..^.H.`.~f.C ....(=.<.&;..}..s.....#.[.u..T..u.&P.....a7...'&.\|....E.)i..}.....c....>]H.......@...M.\|..b.....>.J&S...51.~v.32{9. .N.....C`./.R#....N.....Q..i.....i.cU-.StM.>..F3...8....9-....R.0.Ab....@-.......F..U.K)..p....C.mr.....u.. ..........w...k....2.........Eg...}...W...B.......kk:....@.H.t\........v.b.........@B.AV3..J. ..^...@O...u....g.7R..q.b..#.c.b..vT..s.....zX...6c.l0..7..]Rs\|..vBF.h:..c.R....h1....\|:/S......7..J&2.../..,.X...gCY..Ecr.k:.<.&X..Z4.0.....u...;.....dP...b.......#6..W.e..;.uM....]..o.....\|......l'W..T4c.3.T.E.R.....M.Xc@.J.\..;d..z.z5....rw...V./.6`JL...]..izk.......,.H.b...9..We..p.....)E..)..%:.....i....X....3*T..eS.8~I^4.B..K.'.....$\|7I._..\|..G.W..`....I.)f.c....Vd.r.'H-.C.m\.KxR._:..I.Y.F4A0N..

C:\Program Files\Adobe\Acrobat DC\Acrobat\AXSLE.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	673047
Entropy (8bit):	6.588693394071262
Encrypted:	false
SSDEEP:	12288:s+Py+BZ1VXw0X0HRP/ULtWDeHXEDeJEBZ7ybAtlR0h9dULk8L:s+6clXw0X0HRP/ULtWDeHUDeJEBUQlRH
MD5:	91601B865169940F4A55D6522C362985
SHA1:	C5515FC99E8724A7811C4987383D381C84F5E761
SHA-256:	82B4352D69A7057C7AF599A8A32634EE41B69B0962120519B84A736DCCF5B736
SHA-512:	314FEE92DD93B04F6FD695C44E35FF969ADA256224093BB37C2055624DF95F3D138E9C509FDC0E273E43ECE93E0E22835510E072503BF9A4763CBB269C0BF32E
Malicious:	false
Preview:	.'y..O=..i......."......H.2.?. .%.X...+.9Xv..:...t..a8f...Z9..U.&..^.3.>............_-.....P`.+k.tb>....=S............%.m,l.X.k....P.4.1.........f..n.1..rE..O.q....TLE.......R3.o....6_..V&-.8Z6.4....o.}W.%.HsT.<..g.8.Qi....N...Y..Y.k....a.XxFo3DV{;.....#....n..<c.....m.y.'@.b....d....z.B."...Z......,..1z.T.....rxE..yJ...<P...bX+.AQ.h..`....U..(.8..NtNd..w..:.X.ZM.`9.q._....8.j....4..........j.t...M.}.5P.......d... (.k.b...{SC.......$f.......@..`...Y....,......]8K>.f.`.%..fs.+..@2O......m.....?/...?`.~......x..(<L$s.......H.......[......."...._.......&.....~D.0...T..\|MH..2.!.6..\..Q.%k..;^..D....\|."...\|e...=..~7?...Y....P./1f}w3.1.f'P\|.....}.......5..r.!...b..;-$.........1..2....p....'M........b.......a......;m.({%....R.%XoR\...K.4........g/...$,c.j.4...F..rfE....h$...H..-.w.GB...N........MC3...b.^......41o..D"...v.:..;.G..b..;h/.....!+{N5{p..Z.w+.L...B.9/.q.....Yy..Z.jd..S.?.....]'.O+\|...}~Yr....tWl1.@.'.$.........&.[d...V0.5i..t)}.C..

C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	343839
Entropy (8bit):	6.604300532113614
Encrypted:	false
SSDEEP:	6144:2K/mU668H1moseC4fiHqV7AHvqe7HfgHo37Ni4BCrk:4U6688BeC4xABH405n
MD5:	5E3B403754EAFC993C9B7132A70547EF
SHA1:	C7A573630010066403B9D16034E016D3F890F335
SHA-256:	84CC4860F7C4D21FB919036F2FE25D96AD4E5B25FF1B1AB099B7C45D5DCDA603
SHA-512:	6B6A18137318C546D3765761C95562ACA983AD1029E66FF830BD58EB05A17C5CB166C6EB3F46547BFA37CD612F3057F3D7B594B8F74CF032B3A3810808A8704B
Malicious:	false
Preview:	.5.......(Y.2.....Mc.......RB.....qQg..&.."1..}..r@.oc.?hry....5........y?..q.1.Y. .G.b.U@..3.....n~..).Dm.{r...<..a..v..._..J.;....`..,....u.Q.......4&.b.z...;.u?.<q.{.;g8....z:..C...E.2..h.'...;qpI.1D....]- . )9x..u&.......;..4.].........E...f..\.....N.\u#.....=PL...K...5y........^8....U.k=df Q.q..c...o....l....B..H....a..w..o..\|.jl..7.&[V.X:.'.S.i..r~koeJ.k_f....$'......+.R?'}&..R.h$.f...z.7[L....A8...r..[.djxF.!.R...e...^..-.,.s..C..+&..l.VjCQ.r<\..8.8...?.#p...[X...>.1(.....d...Ub....&..,..\.E...W...Bh...).......h..V.....10...L...j..^.....2;1..._.R...x,.w.\|.Z.-.&8.7>Q.W.....WY..V.F..'....[]h..\|T..Tn......._@..p{.E ....q...f......k........s..D&x..\.$...,.Z..-..o.I..e .K....C......W..:..56{/...)...;......3u..p.R.oX....Q4.. z%v......~15dJ..J...Y...._....._.9.d.z..Kc..d....=.u<...n..uH.....G.E...X........o..l2...o....y.j......V1<.?P..}..Q.)..F.qu.A...x.....}.3z.L=wxZ.h..dl`..$..r.'.l.S.t,..i.p+9..:S.{rcaT....p...!.x..w...

C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroDunamis.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1098015
Entropy (8bit):	6.695812115213481
Encrypted:	false
SSDEEP:	12288:hTujl7UCTJ9NNTp21TJcUup8zk+Rfx7kh1yuazWxEViZQ+oS+gb/z1xKmhad:9uGoZ21TJcUupT+RNZSxUisgb/58GY
MD5:	77AABD4023BB54308B3A6ABFBDCB64A7
SHA1:	6CD24825932931DEBCEA1D5DF64331D5A9ACCEA7
SHA-256:	19BE8645339B4B41E863098C32FDB7AD116A7ECBF30AED44E47350714502FED0
SHA-512:	4EE83DBFEEA5E91A21B183DE045DE79C2D6ED0F6569E6294632261683CB8EE7C69656379751860B27DBEC8FFBE91F93657AFA7FD76338321FAD808CEBB828944
Malicious:	false
Preview:	&.T>.u.._V.<...k...w.......0`Q......P2..,i..1..$.U.X.........Q...F.f..sQb...r.x.!..;T.&<.E$.s..)....\.lJ...e....C.....2........X......'.lo.r..AI.F....85.F..K.j.Ve../.@. .-.uE.5s`}.............s#......_.h0..).cE..\|..]...W.z.w..7..Y...w.3...8.?b../a.%f}..F.1KgjX.b..^.T#\Pi(m.k.\|Gk.].s"..\.s.u..E..Uye.m.....H..'.....>51..%.7Ep{..r'...i3;..DM...Vh1......da9U.SD.........@q..w.....#C .H....g.3zR\N..nEE..6..g./.M....0.h..m>!....>3.-.f.@l&...{.....o.6..7.Y...&...h.a.k.....y.'Z.....1.....i+x..\|.UGH....r.%...~ .z.wO.;. '.T.k......x....68.M;.....$..\|...v..5s..u...g.G.P...8.cH.KvK/..R.v.,.;...r...-...S..#.R..m..R..c...;2.r"N@.6...U.9.........-\|.S....`_.0@n.@6..%....)....[.'......i..:.K......z ..+M..+..........`..X.Lz.W...p:..' x.;P..iXQ.J.H.8..G...?...<....`..6I....\|t..\#].o.1...t.0....\..."..v0.R.....>...@.j}D.z...:..$..x1./....[Q...7..3.).r..:.C?/.F.}.t_.4\|.?..:....v3...QC..^.4S.B....nm.%...3..d..&...?...Ls..V$4g...b..=X..:.@.\|.........W.Nj^W.3.3..<

C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	61215
Entropy (8bit):	6.742412919711463
Encrypted:	false
SSDEEP:	768:P0/cg17a4iX1pB4jHfzugjHPjYdoE2mOuw2teAlOTAWLfxIWst7hfOkYGtswAkxo:c/X17a4mX4fK/JtgTAWLfxI95hfOkfxo
MD5:	FEE9E2363AB1A4D66B25AC53635F5FEE
SHA1:	C934D4385F8D1844440A3803239B9070029137A0
SHA-256:	23741AAC09FE99EA1994B7E45D6FBC0329DA7C545B7877D69A68A7A2CDF7C7EC
SHA-512:	9453C5774285E98D1613F0E7FC9AD8ECFF745F39162C6CCAB49F875AA97F64A12663A7D643568FF5FB00A108F7B6FC1E5BC5319B0F6F33E831E012BAB7D01AC9
Malicious:	false
Preview:	E.IML..:....}..../.....:J......k..^1......=Y..$..._...@.d}.'.B.8%.'.J.....{.........`}.V..:3Y...'0TY..l...D(t.6.....A=G2y........c..>..Q...YTmn@.~....s4D;t...sw.>.[..>.Z'..'..w.....h.cB......T...4.0.B.....Hw8\AY._..G/..'X5Z..Yg.q....9(..I.a.._WIm..R...s.w7.Y...gV....z..O.}......R..+9#`J.....d.G..M.?:..k.eV.h..zG....+......d...&....T.n.....o......n....Y<.~"e.P.W..........D..9..l..R}(.7......b...C..NL.Q...6......5.._(._....IqO....B<.L.>.C.....`.l.~^r..<..s.7z'.J...3+\|.Je..cU....osG......c8..M`b..c....x\.RR.{w."m...U/._i2...p.c.l..[.1..{.q.....\.!a.S.)......(.FQ3.E..].d.l.yVX...(..i.G.?t\..W`..]gP.P.*.+.18.8...{..e.d......`Wo,......r.Q.!E...5/1...#l..?..N.q..vi..2...M8z8.2t.qBGl..5?t.....=\...+..ipP...u..........L....bc.........O...&.0PR`v]...".\..d.\|.[.o...N...1Q..5}Nq.&~...\J..E.j..6U..S....,s...-..r.....jp.&Q..U.p....M1~#......jW7avo..J{9(.=..4.e.....................?.$.u`n.~.#.....b@..K`^Z........ k4R.-~..]L..@...f..C....

C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	62663455
Entropy (8bit):	6.493933836174505
Encrypted:	false
SSDEEP:	393216:UIOF8x4VARA9p3gmj3e5D9FdwHFt5WfuJtmMYbbMes7k3kW19PyV/32COhkrKOGD:Vx4VARADrtLjmRbbef2COTNTzbd9fntT
MD5:	E755486400E6B0BA9D5807411FA18B75
SHA1:	9C72EF1A0FB6414867F001FAEBB8471704787387
SHA-256:	897245E7A4AD6E6BB9F8AAC4393CC11A715F938BEFA438FF49C09B443BB3C714
SHA-512:	47E27821C38C37473DE8D6AED9B0902C1AF5447B72974A713A7D5AB3583497C1FBBD2FB23AA4C0F93C714DD07D20BC0CFCE167735C23EC0F146017DF994A3363
Malicious:	false
Preview:	8.,..~U.`..E...X...h$......U..A...P......{.E1^...\.. .h.L.....`.g.G.......t..YD.....{...>yn.t.(.8...-z.....,...x..f.$p...O..J.....N.....>.M.n.....A.....+P.-.....j[.............&.E....B...r.."...L1 .}...5./W.d...U........&;......!R.!..[T.E..E.Wx.\|......D..(L...+Z.3...p!..?.}..+.a.Z....,....}~!.....VYG.e..@..>t...]Bs.~s79...~/.3a.o=......A...;.p..!...Oc....=-$.........R]..0.v...../o.go.....n?.b1......?%/...!.y7A.;db.d\........L.7...]..]Sj'..w.y".....xm..#.!.....~.VKy....@IK.)..=$5..=...v.g.Fh.....hqj..f6....d&....0.`.....R...EWz\...S....7E..n"T.I.4g.....>T...Y.d..N.3.q.....Usui\....H..?.....K..{f.F...X...D..B.Sr......J.Q=}?.N..~...vuCkq.p.@.fF..(. m..,!.^...8...1m/.J.<.`-..}.,I.L.....K~n.t.....D...-..........r~CC..-..q..L...K........S.%+..@.\|.?.yH.....P..y...p2.;...}...rP..9.RsA..?/.f.Z......Y..g...E........i...OJ..>J..<.....<.8O........X.}.I.=k.TJ.g.].C.$.3.&]DL.f\|&{..MPC....Y!Tp..=E...U."2...O.......c.w.X.h.K6...c..oz.H.

C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	5641503
Entropy (8bit):	6.279654297777611
Encrypted:	false
SSDEEP:	49152:YfEBHz0e+qfp/5gO6Yy8GavycvTt3myxr68FkDWwEOLl6nnzWQEq+b5mFZX+5GEP:7+OJDkvonzWtGEQWXqQRlQM9
MD5:	A55494E9278F91BE20E2C0A98528C868
SHA1:	82706818D8ED571693B315C78A7E9D456343B254
SHA-256:	A7B274A004393B54BB9587A22D9864CFC31FA8D0D5D6D0EB05D9A8CDC1AA2152
SHA-512:	16F01A0C183A4EBBC0050EF13C69307D0160526564396B9672C25DF3F61A0A6AFA8D4092C38B3ECEE88F9A732A52C8F7C195A9D6D0EF3DC6B5750FDECDE7A06C
Malicious:	false
Preview:	.V.h...4.....EyW.a"F.:W./e......<...g.5...u.1....z..\|...}..y>.....)............M.......P....J..S.).$...K.6D.\...<.~.7y...f.7.\.....;,.SaC..?.g........X........i...z7.e.eS..e....Q..C`....ao.'f....N.A.au.....zvP.<.b.'......S..QH=!..m.t.....)..V...7.{..../.A.8.d.#rA......g.M?.Ju..P/..yE.#.G..vk_...@].b.~..An!..;...w)...~f..?.-...M.......P...?.J.....^..ak.?...40.........p6.\|....(.'...............6..........=........c.T:.#.p...8_.p.BI.+H... ...D>;.l`-.YX...Vx..:....a.;.VCU...lC].....h...~..@W.Dn.....C.u.<...n.4...j.p.5.\f.../.wky..1+......BAJ..R.}+.K...............K.....i......wx....>.d..X...r.G....D.4.cD.6./J...~...#.{xjd..I...........e.........p.`....n..B....Q.v.p..r%....D....I.:.+__.v.....jQ.L......nZr..x.m..I.p..P..-.${1j...Y.o.a.uH.#..B.`.p.+E.g..~..1jb.B..d..B4........[.`%...;..R^<,.C.....H.7+.k._$U..?..K^.W.&....P.6w:.....\...k..o$.o2.4xb".~\|^f.ra.A.&...=.7.V1.v0..ggTT....#...22.$.R..y._..N.I....9.N=..C..r..[.\|.UP..........h.^.L=..

C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	38175
Entropy (8bit):	6.808883635178014
Encrypted:	false
SSDEEP:	768:c7Z3/+PKxgrGVT5VbwWrCvJNTkYc9AtbhVYDRAA0xAn47:c3r2yVDLCzT5tbhV9xd7
MD5:	D7E7367E04EF9E62412EFA1A9425827F
SHA1:	32C1E6062748FDA0237419ED8C9E78B7E5508CB3
SHA-256:	823936A14331CA5CA9CD73655DDE71260350DD579A2A1EC66B9C3A87A1F5EE63
SHA-512:	FC2A9B3F4A48715912A30C410A5296EE9F07258EAEFB37DD8AA71B8BD47BF952775084DF41C7CC2827D4B50CDB04EDCD9FD5C2C201D015F149F7CE16A95CBBD8
Malicious:	false
Preview:	...'.x..M.N..!....c......K\..y..?1.{..@2..(p....I\z[..DS..[...%v.r..}..7;...Y%....#m@..B1..w.....#.y....h.....$..D.a0..1.i....1.AT.l......)..V....b{.rFD6..d.R...Vn.VZ.5.....T...S\v.?.J.=j.t@h..H.....w...s"gG..p...`..?.........a.).P}m.L.7$...).~C.....e2&.5.<&.y..~d.".s..3d..w...Hq...}X......ul..&>..np......3.........._.C.....I:...+.m.)y..Z#.e......0..........n .LwM..T'#..J\........%.?..=g..M....^..\lI....T...+ ...Z..p.+...G...M..^...R....`.:}.<.q....X.&`2...D....,N..6.).^..X..\.....\|.Adu.a%...9.b...Pmw.-%.ru.....Nr.#.sT.9A.....`..w..'.Ei..H..A3:#.u...x]\|..VV.K....'Q.....jB..<..H.%V7.....8.$xh.].f....MRZ...l..'.B.c^...!....3.QrpI....E.r{.3.#.29..\|C....\kU....s.;.W.8}..../...D...L....P.D.M.W..-.o....7.K..)...7..Y..A.A.M...i....Ko.d....^..>D\|...<l.wT..hk.;.>Z.4.."...5...:.W.....0..e...#0...\|...I.../...U...#S4......ht...p.._...#.4.......y...2..Fa.}...r.....".J#.....~..3..V..uGRz.A"..%...P?..YZ=G.z...]......G.i...D.._.`6o...t1.<.o.... (......

C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatRes.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	18627359
Entropy (8bit):	7.479122883571231
Encrypted:	false
SSDEEP:	196608:BQRgYbm6RwO05b2ofvt4Gy/uiEHM2tKjy7syNelmOcjYzFrLTVk:Suzb2o3t4Gy/DmAqefrVk
MD5:	29DAC00F829E9776D6DE74175AA24F88
SHA1:	ADFD5089D414EF514A26614999BCA38F64FA7F07
SHA-256:	65DFE63990B3EA20673FB5F0D0CD255770224D016D83D154E61DAA1433881BF0
SHA-512:	3AAAE8F7EEBA1766050ABD1DEA74F70CC8C1F275EF26D004B096D566D544C3742E921C08E04F134697F99E3A1F2E9248F6CB073B30F255B9A9963238093F2369
Malicious:	false
Preview:	.=.A.w..i.n_ ....A.gp.%F........W=...?.K#.\...C\2q>{...xH....p$uqC.....{%.%7....o.w.$.T!......~.7>...R.pAEVE.....IX..yo.o........c.-,.......2...\|.D.UA..+w.G.w.%Z..t.U..]S..!...e-.\..`..=...IA....P...T..'s...Xl...R...N.O9E.]7]..X...............G[-.._.Q.mm.}!b.2&.R.....5q. .c{o.Z...\|../"..q.#......[.?\X..yU'.4...c;...a..u...[CZg?2.H,..B..i.cH...f.sH..$$.=......JHS"..N/F.x.e'.:q.........g....Y..Y....2..g.]7pu..x...+.. .zX.nP...i....[qf~.."..d.....h.(.+U..YN.=2..M5... .,.K+...;}.P.n+...<.@S.......=u..Q.^.B_.I.0...t>bJ... ..._..Yn.Y..4{Z...7...k...{Z.%.Jw....M.Z.(.y.......d#.....Z.)GM.H..)..p..d.=O.H.....hwI.....'].C.....2{.J...V..V.?.o.:...fF."&..IW.G..'......<.@....P...e0T....X......(.J./......6.......Y........[./....4....._h..W.f ..w...../.../Ta.....?.....;X.hEN.SY.4....P.Q4......>.7IX'cL..<..J...sa.E.}w..=,.?7.........g...%........0...!.......-.j..Y...46.<.x.......C....m..z1.H..N.p....+L2.V.2q....s"...3.umkC&...R%..madB.B\|....g.r....

C:\Program Files\Adobe\Acrobat DC\Acrobat\Adobe.Acrobat.Dependencies.manifest

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2930
Entropy (8bit):	7.852690023816718
Encrypted:	false
SSDEEP:	48:FKhZfBgN4yYbAcJB6wj3yx7YIdd2CtUpAqV2UpdgESwJJX5vxcErbiJs9r3KHyMY:ghl+N4b1JBNy7d2C2p92w5Jceb59zK5W
MD5:	FD3CC8AED8B087D29F9C65585E661C41
SHA1:	AF603EF7326B28D9076B52F1FF8964DF6C6C8BC6
SHA-256:	D72740273064751D502E858153E3771BA559312E1F368BE13883DFFA64C793F9
SHA-512:	489CDAA42B4491B72D30D94A1F1FCBD36A34E2BCF0C07A95880959FBBEE7CCBA84DCAA88DC00E8BA21DD23D5952B25569A77D85D760DBD4CC7334D9B51256EE7
Malicious:	false
Preview:	..,..`._}..+.......f)..2Gc...s..f..g..&3N..{.....T.,..j.s.9....a.LV.g......r..E.}..C...2.fW..x.5.t.^..q..e+..R....f.4.....?.8u.6.=..he.....e...n.a...t.Q...4L......;.K.[/..J..\..hg......E...\b......2.B.o.......5.kHd.g.@..z....6'.P..b.,.?.^....9......B&.6]...Q..e..z..ox...6...{,.e...?...],....U....][}...L..../.U\.9...W...=..<....r?(.4..\|6+..E...w.BG.........6%.^...$.U^....&....r..{.$.G...T.0e..\|<..k.U...$..........r.A...].8G-.b....u.\|.+...seN. .g.HX..7...#.p............z..D..(HC[O..AN....dv.f......`]..{...=D.(....&........y.\.....&.v%.StO>.@..T(:~LYM.V....'.....xC..l.C-j..g0?1.......Wh.'..Ps..cx G....s...h{....gK..,.!.........FB._...g.....Ie.......a]....>.=.Q...t.\|R.t....._.h.K.n (.vQ....+S.k..\|.t.b..#..6..A........eQ.\..n..o.;.......hy.Lc..@...o&W.6q..........!s....^..l.r.....B.\cht]..w.....o...S,.._&..W.Mf.n4..PU?..~njd.W...oi&.~...M..2.\}\|.p...9.L.u.BY.n..K..[.9.0y.}..z.....+.q.v3..t.iD....g.....+A.'$......'.Dj!..sLa.sa\|......`z.I

C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	11470111
Entropy (8bit):	6.6093250423985594
Encrypted:	false
SSDEEP:	98304:OnA+ol9lqsWgkK36cevW+Cbl8Dwkjv+hkQ0ldNCVkIHN22I:c4l98ZgkKKceu+CblOwkjW2DNCx22I
MD5:	23B8D338E535EE6681AB61B77D580F2F
SHA1:	E4C6B4945853886DD8BA166E9E423E48F5DB735B
SHA-256:	24E1155585A47B54535D2289CE90C0B2453F94D78310433C9DEEC98B185EC25F
SHA-512:	F78B88BDAEEBAF3C111427696FF43BCAA8A3C7206670C33B95FC4C5238FE6B7F325A6680AF32F07A1AE9433377BF1D6A6E70FB2F618C450CE2AA0FC66D285939
Malicious:	false
Preview:	..T.`.Vw.X[..aT.S.......L?c.Z....W'wWa...{.3.CMf...N.jXo....7.L.#t..{...8N.\|..5.T..c.zh.y...l.$9,w...m..r.Z.M..S.r;.'."\|.N.J.M.. .YG;<..\|.....B..$......./.U.8..G@..LNkK.;@....c.R..%.,.w.u......k.tT....ov8..:..`.6.)?c....,....~2.X...6...J....1s..vK.Y.N..."`...5..'Y:.m...]kd...\|.Ku.<\.h....sUZ.<..p....\|..]>g....#1.=.k...`.ks.. ...i.2.........%.K..x....#.......F=.^Y..m.i.4....vb......9.....ad]q.....H...>.7J..h.~].J.....yI..,.;\.K......ni.f?....w..h.Wr{.f.....n[..Z=z.^:........^...-....X..ok..]..Z9..M&.Q......l..kI..m./J...}....F...]#1..._.s./Y.->..4R.=%.2.'....p."'..(.58....^.A..-........Q^...b.1....^..P....2F3.Q....%_O.....W.a....D.iu.J..,.E..{.E~M...}.~u.B.+.%..L....R..........G...l...=.\sQ..M.ek.XP>......k~>3...:..b....ab..b8.6,\|<o..P.3a...t=..2.e.&...4@......=U+._..-...aeN....N7.?.G-.s.D.o.J...C........@ ..._..P.d.C...& ....::1..fv3..w\..r@7PP..J..Nt...;O...e_..b.u.ee...I...K.G...G......b.2..\|.5"U..O......T.....i.@.Hq..d..1.#.:u.j/..+...s.

C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeLinguistic.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	545831
Entropy (8bit):	6.1520207409826115
Encrypted:	false
SSDEEP:	6144:QNAcIlN2oRmIwcseFDeJR8hU43soPc/hAmWJNhE5rGUgzjkwBozn0MqEXVNPPZIO:QacIPzDsiUwsYi9ki5rjgEcoz97ozna
MD5:	968D5B62E18092025E2C2E10C337A040
SHA1:	5009683B70B3BA18A2EE43A32A5CDB47172E820F
SHA-256:	B4FF90E454525BA714AD4B41B46304C0E567B636AE7A8E864A8EF077E8417258
SHA-512:	0975BAAF2C6979F3D58A0006C805992523CA084A31E340DD00CF46FA22830B49F1536EDE5AA5A06AA9C300D057E83A201626F3FF2982B0EB01276A46BBCCE27D
Malicious:	false
Preview:	m..-JeF_.4..w...\b.....o...Z./...S. ..2+.."{..e..lz=CS.X\R.c.._.va..Lu..x.%....d.nx.XM.w....AZ..[\|...0]...I....m...rq.I...<..I...+.K.B4?E..<....K...w..bt+.<.E.+.......$4.....W.W.rK.F...<E.Du...B..F.....Y...=....6`.}..Wf...}%e..x...4E..Oc.OL... ..#Q...Q.I.......?.S...u...O.!A- .T.5.p.....5....k.-vqi[..i;....E.rJ...;3d......!.J...(...%.........pw.)p...J$D..3}s.r.+rq"aO.k.#q.<vz\...p.p...!.4..].....g...u..$V@.7.j.3@..Qj....X.R.[.F..Y..k..r...=.sRA..i...1N...\&.'V..E?`....z\/iE..%.k..Z]..L.=.}..ug6FG.D..J....,.}jRtX...=...FR!...tCO......q'=$.g.Skh......F.W{.j.q..Q.f.[7k...z..Wq_...V..6........j.<.).D\.....R...3.(./5......3.'.h....<.g....Z.\..1r.b.Kx.."Q.....d.............JLf.`.\|.....CtZ;3.;(.}7`....T.?-..}.....f8..j.>..........#.A..X.....1..=....n2w.yT.].9....}..D.g.4.&G...t.....'.....o.I.{...]f=9z....^..?4u.......v...W..Z.TG@E...v......H.....{...Vgc..-......#R.\Z:..0..7{..?Pa..>.lSM....1:U.hg.&=D..R...D......Z`.U...]{.......

C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeXMP.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1261847
Entropy (8bit):	6.627743508411904
Encrypted:	false
SSDEEP:	24576:FMk6CzB/HsgKxXZKGXpsXZ6NXUncck2V4+A:ak6wB/ZKxXZKGqJ6NXUccjV4+A
MD5:	3E1AF716BA556AA4990F38DD2A1CDB03
SHA1:	FA3AC51F25D7AA8DD24F7532D5FEB969ACFB0DF6
SHA-256:	F04B31800A02F359E7283B3092867938BDF46F5362837A43006FD3201C7750CA
SHA-512:	9DEDDB9CC133104B5A40E112B52EBAF9363EF836DD52CF335AD6B0582BA58940886B9922E1D20B6573036B1975DFFE6A0757EC8C90B34F2641F9FCF09D456F50
Malicious:	false
Preview:	K.e4!}._.f...B.X.{...2.WA...Z.=.Q@..../@3.H6. h[2....c\n..Z..U.....GF....?...$.q....-. ......J..Z...~..h../...,........Q{I....w9$..C..f.....R....V..P\|}...93"F(.g7D.S.l.x3..8.{..+.6.N...$..a..(....U...L...>E.....l.l8.....B\.-.mP.d..O..[..].....4A. ..6X...mrBH.F. .o...9....W...:.[d..08..D....9.nf.M.....[.Z:z..Yr...M.....9~Vg..u......o7:..........1......u67.6.S.6..bf...4.{....y......v.....+7..'V..0....D.u..n..v/.)w....G.......h.0.......Z#..6j....z.......4...a8<#R...7.'.v.4....X.......C....Vd.LZ?....p..u.....0..(.>c.y]. ..:%..,.\...z.=..&..j..E...k.?..........i.*...6E...Qi......Q.w...;.9.R...5@..A#....UQrL..p.o..S.....". .\|1..A. C...m...c..$..G.&....!..G...sX .'..3.Z]....W{x...f.L..m...dZ..[r.(&...~fk.R.6.........=....U2.....SYN.HP....?.z..(.0.M.........b.f...#?j.x.:........k.j.8....#..y18..{y-{Z.CN.0)Z..K...X.eE.i....1.<....r.4n......h.....L..1q.i.A.d..?......p.F?.\|.D.q...'.U.m.R.;.U...v.].E.}~.4....$.2....8.n'74..6...\..@&;.'...b$..[..

C:\Program Files\Adobe\Acrobat DC\Acrobat\BIB.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	139039
Entropy (8bit):	6.576021392303109
Encrypted:	false
SSDEEP:	3072:htelh2CidHqyCi2dxfYaIAOsyDSO0EZKwi7NalqAY6si/R8EcWRTV4lNYSr:velh2CiAU2rfYjAOBbNelTr
MD5:	0532381DBB4A7BE3E5D16CC4DC92FBA1
SHA1:	7E010FB47F882A9C19AF64BDAFE3A0D985D52621
SHA-256:	881131ED3D6FD3054638D8AED6B73C26AFDD929E4FDF0063A61C8260E8066DB9
SHA-512:	653AB1ACC36C5A92FFFFFCC944E3516D0680712AC4D443B9FDEFF6EEC9FD6FEAD4371E256BF22D01FCB0FCD98A8C94BA6B92082AA8B94B77239AC17BD82BEDE2
Malicious:	false
Preview:	..KY.Li..D..\|...5..:b.9m.Ms1q.78y.v..0.WX.io.t.hk[wUk....$..6...U.........e..k.m[..z.r....w..k.P..A...Y32.g`..~..8.Q..i...k....o..A..{b.....;.8.##.R....lT.A.m<HA.Y...p..y].N..Q?.....E...5....S.K.`?..Ug"...H@z!..Z,.J..^..........z..o.R]hD...1.V...47.<. ....T=..J...H....?2.... "H.zv........".D.......o?2.-.]}.Y......E..-..%..r..G...H..(R.Y...C.S.Jm.g..,..d.A.....-.{.B+5...%]."..Y....G..u.z..<n.9...}5E.r....Ez.D....i\|z.W...8.R....a...:..p....s...zw..a!..v...@.....$i;.......j.....1..........FN....A... 3......B~$.b.vw.\|.p....`.`.[......{.I.....g.K_z.8\|....+rq..!..!MX......S7lO..T..[E...fX..;W...T...........>....o?.^.!...h0.-TK. r....L.l..G...=Q.3.&.+..t...."........v.......V..Q.\|...#5...+.....0s{j.....e.....L.e...NDD....@e.......V..r..V...!.k.........`w..Y..K%\|...iF...... h..e.WE..H....C..O0...s7.;A.X....P...t.<...w.i..NS..*......bH,.`Ht.2x.mh"...1.93.....26............3j..Ax..7....y..6.5.6.voU...o.\.9.C.2.._.......Z8.u.t..

C:\Program Files\Adobe\Acrobat DC\Acrobat\BIBUtils.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	170271
Entropy (8bit):	6.625168117292074
Encrypted:	false
SSDEEP:	3072:VuH29eCp7wABkjFqK4QIRYq+W5i7HOhZ78AYTZ7z/VwMAOFw/OAjwJUrwr1So7:y0yABkjFqK0j+CrwrX
MD5:	9D573142FEC5AEA186F842DA463D54C0
SHA1:	63F9B8673BBF4D4B4CAFC63EF1B59D7DFFDECD20
SHA-256:	40DA2F94267644D3DE4BC5BE8A4CFC76E6038D4993487BFF5DDB20BE9A2736EC
SHA-512:	E61987D1C35BFF031431863BF54A4165D056CDBC59ADDD5B08A3981D071D6BAF1FC5F2CDF2539583D9070FEAAA28A64439764AD90DB0BE339BB57058B2D5BEDF
Malicious:	false
Preview:	.l/.v%...r.MP9......Y..Mw...........V..-...".u.h0.....}u...ew...q)0....a....).o.q...b6..}.i..V....x....1Og.T..AO.N..]...s....Sxz.7.R.%.IR....1."$.`...P..K)../..Q....TD?....\|a.md..]{..z6P....a...&....v...Qd?...4.^?..u.....f.1...q.;`..0:i...2.o.~w..!f09.p...d...........$eK&.a.(..m+yWHO:?g.'{.....T..N. a...fZ35...H.7.....\}....L....<.?/(M..Y...w9....N.Xz.!..a.dA.q...3.s.{.D.{&u;I]K..z..XczT.+J>..q.1..=.7...}..~..'..f:x.d...S@F...u..ig..i......T.H...fH?..<..g.1...Vb5.Q,....D......rq......;.............ds.?.l.A.........@..43%..Ve.G..........H.$..:...X.....+......y........m./.x.U.N$.@..N$uD...v._...9.}...:t.G.1y...H..\|.......z6.}Q.8N...5P... f..F.....y..Jq>..-S....e......@2\..r..p.H.=.... 0W.'C.y}..../.wIs........2......9A'c.......HA....I qi..OXb.....k.{...f.[.ZE..J...P.K.f....(...N._\ _r.yH..........m..2....c2d.{..`~....Ph..k..+.D.7..\|.LW..Vg..HBx....f.).....W.&....h.....\|J..%.j..^..#.;.X..v.....&./.4....C%...6..25:w!.j\..m&.....

C:\Program Files\Adobe\Acrobat DC\Acrobat\CRClient.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	492823
Entropy (8bit):	6.530800800714004
Encrypted:	false
SSDEEP:	12288:an9u2gSrgZhxzrHMxleIH70bt533oEVw7tBBtViUAN:g9u2g7ZbDMWIet533Na7t9CN
MD5:	1293AD474FB00925792C6C562252802F
SHA1:	999DEE9A574A0CB64A22CEB9AA6A2B1704E22FFD
SHA-256:	250F8AFAAFA9D5195C4BE75AD97937197FB9251BBDC8D521E941BA06FC1E287A
SHA-512:	04B0BA816844561D8528C61C56E41C34917E24754A5CE1E3818545048F0897EEB90A15D6B3173D8A16ADFDA3D0859AFF48817D4D406C46AC751E5384F4E0D872
Malicious:	false
Preview:	.9x..$Z..O..HL...U.....B....mN...N3...F.^..V.Ea...4..R7..l&X6H...l........ ;....S.?.g...._..S.7.s.=J...Q....HjOZ`.......:..K.....4....u.....d.....^.`.....{.?%n..I.....g=.v...e.VR/H.=...c .dp5..:..v!.O.y.O....\|..`..yeW.qC.&.Yp.h.y....I..x;..N..x..!..$W.-..D..{.....1.e.u^)......p..A..T)..Am.,...$.$7p}.......O8K......fe.$_L.f.7M."_...XW.....N.$..r[ .q....1..:><.w.@^`.VL..77\|Y.U......9...u...~f..............K.U.TS.z..n.U....Wk.w....z...Z....7...#.NQ/l......Ab.z._....kpl^..N+J.1z..s....7Y1..3...nK..^D..K.<....V.)oK.N9KW..Oh..^.l(d..m5.A...kg.".....\n.2../KX.`..........i... H.q...g....../....F.(3.[9(....;.......p.5#P...>....Qd.>.WO......n\.)n.-..yDJ..4...UT..h...!..6.+7!B....}...)g .C...X....#.l.....-..%..eMi..6.....t._WAFp...9...1.....tz.]...)..B.f.N..E.g..6.....E.......UL..+!e.....4.h.....R\....\...k....A...;.a.]cE.w..#.;E,/.o..._..\|d....9Ar.\|..yq.M....O...N.o.:.q.G..>....qv.....K.yu...e..tG.+..so.l*Xt..WgPS....R0KA.....+.....m...P..

C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	770327
Entropy (8bit):	6.517795161299559
Encrypted:	false
SSDEEP:	12288:82JeQNceiyhPS5zA4FLv3MX9yrPxkLfPIfUkxbRVjt4Fqf2J2CY5:82b1dhPgzA4FLv3MYPxk7PIskxXmEf2O
MD5:	E9A4B8D909FC66A64F954F4DC5BA4042
SHA1:	CE547336D46A5FA61172EBFBA00F8F1FCA8D74E4
SHA-256:	7FBE2C8425757E7FC1138776ACFEB8FC6139D22D82C247F6DA820F0C254822F9
SHA-512:	A974594DA5110ECB4714FB15A8F447C40F5D16A831A2451C79A2B85789FD6B49B92A1BE900D2A8ACD5E11D42481F8CFD5F8A2505F31F9AD3C683FF41A0EA8B2E
Malicious:	false
Preview:	]Gg...C..@Q..Y.4....X...}... ......{......Z..h....C...7....C..M..)..gQ0......T...5......U...j....\|.y...1.).9....>..G...0..q.t.E.6\..&f..Z9.[.=b..UN....Q.i.GD.x...i......(^z:c..D.....ADV...n._.a..>Q..^..fU...PB..;...D..'1...$I .a....+..=....a>&w.F..UVK.[04KT.....L..qnMg....EM.tJ.H\|...-v..J....D..yJ{...O..?..O.P.+..m.2..UT.7......\|.!..;....%..J..D.[...G:.5.%-....c.....mU.<..r....K.....f..g.c<.5.:.........K\.......<.......y.jN.......`...DJ.L..F...?.N..+...1ck7..m.'.....z.v.v.^;(,T...&......#.u.3.......kS9..y..`$-.......k.O..1...5,%.8.........9...}...Y...e...c.. 83..3....{.V.T..%..N..<D^...P..g....>p[.R..7.f.W..,..qCYeq..e.U.......4..FhX.r..y.6.ubj\..e....!..z...#$7j...g..h.:....TuI......Q......FQ/.tUI..%.l.!....g.9......`...c(.(..... .%z.2.>...."..q.........c...~^.....A...B.;.3...G.`1_..sS......AG..p.....!....'q(r...@2.(l..$...~).U..8...xN.^:.:.a@.\|.'..P..r.K.?...&6.../.>]....y..#......,..g.T.._......JN.^M.O..,W.xn..l..m...4...(.

C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	396567
Entropy (8bit):	6.324390007357804
Encrypted:	false
SSDEEP:	6144:PPlF1Hmgo955O5QzTXoDtrCd1JDQDTPPbRcZ0AnxI/5T:3r7o955O5woDtrCdKPz3+I/5T
MD5:	EDC4718715E6A8D5B22582A4F3C5986D
SHA1:	296105BF091FD74AC608200F987F801A2647B663
SHA-256:	89E3FB83FEF94F80799F70EAC35049928CF237E536BC1AEBA35902601303A656
SHA-512:	267C08732E6BCEAE376C6303E44ECEEC5829A360795175F4AA639473E2703260C68BB9FEE7992357F60766746BCB639DC8F8857418ADCB10469A9CDA724CD168
Malicious:	false
Preview:	.,.).P..s+'...{..r.;..b.+e.<.d.....7t....u...o.G.2q.'U.u..r......n..c.N....?........c.".l...5...hD.p@Hq......-..8...i..=.o.cO4.u.q.C.Q...{.<....O...$xrs.lz.S.M.d.J}R4+.S.Y....)/r..M..b..O..d..Y.i.].O........YM. ....../...A.(c..X"..m.r.^M.....Q......=..;.y.Y[..B..k....RO....GB./5..7hd..2..d...).[5;c.+.....6.>ps.'.tj.B.Y...Ap..B.+x..5,.0Ht.}....u.>.T.w...)D.k...!.^1.0....s..u..7...Ne0.d...=.?.M..s.pR.?....;.i3.....F...i.Zy.e.w...R..Vx..MR].7u.e.?........ .u.....y.3..7..;.sS ..@. ..]Y......"O.{.[.-.h..~..2x..bF.....W....Pr.z..;..@..`...b..ue..#.....z.5.ua....Q.Vkl.+7...,..;..b.}C......&.1d...m.7.P.]..........O.q...~. .?`..l?.........E...!y......a.q..{.!y....H..R>.....6P...pT9+A[%..^e/...K..Oy.].j.k..u....&..\J.8Z..@.......2Mc:.......5.~5.]i....>q..X..nB..^s+M...e..L.K46.o......p.J..L9%\|.....=.....8..@.....q....................9 ._...,c....0...(.XY.q3.z[ .I.Kl...i/6.5Y.Yn2.........5.dOt.S.5UQR\|...@?.@+...A...v.!`t.2.F.....aH.....W

C:\Program Files\Adobe\Acrobat DC\Acrobat\Click on 'Change' to select default PDF handler.pdf

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	187164
Entropy (8bit):	7.978477498994822
Encrypted:	false
SSDEEP:	3072:MY+fZ/++AMf1SBFLQ66wKaDUhrc5++LwCxMoOQoebQ7zixtjC0H0:lO/++11LkpDUC5bLjMooJzix4K0
MD5:	60447DA8CD215F56181F89FD1D20DB5D
SHA1:	EAC27E062C5AA7938435395533D96704475094B2
SHA-256:	F7FB13C436CD2D772499BDF09C526BC03FAB8528D0F2A97EDD06FB9DC29B8D1F
SHA-512:	4349E6412AD698F35417B2450008CC49433E05D134731E3A871852C4CDFBEBDDA87B68F51F5D50CF45041C13770575CE67EFD2851F45AEC86AD7FCE043497909
Malicious:	false
Preview:	...7.O.).O...... .4 ..mB...8D...!.;...`....p.w.%..:. ..N...e_..I.....D.t.:..m4.5..K.o."m...z...V...x...J.....%7.+_..}./...!.z.....O...3..@}....y."..(B."..6..H.r.L..6..oI.6..1...`....h.=...!.;..J`....k.%.3.O.....J..%.....Q{...;...j.g....?.6.+}+.......`GU&k...v........(M.....Z....^.Z.W8.I..6!d....(....6..Vi..w....._.{D.({f/....1.....9!U".E......~.,[..j..,g....lbC.9..0[.S.G0..j..nZ,'C.<..1F......F5r.2.~A....y...`.%A.(.R.#._...(...:.....P../.S.M....I.KX.F.0;......eW.3.vu........x....4R....V.%.S....8.S .ID.C..\|.H.....-t........09.y.s2.Eu.X.~./M-..........."Qd..a=....n.a..b-...0...W.w..m..B.-.._...D.d_.z.,...p....+.......&4.<.._.!8.lv2.L~.w.D......Z..7..."....s...l.X+..d... M..FNP......2pYMF ..L .~...*..G.....@.....Z...8).w.g528bc.%D....T..0.......~b.M?K.n..7T.......h...{d..T.Y.Y8s.....pH....s..U..7E.!6....q.E.m.M.....(P9..z.H.U/....D...`....a..noJ...:.Yi...INJ..i..`..A.....H.\|.ee.5@.....^v ......b..o....Uw...U..../.k..o.lC.I....j.E

C:\Program Files\Adobe\Acrobat DC\Acrobat\CoolType.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	4294431
Entropy (8bit):	6.7909605263538015
Encrypted:	false
SSDEEP:	49152:8C4OaewRokGfTxKvpksjSYmNPArHTVmtsX/4FoLC8OonUMVLB2o2FKXaxlLFMWWc:TzAvp8Ar3OS1UbYIlRMWW1Ctt/
MD5:	534785DC628D0D7687E9EC6046A489FA
SHA1:	5064A5ADBF89FE2DF7B53C1871D01866D614565C
SHA-256:	B91A5D0BBB146EF57A96A80920DA7B3468D9095924802D6554FBC1B4BB82CE10
SHA-512:	855F9C9D1AF36505785B492D30DA983939B4855105747EBA26CA0E7BDE3327D7906A740F541102F23EEA92B99444B1EC6BE81AFF1DB55ED26C274FFF25D12757
Malicious:	false
Preview:	..a.J.M$0...M...lNN.-;...F.. Z.kb.>..%..... ....5.j.N+a.xx...gQg.>.....+.......yuL.IJ..Wo./zr.......R..%J.~.s(....1Q.....9.C..z..g.!.M&.(...I#:...K>...p.2.h...Wp...yE.....k..e......X...D...........W.......U..QH..L.3$5....r.p....`.T.U..(..C.)..1n...x...W&.j....].y..{...k8.......9.P`.W.r.DI.w..RU].w..#.y.......gA6.....v.....X^./:.N.h....ha...8....]9...S.A.dt.zDe..../.C9.....?..y...........7Nu.BX..+...~....7......o[..xu...c...`J0K.Z..#q..F.'.....Zi.j..]..HOs.T3t).!..........q......[..~.X.............;...bX.R.XFx...iQ3I ~.M.....g..5..y..2.....$....)..n.Q.>'_...nA.[p.......Q....c.v....l...\|....i..`.0...%I...o...P.C4..-<.H=.F.M..l......+..D.N3......z..}..2.>F.[..#...?......$o.].~<q..h.:XG.x.Lh.%.{.....Y.,.p.P.N....,T......t.FVz..KD....7I..G...m.b....=.s.R..~l9O..".........a`.<.v[.#j27.?3Z;......-N}h"-...qRx.......L....$...)..{-..d..C..z.._..$/....a ..}1Z...:..a....Kx.dr...$}jN.N..W..&....c...J.RPA.p.:.......di.....%

C:\Program Files\Adobe\Acrobat DC\Acrobat\DirectInk.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	166167
Entropy (8bit):	6.55816075192781
Encrypted:	false
SSDEEP:	3072:vHfYy2eF9I6KYQXQgPSwKj4lCTVzd6ZyBYUNZCvfld2Rguyyx3j:ffY+vTKz/SwKj4wVFCynj
MD5:	7D3A40B2186E0A7F18A1D8FD9E9B9D0D
SHA1:	61F9BA2501451A4A7AE3E2A122F43130C8F14371
SHA-256:	A903731D30F83C8E3AC47FAFB5179BC9590CAF568CEDCAC8755E85FFEA77C78A
SHA-512:	0414582A4762E141266AEBDC80E54809931C005F3448C458AB39D216814206309B8D17EBBF857B9A06DDC20D7E955A06271EBD6E11AEA3A1FC36DFA554ABAFC3
Malicious:	false
Preview:	Q]..<",3...!..}.>!..H....f.n..m..C.O.....)-.Jz....H....%J)).D$..L.Z..k..G.j.&.c.S.:.B_.J2.\j......d.2."."Xx.n..Z\|...QN....Is}R.8..I..y..A..._..E;.J.2.c1.i....kS8.h....%q...7V.,.._.....b3Wf.X..77.mWL...o7....(.x.9-.2M..t..~F..p..Mq.R.m...\|,.:J.F...rh.......+..=0..@I.P.....DW...\D.%..!..J?...}........;+.........I'...... ....Z.Lo_..h.o..>.....55....e..Zt.`..7u.....T-Q...)....{...;..js......n.F..kO.....5Ow.C(.i...HT..U..X..KW.f.2d.$....R?..].A..4:.d".r\5.8...F...$.[9...O...m...."y.MDvQj.........c.GK..1._....2....3...bM]1..EQj.._'.p_@..%...3I7.J..W....Tf..V.........Kc.7l..l.....!.tH.S.n..epY...Q........,7/...-.m.@..cS.P.>..d....'G..Qb<:.~C...... .I.[.Y...<...5..s4.YLc..-o...`8...2..90p........V....<....V^B....O../....x..71..&=.P\|....h.WI#..e.4.q.......1J@ti.t.....7....&.r+.".-H..).......p..."h...Z!...$>...B/.sIc..m....{.Xg/a.z.D$....i.A....j.O..PV...v...gB..WF/.#.X.'.....xc^..C..x9q@....%.....74..k5:.A.[...oJ]I...tyl.H... .F.}9.....i

C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	134935
Entropy (8bit):	6.337434976453809
Encrypted:	false
SSDEEP:	3072:ELeoGcgWEhdDg+wF2XvSUgccy7Sq6ocWuOr8iww/BiYx:lWadkQgcJZ6Knww/Z
MD5:	19D9BA25EC6EC3B82737BC695F015CD8
SHA1:	856506EABE17FE4A68885C4F86BFF7EDBA77F839
SHA-256:	18359F23736527FCE215179C1B5FC784F236D46A8F30984EADA171931E1C5C8E
SHA-512:	2768038BFA75301317FE1E055C8358893112613D62D309B075ECBF8FBF9A2B67B56570E3170345F01BD1D77DCD39D791F86D70FFE737DAF49AEA04065919AE58
Malicious:	false
Preview:	..G..........,\.O..X.......r.....v.H..,. ...0.-.i.\?......-su.\..._mk\|G.."k..`...7W..M..G..7..f..MEo.W...8.F.....1Ke.4.F..}P.d...l.#.......uC......,..{.g...+.....,$.sb~..K.k..J....\|l.o...Ht..6_>.....kQ...5...'..rJ.v.t...\`.........(..2../..Z\|(.D.S..X..!.{...4[F....ZI..f2....:......py&S......a..xk.....".}.lW.M.,...(B.O8..K...M..-.c..6....U.\|.!i..j......x.YoT...WY....+.9mU.[z..%:...C.Y....<..L.'PV...........F ."4..._d....k2...P/....`.. y..G-4.. X...O.......".1#.5.B544....7bTj.Ed.. .qr......K.....u..aa.8.....!2.r..p.BM.]l.U7Eq....o.'....%>. ...O6..1k..G5.Pp\|...:.l...P.........a...r.`q.?....C.M...}.kQ.....A.).G..i.......l.......yI.`...;F...3....p+..C....B1.+0...[...e<.s....N...<kV[...\|.K..u..".@.@............MS..6s0~.~..^g.y.'.iT@..d...=..Y....K.g-...'L..A'..n2^.Q.K..Te.......J..C.X..\|.s.....O $e.K...%]..8...<....M.P..Ch...Tr.Qvp.?$....a".......e..!...1B....$.3v..7.RU..A.q.(.......s....4...3.E.....P...(...)..?.&2.H.F<N...,....{Z..7b.

C:\Program Files\Adobe\Acrobat DC\Acrobat\ExtendScript.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	795935
Entropy (8bit):	6.380879239063053
Encrypted:	false
SSDEEP:	12288:KKJEn7qlEuQAs//6LaR9ZceWO8EXSRiPgMcFQrVYrdL/EmEa3VF:bEn7qlEP6La+eWz3iBcFMYrdL8mEk/
MD5:	3FD4EA32A2B40E1043248F200FFD32C5
SHA1:	6B8E0A857E8FC9DD67D08506EFA9F791EA92E5E0
SHA-256:	1D0A421F24BCBA30314E6C6563189110ABB1FEEAB20720DD29A31A3DB887EB56
SHA-512:	F01106FFDBD3B7DCA793099B6F9FE1E8443CBFB1AD839EBAF881FA5D825D57B97FD85F45E09E17B3B733239091D9590220320D37B250F23F94F33BFD14E09381
Malicious:	false
Preview:	`..-.Z1...>R....u:.I^.2..i.n..pd....yj....."....A9..G...x.\`...&9O.....U....t....`y..p..Q..h..^...^..]9(.D.....H..45!..=.`....o(.x..6-.G./z.GQ.....Bz.........T..FX3{"u...w.?.6n..y.t...yEMg.(j..=gJKe~H....w..U........B..o.h....u\..\d".d.....=....f...?.....\|.sY.y....._.=M.....Sv.@.3..=~..LMq....%.ki..x\...^.....!.......?...4.C....p..X..P.;.g.}..1.s<^/-.-.H.=X....Dv.......f...<.._1...xg..[.cS7.a,.;.Cdp........j$:Bvvd`.j..4....#N.j%...M$~iI..4.I...50.k.>.&.&.B...AW.[.C.(.....v.1.L..w..9Vs.B4......CE.X7e..N.{....F.B....q....). ..j.?EWeP.<..P.o.;..4.....zg..`...x....M.R.}..`X.`.}.GO(.B...[;....2,.8c.4J...-\|.2...T...T...K...+.%n.(W...;.l.q......r..P?...E.=t.....A.yX.x..l"#..+...\|C7..Hz.~.d...QI..,R..osf.Gpcf.N.....q..!.....7.R.in..R.n.......q....^..&./..#....>....!T....@...........#....%]V.S..0'..<.c.H......C}..>z.T..\|.u...y..!k5.J.8P..S.l$q.#jS.V\...2../.p..x.9p......^.. .t...v`.;Q#Mc..p..r...u...........2.....j..p.t..LJ......~.V....T.

C:\Program Files\Adobe\Acrobat DC\Acrobat\JP2KLib.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	673047
Entropy (8bit):	6.807106763221049
Encrypted:	false
SSDEEP:	12288:XgAvDzwoZ5eTpx/WST+7h+wE12SuZ95ZxZ:QALzQpxOm+7EUz35ZxZ
MD5:	AE9763FA0F96DD9A8F2B55EFD2E1637D
SHA1:	39A3C950C7A0285CA8D1044553A5F62DB3D2C7FA
SHA-256:	0F9BC81931AC6D33CE221274E0B8C7226479C186F653573AF682007B6CB10A0F
SHA-512:	B509411BB02617B35A06AD44E4406F2B160D0D7B08C84001CD78FC67D8F545684D6A10CA1A8952D09E7CD3C8AEA037CCDEC6BADBDB233F2622B04B828EB55499
Malicious:	false
Preview:	{oA................W/.f4.h..&..B..aa..=......kp.#r~cp.Y.'..f.G.X...k..n.nz.\|.......u....e....r....T............s....V{.{.!...3i...#PO...C..I....~..I.L/H..4.F!H...aL.4>.{...l.j...T.!..HN<.)Xowz..........ep.D....c_>..f.}...BY-!.EO....z)".Fr.M13T0.f.KD.....w....\|.&)...b.s.9.Cpp....W..Y4?rU.>..D#.../.Z....X-_.:.K.ZV..u...aT...p}..Y..P...;w..~DZ......n..v...l....@...b.?..8.(.tW...;.:.(....M......mF/..T.#.."j...3.I..a-....rzJ.}.A....t.jLC.3..\..x..h.M...{..y....l<...H.b.F.......>....v=..)^m.~....Ce.5...8.MdQ...k....t/..c...i..d..2.......05sY....A...0h..:..#b.....~..T.>.oZ-.1....J0H.o...7\.\|?g.!.o.R..:j..<.6...^......Xz.%.......JfvE......`L..TKk?}..">R..b...WyP.dW..[.8...P7d....?....6R/....l..kf.Wh....K.F.S..:..U.n.u3B..jb.C....D.I.!..].........Qv./.U.r.U...(q.S=...:.....L,...._5..N..9..YC0.....C..6.....x.&.Sr].v(...J...m0.8(.^.........r...z...n.jit.2Y....7...g.).mk.....P...v..=-.........uh..v....85.....&y.mK..%.....Q../.Nc...D\.Q.C-.g..\.

C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1113879
Entropy (8bit):	6.798406883264494
Encrypted:	false
SSDEEP:	24576:dbxOZBdMruw8duTVNISv6OU4W3ICnUJezmcBCwxHnVe:dM6WYzI4kncez9fnVe
MD5:	A22EA43286CC90B385F6C1D60E76C5F6
SHA1:	19C5A317C04FD4078FC3E5565AB814797515DD4C
SHA-256:	0AD023F5009ADEC27814F44F3C17E564DF0DBF3BB50C211E51B40BE60809EC18
SHA-512:	55C123D882E5D9FE73802576A634555D0C776A39C1A3EBA165995A6321F6733296A8DDBCE7809D4093C4E141D7DF2F0CCC49ECED5732A1F79A1C0A80EB47B9B9
Malicious:	false
Preview:	LJ.&=....Z.&.f...?..G.I.DoK4./....]c....~...l.E\|3..].,..z?.;I.....3)juJ.k&...9..x.lId..k....]...}.AN.@........B..].6.........=^..\T....d.Vr...)3tK..I....#ez......kY.e.f.{.z..$^.....o9.................hP>..:.'k\|....b....B....g..z.A...4.....9...V.......;...\.y.b.DX.F.wS..u..Y.vQj.1E..q.....y=.1...&..8p.eq..z..5R.......U.~gnT.3l.Y..'..I..s......c\."Km....K.....u.i.(.....3C.W....7......-n$.p...o........Sl..e....\|..u.C.kIb.....}}~zYFq?..)..R.S..<G......O.ABz......)......N. 2.U..c.#..VL.x.T...Dvwo.^.{x.&...\|.N.....v....`@....W3>.`F.t))iT fg..!....$zD..".IV......#.^..'...).F...S..=y......+.s..pA....C.Lj.0x..X.pf..}.....7.7..){.Y.0ij.b..^Z..+.W..,...xs}..VX..W.d.\|g.JJ._..(.Ilc.7....+..lh.\|x.\...X....u..WS.D...Jh..A..Sg.$.....\|....YRO`".\|.%..N..y.`.X...]...$W...<...WQ.k...&.p0..).[...f;..DVN...0H.N.h$..<........&j%R.0.,................y(..\.{...O:.3.2[.....G.R...X..c....%@*.r.ncN:FqG..-..7...a...Y+.O~.).}@E....R...`....3..2..3....Z..

C:\Program Files\Adobe\Acrobat DC\Acrobat\PDFPrevHndlr.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	126231
Entropy (8bit):	6.482903335878256
Encrypted:	false
SSDEEP:	3072:BCmvFzu5L/07EH73+N4PZmpqqwtJykVdsjDx3:V9zu5zwEH73+Gjvte9
MD5:	6D3E096AA9D8267170E868F94AA2F66C
SHA1:	653DE2063F81075E8957B448EF33B48E31D95F1D
SHA-256:	C11C956E9E71C75045E5483B782515F502A245EA57A73423758E42ED5CAB2EDA
SHA-512:	53B0F53F67E1492B22858EF4BB3B1A663250C5EB2F40F83C2C05E7F67744C7C0DD8268AA23732964B54BFE1CBB816057FC111975DD23BF1969E5A24E1070EEEE
Malicious:	false
Preview:	..T-..-i;'U.i.......Q..}..we.@..=.z.-i".....6....5.u..!./P....L../...Q..Gz...`.......:.Dxp......`Q.9.....V.(%.........F.6...9..\|1B1.'..1..[..eR...DB;c.I...p..=}.L@^.E..4..=&b'A..^.z..1.F....i>.6A..\.m..oX..k...Xf...U.ye...A.Q..Y......v.g.G...q6.=.].8.Q..^)7^........t.Lja....6-..Oh./........... maSHV.~..E...[.^......6.>..q..U..X..5w.+.b..\|...ngr.C....`..J.b.;...M..D..:.n=......V.vJ.B4.q.1j.MK.j..x.......W!B.....i :V.S.>.0....Q.......W.CW.z...-o# {d.2..cM1.W..2c..I.........u..D.4IU...D......+.....:g.'.........?.......d._1....s/......j..."dP.L..hg..$.P....w.SE7.l.....6.'?;...@.f.....c.W.. :.V..A.....Y.I....3...$.4[G r......./...D....3U.. k.$e.....n4g...i..........@.\|.-.z......!q.jP.......u.e7.N..HP.~.....Y..e`i....\|....`1.G"k..L..u..._b.,..../.BF...BB.m......W.P-.g$...=.._..-.`.N9\|<C9.$...:...[.@.......V.\....Y.l.4.-.....[...\iby.N....,6...n'.0CTQ.k........y7q......>1.DG..Ni9..p.cR.f.../...Y.r...p`... .H..b...Z..W..2..$OR.:.WY..U.(o

C:\Program Files\Adobe\Acrobat DC\Acrobat\PDFSigQFormalRep.pdf

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	468533
Entropy (8bit):	6.367001576333683
Encrypted:	false
SSDEEP:	12288:gO5solUH4MhwBBv/7nQyhLCYRCtvhnAAURHO2Pj0Vjt6aS1aES1S3MO6ScaE/X2K:gOeYqHNi7Sv
MD5:	E9169AAD01C55A164554D6434B2CBA86
SHA1:	F4F38BCA7A29CDBAE29FE6A1DE69B0D758679E8E
SHA-256:	CFBFDC832D7F8D107BDE823430DEEAB8C6A730D48DF171CA1E88F8A55D1AF548
SHA-512:	5096FE7955D27ED095A0F62914A89510F627A2CC867BF3510E2B3669F22D2B177BF3249246E2C9C1A7854C55261434E4C123748574B432BAE7F96ABFA2E09CF8
Malicious:	false
Preview:	:......Z......0l.hj......WQ.riJ.......!.......j....r..?b...xe.!..w..... ....@...?..s..@....A..,.7.A-...b...w...?.4xI.b{.N+.l.9...zP.j..9......2Tw.]<)s..).....4.Mu+..d.E.'...g...h...!@N."'.s..k.vF......nF.w...].c.....'`........>;K.I.b`_.S>....m3..C3.k.M}..J(..w..W..8.Z....\|..\D.Gp.d...I.-.R.o..2......3...2......+=F.O"RnOEi....}....2I..Z...j.....W...sCJ.....\..[..w....ek,.5.G.Y....6/${.....8b.....P...k.4.."....hf....wk.9).>.bF(..D..#:q#.X.B.-=....g^.{p._ImP........S.G.7.C....[.b....6..qI.xb..RZ\|.....x..x...).X.c.BD.6.6:!cluk...6.....?.DO....3U.J.I....Q.p..n3Y..%....L.M.Y......X3e.E.I.:!Q...j........t./.v..0....\^.t7..T?...Xb......H..TE....le22..mCO.f..Q.kx...jW.s.j...XQ$c.e......b.!.....Sq........@.T...+R.6.+....(n....h.v>v...9......#...{..P^o%...>.3.r.h.-....#N......I<.....W...........M..........p...>].........w.{)T...!2.kH.7...I..d.........d.==.".O...s..V..".+.,.L._..* ..}.......k....N..k^..e......M...-.e....-..]..W......~.X.n

C:\Program Files\Adobe\Acrobat DC\Acrobat\RTC.der

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	7.646162995651588
Encrypted:	false
SSDEEP:	24:x69LycM3HWPLpbmU+sNX+1JyfgQ9AvnBH0RRgRmeVHrUJsK8rxlIb8VhW:x69Ly8pbmJeX84IQmJHHmeVbLLqUhW
MD5:	68F11C5E663997F2F94312AD9308E97B
SHA1:	5BDE74CF0F70EA8A44404000D552A9061D58B35B
SHA-256:	32879C86CD98C6B593EB1A036C46A1647724AAC97488BCFDD5182EDB74CF06AD
SHA-512:	71D0701624502B0AC2C0ABA37F4FACDD2E713324864F077BF27FA67A196AEAC3BD3901966D1C152996A761CF3B58C36A988EC59DABD52640CE450164A305E379
Malicious:	false
Preview:	.L?....j.._.0...^....HV+@,.P.[..7}Oj..P/s..k(J.Jt..S..5.$v...3..W..ehEv..6 ..T....xJ..`.v...-9......A.2.g:.n.<.u..=....J(0..8.Q....n...W.t.u.l...x3l.y.d.......N..o...O2...G.o+......2...F..\.G..yD...)..t.\...r..>...PC. N^.U..U?...`3.....l..h.'.).\=.Lu.<...z.$...\......jF0..Q.1y.....d.......]..H......#&]..!.Y:.RP.f.0..x.....R...s.......}.S.;..`....p..3.....K.O+duX..!w...........k#.W=...=..r a..c%.ti.N!.....\|.....:....._....ag.3t.b....l..r.?3%...>.... q....K...vY....+..x&.FEh...)...N..Lr....<...s...4.k..{.%..e@p+..N.M..m.dx...2..w.).........<Ho.+5..h.0c...uz..R.P..l........"oCty.,N.G......^t.n8Ne.......1.66`........^;.GXO..\|......Dw8.....x(8O.&.....\...,..f........V....\..M....M...)^.[.~.X.{..?Fq...8Z...U..Z..._.....?.....tbpB.]...v$._/.Rz.q....f...6..$.<..r...u..x...!. iO....E8.Q....j.F.....H.S..u.\|.2_$...]..t......>.PkU]O....(2..wr:./.....6....5.... ........{.j.Y{..~..k......<y.F.w~Z..%...]uPdV.68.o..\.br..g}.M$..8.&.4..\|\|.

C:\Program Files\Adobe\Acrobat DC\Acrobat\ReaderUC.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2957087
Entropy (8bit):	6.679455933263905
Encrypted:	false
SSDEEP:	49152:0UIfdvWOuXVyxu6w2bto0HBmq1hoZCEbkN3Y90h7SdNm0Qfuc:0FLxf5Th3Y90h7445
MD5:	EC38DB300A1DF551727F63691EFC7B7F
SHA1:	57EBD6A315FA27BECACA4070A70297A07EA7DC97
SHA-256:	EFE96C4C0476BA5D085452C82C53A3A31EC471A13A503D25D6D8DD353500BBF0
SHA-512:	BED7231B0F93E78FD8F3FD6C020E85EAFF1C1A2D528D0663C64931A56C503CDAB1CD50E91C825C039D3FBC7D87247682C12B8CC61626973680AC7C88D59F986A
Malicious:	false
Preview:	o..r.^.J..F...b.<4@......^@.R..P.E..%.\.....D7.p....g......WU..._...Yo...p.&;+..I......0X....@..7.7H..>.[..Q..!...;s^N.u.$.;..Zg.au..4..5...h..-?.y_....bs\.)...c...c.6.;.B .0...%.........X.dc....!..b.Ebr..W...SH...Zx..B.{..-g/..m..^.............cq.8..%..I9F..V\|L.....&^z..@P...g...fdT?....\U_....$.1O..+..v.....CG(~\L.u..b&zM.i....h)S'..;...sR+.hf.V..lV....>...f.J...z..<7.U.[.>.d[.r....M.m.......`...q..1...vJ...<.?&.SS/6et.N.....Ste......c]..1..)..[..^N..../.}.w_t..k"..f........0..2.L..^.!..=.....#..9.XB.b.......j.c..c.c8.]F.. .~4.w/.(...[b}P~.....&....X.aA...>..S....V.f.."..T.N....3..".rC.5......bYm%^.r\.8.V6S.=..0....B......Zz8..9P....Y....U.e..9t@,..o.Y..r...e.%.Zp_...;........L...y(...e...R...]fi..N.<+.4,....\5....i.\...r......Zs..D.U....1?.+....cq.OI...\..18......=.k.L...5).....3.5.dxA".a-...i..p.....$...R9)..R..>....h..n.....2'......V.^....?j6..G.P..V.....pR...................j..-1.pHA...!..3M.. <..F..........C.*.@:.ij.

C:\Program Files\Adobe\Acrobat DC\Acrobat\ScCore.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	720159
Entropy (8bit):	6.5908976798779735
Encrypted:	false
SSDEEP:	12288:9l4OO5fEwzU8ETqXQ8fNB+bwkY9qpmxu2PS+WePeXdwe:9l4OX18ETqXQrwkY9qcraI+me
MD5:	92CE375643446A3C98AEC8A334A1D6AD
SHA1:	CD814259D570088ACA6D40A7BB5A747A457F30F8
SHA-256:	C5C8E48D1873CCDF083F6E0892069C6895D095162A3401FA5E11DB41DC5B1923
SHA-512:	9BE7EF74BF066F4B208E93FD7CFCD7F05E1DA878D3C0C933F01CD2EC9F697A82455196A66E411D427BACA88BD29F79A39B739670B9584B6D024026EDA3874E09
Malicious:	false
Preview:	....%.p...*.C....).{..++.m...<.'&.RQ....^G.?l...g.M.C)l;..uF...Jw......r./[!.....>zD...x..L.Y~UE.4.2_2c>..xQ...o....%}.w...Z.F.......I...L.]..2..}....y....~.k........m=b.Z.........q..f^C@.~.%..........g>....K,Og..D.R....`..{....v.z....u...E2....P,.y.j...b.""....o7\|.1b.x..Q......P..=.H..\|.u..H4..}.o%.T..]......5z.a..8n.w...$,.v.\|-).~..Z. c"..up..[....r..n....\.;.P.h.;4...T_"K.7.}.. .OZ...ci.=.t.)..g1....1.!..&R.;...[.[<.o..b/....\.G_4&..g..6.cP.o.C"...<.8M'..b?...]#....I.l.1&!..l...6. ..Us0g.......a.....^.....1....!F.V..F...r}.....ZT...S...a..=`C$xS.I....P......,..H.N..C....v]...H..BcJe..b ...y...\.k......... .1A~.\Q0s.M.`..{.._.......2h2..A.`.M>t.y#$.^C..O...6.r....;...p..,....0..>.b..p...b@t..0...J.H.5..})?.6.4.Y../.Wqs._m..\.xxK..$...m..:.w.i\|{.T.ZZ.....9.S.&}......hj.....9~7->..`..nO:..H...JK..G9)m..=.._ .\b...R....(........+...F..Z.K..Ulu..[...=45..I.\...Y...#.z..0B....c..}..O.u...J_].y....xJU...\|.B....q.~...Y.'.~hv.}.r....h...SH..}.8.w..W..

C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	24343
Entropy (8bit):	7.073140167427344
Encrypted:	false
SSDEEP:	384:bgvWwrB0YFW20rhnJcBIaPqMHgl+ZwcIaij9fLkm638E9/6FXvrBXxlj:bDUg20sBIaPqMAldNaijhQvME587
MD5:	78DC9699C0F3ACB77AFB5FBAB5F4338E
SHA1:	4A0319DDAC38D927F07A3053FAB0C98B339BA225
SHA-256:	4057083B8580A2EB16DC989AA1E81AC4C254D9D5CF07A8F18170CCA082738883
SHA-512:	1A6FC029756884EF02D24A163A3ED147D899E81FF51C3196688E56690434B457A06F672020761301EEFC52F4A01BD8D54B08EF6B549B0440898BD5AA05AD8D32
Malicious:	false
Preview:	5[..#G.b.....(...J.O).O=......%n...~5..U%.\...i.lg&A....y1.L.e.~.....2.v!9..B....X..N.9"'..8. ....JQ%....V..2...m...I...Bn...tfV.e{..@H..T.n.j.\..=...... .4Er.M'.{..u"..Z..R.......r.v.V.%...O.V=..q..1&........7GG2.&..k....o....._h....6.t@$.?.....U...E..?..o>...IRoD..9.7w.M...%..;.83v.a..XB.u.iq.0...iDV.zJ..L.i1u.8.M.......z.....+H......y..y.....c.Y....C ...4.r....O:fF.._..._b....5lO0R......RN..;>.OP;.^....TxR."......\M....{&...YN...Z..Z........[]..K{........by,..........WjN`.G..;...rL].Y].?..D.".+k,...!...p:...^.&.J...]&....`RU....%P...pD.@...^.q.L.JpE.x.".xbab.l.j.^Q.... <=..."2+......${<.3P.BE.........nX(sy.."^.c`Nkg.H.7...a..6.r....,....>.\|......I%.N..u...tU}.g.....wj..c.....>?.I.K....=...0-...T... .....4.....o.\kvR.yL.@.....B.YHf,m...G.c..M.i...`.._.x.-<N..AJ.6&%"B..*.8.-JN..7.?#.l....F..Z...4\~.E.~{......Ns\|V....\...W.y.#O.!z.)..%..".O..dx....b.`.l.gv..<..G....4..0c&...<..{+d..."..m...\#.%gu".......Z.2...7.....)..$?"...7\|..T.M..t..x.p.

C:\Program Files\Adobe\Acrobat DC\Acrobat\ViewerPS.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	27927
Entropy (8bit):	6.832928701214612
Encrypted:	false
SSDEEP:	384:DcUu8LtS48Uz1qsQJ28Z7VTtTz7C1tM7wJUKYn9YvviHNxbb9FFkX2yxzsl:Is07sGZTfC1WkvYnS4x3efAl
MD5:	CA52BF7A8682ABDBCA2A4D83972375ED
SHA1:	F9B9854C25CA912D09E217C4FC2E532E194D123A
SHA-256:	38A2B1C855CD2046FD66857E062F75AC38970C7BC3FA3C377D2104F3C0DD1D19
SHA-512:	CDC8C76A61039A34590862BE64450DBEED5C1D5665DC376D24C57ABFBB4E20BB45347A532903A540B75A37823BD672A2E2B9B224EE522AD47F0292D98FF7CE99
Malicious:	false
Preview:	..Oy.`.x.....F..l.......h.h6.....UY....w!......a.x...._eh.....[R...u..sN...Y..d.......u:...fF...JN.&7..$.h.GE{Y.....4......Z............?L.6...jD..`J_FpZ..R..~.:.9.G>... $.?\.....a...ZK.H...G..8d.-h.4....g.m f...............].3.<..G..a.Cy..#;..Bs...I.n(7B...wFB4........T...A..O.....x.kY.8..D.o...nB..VC..O^a..d.@l....;.c....n....plg.b. ..!\}.4...i....}....[.l.$..M.B.1......0._..V.A......`........_.;.....^......3.sO...\..J_..J.Q#]&G[.....t.D:....A...q...t>...4..W.i.v.m`...Y%.k.o..._9.m.@..j=l...r...8..i...;n"y.D.........7.L.j.d.O....e9hm..y.'..z.......Q...c.g ..Wu...-..v.........T....8..({.....F.q....K}...]...a....u.H..lC1..._.1J..n..d........!.#8.. ).Y...g.'.+.....1&\\.j.......q2a.0_.);.p_#.p....QS{...E<...9.H.o...*.\.v..&.YZ>9.MI8wx..]#].l....P:..n..".iGGn.Ko..nk.x?...S1....:i.Y."...='tN....w.l._.P.n.....'.y~?L... @. .r pR..x..Pv..^.......:....?.=O.].B..........gd(....d.@...=.z.EJ..Yrp.C.<5t..b.x.!...rR.g..m..D

C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat.tlb

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	67307
Entropy (8bit):	5.8782465034110825
Encrypted:	false
SSDEEP:	1536:lMgea3BIYSIfZmz2MbCBfa87ZK0e5H8K9b5oCK1gR+EXRM:lZY2Mbua8FeJ5y9
MD5:	C15F7A3C244CDE0368476D384171DD61
SHA1:	48D934DC549576687DED4A205B91554233F509D8
SHA-256:	1F283A543DCFCBC17E84249004B37C6023F731F360F5F5FF2EE0B8A3488834BF
SHA-512:	C8965A8588F05B90366E3DBF5AE5B81F3BDDF8A62F49F7F46463C2A0E3F309609B2C77D31AB4C310AC22212BA2C0F06D73F6642ADFAE65D4F17FF57C6FC4859C
Malicious:	false
Preview:	8.H;.V..P.0.....s.1]..+(..Lb...K..n............iR..l..M.....5Z.y......el&.p.0..H4....UV^....:..{....b^.S...%...r.e......)M.......G...../d..XPc.DR..c.^,r...sq.Y...0R....@...K..{w.Z.....+%.....J.I."..a....8..lk.k.o...{Xb..g...}...o..k..z@.Ri.`B7......+.....7G.:.(M.....r..e n...M..X....P..9.?...E..<....`IF,.. Q...I.tn.7..2.......#..5..e.\|.}E.)(...k.....F.hvn....P.UiX...M.#..l..u.j..MfqpO."#.z.@E..r.....SIw.H{8..]!..<....I\C.......2...0t.`..=..A.Q.W.Hna..f.}(..>0Q\|S.Q.5.Q.......4.......IHe.;.._sA.G".k....h...e.KC97.B(...yC..S..#...w.>.>...?&..jcV."x...p^.[.mfl&......E...9.].._.O...w}[9a.4..`D...k.~.a.?.{T..:... B....J...)...ri...l. ..V=R...w+..(.!j...G...A.1-H.4o...9y.."...%..C.!.....2...D...;:.09.S1..eY.d..D'.......m..i........m)}M...Q<w^...[."]r.6%.[..C.\|+...'.k....@).y......g\|.#cbi....}L.[.t....A.p..Y.&1.k..].E.b.:.b..E... ..x.^H.8.C.....`g...N....m.0..r.a.g.K.t;.D1....@fm....v..}$ds\|....V.].kr...8.......i......ag....x3.+.?&...

C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_reader_appicon_16.png

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	696
Entropy (8bit):	7.045027504512754
Encrypted:	false
SSDEEP:	12:gzHnbxqXWB4npkoImSv8WkI1umTXl7h0j4gQBg0W:gz97oI8Y17WpQW
MD5:	A2C34F5D7A6DD004567DA84079BC139B
SHA1:	056E920106C534A914CD25BC8EAF726977C7E75C
SHA-256:	8E0F8949A4E36FB76E20A0C1BF5D6F58B8377BFDB676C8CD66B86AE9180AAB6D
SHA-512:	6348576C23434195F33A342E2AED317630C9508DA912B11BB55E77B1F990308E87829B1B40C7CBC5271BABB5D4DACF0FE21C9948F1A3D91A2DB96ECCC1672C53
Malicious:	false
Preview:	:.j....qV.........[f..6..?...X.2m..5.h..=;...l>.....\...@..7,.....J.....l).....]."...D2 $.e.Dv.d=}5.b.M..K....(..9.#..4.....R.L....X`5f..xd..uy.5.\|p.')0.....>[..-...}@..\|.8.....o..^..@9N..[....h.2..]]..H...}..5.... ....z......$\....Y_h;..........A...v......../....)^.......0....(..?u.Q...F...0a&".(.0.P....9.d.....?8........c3......IEND.B`........8.............rs....h.r.....x.\.^^.!%..I.....L..&...lp..../2}.F...9...2f.H.._....(...6.....,.g...y.....YQ.......m....K.:.2.. `....O.%.. ..6..H.(]..!...<..].5..oe.]mKg..(..N....y......................................................................................@...............Y@....czyzk0zzhil.

C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	42775
Entropy (8bit):	6.724642534176655
Encrypted:	false
SSDEEP:	768:6F1hgmZZBE1B9gcTx/0bOaYeJ4KWvDesdZ/1hvY1S2K/yNaCEL2i:617jET9gNqaUKoesdZ/1hvgMKaf
MD5:	DC6E9B074DEC6265EBF8BB6F99C9A5AF
SHA1:	8A9A2AFBBB20EDEAD6B545A5EB7159062B7D49F5
SHA-256:	C4F1392E0E53859680E01450402EC66168123520FAD35BF62DE86AEF96AD92FE
SHA-512:	9D0A5DD35536C16BA13079C3772E6764EDCC52E2BA6EBF7EB1E71D46B6F5F3768923D362393190AB0E1D3E632122C531D4413240C3E8E3F832EFC44478202566
Malicious:	false
Preview:	.L.`u....r.>.._.2.P.../......\|9V.N.a..14.h.../e.:.i..O.>.%..L.........C.y.T=".K..Vi.c.[.u?..+Q.(..lTR...8pK. ..=,./Nq#_.............c.....dy2$H....KO...d..)......1..F....2..y......gwb.7x...p....Q2...E5I...:...p......ep.aWE/.=..6.....<.%p+......?.....)=.i..J.K..8..{+.e.q.p.........)G....P.r. ..n..^d...^H...?.?.S9.+gP.Xm........z_0...'m/.L.f.f.+.{.*....#.%p...%...QO.p....P....q....;..e_.(......AO...Z..t...T.`..Yr:+=.P.#.o.....8.}&...E..^..e4...^uF<....2^.\|M=D..#`...Ib4.t!...J...^..&...22._.a{$....cEg.j:....QM.>._.\|..R.D=..j..%..m.o.u.&....`Oh>X.v..B..s2Z....W3(......9sW.%.Tu<Mt..D.?.3..{WS.Kx.....NAL..?.....^....!..q2..mB..C.....^..T8I.P}A.......@..m...h!.A.c.....~M.........&d...4h.[2.....z#u....[^..6A!'3.W.`..<.y5.@xo1%....V.00z..z...p.G....r.9.e...}c5........'.e.....}...........Vg'.Y....R..<.q....\..l6.+..;...0}...u..g...r.%2...y.....n.g_..0l.%...[[._.q.z.N.U.c).8.....L.'e+.l.......@.2..&u....E..!....4D.....z.?.^.z........?..C..u

C:\Program Files\Adobe\Acrobat DC\Acrobat\adobeafp.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	376095
Entropy (8bit):	6.43394297535095
Encrypted:	false
SSDEEP:	6144:YYybK8DV8VnV4GuuNZX1KEQw1pkbiLG/CH543Jo94z:EbX8VnGuZ49+LUCH94z
MD5:	41379DF3E314560EE75012877F0AB83C
SHA1:	EA42438A5FD77D0DEE75813B846F13B4E70D423A
SHA-256:	2C2DCEEF8C98CD0F1566B4418C5A793EFAD0033BBE4944B2946DB7D514A0195C
SHA-512:	4572F7F8EF92C6B4390BCFDAC580AB566E09EE0F0CF3F57BB296EDC0CD4FCCE8ED6B8747D72DAD04113C2B751E77D9106AEB4D6A72A1ADAEEC3991549BDFD258
Malicious:	false
Preview:	.3.../.f.\8......c.8......../...U.F .".........g.....r....!,....B.f...Q.k./.4N.Y!...k....od+.%]^......3..&.yDO.... .p.6..i-..SEW..N>.)..ym. .R..+....s:#..'0eBn.T.V&..3._.u.UF..._.8....-.lve....Qm............`.+?/B....F.;...bK..%...2+...A..9....H.._...i....AD-Z......E..5WZ.N.O..s`........e-.q,39..<7.PBC....L.tf....,..I..v+[0...f..mR-h......}..E).= .2.....E.i.....n9....?..O..h...;....g{l..3.0.9 /........-C].s.$.B~.8e./.$dG..8.....i.......TE.V .,u.Q-..]N..i...?W....a.{\|.....\|.....M._.T.....A.u....!.(;@1....n....GV..@..M.1..4.<.s..U0..I.. ..0`}OF...._........hq5\f.........&7b.2.....=..P.k...h.{...Lz#..i..?e;.. .R.F.q.2NY....C..'......G.Y]..0p<...._...4.wS..H;..YM..$.Au.O2..v.A.I[8B........a.z.L........q<....7..ySl.Y....i....X{.D...kX-..l.O..xk...{_.d...4.Vx7U.<.[~.....j...a....pA..GF.p.......E._H.{...z....4t.N>:.y......@....@.n==.U/wMb{.!.Z....w.s.&}...p...Ko-..}..i.Lr7.J..............VO..\p.fF!C..:...K.....Ei.j.%.?..P..3..9.4.E:%`.=..

C:\Program Files\Adobe\Acrobat DC\Acrobat\ahclient.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	367895
Entropy (8bit):	6.601924487681807
Encrypted:	false
SSDEEP:	6144:iWRR5moFSZOSu7k6ba/d7J8i31aiHje6EkNVnJDuHW:JmySXT6bcezmdC2
MD5:	0DBACD9A32EF50E89819EACE1F8CA9A5
SHA1:	88633D8E00FE34F18009DD72981BC4044C508EE9
SHA-256:	58FF742E74456C17CA223F2FD3BD6FC3EAE19B4D5B7A8DE6683D36D3EA5CA22E
SHA-512:	E5668655AFCF7ACE48D761D9D16BC3A7F2021C1FB9DE67CF8F50C88301B5165539C70AC3738FF0ECBE11790D1671EBBE23F9095AF6A48DEDBBA2F76E4B96588D
Malicious:	false
Preview:	..........D......O....q.L..Kj...`.c.y.)..D..x.B\.}.....y!...2.=.s...C.8.r.~.....~'...l&~.......=.#..{.........f..t.+.U9B2.....U@...I6k.\K..5.`...I...j.5t..:.....M...M..\|TH.L....1....Gs.8c0..~.....t..F.T..d...>#8LF..s.A..5\S2SX?3k9....&`W..'..h]U..(....q.{o.G...q..=..j..4E.FR...i/....:jy....\|EJ~HQ...e.\|......1.#x...(8..-.....^<....5.UK.h.I..d.CC...Z....ky`._..J;8Lk.Q.0...?..4$...#........)..................O.6..".z.:........T.u..6. %o..d.c?.d4.@+C.6.._.k..i.......h.}..W.`o<.9..fX......h!..\.-`...lH.9..p..N..Y...J'>O...Q.spjM....N...s.]p.<#..j..i.N..{.;...X..`.....}.....I.......o.Po...P'.2IT..+....3........d.'$......I....mB\|){.K..".....H.5_..."4.~..dx.2h...?rQ..0....].9.v...].EX}...R...Lm..=P..\|GgU..Fw..4.O.4.T2.....k.:o.e.@dLw.$.TN..F.=.g....m#..[..g..kU.Y.`{..d-...F.K...b....i.._.(m...[.=e.y.J.(.c.}.W.l.:.K...H.8.u....N...[<....p.E.i.f..E...[.~...L[....Yz...4z..p.N...C..D.. }.y..{.W.<..6..p..e..^...,`{@.....E5..%~.....#.W..v.VWe..H..

C:\Program Files\Adobe\Acrobat DC\Acrobat\ccme_asym.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	266567
Entropy (8bit):	6.482813620957779
Encrypted:	false
SSDEEP:	6144:7pYS6jxnLZeFtC3r6RMgEsLyxj40/4MpEhc3LETw4Sq/0RwA3O:FP6jxnLmtC3re78xjHehcgTyM
MD5:	35BCB4CE7D2011CD34D9435592BBB01B
SHA1:	B7AAF280BFDD0402AAAF19B665163663C770D2D0
SHA-256:	9A8DB1591700DF51E2737F0127669AE4C6D979F2B74D4C476C5CDE2C0709BB44
SHA-512:	E3D3C3B7C0BE7888B72C3E5EEBF7C4A7CF318C6667AE6957B4CD61066A35568FA3AC91182DB51F25668F7379C667991A82D7A450E5BC7923401242FB11341144
Malicious:	false
Preview:	.4......h,.fvS5...Q...S.o.V.g3....w;.w.....]._.."...Z..J.6.E.4..<[.DW.^~Y.}_.dD...b... .Yi.\k...L5!......lpr......m.3y.tE=}...j..Y.>.;k.....O....:N-...A....Y.mB% .i/.m.Vq...v.3\h..?)...V..R........v.m..V&.Jo_..JH....%E.k.....3.)..l`,...$..R.<."..O.+.-..2Z....p(...^.Y.G.#.....-......+..R..5L.ev....^..#..o.B..Q.T6.s.72B ..E.....0..,.....V(...l......!)-.3./s...w..x..4Cwdx.=..B.....bX..zu.p...N..`.%..u.jJ?..[.U....Y..!b..$O..t.y.T-...q...2U....a..A.4.O..k.#..C.-.y9...'(.D.......2Y...qE...].8...V.C..[.9qA...Z].T.'?..c...6..@J.r..V...U.S&.._.........+..\l).SG...iE.jX]F9.Y=TR..(..........."$L..8y...i%..xB..O.....e\|.0.E.Ay.. w..co$.@..}.F.e.U..Fu..........+.[Vsn.57.9s$.T..pm......Bs...s............s.6.+6j..N..&..N>..>...q..3B...f.)..-o.FA.8....^.r...M!....t....=#:..L`..\}a......H...o....{...4O..}...{$Z.(a..F*.HD.&..DoE)@VM.5.Ir3l......G......~.G..I.......O.......h!..dD..57.N.....)..U...W..}.8.....:.3n1..&Y........z..w..`X...t.ltV.:.B.......U.

C:\Program Files\Adobe\Acrobat DC\Acrobat\ccme_base.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	450887
Entropy (8bit):	6.612032332064688
Encrypted:	false
SSDEEP:	6144:91nrOgGe8pTUiEn3q9TqTsiHEZMIMENQ+gbOpzGvfQ86+KxdjuSYTA0E6kUamgI:91nrOgG7pNDME1gbOpzGhSYT9EXmF
MD5:	493FDA95A0395CBE0F32E0B2D3062255
SHA1:	814703CD2AB6F951EFBF4554C525A5D9D30CB8DD
SHA-256:	8F8F825BC3AE3C865B1D0287E02FE2F4F5C8DF5AEAE2EC23C53DFF5E6C7E14F7
SHA-512:	8BD84062CFEFE808C8AF0D85D60BBFE2141915FDCB385389891BE3035EA4EE8C2F01AE18A5526A3A76CFB10FA2DADA485719F54B041FDA16561A915807B2A60E
Malicious:	false
Preview:	..)l....Rc..\|..f.q...@...J6..A.....66r1.<.`.t.x.2..w3...v'..@..Tr...U...V.....rB...j..k>..9..v....O..<.}.)i..o.$&.O.a.fJ...v.H.]....%o2&.^>...^.a....Y.3=./..n....Ae.-'.=....qJ./...{..&..9Y.+.....X{4..=...3...j..qna4.......J..=.......L.....j..mn ~.[..6(..R.)..e.@..P........b......`..!s........'A=&.?ly.B....Q.Cy.~Pe._...p..F...;!....=5.J..Q...E...EV...qvF{.[Fb..........{,.....jU..\|W.#.0#.\.r.....G..7O..7<.&@..go,...1..B..AB;..9...[....N.Se6.SR.-...-......5.I..ym..ctC/...\|@r.5Q..{.O....0.4..g.....9.t....tl.f$g.....ld...9`+F...'.y.c.S.......yW....-...H.`....k.O.;q.....Pd...v..rrC v.E....Y.k.".kOR>.w..te...\|..,#N.P..J$/]...>..y.[.>.'.{.tq.e..%n\...g.J(ha...\|..X.c...H^..v...........3.=K....J.......3...!.R.. p.~P\."..R.....T..e..1.".0q.Do....oP...4...]...h.A.".#&....Z4.w..p...J.^FB.N0...l.`>B..F.....h.5.Hs........?.^.(5_qu..'.1.......S.pi.f[b.7.(q..`m^l..R..8..s...H}....x....!.......Z.....]........<.2.+2]....z6..'.f..+..l.l.....SRZ..!

C:\Program Files\Adobe\Acrobat DC\Acrobat\ccme_base_non_fips.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	399687
Entropy (8bit):	6.6784932723466035
Encrypted:	false
SSDEEP:	6144:mzSVaUh6PRr9E/WSbvBiuVcOZ+sDYkCzCLPg7msBaSO22ydhl5cjAN5eI:2SLh8v2JVc5sMlCkisMbydjII
MD5:	75D309FDABAC72CF1CA41988AABC53AF
SHA1:	6DA9C71F511E14FF30B9BFAABF87C28BEB0AA8B8
SHA-256:	0AD565425194209177E3F4E2DE2EFCEA26197DF5309654833D6734C871812BC0
SHA-512:	F8F0C2683B29BE127A091C8B102E63C28C40BCE901FA038901ED0513E26653FEA27B1F3E3948E5C53728823A9E1E1E8AFDA48F7FB70F9F500D091EC693CC75E7
Malicious:	false
Preview:	e....G...c.0..BlLSG..Z..../(...X.%..a...8;.$..u........E......j.=R.....Un...4...3dd5....b.....'.....w..hm.`P...J..x. ..iD......@....A..q....(.t.56..!b..}4...s.g......s..i.A{.Z.A.aj......... ...^.E.A.......W.@Fx.i..m.6w..2...Z..S.f.\J.k.......5u...X.L`.....9.Ln[..C.....R.4o..S...R.Fa...1k.....$.'...^$2..;....W.Q......4_<.uAjXw.......< ~?.4...Wi0.wi..!4.]I...Q.F....p..{...F.yy=.>..w._!..d...z...s.[\.`......>....bp.:V.p.....0.7T..h.2....l..,..W..d..Z2R~.Nq..K...Q...o.c..D5.>1.3.L.C...... .o...(....2...$4......kA@N&E.O...{..z..g........i....n&....'..b...&.C..2.k.FVdu..J..HX..?Q..x...oe.Jpj..41..X........N.z.....3..A{.R\..!...o.b^....k.....Ao`..[.m./.?.U8GpS......}.."?$E%[B2.&p...Cq.]..W.}.....t].1b...U~....W9>....<.UCs...p..:.........@X.e.g^..6b.T...d).a.^.].].n.6TI.^..,8...1%...}...9t.%..h....s....r......\ga.......x..Vv..vx..../....D.v........+7...>.W..\.H...Y9i{........q.q.E..+.Gi...:S..xb_-.zk>......Wy..F.A..;.9c6......Or..{UE.

C:\Program Files\Adobe\Acrobat DC\Acrobat\ccme_ecc.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	561991
Entropy (8bit):	6.273676931869096
Encrypted:	false
SSDEEP:	6144:ap7VqZ1XnpSS2rwYpQp0SzhSzfGE6QRXfF6VQir+FtDkd6pvjTunVelTdcOz5JHQ:a7V29pSS2rzQMZJfFVFtDk4lGdF
MD5:	7FD04E836183D323E29626E6C57E9584
SHA1:	0BE5DBD0CA17502D9EC983437DCD09AAAD12D544
SHA-256:	2FBD84F0C6FA1D573BC96EC1B9EEB0A0EAC6B5E1D04C11AC55ADF0060BFAC637
SHA-512:	CBF0BAC6EB6011BD31450A264C5DAA26AE32395C512F6C198090B99AC7C120CE42F9F0953AF030007703E9FA628D3215DD5BADC821AB39B41CFE9BD837D6AAA4
Malicious:	false
Preview:	..mb....r..2..S..T./._.6......+..c!n.T..!..>..t.?]\+...W.O....,\.6z.i.-..^....'a..bv?..+.."8s..F.7...Sm......$t...d.D.1..A...!...M..uW..-....Y[.?.ls.Q.2e.?....tN....%...8.j9.I.n........G.OSl.HM....G..9q.u.lIJPu.O9.qQ[...R...z...L3..cu)"..K......`=x..o...:..6i R... J.......C..3..#....FK.G.&e^.~Fw.3.C.......r..^9....<.E..R:e]....{....Y.P`..:.X......@.:..ych.....D..6.R...1~Y+.:7V...V-.q\o...7..x....eZ.....UW..3K+..G.^9....B....^....... .}Z\....vZ..5...U.awg[.D1....azJv....].......c..)w.[.R.Sv.D./..!.:....5.....K...h'";B.....c#v+a.n7.....p.......>Kw...c.....5...V:.x..p#.)..S...@..w6b....8.NL....?z._..B.~.O.o.i..!K'...3.....LCw.z..`.r.`U...Q[.FC.]....\.>K...G2....).V...~a..=E..........O.T1..../G....F..Vj....7\^Ng.B....C.._.jx%.4...![.AP.a.E.....$.d...j..._..m.......D..2..<_.`..W..=..E...ML.7...@.VP......g5NZZcS..4s.K...;M.T..).]..[p..I......g..Y........q....-....:..lRk...."...Ye.1..I....i...{..Q...s..W.$n..]/....9..k...?%...#.(..l..F.

C:\Program Files\Adobe\Acrobat DC\Acrobat\cr_win_client_config.cfg

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	526
Entropy (8bit):	6.706267241560031
Encrypted:	false
SSDEEP:	12:nTPNBDVPbRa5UR9q7YzSgCmmCeV1Ic22pelCW:7TDR1wE9q7rgC7pCcvRW
MD5:	A467A19DF6BF6EB66FB3BB96075F77E5
SHA1:	77CCB284E73657D8B4320BE603198ED4515446DC
SHA-256:	D6CA077387C758A59F0F6F64E17E1078494435756D465AE0FB3202C329C850DD
SHA-512:	8FAF918DA020BC4A059F31715971F6F53CB6857E62F8D94C14D3C76CF7E51EB5D9963E1D55963572F36DB3F1A6E454C6396BAB5801F980A2A95100335244A163
Malicious:	false
Preview:	.`/>..-.MNx.M.}.....Kp..;..y3..~..sO..hV.E?.....b...D/..j>...t..D....F..Wa.{..#`f...b..GM....=..o.......U..,M...ca.....ugJj.W.V...P3..0..`...E....4.;.....P.......!..;.je..M7s...TG..t = 443.....C.#.E_N.../i....u...'~] .?=5...E.:.....X.KOD......H....k..A.3.........W.T.D...m. ..L.."Fc..W$}...wM..."....K....dG..+]..j.+9.-..L.w...F..l....5. ....i...."....5.9.Ra.F.bZ.FX....B.<.d6.\...........................................................................................................Y@....czyzk0zzhil.

C:\Program Files\Adobe\Acrobat DC\Acrobat\cryptocme.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	292679
Entropy (8bit):	6.595558870537899
Encrypted:	false
SSDEEP:	6144:lS7YdM+ZL9m7nufpl8/7mR4dTO2stFupML5kecMcy8ksYsdBZjH7P1PlWHn:RdMIm7nufo/7meO2OoM9kecMcJFxUn
MD5:	BE02E4893855C559200590618B43921B
SHA1:	38082EEE01E5108F2E924FFD829B8C8922453318
SHA-256:	82B3B86756B1D845F3D16122FA66466F73BA097F671E24D50F1AF92BABFF7DE1
SHA-512:	04807608EA0E62AE6D26FB5F3C1FD4BE2D930B9C9D2570E1877D65C14C710A38652915BEEB4FF60337F58D71A1D2E89594AACB09741F16795D7E0DC367264FAA
Malicious:	false
Preview:	.....~.%-.,..?.&4.F.U...3m..3FoO`.Z;...m.v.p...x.p.5.0.......%.5..>.J...+..V..Z.z...6X..~..s.a...."...m...N\II.u7.7.....@..U........$.....U.......AD.hY.,5WF8.U.....9bU#........J=.~[.....hV3.9.I...."6\.....1w.{b.#..?..>2.kH......U.5...s.....p..e..U_.7._.A.vt.#...u..l.0(.x...de......}@.cH(V...=...E........v.-P.yk=.tUTE.c..%-....<...`c...]zV.gJ..X.y....r..DK.f-<...h-.m.T.4O.Z...S.p[.m'....}.t.T..y1.2P2..l.uR.b.U.s..U'}.j...q'.<B1kC....../x..R.".V..k>2k..Z.....a3.VR8.V.r..%.l.X.f...6.Mi...y...?j}=.2.1...8....=U..ZH1$0..]...+m.".Abq...{..?....n.).I.(>\|.Z.i.F..MeL.`.^."`..".1Z....\|..=.`^X[...q..s.......2..}...f]i..2...V..=\|m .?.O..z...@."5c..,.......9. .wT.j$0(.L..M....%;........(.J..,i..rK...)@.I.M.......\|.r.....S.F...$....I.a6j...r?...$...<............."..2F'%.....}.lS.,...D..}.3....c..n....E.K:..u.............C.h_.Si....Iz`.l.(*.....<k.lH.2.yH,.....N..E.f..r.W..~(....[8...U.....=..l.p.E.@.(....SLlb.&u.0{%.........W`A..{....[l.@.\....gkQu...._.

C:\Program Files\Adobe\Acrobat DC\Acrobat\cryptocme.sig

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	3259
Entropy (8bit):	7.880747961846431
Encrypted:	false
SSDEEP:	48:uev4RUaRlod4MuZD1kpZb1lPYu1b5prmDoCAk2coWDCoqUW:DaUaR2d4MuZZkZ1lA2lpyDqk2KDmUW
MD5:	439887E8AF4BD84C3602A24A3DA4E7E9
SHA1:	F022F7E71FD81B6C183AE508D0457402ACF44412
SHA-256:	5B7C9E95DE06888E8007AC427BEF1BD3255428E40761A861F8955E7B0EC367AE
SHA-512:	BA06A9C4A92D6D06254D6B3C241D65E00DB9CA45935F63A508CBCD62A8540FDF0BCBB93B30E3601AE176A6337F7C18F613B36FFCD062058B3F8ACA3D85F595F3
Malicious:	false
Preview:	..Q....?.X.......v.]......[.T...5....D..V..h.........,.CJI.y/.....7jw....).......>.:.,u..2.....Z..b..6.e.Xg..GZ..r.x..9..>{......I....A.L..Q..\-._d..5].I&../d...#.....3{9...W...<}<u..C...r....{@.b.F#w.e.........~!..KO_......q./......7F...x..Aq.c...r...kXN}.......Z....g64jf....T......2......)~.... IMiA..>.L?.....Z...s...K.....FIj..&....%{.a.o.A._......<.R...]l........C5.T......H..iO.......\..0.AoT"...s...e/..a..f..T..:..6/.y#....k..}.D.]...R.~d.....).EB\.L.......2iP..&...gJ.J.v}M....Nyx(..>a..'.........`0.R..Rm.i.....5.....yh....s..Y....p...<\|...z^]...V....q.B.G...Lg...I..]e.=..ql2".2R....E..5.....l.K4....].2.P.x.....]...m....p.......R.[of...\|$g#.....C...n..c...h....s...9.$..1...O...wGh%.......]GW.qD.W.N2.e.rF..i.X....~...Z..h.2.K.P..A.[.;....0.t......ho.....DX.D.A..Bn.#..}.Zj.Ub.-.P........eq;.P.\|. ....f..G.Ct...v%..<...?..hS..8Usy....7..H..;`..B..Z..._...@7.q.Q09xk}.k.g..........m.l.o.S.gl.?..#d..ihe../.<..../.u).g*.F.........

C:\Program Files\Adobe\Acrobat DC\Acrobat\icucnv58.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	15175
Entropy (8bit):	7.852524468650141
Encrypted:	false
SSDEEP:	192:Ba2g4HKqtWLNWLtcosF9EVTRrq1RykYSAQd+om9y2g9j0FBgyDatiQY:Bje6LQYCyktAa+om9w9wFBgyutiQY
MD5:	064882A8F02352D92599E099BDFA5324
SHA1:	D4C06A1532CA8726D65079744D903E8128F93D92
SHA-256:	A451B4F0667C0EA82B0C825B450D95F14B8E52CBBEB9A9E330609E7491A46A03
SHA-512:	25BA1C0E11A3E4852D8D8D1E37F94F5F34ADB1A323C3E745297673592EE4E177ACF18E2468F3DD72CDAF033AE6BA7F02CB220AE0752A3601B052F458053F95E3
Malicious:	false
Preview:	...gQ...C.x..zh.':.Z'..V6.2,..?..&..)qB..?.........\|_..7...M1......N...{..n.:...f_.x....Q.7...z..>f..E......>.62.#.&w..Z.Y..8+.9..lNaYi.M....2W=...z).......~L.Z.PNE...@...?ot...5.....Fq.%......x.Q.&........m....w.y.K.)M..$v..y.....X....G?u..s>...b8.T.,P.c..t..u(..gt...].m?.!.I.j@.B.....EE]9....9...P3.0:...R.6].>..o..X......x."z.k..z.L.6.KZ...wNv.U....;.../.[{..9,w.2t..~C..{.....}.[#.xd}uvG.pk^V._F........<;a..l.qVA..1._.......w4.K.m..B.n..Wg!.=......1~U.d..m...n.._.@..4....MyQ.."}fm.E.WL>..\|........zC7.Ro....J..BX..>.0d.....aR.h15.z...AO.F.......R..?..z{..j..z".\|..-pJ...y.#D.g.....3.I@....p...".AJ[(...vdN7.L5.9..mS....) ...<..;k.....L.MW..]....@.R.z...R.u....)..A...6B..\|^(....9\.JM.l^..x.._g..K../>. .Yh.S].Z.u{.0{...2.?-.O...6...Gxk`.H...x?..F.g.Flv.0..e....y..%o....7.W^..T.T..G .....@._._.....B....{...>..3...{...Pc..x...Vk.un..+.....7.p.vBP.dM9.\|.N.5>...s......~@u.v.u.@..O...m.....bGlz@.1..o.Y..........%O]....u.w....{.T

C:\Program Files\Adobe\Acrobat DC\Acrobat\icucnv67.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	15175
Entropy (8bit):	7.852308932431741
Encrypted:	false
SSDEEP:	384:TlzG9TQwf3p2dM0Q3hkYApmb+ojw9SFVJMygtD:dGNlf52dY3mYAQx8N
MD5:	F81B47A3F5D4E05A61F467919FB2B793
SHA1:	F931BA21E42715E6B2ED904FD7B73A6BDC0C2BE7
SHA-256:	05169BBF0C763E17EBD421DEA998F006FD50FA637DBC7DD73603BFC99DBBB23B
SHA-512:	319AF2A3EF5D990D61F35D47A1D55266CC32E4DF038B7B5F6C94A920F0C7C6F31EEF42BA7B1398AF57C3DADEBC6398FC0574DF1BC78DF4E80080E07BAADAB329
Malicious:	false
Preview:	.G .+..w....x`.Y..h.HT..5!......O.-.V.l............?..6f5...6;..t...;R.mt.....%.m_f..jQ.."..x.aH.0.zH...$%,...LX.b".....0.x]...,.{j.I....b1..Q..;.S....m.5k..I...".h..jD.$..e[..w.. ..9.p..z-P.B}t....E.....A.\|XK.fL........;..[1bq...c....B!g.5............2...Kb..........'.n#......rV....Pq.+..i.h^9....Yw.S.=......E[.n>................-....v.......T6VrV...9..=.....\;.-g...`'......X...........1b0..B..Tx.../..+.dh._I.........'..W..%.+...D>.,.}D...2hDu....x.U8..-...qd..+...g....km.hB.......P.C..6mC.7-.{..%hF.:...... ..M..wv.....r.ZMc.......+@..V.@.T...A.V..z..p#.p.zrm....5D[.wl....>.v......?...^.#..h.S..s..\yAZh..&..x..%..q....y.. ...X.N2{...\|..c..u......\9.M..E.c..\|.............hJ..0.f...s..6L..)...h...[.s.jt.CLV...W.0.6W...I.......'ho.0..+...7.{^.!..`.Qy.9..bHU.y..@.4.Y$....vo.......e...I.c..\ ....i........c..KT..E_...Dw@.......0zbO.E..).4.....n...Ps..S.bcL...o*r../U.,$S.......s.$J]R`.......n..-5.]........yC..,.....$D..f.$

C:\Program Files\Adobe\Acrobat DC\Acrobat\icucnv69.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2005543
Entropy (8bit):	6.790060918655594
Encrypted:	false
SSDEEP:	24576:JSe6PxMQnAnltSNa5JVOQnPLEVMxKnJlwN+nvuw4xtS3lyQtA+IkkWEdshlufuDC:JSfrnAltztV6MiJlwNwZ4fS3kUZlW
MD5:	48E3D16E742EAC3E7EF680BF4DF2A32B
SHA1:	8096DA75E942CEAF9C2A6F2CD9D4FC4560F9BF38
SHA-256:	4798545DDA19BE35893DEEF8B60359B8467601081DC55F1304288BB3BE1D8B56
SHA-512:	9940E23570F96AEA391CFB93E80EB3004B786C4D2D0F6DD70BEB5A483434403BF8E7AA493A94EBA16181211C2A1CBB18C6C79893CB794982124AE0840632C2AD
Malicious:	false
Preview:	...n....Sl.....[4.eP.$...8.).H....N.hGU...j/...#"-.}...O.....l'C..d&....7.L>TAZHX^dD.D..{.g.J?U..o....`S.............{x.khD....tI..../n.[....U<D..)X..O..F.Y....u.%.....}.8Q.2n.&..?.Va7..O....\|b2......k.+.L.<M.o@y...;#.-t .^............x...w.c.8..DH..5L}.-.l.......z........../q....`a...........v=...@.LbC.J...N...<'P^.]..k.y.....j.8........q...+..l.......t..`.p.O.......G.27cX]0...p4&.@...p.[..Fp~..4P0 .G..,......y.=.v.}j.......\V6.Wej.....F0TX.\.G%...<#...k...v.............~?k...........A....@.7Qu.....'..J..Ad...K...T.HD.D9..H...^`.j.E...$.s....=..!R^.7Y.".\b...`.[.8d-o:.\H....].:..Fs{.1.....@......aI[.s.F..Yc=.b=.4.j\|.64...8.u .....q....l.~1...........n.X^.w.."q..Qa.....<..0.....+......ck.`72....J....<....CX..l/...[.\|.Z.,..........n...............hi.-.d.S...P..D..0p..<..,.d._..'.){..80g...d.3.^._7...y....$....1.m...U..dI..#R...!m..b....-.....t.....dj.?..........=...2)..}].g..'...M..+=.'.C:..R.9.Y..2n..8....m.q.#.....J........1.=*5J..F[..$.\

C:\Program Files\Adobe\Acrobat DC\Acrobat\icudt58.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	15175
Entropy (8bit):	7.851284335929908
Encrypted:	false
SSDEEP:	384:VmdlUG0PcoKtQSz5JkFADe+oLHIp94qF0Myq+:lG0P5w/eFAaxLHiW
MD5:	4399C8A19724C966DE77B42397B7AA46
SHA1:	A2E93015E29A0E1E26C0F4E2508CE6F5E366ABD2
SHA-256:	E890D9E7770F8153C857A67DBE7BC2483E43E287C12BA35BAF0326D3ED90B46A
SHA-512:	E5C0C27D78B8E720A26B80BD65E59AE76D1F47067D698C5B0DCFE2B29B2329C213FBED8245D58BB495147A94BE839C74B03511289D45E47CA5E5CFCBD06C00FF
Malicious:	false
Preview:	O..C..89..Pf0:Tv~..U....i$....o....WM_.....c.HQ<./...;.&..V...c6.J.............+p/2._+s.....HN..Mk..5....Y.U...$...pQ.......(...w.....bc?....6.97{.q..X....L.F.....;.a....)...W^..]..o...>.f..f....bq.>.\|.T.....V.yj.L.W7........ .\|....G=b.C\Sv~a....L#...O.......t.......f.:}..%...S.6.+..>.O0V...5.V9..F.r.O)Qa....Vd..."....h..N2+..H.2x........2...B..P.s..%R...ul.X8.;}..Bvq.A..%..2(...N......~.-mN..I.1...m.1kC.......C.h.....]...M..&...tYQ3........(a.U.."...S....\|uu.I...P.;..Z.Y...9...n..G..-.D....i#0..w.:WT8.8W.k8ytV......\|L%u@.a.z.0snAe.3..Y..y.q.XHT.5..B.i..\|..n.S..d...Z..@z...._.tJ.......-l..d.:.'.+....(..)...}...W.].!....-.^e..I.....3.n...M.A:.cN..[..1..:....D).Ku@WCv.vG.......m...Ic.... f.,Dq....N."4.><B...e...>..KE...::.sr....:\|.0..>y.D..9p0h5.,I.\|..A.......~..&0fP......dJc...zl6.L..U..U.....\|Zwb.h.r.....e^.,....A....q.....?.N.tZ....u..Vz......9TN.zw0..#..............6.\5..,1.u ,..,....+.V..d}.&r...{..X.}x..i4.....U,.

C:\Program Files\Adobe\Acrobat DC\Acrobat\icudt67.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	15175
Entropy (8bit):	7.85250270593967
Encrypted:	false
SSDEEP:	384:yVJXRxxhjF22h11k4xkHAQ+o9m9eFzcyq6wut:yVxRxxhjF226NHAQxsot
MD5:	E3D9FCA66BECE31D2B6685046344A114
SHA1:	F48522F28FF83935A181B0E038D3A25029DBFBAC
SHA-256:	A6FF638B193AB87CE99FD5AB4FEB61CE5D22B9DE49D683DD17F829D93FD2B321
SHA-512:	43B9F8B7F10296428B941985A96DE3BC516EE8CC5B8EF91C087513BFA15D41B73B7EC6DCF371DA49C9F94A8CA10B9095DC1426B062D6BA12E83408A4F4CD3B45
Malicious:	false
Preview:	..W.:....JP......H...G3..aMPl....1..i.i..^..9...A..d._w.].1.LQ)....-.i]./..r.G'..N.0....o...\..%....%(..}..t.nC.....~.. d.......m..V../.yv...p.....DQ.>.E.Ib.i..m8.gY.......\|m@Xl...A]....q..r...?...F.uv.3v.`..1.5J9..xU..."..~...v{Z.U.....0W.D.Q.....j.Y....\|......> .9G4....f44J1.6..`oQ.....'P...z+YF...[b.BV....\:...1. ...^u....+P...W...G"...6.'..../\|$..C....f..q..Om.?..n8..m.Y..D.;...h.o...R;h...B..W.......Z...n.U..6.b..."+R...D.q...).{]...y....ng...b ....i...Y...v-......m%h,.r....$.......V.. .........zP.y....lI..6k.=..\|.6.,.?[.+..c.>...W.X...!......6\..?q^...%&.~.f...#..I..,.4....e}z.;i..C.....`..V......F.S.....%......[l..i...y.z....q..&..`..#...<...(..D.aFY..>............(..y.W.x...Uh.D....0FL...\|.......E.....m9Y.i.U....Sx...R....I)q....../.t..Q.....k"C)r}=66... T-Oi)z..B...;.Z..\e..j.,KP...t.T..L$......m.#8.5N...w...]....7....i..s.RHi....'...a......4.......W.hW..g.`H...........2...%..6..z.......H..?...>A.9.r...V......*V.^

C:\Program Files\Adobe\Acrobat DC\Acrobat\icudt69.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	28863015
Entropy (8bit):	6.356970514706466
Encrypted:	false
SSDEEP:	393216:SDKT/Bl+4gBlURediXUxDmDJqIWlj3SUl2nong9Wbk5ymDS/aMO47T/9r0P6gFre:9jBl+4BjjY
MD5:	51D7FECA13B412ACB9F56BE4F1CCBC3F
SHA1:	8CDDA1B8E754B480D8EB1BFC2D54186354E40032
SHA-256:	020B5A70280A9C8D9ABA40910EEAB28434E39671AE8D9F36BDB5DBC42A66AD7F
SHA-512:	97FF662C56E81B4446F51B15DAD5A423C20CC1E3378ED816C3C3C1B0681BDDF413C8A62E6D53C33DEE0900605D17DDA47AB8CDC930E666078556CCB9C8BA3A86
Malicious:	false
Preview:	....5.D.R/..6.Gs.>..p..k....'...7K,..(#...lp....a...5?...c.P....9.....A~..<.E%Q....... ..B..kK..e.H...2s..}..6...l8\|.9?....1R...f.H8.d.....p....z.......F.....8.n.{..R.YBgv..r.G.5X8..f;......C%...R.3..j.I..X(..:.6...~.1%4g.t..wu..(..^]....}i3..e...~.7..c.T..?m.....sL. 3...n.J...^Pb=..[.6..l;I..f...AX?.....=G`..I.).4Hl.. .......>p...&4.!7<....O.3nq..g.0t:9lO......'F^<.!m.......\.MstH..j.(.v.....0.CQE...w.s2^..=.U5....}$.g.......P...5..........4.....qvW....e]...K...Z'faF.:`.r.N.eF.=.U.Jy......[n4z.....B....O..U.A.J..#.:cIe..d:..L.M...y].R.V...iAV?.........'..K]..K...51...a....5.X..X...P..j..2`..rm...3c(xD4.......hyOM[X.......8..1+..\.....N..P.s%.!re...>.(.............]\........S.....m8Z~.X....F..........\|t.C]...w[.K..=.....~t..xa3On...o......9.+.....$..?..HR.. .f..E8...N~...P6..c...-.Y9.Q.......&$(1....ezk......Ux..BN....A.+..$Xd.O....g..Dh.F#.Vm...c..]<p..`SQ..Q?D..Ju\.g.....8....\|....ze{k..X.A.._0.=...)13..g...Q.?...J.-...Y6...

C:\Program Files\Adobe\Acrobat DC\Acrobat\icuuc58.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	15175
Entropy (8bit):	7.848313471444996
Encrypted:	false
SSDEEP:	384:dA2A+fHNgoyKuxqm0ROkVAu+ouL9yF6XyiEM:dA2A+fHNgoyhSRdVAux6yM
MD5:	CCE8DE4F73EA66353BB23C5A08C20CA7
SHA1:	05403DA8C0451562A8D9118F8BBB2E9C88CBC6E3
SHA-256:	AF34C21C4503A6AC75CF123F701822742BBEE88D5BA7368737C7FC06A029B1BD
SHA-512:	DBF5909D6903534D8D5B7E57A17AD086495E7E8096B4520B87ED674D845F921407FAF807145124088AF2707F3776AA3FA36A07A9B7BCE75BFB8130C8F5726147
Malicious:	false
Preview:	uO.'..a=...8.s.gN+....]...;.a....'..d.7.X..R.xa.=..&.3......5.\...S.....r........I.uht.rQf..7"bJ...Gb...:..2.......NC}....:..4..0..0o=1.8.z...)..m7..8...Mdu.......o...c..I/....^7..O..pg._..Fw.....3..%.{m...$..#.#....W......'...L.@L_H..\.R...V..^".j..3.H.......].q.`@.~`l.S.n.0.$..@^.q..7.S.P..u....-t{..o.R.../...v..@1...j.......~.4..>..pn.0.Kx0/S.*..j....+[Z.?{4U.........J..K....>..Jq`.$..13.)G..fS.....7e........\..yW..s..........0J<F..@.a...v...jv+.Db...s..U..,..b8Jc9.#../.=V..V.C..7".m.K....1....Q8v.....j.. ......L .l.("...T........7.4kf.ZWc.b?!:c......$q...V.N....6..!y....QD?.a..A`bh .8...3...k...i..uP..\|zM...v_..+.~.&Z.c..c....e.J..ip..l.U~9I.../.W]..U[l..../{.....2....m......O..\..R.O.v....[.V...Vv.?.4..}....3..n..?H...GT..3........3.t.u.XvtR#Srn..{../.`."...y...h....b(.J.fAf.'>v.......i...yH.o.u.....b:..i.4..W...oU-.G.8.#/1...w..1....5?v..h...l..>......fi.G0..4.(.y).H....[.Q.N......o...l.H...U../7.t ...4..FY..wE...y\...i.j.8...i..X..

C:\Program Files\Adobe\Acrobat DC\Acrobat\icuuc67.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	15175
Entropy (8bit):	7.855286135833827
Encrypted:	false
SSDEEP:	384:tlX5ejfwfVktRkTtA/G+o5B19u/F1ARymTh:5MfWUWTtAux53Vh
MD5:	E5B52A01F89C7EB4D46C68EEC4F9120B
SHA1:	231B3A05F3D2508DD87FD7F413E3DE5C96968AA5
SHA-256:	3825F797E82EF7DA6F0262AE88C021EE5FB2F9EA317835411576DFDDC3C91F65
SHA-512:	ADE93081BB4BE19CD9215BCBFC62CF0312796AD359236BC5568386C7725DF794B2E674F158FCA427445289A0EC9EEA4608FC49B0D1E88450796E5E9F2B2FB6F4
Malicious:	false
Preview:	.T....].}.....F.7??.o...(}..(.'.......s.]M.y...&%g..z..q{.:7...I#.<.U.n........-.....B.n=....O......}qR.Sp......;.v..B..eg.;1..S.5\|q.`.C7Jw...%.#..Y.......&.....Wpr.....K.o.W..+.z.B...}QR.l}o.Y....(DJ..........E.....m....50.q....y.,...@.....[...r.....wj......=..qW.. .1./.v.Y...q]..G..<...e.a...e...../3.wgA....T.,7.H...Q..n.....I._.J>./.}.u+..7.....<...@Vh.....N..K=.e...1.}..........N\|..t..w..W!....Dg.......~..F.o..7.4.m).yiA._ec.\...=.L.X...>8...J..z.. rt.Y...>...s.ygSe...z...$.....$'.-...8.-e0.Q......N_<o.Z..^.x.).....O,...I.d..TP..ns+nYj........@.+M.o.d.s.....;(..P...N.v....H.Ti..}@7$.q..1..@V..@....r..J.....r7z ...e....D{..pF..C#q.,U:.k.......2{..z..O.'k..."..G?.!...F.....2.w......r.u......}......S......\|..'........`...X>..q.H...O.M0.r..G=__.5.D.3.o..2...X....x=..7&a`.~%..P....U.@.$....I=.p....5...bh.~..q..}q...*....nG..{:....P.D..9Q.}.G.U...RR..q..C.D.gK.OHL...z..q... q.....c.0J1.;.....\g.z..km.5..3B....z.....

C:\Program Files\Adobe\Acrobat DC\Acrobat\icuuc69.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2587175
Entropy (8bit):	6.785540077031906
Encrypted:	false
SSDEEP:	49152:D9DDaN9AkIfez7IZno5OOc1F2tKY9JH+3FelH58mm:D9faNikI2z7CH6Z+3I3vm
MD5:	722224B213EA142D2E9ABC7FDD77DCCF
SHA1:	3CB1B6C4C6DD7EE62B7F98A6DADFC6A25DADFDE0
SHA-256:	3BA066369C0B13B7139DDAE5F53838CE80476B4DAD5D9E9AE4FCDFE57143C8BF
SHA-512:	8950A607D4ED39247D923DC3F5F1C4282BB45112D36BAB9A47B2704CAF5053E1F2034E9F50AE6D1090880ABA87E49720445F8E4B5C227F35F6A2BD14CEC029DB
Malicious:	false
Preview:	.U.5G.{.2.."{@....)....L$^..)..A.&tU.......~..?...A..7...[./.....)f.......0...$...+..4..&..U..R.\|....E.8P.0.c.6X.U..K>.W...!7'.$A.t!...~..Q...(.c...s.`._.#y...g.m.h....: ..O...~.I....P.iz.b...k...6)..]y.\..P.WaQ=gW..N..0.\|...rv.-m..f}......}...:....b....pq.1.).g.Ig..~..A........e ...,;tI...[..w.~...T;a.K..9p...^.uM..}4.?c..-........(1q.=.3t.A.E../...{\|QMN.W...a.~.....g..U..-.d.0.!.....]..T.4mz.....e.$u..X....?..0=.9.(8ol.........4..=..r.,....I.b...+.Dfb\|I.{Iz.....{.B...<I.....+j...I..>.z.Q..=M...UMq..#T..9^0..<.....3<..c@...ie.$6..c...G.~..."j.J......'a/..A...A..z....{..9.#X..1.p~...@......t.A?........j....4.\....x.w......B.1.J2...e3..v..D.z...RW[..%.....9u/..J....W..u....MM.M..bf..../...y..Da...t&...w...$Z.vi.{..J..FU.%D.,...<X....`....yBw..l(&N.i.....p(....p...c...(........H.._.6.....X...z5.....t.G.........../.K...#.~...L..Q..Bwi.5.&.d..^..%4t..U>.........+....cYP....Z.i...Y...h....Y.B\.s.[.C.S..........>:.....a..R{.......j..O..a..5...p.

C:\Program Files\Adobe\Acrobat DC\Acrobat\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Adobe\Acrobat DC\Acrobat\logsession.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2905367
Entropy (8bit):	6.747996208685387
Encrypted:	false
SSDEEP:	49152:70p5JJP6ZBT1tCaFrTTu8vVlSQDrBtYqFsE6DZilRhZVs6V9t4zf9juk:u5JIXCvQDbDsE60lQp
MD5:	E5E538DC889A8F00EAC1277E6AEF650E
SHA1:	0246EA0C998EDDA3873AA5584E9CF720654CA5D9
SHA-256:	F54E7B9173EF42237FAA3EE1060C821115DB86A535F49F58024B9568C9D5F185
SHA-512:	8D7E0B31A013185DC835320392356650E8832E803B444671FBD7CF53923A2DFB3A246464B22CB7F56414A8481EC52050CB6A7EC881EA3B1E1298AE3DF53CC136
Malicious:	false
Preview:	J.b..`.2.o..IS~9`0.D.+~J.A.....3KnJ..?........'W.....U.I.4. S.........fV.+qiT......'G.@.Q....k..'.~ ~I.......@.h....h.X.t.....!..'...:.....Y..20.....N.....U..X....G..x....f..7...>..i..Xo...#x./...[..!$...F.)0b.t..e......Gk~.hM.#tO...K.(!H.c..?.w...Fk,.mv.gn2.C.DlLD6.GGgJ.h_S.J.q..A......Uw...2f.].".Xu,W.8.....&..y$.\...+C\`....<.A.>;...eS.}.).m/.v7..^..u...$VE#..J.{.`4..h."x:....}i.q.1...-(.C.h....~....x5=......Fx.kA..v....}%.$.o+>...,'.v..k....n...;6-{"t....O...d."AY5g.=F.@..% Z.{3....(.(u~02x.....[.=%.J.AC..<.3^....Dy^.........p] .....9..%V.N./...P..Q6......./.M..ID.^.%...9g1..c..qz..4..74s.p/...C.8..u.lIh....n$..".!k'{.x.......Y.mYN..fI..v.M.....6T..4Qk..S,2.h.I..._.......{..C.T.6(.]{....z...4=.)6.d..........Q.l..\|...W....j6\|.aq.P.m.''K..y.9........).D.{Y}pJ.\|.h.`..C.....b.a.....djj>.&....T..M\..9a...6O.!..5.k@...AA...:I~..6.^..VUJ2...-..#5w...7.*SQ..{N.!..R...NU(..m.v....4+........Xf.3V..wpV.H.(Mo.....IL.L..N.@...S.%....f.u

C:\Program Files\Adobe\Acrobat DC\Acrobat\pe.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1631215
Entropy (8bit):	6.274712514533306
Encrypted:	false
SSDEEP:	24576:Y4wYpbtdF5+3GsegyBbVAaXaKV3EDmzk/8kZi1wFH:ZdtdH+3GsebbVAaJ334/8kZi+H
MD5:	8D711D3118824DE6EF2D0D76260919BB
SHA1:	BB11872451720BC229F26432A65758E2DA697724
SHA-256:	AA378782B09320A19E19ABEF71065B837BBC982B7CEC75C6484985D8A7B2783C
SHA-512:	AFEC8ED6C8DA7B64400B8E575E3BA3D95F79E6DD5D8557850644F219B1DD2499A7FE59B5D962BE65BF92E8B3E657ACE1EE6592D3A7195335E34BAB60FE25A41B
Malicious:	false
Preview:	....8.5.np....K.\|...7q....6..pTd....MPO...."4..Y.0.._F..%....BQ..!-\..._..3..1[.U/.c...9.4O.M[...H%...'.E...ZT....B.M4...ui@'...N=...'.!X.D..M..Q...T&.M...&.OXu1.Y..p.l..P#R.lh_.B].F\|)BXZmD.......F..Y....0?6.^.t....)..K..[d.KL,T.Pw..6...l.Z....8..T.....aK.;.m..)M..r.6.;vJ.;{.\|.0..z...ehn...v.?ab...d...[.L.R"uN...x...F=\|%8..;.R;n............\7.'.1)A.QXB..-Y..<.%..GZ..F.....6.~..LeC.M.kh&fn<cY.........Ar.....1u..Vey....8..}.A.]f.....uD#.._M.^..Z....!j}.A.^...Bet....M...R..Zs.jKp}.$.3.....xk.5.........M....s&3.h.j{x.}...iH...=5.Y;h....!..g.nG)'......su....R..u.Ex[.$.N"e.(....nR...\|.(../..4...L+O,.#......]. .&..v..qg..A_.l.7....(c...V.;.:.._....v...k..'w..@r.^@:.L..0...qk..vF.\|..Z1vP..=WE'IY.....M..j....S.f.......r........6.MI........k.0.[4k..GD.>.........}C.].C..v._.q.........#e.'...g9.n.....F ...<.vq\|Qnc....,k].3..k...^......wvN..e.v..x?...U.n.B$.......]qw...G..m..X.qxipw*ca.\.Ul.[.....0.........T-....Y#&..c.Y..0.nL.......'0..T.>...y

C:\Program Files\Adobe\Acrobat DC\Acrobat\pmd.cer

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	747
Entropy (8bit):	7.184041153584283
Encrypted:	false
SSDEEP:	12:ld0yBucvo7f9XCJv98aVXM2e4k9A8CB06dZL+GTaj1iGaMCVP8ANymiMiW:ldZvif9k8aO4X8+Lf2RxW8ANvirW
MD5:	75932C8409402A26A33BB0DCF33BD20D
SHA1:	F0B6839F1B12FA4AB8B24246BC5DF68979066463
SHA-256:	B8DFDCF5B321966C5F836910D135A30E1C3C34273A02AE49D353FF13897C27A1
SHA-512:	9D73147F4191EE06125BE77876DA9D7D1E9588C4DCCF704E872232E4FF14441F64913E7E7176083E042422D8812F3AB64F3FE27D6C66E61EDE48F2383C0D157D
Malicious:	false
Preview:	.}.[..{G8?.@...;..._...sj+......$...5...0.`.. ...&...8qr.....I.0N.,e.T@..e.LVE.?....&n.m...y....y.\.Bv.8.]9u.....S>..I.t.@v1...~Bg......?.:..\|.o.o...@`........6..W..A....$.'..k...\|s.J.w.!..8..G....$....u .lO.p..m35.E.+.9...^..J.!.w`....Y.l....U.&.28..]....q..3..S7.....y'.....j.....F3.^. ...!... h.t..5 Y...k..%....U.z.......VS.....lVj.'e....V......\|...I.X..u.W./..K.8..L..7..c..1.r.Zc.\p._"L.......{$..O.....U.X.1-w.......9<...B..m..qV..e..........=+G...P0..o.....[...s;.O.U....j...$...y:kv_.#[........T.._......=%9..i.......Q..\&.+F....J&...Ot..u.!.......i.t...nu.....L.3\|P6E~3u.^.Yz.s..U.n.E.l`....................................................................................................Y@....czyzk0zzhil.

C:\Program Files\Adobe\Acrobat DC\Acrobat\rt3d.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2041119
Entropy (8bit):	6.687073089314085
Encrypted:	false
SSDEEP:	24576:WtgwVYbfnB3A6u0THuLeRKESQD8lqT9d4VaHj1fRVx1cis/AEdVsh55M946UiX:au7nuuTHCeRNS484DxZLCQ55E
MD5:	0E2DEEC6A088B5A761CC3F4D32C3CAF7
SHA1:	B11CF23618D5D178C9F36B76C59D1E58A99C4F56
SHA-256:	BE5908E7BCC2EDC0BF64322420F4590508FEECD87140687BE1F3FC20FC933B4F
SHA-512:	9F02E5FCA3444A1D9BB89525313E0E1BA07EDE832B65AA714AF4843C3FE40278DB48A8798051DEC0679D0BCE99841B411B8DCC7C86B5AE5231ECD8E8C9966CC0
Malicious:	false
Preview:	5s.Cr.a..7.W`../......F.Qd...f.h.3..........%....AV.Y.#...rQ..]a7....\.Z...Y....`...5..e.......^.O.j18.n.CWa..;.7....]g.Z..0..h.x....;.......B'U...+]d2W..va.U.....k`..a-,..F.2.}a.-Qm._...+...5.jG`....%@..e&.....a.sU.a.1....6..x...3.U1.g.)&..y.x.nv].V.o....@<8.....uq.&.s.b..Z.B@.<.$b]....V......6.0tJ.......hw....~g'.0..PQ.%...G...&3,..z.y....bo.^.R@]7....d..~\dm.(.#I..y.sX.. N..ZZHv%i^]*..X..x.w...-7._....+.Q.Q.(9........X.K"C.......>%L$.sV.w...FT%.....u.D.Two....2.T.j..n;..).pt.#..5..Gs.f..}...F..N.t...!.b?8).@+......3..RW{R.y"..;.Y/.......{.s..,:..O..<.MI#...<.@.2.W.c`..`...c..t#I.s..a..tT."...9.o.9dm.....8^..~....k.JY..w..Y.dg.... .!.;....>...E...m.z.7....Z@Y..#......Q..R;......n....:o...3.s ....(Cg...V.R.8L..L....?.....n`O...........p.8.W.N..c...a...C..L....#.....iv.<.F...4......gXa...y...14..Y._kmB...3.A........f...,E..j.....KBb..,... b..b...-.T.Qz.Y.../..#......i .".t.}.".PJS..[.2r..R.../..rF.vw..K.;.1..P.....m{.

C:\Program Files\Adobe\Acrobat DC\Acrobat\sqlite.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	683799
Entropy (8bit):	6.820042559180071
Encrypted:	false
SSDEEP:	12288:HxCSbi9JExbgyVorFM6MoPLiqiJSiCi/FyjM6pugFWbEQr:YoxkPC6RXiGidyowMr
MD5:	4A69576EE2281032FDB7002301CD6AFF
SHA1:	CCEF5B0E8ACE9D831CBAF13A1B182B3A040AA810
SHA-256:	D60C3F60ADABF5050E036EFA351EB375FBD83222B889F061724BE226D542844D
SHA-512:	9278F7A460BD2864E82210497DCA49330C311921574DFAD4315D30F510C564E0D16897FCD180A2FA20016B3B441E1FF62ECE6E1D838BDAEA51B9FE5A2F940424
Malicious:	false
Preview:	O>....YN...J...6z....b.....l../.!.U.....3UyS...lg...T)\|...-..m....7....}zs..A.....wBmT....^..2>..g.W.t.a.n..K...]Z..v..L.U3..x^."9_...$%Dxu+..t.AH.xo}........l......gd...f>.=s....OS...J...m._.f.;...Q.]...{..%.....g.-vKM..TD..%.Y.BR.@.".$.......Y..9...zY.1.....Axk.<WJnW...e.....;....c..U...$...9.z....h>.......Pl...6...w..x4wuw.y..3Ts..j`{ns..(....>....u..N....08.R~..~........>.@.B.r)....f.BG.:ew.5.T..4:.....Nd.4/VT.1..M.....I?....6f..iSn.e.Kl.....Uu.8..HnGj> II.Z1<..K?.....C....>..X...Nu9I.6....~6...4.~?^,_a..u..mB..;.w@E...>.......cb...d.X,....Vv.(...>#6B.J...E.I......-"..q.Ic.!...9.5o9.~........H..jF..I...bC..?16..(...s.!\|`P(.K,..A.?.......,.^...&.rB4..:.?.......$X....P=4.]q...\|.YRZ..;g..S..s.9./.b5q.....N..Xa`C.Z....x.X=.y.;...L...$.z..y.A@z.Lq.+.c_..'.Q...`_.N..~..Q<.p...).[.T..F."....o...:.Y...8.8.......Y.k.{.4.9..oGY.A....XA_l...b..CKe... VG..u/.^...'..c!..LC,..!sS:.....u.^8.....[&.(...pL.p..Y.L..3..3..4.DS]...>...Q.......T.&..

C:\Program Files\Adobe\Acrobat DC\Esl\Aiod.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	747807
Entropy (8bit):	6.683010478335499
Encrypted:	false
SSDEEP:	12288:FwKM/Slw2ft2P/KtC5VC8GCZckkYQSg0/AkKRfF:kalK/KtCoCSYQs/2R9
MD5:	2D543FEDFE2466D984344063E556308C
SHA1:	294F40FF41040D75EFE43D2CA35918C7B9A77DB9
SHA-256:	70E146523967C2617065FDED28D3C99C4DDD25AE6665E9A887E1A369659ADC90
SHA-512:	F2B3DC9D954EB629F59ABF8687A1080809B8298C891B9A253FA0D3BF0AA2F4D1EEC0FDDF80ED4AB2ACA7CF916421A651C0B8CA601E8EBB2D6FEA38AFF69BF735
Malicious:	false
Preview:	....).[..[.%.....[.._....N.....5[....NCp-..'.0.\|8{zTl-(.[....\*6.o.f....M.v?`.7..m.P..4.D...N...T.X/.S....&Nz"......j.R...O.c.....Q\....sw...H...z.L..\r....x7"c.oO...........9...!.]...O................m2m..H`"....3M......#...a...o.8..u......n.2.9sb..7..!.t.q>n...{N.......Va..&GNR..-..`^..x.P.1....[x...........A...s(..-m...y....>.a.[Lt=L...+.>B..F....%..r....K\C...X......1..........Q..ymU.zS....Z....! ?..G.?fW.P....a...pV....t....z..d......"c{%.D.O..p....!B..'rG.9.+Z...l+..AS.]..EA...!h!.h.4...'~..4M@.<F-_.A.......ilx..3.._.z.1U[.4....A.e...~.$..7y.!~.....8....Z...........RQ.?uY..$..,.d..2.@4..f..;.H.$..e...t.5...u!/...<b(....Z=.Gh...0a.SH.B.._......%...C.9c....zm.......f.?.P.Z'..~g..RCl.f4..q......~.;%.h......?....ka.k>.L`.h...F.n.....T..j....G+..u...).j..M9.1w Y..g....../fL..'.H..m.q.........bbf.KR.W.....TG.j.....o.Qo...............h..1...:...{Oc...Q........%..(..oO.K.ji......+.D.+....$.!.. v^d.0J9z...7....;.=Zf...].H.}.VS.8.L.i.........B

C:\Program Files\Adobe\Acrobat DC\Esl\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Adobe\Acrobat DC\Resource\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Adobe\Acrobat DC\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Adobe\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	true
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Common Files\Adobe\Acrobat\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Common Files\Adobe\HelpCfg\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Common Files\Adobe\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Common Files\Services\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Common Files\System\Ole DB\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Common Files\System\ado\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Common Files\System\en-GB\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Common Files\System\en-US\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Common Files\System\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Common Files\System\msadc\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Common Files\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	true
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClient.man

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	196883
Entropy (8bit):	5.8132072648821485
Encrypted:	false
SSDEEP:	1536:td81Kc1IKXqcrkBpvjFk63NQD268YZPgNdypC4NJtvs4KCodIOrvh+x7ZKF+MOfd:XcO2qffF9oZ8YZPgNdyM4edIOugWd
MD5:	04709F713DBACD448FB170019D189E35
SHA1:	AC711B318873FE25FDE14345FBB5D153501441F6
SHA-256:	C3F2A34963F4928A9733DE0F1765764C0E0DDD2CD10002E14B52A01417987441
SHA-512:	2EAAE77EFEDF11CDE5443B9571DEEE9CB0A23A227609588F0746CAFF8CB5F91F9F1FA6167C3DC04E720CB25CB06194131478F6648896AB1BBF606F155B220CC9
Malicious:	false
Preview:	..\|...;.+......)1A.6.8t.'.....vA..>3.%.t.X.'z.s-k=\|=...].@.l..mZ.\c...U#...J.........`.B..r.)...0.!...q9_G...EN..W...g\|.7.pb.. .}.7.,..I...+..a...l..=rA...A.G@:.R....w[d.Z..H#...>?.p.d.x\..(5.i.~7dW......C6...=..i...d.c..U.T.U..QTS.f~.]....g.. ..>].z.5..X..k.........\\..n.Ew....h..&.......H.\+eT...........].eS.$......a%...0.Cb....S.......z..7..nUX.`!.w..=..:...0.4.X2M........Q........!O0..._.`.r.[.(....<.njf.C..........Y.#$g....F....J`....qh.W!..[.....}..@.5.x.w.voN.....x...IB0.....y..3^!J...l..}.n..u.@.5\9g..(.v..a.{...t.sa.....o...c.Je..Br......r.Q....T....7a.m+...\|.(.... ...._.6>..Up................&1D....:.P..........Nv.1rox.,oXy........O....e..R...[+.... .._.&....v.c.C.r..3IR.}d....j..b..Z.X...i.xN7...+.[...+..f........?[..V.....n-pW0.\.y.....b. .+.x.. I..J...u.%.=e......f.*p....Pu.1.r.5X...P...R.KL..5...R..D.O..wP....X...K..F..4...n..8..Wu.&n...G......(.O<a.p.O.....P.e..Q.O"..e..U+.[...O...dD....+P..'.5opXf......-.:.1.x.`..2.H.6.gPh.

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClientIsv.man

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	187648
Entropy (8bit):	5.9298856195395695
Encrypted:	false
SSDEEP:	1536:3diMNyEp1NSJJ+tEPXOCjCVP/xLpqj377H2DyroHBsSWygTZdvHFiwA3+:3Ik7SJctEPXljaxLpqj377gHBsZdm3+
MD5:	CE00969700375E70EFD68BF2241977E1
SHA1:	4D18A36BE1E7E2F04BC6FEA5D9B9C1D432A20D70
SHA-256:	6D497A2404ECEA0DED770570E9211C0D8C65D52573B6B33949E50868A7F1F7CC
SHA-512:	61DE915F06AE4E20C8388C47AF61108B7B96FF2605D4671949353A97E480C509D25A1709A33030201FA29CE658E414AB75C0BD4D4A8A21675F7B539D8DC12C46
Malicious:	false
Preview:	.V......d....\|.)...'..l.rk....ZW.J:...K8.a1/....."..n.I!..o..M..b.N......../.d......7.!l...."....o..N.z.{......Qf-.T...J..c..He@..JV.B.Q...J.Ab..i.B....xIQ.P.....2,x/>.....z.7).+.....?..@a#{......p0.9P....5.....j.~dI.{r~].:r>..n.%.#.VYTa.a.......ZR.f..Y..."/.MH...q.RH....t.<...qh .rb<.h;H.T..F'...G..n.c>V..H.AQ.>..........N'+=;..<'31l..1.w.Q ..+.(A....xN.].hF.Dy..Bg.I..d.>G.....5.M0.7......].}L:.......gBu:}..b.%E..L.#......;{.].....r.x.V9w.J>...e.......+.`.4.I.\W=.J....C]i...^x...r.d....a..uP.HD....t...}.....m&..0.E..+R.^....o.5.....e..u..S..l.w.&..Fy9.y.....T~D....N........UB8G.......!tSv.`.b....?tl..n..:...3......<..4R.@......y..K.K\"_s..u1.)W"..`quw.%}.1...e&..qp.D...`O.1...b .h%a.s..hx.-.z.Pe..<..yn..2.n.z....c...>.-.W......l..X...DX.K?..\..8......T.\...PbXc.J6.RH.......?.g[.C.\xz`3.V.F...+C.....8..........Y&.o.q.l.&(...i...=.*$.Nl.".......e.~.y.<....X.[.........r.. ..G.r..K.r..O...T3xB.SP.k.E/....g..`Z.Tv.hU...j..fXj.).M.!'.G...}

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvSubsystems64_msix.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	161503
Entropy (8bit):	6.8162849055133545
Encrypted:	false
SSDEEP:	3072:IbM0HoKR8dQA+blavoblptZZkSVpK65rSF2RwS9N1RyqtoVUhJ:Ib7oKqh4l3ptXkUU65aqRxy7e
MD5:	B22F39B63DE847D877D7FAACB702B0DE
SHA1:	C86C080E0B66C4153392D42E28BEBAC0B705C65E
SHA-256:	EB860902947064BA84C268D9E67BF611AE8CA5511180EE32C58C2DD48CAE6814
SHA-512:	5176CCC8489D67C2F1376219E00F5AF2FFE5A8F1F04086D20A7D91DE0B9683BA3194E0BABFC3CCB3B642D86776EC9D61599D72B98690D5B6215ED9FA3472CDE2
Malicious:	false
Preview:	;....+....+..\|...e.d.C........l.~.t..mf.`..S...WZ.0n....Ck......x=...+qh.e.......Tyh.X,@...m(l7R.D..n.Z....mdW....h.o_....t..<..%.kv...W......dN0..1_5.........w..L..r.=qI.HyB..........2.Sn.....[......t.........p.9lN....`eU......W......@.~...?dS9!=/.zv...@n...O...s..?eZ8..h.C....!vN3,.A.. Ob.>.m.+A.%5.....vw.........^k..7.(.iX=.H.sA.6.i...m.G7.(.gT..D..q)..G..B.?Xc<T.K.Jk<.1vO$\.l..z.)8.51...5gY,pR!.Wr.'.....0.=;....S."....J'.xU..[.......%..'....).b....9m.. ..y...4>......l.......(.0..S."QcL..B.......iK<.. .y......d1...MuC.V..{..c:@.E(...q'X.a.y8.1.3..-...X.(.x.4.`..(.W.e8..W,..\b...g.k./4}....V..z@...&+.S...o4.8H.9...u..X....h...$.D.. ._.YC..V.>.v....X......=..C.E.f...3\|.Q..;w4.l...9FAg..4UB{.W.14..H"$j.a.</......."+v.......i..~......<....3.....'..c..1.....G.E.....}:.O.e.f..]..V.......wd..........vb`..K..b.z.....Q5q.z...sI)...F.E..T..../R..9e....v.../.....(0,.V.....T+.a.>....r-...=Y....,....z...r..[<.....qhX.....Az..3...A.nY...Vjw:.....AaC.....

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	423703
Entropy (8bit):	6.404326048815627
Encrypted:	false
SSDEEP:	6144:wKwGs4+akEUXp0uLfiRqhGDcKJBjgSHCylZEGm3IbxBWnPHL36jIfPLyeJ6NRTgV:wvGsA2fu5giSlU3STe77hBCmnV8b
MD5:	28D5C7A12E28E06E7E68D2BCCEDA0CE3
SHA1:	B0DE5758374121FEBED2B5609D16967DB79D29AD
SHA-256:	DAF06B8CD47C8F956F3E2C6EFC1801A90A37D5B3FA7F2792C0F5960334148E3D
SHA-512:	8113B85EAEE4EBC1DB7722619F3A2DBF0A7124231F2203F7C7A05D973DFFF76549BD6821D1C9EBCFBE5C3C96D177743758E64260A3EADCFD6B199D12A81108A7
Malicious:	false
Preview:	...9Z.....'.V`...S>I?..~..I.mx...-.c#G._r..+....M.dkr.Ft.Z6g.3.....m.0.c5.H.B..P4N"..A.l..J...z...Q.............jf..~.J...K......2...J.lT.<.":.H:..N..`nhI.....=...6uf...1_.g.7iT...:.f..F.Wg.{%K.`....z......<7^Sz...9Qy..,.,...f~..O\|O..Hb/...=.g.2n.%.........X..r....K...h........]...Dh/}x...}.....e....kS.....X.+o...mS.G...:..I=5..q.[....b.rZ@Yi'3N..B2.h..x.....s,....W. .E.fc....e.U.......fj.T...~.T._ujj....#8<......+..x..H>WU.T.`}.#.q.\|..Q..`5.t:.Te...t/W5..........cG...e..5j..G."F7..G...f.....X.)..)...Td..A...Nb...v..[...c<<,B...i..0...b.<6.....79.L......}./..=P...9pDaf...~gS..wal....$..).vq.I.m.\|6^...Y;J-....j.xo..R.y.........tc..Zf.../.m\|..MfVL;....k...,..6.R.....6\.Q.l{.+...CG.....u......\|.....SH....g_/.....#.T....A.v~.xP.5....W.iZ.....C.s.#..-.k.,...".v..u..]t,.H...U.{....L......b.\...r9.%.e..}m..+. d.!y`}5i.\|....i....e....Q5.....I:M\.m.t...vP.....=!.\|..o.2..[^4^jx*.B.6\|.@......f..T.H..@.J...w.6Pjk...j......c.."<V)G...g..

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	268071
Entropy (8bit):	6.218175189930924
Encrypted:	false
SSDEEP:	6144:FhMnDjeqajf4LhpC8VmJCYGFei7SHTUPXEv5jS:FSCfOhVVdYYei7oTx5m
MD5:	598DEA4DDAC60DA353017AB242FF5AB6
SHA1:	1AF284A9517849149EFC8E4AE49B23BAD465B332
SHA-256:	A2F24F7C7479A70BC8B5118431D5E5FB852E5C8C1098029CD55BB7DC514C673D
SHA-512:	2A4F112867F8FB9BEFCE1D9728E004D09C4CC59AB366D0D3BDEAC260DDA1498EF51CD36439CB6491EDA9B8326F4FD1A0A7E4314187723DA2BB85833EFCA28B0A
Malicious:	false
Preview:	.rR C.k..L..~.T.?.4..........y..J.pJ....k...P...r..._.."...'z.>..kDa.?K..)$..j.0.........C....^.?..,...A.....A{.M _..b^..W`....Y.......d"....L.R&.....SU..z...(..-..n<Unn?Y.....'..."..i.p.R.a......r.}O,.Vg.1&V3.U......0.... K..".rT..%...\|fHx.`./........'e=..y....T.P.B...x...I.OA..a>..&..k.d.(.K... ......{.QQj...2d3A;.3..t..M.K...r..2.?.t.M.(z..A.l/"./...>y.L.....B:..#.$...Op..}...W 9.-..Dn..D.. 9C......B.......V..6.H...e.E.9."......W.....?CI....U..:6...z....."..X.~../... .nd...F.-.h...Q~I.a{....5&z....j...x.x'....l...qLu!,............\..E.".\|..{..W..d.._....-...!..V.;c!.".O.Vh..t.V.$p............".......i.......&]......R.N..]...:..k.}..........v;kxu...._..o.a..d.+lb.2../.g. ].wh_..p.$\|...?.F....N.T..S....H.n..2;..F.:.O..D...gj.nn<...G...z5.l.s.2..-v.K..F...).4.w0.....:..P.:.{d..+r...]_.c5.....P.">.>....P.$.........U....`...O..i`-.[.e.....S..7...{.wD..\|....i.B..k...sf.hvE~..&t....Dq.......W?.y..4...<....l4....0fR..!.../....W.Dz.<...".

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1401031
Entropy (8bit):	6.859987077394358
Encrypted:	false
SSDEEP:	24576:38fGPv9ESX9zwBbj9gwObKdFW9AtNCAT45wgH9EsIDEs45fH1Adx9:s+XpX9dw1nWeN/45f9EskEN5/1Adx9
MD5:	DAAB90CE1853608D6CB398FBA85CDE40
SHA1:	EB74DB30C5ABECA2633ED57E03041C5AFB17A30B
SHA-256:	BBFEDD73C932B366E5766B9C1714956D7C9D1D9D90A9959FBB64178526ACA6AC
SHA-512:	059C610CFE2B59B908A20687B8AD8A9347BBF584F18AF7F7F00E153BDBF0C2B84E9C56121690C9264FEE2356CEB0C7FD974F043331AF57E00DDE8716F434D80F
Malicious:	false
Preview:	.Z...FK....a.....@...N..`..4.S.o...[.....2....2...X..O...NE...U1.G...\|q.H..A#..39.....]e.._.O..~+o..%....b"...f:...S......s.u.Z..T.K..c..h...U....k..D.....c.m.+..\|..B.%Z63..=..B........O$....{q...XP4.h.._..^...:O......,.Z^.....5'.@...0.D.1%6\|..D3M..2..N..~k..b.....#.-......k..x."S....Y...^.."......h....I..X.j.".@.?.).#J._..M...5c\|.......g..t..F.=....K.)....xA.6{....Q..(..1Dn...~g..@.]2.J...8..W..<..6.3.K......~N..3Gb.Y..$..........e.i.g.!<......9....TXk.5Fa....@.....6...(......\|.F....w^......@.D.U..k.W..^..7.hZ..+U.y......5..n...t.Q..A..Q......a....".e`}. .~_w..6."I...{.6?.JG..Ls....p..Z.......g.^...v..p..Q?B-.....q.....AV..ZF..H...m...D.~...P.".T.6....2t.P...`=P0A....<)..q'2..._......@J."Rd....<[-.$...f.UN.P.~,F.....h)s.[,....lO...:(....[...:r'l...fUEa..K.....o.7...0.........]U.P..w.O....v...G..a(h..<....Y...w.........)Q.Y.<M...]..FL.<5.I.N....t...~}..X....I...3]qr...E..2..n.......4.e.Z....v..H./.<.aN....iz.%\d.M0.Ph......f.

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32_msix.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	PGP Secret Sub-key -
Category:	dropped
Size (bytes):	119663
Entropy (8bit):	6.993664447724948
Encrypted:	false
SSDEEP:	1536:lsNxDhFzqa4VNw6qSch2g6CXwsv0O85rksSnDXbIGYfz0dYCoG9dwxDmLp6Wzwq:eNlz/4VGSNgejPUDLIGYfz0aAiCUWz
MD5:	8B11FF818F185B671342446F1E969EC3
SHA1:	A67C7ADB2DB9682D8396372DDC39CEA85F36B701
SHA-256:	5123CBC93390A85CE1BE4F78C189DAEDDC9C0593BE67E97A2720C935314E0D11
SHA-512:	83AF380F49F876885E9A2C7FEB8751034A6A6CCFE348379C2C7EE9499CA8659257C26A0317009F9CDBF0F73007E8170D9768ACA0D05A47363C3CDACCDF6FFD86
Malicious:	false
Preview:	........U.3..].S..%..,.X#$}".W<?g....U...C..3!....o.....>~...g........c8f......O#8.....W..$..qq.3..i..c.~Z..:.V_.-jEv..8.%q.W'pT.....`.)qeO.."Sc.v7...}t^..R..U.s.+'.gT>.$wf..7.E.....u.Cm..k.."..K.2.`.TLVg.3..?.....:....VMh..O..1.T.dS......5_.-.J0.tl....T...fa.\.O.....G.C...l...K._."$......A......e(.g.m...0.......?.{..\|.)...]......p..[M...4.............U.#....RA.n`._v.n....Z4..G........G.~.....^.L.1^.a..l......;.......oCD..MZ...'_.[...%..a.........l.. .u#Nbu.0..8=5......@...t..G..h.."....L....e.../...J.rU....".M.<0.c3..#.#..j...6z46..{.F..#&.c..9...,...5+>>...qd.c....X8..Ts...a5.......8.m.(..F=.. .-...qDv..0.w.).zuJ...a{.o5.f....V_..:t'.....$.\|l.2D.x&......%\|....[1SP.L....?...].h.M4.F....X..~.<..*..;......F.....M.L........:U.......@.......(K.I.....uD8..<.QY..4..3....z..-...^`.K.uj.b3.....L.K..h...p.-.vZ.k^....!.f.J.q........=b.=. ..hG.t..:K'iP.l4_.o.1...4.....3?].?Ns.......w}~c......Ch.)L....-o1.O..M]P.j....i..t..h.E.(.l..EL".N...4:..{#V.sG.R

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2010895
Entropy (8bit):	6.481579769174465
Encrypted:	false
SSDEEP:	49152:4lUOHvosoRShP9dYkK16sF7WxMbw9+yM6c6Fcr9DhUixGy7IheN3uvkA0/CKoxxl:CUgvm3H/A
MD5:	8E10D3F6574DA67235717008E79C934A
SHA1:	67E0E831C2788268B047BA4702A2E448113F003A
SHA-256:	9C4D69B2C285B445FF770B38FE44761A3C9A65226539290329406BD7F522620E
SHA-512:	A04047E78E4B494057F98BFD450EFAAE063553EFB779CC8741A1EE72780796C9BCAE153860A71928580250462DC8FB1E2E0968F25CDDF4DEAFC512C72FDF1785
Malicious:	false
Preview:	ky..Uw,..m.>.o8Ry...t...W....k..,..E.....G..A..?..D5.R....W.3.C...n....sb.r...5...Y.......Sx.....P.r.~..j.1!)..e)w]W.3.>..n.!.{z.Y.........V..5{.5....v..P.......[...Rg.A..+....P@.9+.0@.bi..5....X.d/...Y.....gg6.....C.Q...39.x....Tn..1).GD.\|...{.c..)-)'>4Bq...d...............L.J1..~_t....~.3.o<. lh...A...-....R..z.iQ...V.SB.u9........5....-.+.+F.2-D.N].z.%.'iN...O,1yC...fy..B.....+..b...vWd.p..D9.......oP.9.........X%...{xnb.....{N.%.......M.K"...w..........@..V\o.QT.W%.3...w...BC.8..Q..._..U...t0..v6.....f.W..Z...^..!..b.w.`h.......Y..W..O...w5n(iY.N.L%=..V.V.9[....GZx..c.^..C.........v..0....N..8fF...l..?..].%.S..F.L.J[..{[.P..im.I1.!..\|x..GL...;E@.o#UR..}.....P..J.?...%....L...k+..+.=....fq%D;.]sn....Ek..4..a{.>`....8.%P.\t....2....U.....0{...k..Z`...4.tD..].....?......#.g..k.w..'.&....5!...D...n..?.W....>I...[...(...Cl._......1{4.$.1..S........q7.:x....@...K~.....r.#a.V.....x.....A1_/.....V..Z.h..ur0........va..G....b.."..Bm.Q...v9

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64_arm64x.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2118431
Entropy (8bit):	6.486875978708072
Encrypted:	false
SSDEEP:	24576:J47VBn0EJAHOeOIfF2pl9oPsdq6NOZ+mlc8j+V1dmNcTaXUrbg:KPJAHOeOm2pOAq6NOZ+mRXXU3g
MD5:	855B5A201F88642C3AD324959CFC4F55
SHA1:	795F4006F2E41C07818FC4DF3EDB86FBA459941A
SHA-256:	52E2FF6B054C5CDEEB90159926F324CC47814015114093043FFAFCB361FCF7D8
SHA-512:	389AA5829647B8764189625E5578642C8F254531D8404618BF40BC3E5F9AB65BFC056708370EE439835CAF597D72E37EA8E23A48BA1935051A620B17FCB4DB2B
Malicious:	false
Preview:	.E.Gr\..-2.n{........p+.%..UBS.Z.>X7M...^..".,.....U........ :8pi.L!..r..C.L.......Z.....f$.......\..a.Bw.<.?@..z....N....RI.lD..`..Xg..D.vr...&.....#JIK.k.X...}c&.-[.HYJ.....1.r.F B6.d.>..h...K...!....e.k.n%.j..;..>\..e.k......:R.0&!ob.fUBi...Zd_"#G.u..G.....K....3p....4..#(.....~.?}....3...).6.\|............Lk...fy.....L...6....J.r...}.a.......g...yKNt@`....K[...8..V.....SJ.25d.!W......."..mE....Q.CSe...9..r....vcS;.)Y&...CR..>...o..Q..D....a....ar.!.N<#. ...y.....e.O...dm.\|......&$...>.&.....r~............K....Fy....p..YJf..~p.2.G.q.Z.3.J.[./............s...#..<......=H.0.'..l..0...5i1C.GH..N....\|.M..\G..u:.k....v.t....M...n..m....A.......f.xCU.....!.ZVdK..Z.!...h.]?..ur..4../.g.\....,.BT.$......K.......,.........J..d.%%.T..e."....4....#.P.s..,.XU_......@....3..[.A.-....WR:.i+.n7.....w..I\"S;......}6.......J9.'v.....3.,t........H.5Z.8.. >..S:?../..`....J.^.7'..Y..c.p9.v..T......i..W..IyT0'..x..Q..S.....$.....@k..NmU/.S.^.

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1899479
Entropy (8bit):	6.769224907559454
Encrypted:	false
SSDEEP:	49152:no2CZZI9wESt2ysEAz2fAD1hdF/o/J8eJa4k+Da:no2CZvvi2fAjdU5O
MD5:	ED1F7201E462C1B060E3FDC245449BA0
SHA1:	D2027B6EF8070CF8841CA468D5F89B476E40FDC3
SHA-256:	EEE885DF3364F71FCD38D51769A2AF0E98F105E8047CD5A387AD3E781E7F50CE
SHA-512:	A786EFF50064FD2DC429EEAE9A30F059EDEE10311B802AE922C9ADC0879A4BF83F8C3F6505AF313C8D8B41EB4744D8EED3669B7A64828CE2D36757BC581B7C3F
Malicious:	false
Preview:	..;..TA....f....un:..{...<..{3i.....c@.7#...l...pk......z.V.s.X..X.N.a. .p.S...]..}...J$Y.u>...y. y.].<....@.6.J..OI.r...R.CT..G..'W....C.C..MG..Z......R....n.c=..T...u ..Z\d2-.3F$......{..;....Y...S..fm.+(Z^...[o.^.M.}................'....Er..B..dD..m..........s...d.....:...#..Zm.'..?. R..{U...../.0......#aQ.q4B,.I.!.b.7.I.V._....X8,.$.n...0.eN\|..........N..D.C..yQ.l..e.A.@.5....4....X...5.7.`............O.&.....p.D...\|Ar.{.h.X..FST...u..Iak..8.;...gq...._..`'(oJ[.)f..4!...F....==.....=.....4f.q..L..m@`i.W....x.......q..S.-c1..^........M.pe.).n.....!,..Q?.....r....&.....$g.br.m.+x.JYo>.....~......m.{.wG...u.N...z.[Q.....]........c`6I.F.......&..D,^......+....Kj..]Z.......6.......x....N..&#..F'Y.J`......X......<Z...)....1....w>\|.r..s...&....-.AP..U$.....".Z.8.n..o.5..>..F..J...\|Hv#..~.e.#.f....4.lr...._.7Z.....L.`).D.).Te.{&:~..w.g!.2....4..V..30MqB......~j.;..@.&....(..2.......o...6....iXDl&..=..U.*.....^.%+.<W...z.&].X.f... ...t.

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2376079
Entropy (8bit):	6.559097774777731
Encrypted:	false
SSDEEP:	49152:E4/FQG233fiqpF5IaKlG6EULO6lqGETyFA+HJhYI8YUXAdz/b5bdeYv2GfUx:1UF5RKlDEgOWqPb+phOx
MD5:	85FB71D17841F9E0DB0A5F106EBFC8B6
SHA1:	67E1DCF4276559D05E06648C6F6394C5D15C478E
SHA-256:	D1A67E5389223E25CF71E6440D6B03A30D0D966BFC7993785481714FF9423963
SHA-512:	717EE08B7ED203F4C8050214ED5D6AA9BBA3849879E30CC7E2B322577B34E62F240EEAE1A92C6AE7D5DA4A3CCB053FCEF500ABF8CC8F1368285D65684DFA4D8F
Malicious:	false
Preview:	....[0.L....U....!j..y.9v.i..3#x..>..?.3.+b..V%.v.#.}\...Id...D~..i....C=........~..P.A..E...3....zo.Z..1Jv.5]..36$J.gHW..A.`I---d.f`..:...........=....}t9K.....[..^2)....o.e./...xB.&.)...M>...J.$5.<q.Jf..sF.$....9.)1q;!C.......".Y..+.7.g...........e+..P...<.vs.$.H...q...hy+Z....m......@.=.A..8-W.<......(...I.P.....-.yz..N..\|q?.C......C.QeWp.....?....i.:.o(..B..>...r7............V/+......wJ.:.d_d...^w.Q<hK.H}...6..g..q.0Gl....~..5.K.#...\.0O.3v....x..e.>{.2S...._.F..:.}'..j....b.K.~`...8.p..5K..s.3......vZ.d.ilog..3.2<..@..n\&J.p.[<UO....:}.4J..FM!h... .....6.......sx6.....jiy.5.k./F&!.W..'.W$,.>.u.y2...P-E.D..d/b..zSWpG....U.4....B.e"....Buk..P.m\..a...^;?.....E............!.}..g...Kj..@.L. A....G\|....5.....t'..I..S\{.h.e.\.o.\...;..q..F..r.#.cv.h%.__..%\..2U0.[.......H..4.LX..A.s\~.a^.....q.o;e..rr/.-...B...p...-..D...5....m.b.~.,....9kl..0$V.............L.,P.v.[....Q.C..>.0.b.'8)<..N..S.N5m~%......P...aHM...C.7. .h4..Q...A.....{o/...^.9v

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	4431
Entropy (8bit):	7.909848214358971
Encrypted:	false
SSDEEP:	96:7L2lxMISdRxEM7ztKTiuaZa/n5gwW+cUogAicy9KJ50j2W:7LftSMFKSa/LcUNl9KkH
MD5:	956E83596A1C3A299E5435597F983EAB
SHA1:	957D083114BB773F65C4A481771997C60F7106A0
SHA-256:	059EB7E0DAD017D288871BD0D955D2922DD4731F84B44C7BCDA831F76723119F
SHA-512:	34963CF099407D21B529A23B1DF6D0EB0ABDDB8684813D2B9EAA3FC6FD4EBABA06A35BFC40A38AC5399542F7EFEC5442F8562F46C9203924201088AA6E25DE13
Malicious:	false
Preview:	g...TV.Q}....J.)...._.T)4.../..xC...<.,.j.KO\|.^V~...\|..\|x...........8..9...-V.oA....K.$....r..k.....c........!..}.~l3k...R..W.....-..u.v...QFU....II<.a.F...sAB.........:..d,.dX.`.V..q%D..d.VN...}KN6..x...........~JT.....V..p...u.S.L..q..D...u..H....Wwd..$.P\|...-.;.....E...P...4a;x..0F..\f.a.^.<Q7..J....Z./t.l../...~&o..........7..I.c....v.\|7\|PY....di.6.@...1._...o..X...T.l....5.....dI...".(...S.h....l2.5..r..+...7.Y....`1...-..V?.&y.........@s8....N...V2_cr7......Gj;U...".^...r.oV~.xd.../.xa~'.........?...I.u4....$3..0.v..(...P..GKsa..!....3V..4t{!....N>.8a..Q.hc...&.4... .e.R.1.../.)b.<\....!......m.=......ku.8..nF..x.22....i..3..<....<.M...S.......t...? ..m.P..Z.3Ie....K.o...z.....5.3(*.....I.u..`.5bF.n..#.u.....G..t.....Ji8B..j.pT.&uy\|.E..".FH.Olv@......J.>$....5y.`..jQJ.b.&.[<I......W..t.R.....T..@...WX..@.......coV..].r.....E..S.+.$q+...\[...."$....e..W..K.....V..G.v..,..,0z...p(...\|5J...,..l...Z;.e.}.y...o...`YZk.:...r+..H.S

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ar-sa.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	52951
Entropy (8bit):	7.440816165340787
Encrypted:	false
SSDEEP:	1536:WsF8yVVyYWx5PX3ZUZZ7h7HSDjzPqO1vrDDz:lxsf2t7HSDjzqOhrr
MD5:	1708244903CA15B84EBA5C096EC5DBF5
SHA1:	A34734E98B38698DAFFFFF56042ACB28D277C79B
SHA-256:	042FCE0277EB2701C852C4190711D29151522F49FD41D44AF4E25B7B2746246E
SHA-512:	166DCD830EEBC30F309892DE8915E9DC91C3CFEB40CBADEF481E970B7CF17EAB3EC183D5241D81A7F9597F0D4E412D3C217DE3A0453F0ED04EC74CE2674EB630
Malicious:	false
Preview:	1.V.......s.....8.{g.wT.....k(..@..j.;3U-....(.2.).k....q...18.m.g.k...i3...m........n..z...)..b.m.~.P..Y.1....#.......%E.L/.B.......g......6...O..;{..:..C..[.ap8p.~V..y..>......R.. .G.O.cy.p...X..........e.A._.x..J.E.:t.....M{.3{.........AG\.M...'}D}..c...e#..(.R..X.b..H.k.p. (.......W......`....h+b.L.Y6.6...A.+^....\|.....)8..j..x.a....P..1m_......e.62..E.3;h.k...-..2c....QA7e.+.T..n.@....d#...GE.[+.oT.z...UN...U..I..I..t..$.O=Y..H<\.GY-..843..L.2.,.H...p.g+...n]..w.`;R.f0..0....2U...q3[YZ,..d^...)......Z..(w..w...:tt.X8LP..W.hP1........A...t....;X/.~`...A.......!@-^.@.[F....7..:p.V.o...27]...".<.TW..V.Q5.*>I./.>...=....M.....FD@.......l`o.()j%.k....(R...G....h..J..?.}Zz7k..4..9pV.z../FEg`?....e...3.....Tw..._f..y.v9...H.W.U?....{AT?4..$#....4B........G{.4....-Cg.;.-I...} ...,.>..Z.N'o......d..Uq..^e&k.\..,.e.......KC.R.7',.vv.p.f&s.e....\|t.....u.o@.x.ct..e.d.,NC..A[F....!s...p_.mv...d.B...K.`.n.H......%..K.dAy.........oaR.@

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.bg-bg.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	57159
Entropy (8bit):	7.4609580508276725
Encrypted:	false
SSDEEP:	768:L5Isx2ukLYNY1k37OCxWHNWA77dXhK4VBrbzOQkUEzWiN:Lep8D37ytZ/d5BrbzLkRzWQ
MD5:	AA97A9809CA2D3ED168722B8B4276411
SHA1:	41B7C1C9982612AC43D56CFCEFE32CA5A4F02E1D
SHA-256:	1BD217F2081FE5F34E0A6439A87EBCE6B2F19E4BFA0FDCD782625BB29B5EE9F3
SHA-512:	D2273CB97A282279F1430FB2FF4E53A6DE71C024E61575130039A5680C3ABEFE34B71660252F64F2F774BD45ED370FE2436FEDAAA0F44B6DCF8A7AC93311C122
Malicious:	false
Preview:	..B.G.&.#y\3\|...)..VTf.]@S......F.:....:.[....x.Y.z.\..A../_.T..(.<E.!OF.Mn....[A.....VF.........xU.t.....1.{....l..`......7._....!..]...>W./...2N'.X.J ..M.M\|.....z.......[......o...T2..+(.Q^:.(Xt..nG..V`.....N......@\qs....z=..V~.7.WL.\|...Z].O.\rk.u..w.ME{. .P@.%....-...a...a.l.......BH.&b......X..- ....^.%...B....H.T<......BO%.U.P..........<."..Z.Ul/..'l......8b.]..S.\|..H.Uwj...!Y....:...>...~...=)...........I{......-...V...^..$.k..9.6g.x........m`..h..E.@5.O2Y_x./hJ...S.........!....K.&.FY.#N.U.Y(SEG.d...$Z.C.I...D4...=.I_..q.U..f.u..A4..?...]d.7B.UW..Q...1.8B......Tmo.C..hi....\..l...2..+......t1o.j.....p.U.D.w.f-.....S.......E...f. B.k'..6.[K...'..w.G.^7_.....sU..^5..1.~..A.A..C...Z..a.q.'.}..D..........n.......p6...-........@._#......n....p........\|y..mj...%.?c0..W....k.b.ho.vY''Q.$.fWZ4.z...c....3._]~.!...?.G.Q.~.@h.G..e...e.....4...X<.+>..is.$}...!w...d.....^.dz)U..tffL.......D.I.0...?k..y.T.h...\.].p$..b..h...(.lY.T`h.....

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.cs-cz.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	58079
Entropy (8bit):	7.240581872487175
Encrypted:	false
SSDEEP:	768:wy7Bw2VuviXCFHj3JNG/DysozvjVnmhts82VYB16U9p9VvsR4Y9//:B7Bw2sKXCFi/DSZnmhts82iBs8pj4V//
MD5:	1F56E5D7FF25BF18C8BC22642C5631A5
SHA1:	E5D95C8724E714A24561D2723B3E4D8DEF115588
SHA-256:	8EFFD2DC1A692551FDB09158B240D463902EDC10D6072111623168128404FAC7
SHA-512:	07F8213393F3574185BAF68E6EDF7CE83F0FB994D10EEDA5D8D98469ABDC3EC2245B186049DF4AFDBFFF169A9C59171FE3AAD6256D8662FCE9186179B1E3882F
Malicious:	false
Preview:	>WD.S.d..C.Z....@S..9..e.l..A...../.`..ZMO`O.a..wS...9m@.o..}.w#. ..d...u..?..d..-.B.......p.v...h.?.P..._.s...)....X..^...7.&..x>.Am.....?...;.........~.(.\A.."...7..`4....$..f.bR..v..b.%z.q..~.Q{...=...96.`D.V...K..d..s.....r.+6.T.vzF!#...... ...$...X../..~....z-.(._..]t.m...;N#..I.o.f.\_+=.......j......q.n.PX7.HZX...Y\|-l...e....W....+.....c..7RB...r%l....O...S..a.,.V............B..S..ai..0.K..9....+..O..=.T..'..Y.`.6K.-.....2...4.Wm.@".@Z...M=.l...n..$.z9;x....P..a.(....; ...+......J.....9..X....Z..>9....j.....K].Q...\|b...<;.S..m..k.aO.M....A..6...V.P.N.IM.....H..C......D.\]..h..].W...ZX.....RvZ#.+>....t..*NQ.,G@=.{......D..0.%.@..wZ.:.STG.M.V;V....\..D..0.9..fI.cIR..[....l"v...q.vW..h.8.`..b?.r.._.....:@..?.k.......;..(.H.......W..XG.Q.C.7.......Pc....RM....'.w.F...k....v..M.#....+:^G.oH.......q.4E...N0f#G..=T.=...G:.q%.q.._?`>....:c....Y".r...Vm. .n...H.Y.....fYY!.:........6....![s!bc\.......[.(....A... ..`M@L...<.8.t+.l20..#....X.

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.da-dk.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	53471
Entropy (8bit):	7.540628826787405
Encrypted:	false
SSDEEP:	1536:+s4l7XpwriuMnFqgaPkKd2bOMqNwcTg9A1s1oTIxWYrwgZWoXAI:+pJ4iznFqgaPkKdoOMqN1Tg9A1sqTIxR
MD5:	FE8EE615910467A5100B0075C0744DCB
SHA1:	4EA568FC4E019D22A5B34CB09DB3474233307553
SHA-256:	43B3CC6FB56636F3ACEF7E4E1D55F5120FDF67D89380D1E992382C9D68AED0B6
SHA-512:	1B537795075FB77518AA0C042080C1F4AAD563C53F3366F810F924AB92675E98816128146617014F0F00639C7B1AD2A2C3694D4A40843230A0A3D7B145804991
Malicious:	false
Preview:	h"..8....G...=.@.a.M..i.^..3.M..o...~...b#. .h.9.n=c.......SF......_.N......j.U....{...Fo^Z.r._9~......14X..>.ku.+.&\|?...,.k.....s..V_......N...<..6...+8.c..j.u...1-....&k.....\|..PG.x+j.&.eb.C.....N&..y0{..Xx.4.t..+7.z.."r5.'..ar.7..../V^%..`.9...Er..L.X.......z3...{..ox.8p.?.v..?..\|1Ap;.s.v]....ju...=.Z0..=..G...f....;(.WU.......L.....g[......m.1IO..`2.....A{.`..^.....@B.[m...n.`pnS.........h...QJ..O...Ou...9....l..D.}..T..7#M..9..\|.>m.Mp.......=...Y..a..U....wua.T^FC..1....&4n....i>.J4....[....:......T.T@(...l`Gij...V..^..........h<._.....U..#....7..Re.p%.b..z......a....S?...:...F........./<..O..rcw9..lE......r.BqLz]LH.}....3..4Y......p..s,..#7O.."._Z.JP[p...F.d........:. .............m..l9.ymt..C.#.0.....'...). ...{...:...zv-...;.....-\.Q...n\|.q(0.?.`...Z..f........<w...... .._.r.........k./8.y..\8."\p..."7....m/f....E6..@.(U@.b....p20@..2..;...._.f.0z.._.H....L{<...B..P/K....0..Nb+.......o.-.\ .h..^Pl'.=.s.<.\....4F..h

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.de-de.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	60231
Entropy (8bit):	7.394058378172407
Encrypted:	false
SSDEEP:	1536:GFNf3NKbFGKK3Y1OL/kQL5b7KQz3k9eFJzFovzdpAF:GFN34bEKmL5ZDk9KJYDAF
MD5:	FEBF140907297548B922D62473628661
SHA1:	86B2E04BB5D6AE40F1A0BED317B2CCAE16C5B56C
SHA-256:	057FE6F11CE4D0E711E9AC91D9FA2131D7CD9924FC9DEA2055FC07827FC31EF2
SHA-512:	824DB4D7BD06BE8B6AD18464613D52C3346B0AD8D215A830DC8D801BE3ADE578906816235B1C641FDB2FFE776500762BF8695F83717ACFB0F8F619DFF7DE2BD5
Malicious:	false
Preview:	>..{.DL.....#<]......G.....Y...gp.:.....$.[...D...G..vi4..b?O.......}.pOK.4..Z..x...H..MGg..... ...g"..}.j.\..E......D..+B.'0...K. b..K.4J.u..dX_Q.>.tn..x...\|...9{)...q".t..}.D.._.W8 .NR/CL.......;..#_..1..l.n..K.x..<.G...k......h.W_\|/I.,^.......N.0m%.j.5sTn.H:..........!.Qn@......./.^.B{Af.s..m...\|/@%?....ET=oU>..4y.<....j@...r..Im+.....J..pVU.r$.<...70..............u>....'.t+..v..........MS.Et..~e...0z+..7u]&.NHr...^2CD.L.c...s......0t<...N.....)E../.#....F..Wa.v.}2.....B\|.(....)-...V.cC..0?a....C.&?......<.\....9s...>&;N!....)....S./.`j}...$...."..$.@..]Z;g....j.J`).:..Q.tF.J....$E...&...4`.#.7..Mw.s...P..N.f.U..Q ..N.Z.sz>.?1D-xQ.6u.g.\|=S.{.?.H..~..f.b.D&k.5dR.<..@9.~.H.%..T'@~....pV..?..... \|j...../...h.g0...A.g@<.t..t....ie...{.z....^...`..d...N.1{.C..\|...-#....Mf.d..,.X..W;;............."./.CN....a..X+C...w..b.........I......L...T....B.m.X..=.....t...SN.Q....;.J.k..q(..j.u.......}....}x..)W..o[..............2.O-..*T..

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.el-gr.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	61255
Entropy (8bit):	7.392413003031624
Encrypted:	false
SSDEEP:	768:qzKMWBD0U8hWwHrl70U/+4z9p+PPjQ4NiG65AKci1RfrWHpu5j9sOLRP9Oh/3:2LS0EwHx0UxIPPchAK13CHpuPjtVOh/3
MD5:	7DD28DCB8BD7AC4909600F83FBE742BE
SHA1:	EA87757658990D43587A6C07FBE3B7E5A52DDE92
SHA-256:	403D5297F4EA735185FEAA6B317B6115A6D72C1701D20FF3D0B1BE2D6C837BD8
SHA-512:	2DAB4B29BD5D2831098366ECAEACBCD5C1FDB647C01B7785909B18F3FDD0A7238A4400D010DF978A80A60E585D421D00A46B448BB305FCFF2983C2545271ECC5
Malicious:	false
Preview:	.')e.)_x.?m...w.($.....n..(!....7dQ7R.(......&...(s.@Q&:..i.c....6_a.u.K..E.....B.!J.f.h.R.{.h...Y......W@.v....l.&.8e+`....5.S{........&t.f..^e..-g./...3.w&.....T$...W....R[t...J.....MD.z..>3.5.I...K.#@....~........T..04.G.5cZ@..g.=...+QC-t..Jm.?/....0.A..7\|....t...J.....j........K..#h....^..!5...Jx..Z4....7....o.'.{M%?;..u\...f...(K. ..F.^x...\|Y.\...!....y.:..j.$.......3..XbN......u..s_......"...3nl./....W....5j.S.d...o.g....onW.I.I.[....g.\..68..7.3N=.wat.u.n{....c.Ss..]..{.h.;@..d?,=..?....L.7..7.>..O.T0.....5..O.....o.......P72R..1x.':....]......G....../...~Q1......p..z...N.n.D.rH..o..]KuFNh4>.d...um?....z...9.f.i.W..q....+.jp..pw..q..."RcZ........Rs.d.5x.].z.%..o..Z.yU.-...s...jU...x..~N.,.8..X...f.O. .....n..W.ti^...0<.r..I..7Y%.}.B........\Nt......Z...9F:.w.......w....U..r.....D.....(H.hJ$.yz...8c..y_}Fl....J.4UY.h.[.....P%..\..W..F.Y.G..AWs../....p......}g.aB2...Pk...+`...G........#d&M."..J..4.o.~.\a..(.fh..G]Y\....

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-gb.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	52039
Entropy (8bit):	7.600887110436333
Encrypted:	false
SSDEEP:	768:iTGKTJZR19yB2liG66FwV8IenbNxX2ObUVasc3mRwfzos0uk35wctzdco:QGiSBiQiTuVvum6fzor5wctz1
MD5:	68D2DA2104B41291894AFF8770EAF34F
SHA1:	89ED0072D1B656918B946AC061F2F73B087E08EA
SHA-256:	014A1079FB0A09253F04F348701AE823B933E1335C6BEA787D6358DD6C635616
SHA-512:	9C541A5063517391D3BBF19C9665C4A296AE64FB2138526C72C80A2E24A07B50D68342107D77C825AFB344C2496F0CFBF47BE507E9F770067E9CBB79161AC8AB
Malicious:	false
Preview:	.......;7.n.....7..T.8...US..z.`b^......\m..r....8.2c.I~y^..V....[.6.E..sp....(.......%A7.!g...x..Q=.ve.....Pr$&....\|...g.:n......].#&:...,............G.Fm.uw.0.a.$. =.....<8/E"U.}..e..B.c.O.B...!..D..../AY.[.9.<$,..q.V ..+9.x...Er.<.$.e4.\..1.....n..3...N5Wq.^>..(CK.+OI..,..</\B.....A....Z6.\|I...[..Miq..=K.....u..w..(A..?O8.'oR...b..x..."Y..?.G.q'.......O5W.:C.s.....Q.....9..55q..O....w/....O..!R.....!.\|.Qw...#.9%Y.............\..g..I.QC.......HJt9.E`..R..E...........q..:...=5 ........@...xV\|./_E.\wtvx).......$..k=\|^..^..&....f..%.K....$..[...B.'....-.-f....v..:......+..U6.....7=.`....U&z.Z2....[\|.\..j.g,F.&....$...d..8B..X...7UaCW<.._G..f.h@.....45./.m....{..._..H.zEm...$i..../...#..R6.r9..Y..o;\.\|.X.F%.&3F. ..^............v..G...(...q.m...YU\0...~..r..i.......t$............c.4sh...f.U/....F2........c9..u....e.T.F.....5.zs.k..j'..^.E..9....~.~.N...K.,.+..P.fen.B.M(...V.7zW.hR..O...\|./z........$.".......Sh..>.Q...V

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-us.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	51631
Entropy (8bit):	7.543549482150706
Encrypted:	false
SSDEEP:	768:0BpMd6+/2lLASs5gi55pQZwLgxU1d3/rGK+G9zqq6RGT99gP:iKAaiLZQ7LgQx/rqSzIGTfS
MD5:	6A47B28C20AA1B2147244AD6BCA5339C
SHA1:	790836EEEADEB8D5003B7B5D413539E80187DED5
SHA-256:	32BBB9C3995FE042A9B0C32649B27238A49759B9F0050DFAFDC93D1ED4020107
SHA-512:	77DD850433287B7095DA0DBFF757602A1D939DDA0F2402B2846219DC0EE9DADD227A2629012D269F04908D77FE47568DF0D45CC9C218178610A9E2470A0FCDC3
Malicious:	false
Preview:	...X.Y....N....:p..N.N...6.Q@8.4Y..<<kLzy]..Ri`.g.{.#.._(%.......[]X.....:.V..1.e..\|.X.....`'.DyOH...<.G.W.ip........^7..@]5........T..a...J..L.K.@G..z.v.+........"..r.r...F....2.[..S..5..U........[.o3.]..#u....'.Ez.c.+.....v...:..{..>......I.L".#....V-....W........v..gt.......s!G..'..l.......0...r..f..\|57.Q...fs..S.....&.B......g!6..0q+..N..,.G.Xg.....H...`p....U.,..<.+..4*...O...-.&...V..;.{.4.....{.k:..p.....y.;.+g.:.'i.?..}>....f7..P7Mq.$.........P.()...A#.o...w.../.;.OT....b. .-.e.@.hi.v......$...'..m....O..^.{z.1.....R?........o..4..x........S..".P;......b..5......K.?.......SW.n...(...f.......0u./....x!.).x1.G-q.#.$U.\.I.../....s............u9LkH.....J...I...L.........l..\|....W......N...x.!.h.t.....^.......Kyz.v.rp.....F...q.8.tUjCB.q.^..x..i.K;.-q.(E../........aTX\|.P..3IqV....G.......!.v%....j..^Nv..U..$...wd..VA....w..W..~)......;...M2....C..5..o....j.P......:.........w..K....S..}.%V.9...I...Z".+.H..,..n..o..;..~Xqi.y"...y~..G.

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.es-es.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	55519
Entropy (8bit):	7.5281496195801205
Encrypted:	false
SSDEEP:	1536:1Pn1SjgNRE4mPC5XJW5pCu9XE9zokBfoZTSmc:B1SjgNC4uC4phXWaOmc
MD5:	0C46AAFA897DE08B607DA54A64547429
SHA1:	698148E053C31DA14F62464DBEEB89FD23716341
SHA-256:	BAFC8058FB7ACF9CC5C9CA831C73661AF46957ED1827DB4A15B29C9709077494
SHA-512:	8F88D42C768853AE67180E156574B93C7C34F99525CCD730BA62C41F432782A40E9D0B8E17A15ADFF1CF918277255CA6BF29E50F9477B2153FB45B9C1AB0863E
Malicious:	false
Preview:	........W.B....o..i..4....B..A.A.e`.i.Op.......QD...K...\....1.M.......^t...P..n............G...;>=O@.....!.......N...S..=.....^i.;R......V...NNx.t...5.....D..j]...c.....3H.....4N.l.7i...o. l..R.......N........I....V.1~.$~....S.......+..N.t.E..X:.8.......R.D..;.<O.'....H.t.,...E....`.C...qI.uX.....(..a.44._.c3.......P..}.a^...+...U..+.L.].@..........]..?.6.IQ....ti....0.4L...#,...........R".\|<0}.,.=..<)....6~Y.n}...C.<.n'l.'lu.(`.?=......D6.. ..........O"jR{=.8...s.....n2..<.P........]..H.....n.5&..........D.2e.E=.=.Ib.J..P.9N`D.K...zc.!...":.....y.c.'zJk.....P.M.+0.......M#.!n.F.d.......CU.-..~=M...L..".<yF.....n9..W.<.gO.8.0.L..\...L..z:./tu....Wf.....%.FV<..C....h.^.sD..6.....Q.d#d..@I.P...5....D....y...H.......;..B1..Z..w...'.(.{+}Mj....w.}ht..[.......>.iD..}8.a...-O..3..A.4..=...Y.6,..[.G0^2J.m.j.....B...4..5........0,.q"..m>.u.Uh...j..%.L#c6c".;...........i.I..8.Y....x...y...x..a..C.....?#u...g48..=\|.....e.E..\E....

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.es-mx.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	COM executable for DOS
Category:	dropped
Size (bytes):	55511
Entropy (8bit):	7.537218197838172
Encrypted:	false
SSDEEP:	768:7P3DGzpaNIOD4EjL6N3W/xXWAWko6NfVjSDjry00DeLYLN9mGNjRc96o/:7PzGzaz/XZGOltSrb0DTLvmGN1U6o/
MD5:	009A19342C918637D7C8BCE3894685DA
SHA1:	E62A5A316F1FE659A99D394F5503AE8BE46AC2EF
SHA-256:	A121B0CB4EE8D0B2E0783A2C63E2202EF0502FCF823737C89D0C370193C66CD8
SHA-512:	10BD421AB616C2D46FA4074438BA5431CBB60AC4F50ADC2DDC6F38BD6C791F3D2D24AB6CD3C413F3F4083E3C38F713D94BE0565F5322FFBF7B5377005895A856
Malicious:	false
Preview:	...C[Y...SS^9...r...I.k...6...F......W-?5..ND.....WJ.J.....^F.A.E.9O.@M./sg...j(Je.4...Y/g...`..4...../.gs....I;.......N..-..A.5....}.e...B......h....l..<.F.kf8A..<=.P.M..."..I........O.....BP.d>q.3...].]..X^.........s7......S.#....kx.0.=\|.L%...E.a.4]_....k..,..d~...q..(.c....T..I."z...........}.q..@...fji.uN.="P...@u.1B..VMl.Q.,.P.&..W!.o..v +.h....1...KE....?3.. .f...3...,.^.6h..>.......u....c..........v.C?.....7.@..,_`cE.....3...}-.$#..jB....7..`d.".okh..=.>M...w.n..5J......o.....4.R.U.,g.`......g../.3R3.B.Vk..Tp......j@.C.&.,..4A...0..R..S....B...gSb.PQ..m7.yK.ssr.~...Ujm..<...TL.....U.uD...j.................k..r.R...EX...]{`."p....V.....0..m.l.X4..w.\|..QE.D....j#.......fR.. B.T.^..)rm..+.-.....9....W\.4..xg...o`.j{.'4l.MU#.f1.p...+w.+9...xRh..m.......M.....c....,B${.>....r.[.^..[{6....zSB.7.B.6S....0.W...'o.+9=.8U.p..A.c...TlyHQC..>.........Fb...Jm~...*~...h.y7.4.u.PS...)..m...`v...m.&T.AJ..)&X.3Ks...4...y.Z.rJ$Rw..>..".E.....M.P\|Z....aQ.

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.et-ee.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	53175
Entropy (8bit):	7.644567510022717
Encrypted:	false
SSDEEP:	768:/D0TTncsbjLsyr6j+Y7Ok81YQDbXIOiUL9GbDMkOit7Vmr7:yAs7saVY7OJYeLIbUhGbD7bxY3
MD5:	BCF0DDAB5F8623C94CAEC125C6902BE7
SHA1:	E4DBB23C80DD06A89965CBBF9C5A0818C9C84D41
SHA-256:	431065E18C94F133A0A824DE62A3FDE090E963B42675C69AFA73BD2B04C343B3
SHA-512:	AC898ADD4421600E75582F013DDC11918855D781CBE4FA606AC1412541EF5C00046CA2503184F21D59A2FA27972F6F0779A8F354A4588062F743E0F22A30CDE5
Malicious:	false
Preview:	.5..7.....~..?n..h.~.K.}a..l.....c.-...."..........?...Vi.B!!f..w....9.x.~).S&`...E:.{..D.X/.....y..N..L.6..q....V.-.#.O.Bi..Go$y.M.U...`....p7.c.M-.'.. ..6.i...;.$.?....C3..A....A6.r..[..p.@3T..`/.....E...I)...o64...i.[....Ig..2....Ho.0<8.+..I8...w .#.......5.p..V.....;..._..D.d.s~.t..L ..u..K...;.x..\.,..B.-./.~.Vf...T..~........B....M..)....q`..xsX<.0...m.{..@...U..1.9#.....E...~a...1.]t.x....S..9.'.j#....R}.....}.m..a.F.7.w..R..>..@....\..}J....D]<.D1..G[..y.....X....A....@.&.km...)....,...W.I.=...\-#Mu.>.d.@..\|...mB{p.j!. 9.55.....x?x_.6.`G......g..=....,....Jt....?N...9.J....;%..%.....\|..X.iR....a...m.t;yU..W....vm.0..My..). ...c.S}X.+.B.:S!.1......B!.>.?>R....t..0.j.j3N...Z..n.=..e../......\|g..N.........g......C.... .Y..{7.7.t..mM..y...."$.L....>..;....*L.}.8.%.@@s4...[A........q.XT.=.....n2>.8.&.....}....[.....p..A?s.6.O.m.Z8.y;.....3.c....~ j..v.K.........=<=+.G..)_h.I.....7...r3....A....p.....W.p.66E!.....w..4..... ..v._We..

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fi-fi.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	52039
Entropy (8bit):	7.59588223300181
Encrypted:	false
SSDEEP:	768:Lusf3WK+iQIbpHjO1MjC3sZ4xI1ddR4o0yGZKHrGzc6MAYsf4zh0:LX3PQaJecZ4O1ddREzZMrGzccYsf4zh0
MD5:	9ED95F05CEB1D493670BC7D71E370D78
SHA1:	0152FC01C93ECB60184181B3F9AE6276AE58824F
SHA-256:	115E7F87E590D44929205B1DBC27A97176FA481A07EB4D7D78706DE338F60D2D
SHA-512:	0F91B4E624081D28AC0CD0F370FC8B9EFA1BE861CE9B42B3E169E2563F010564A194532CC47EFDBCFA0B72D78379A00776E0DDD1C40E76413337BBA0DAC689F4
Malicious:	false
Preview:	.....(...:.Qe.# -Y.d..h7.,C.`.F....6{..... ..r.Q..T#+.l.E....:1...~.F..sE...U.k&.aT.DJ...y;9.Yi6$....Rw..A....l.+..,B....L....`...zR.).... ..$...mW.O"t..R`h. .".$.......C.....a X....P.e...xK....}....t.hA%..].....}L..9. _....r..X.?w.2@.&.\|.M'.\.x.$..l....~`9.D....f.`..[W...F:@..VL\|.+.Y...N.R.......5$..3.e.@...e\)Kg.........+......(.x.E...s.....s.sL........}.0>.j.&.m...B...}(~...........S.^...{...Hl..=/.......{'..]..\$.q..i...<.w..C..N........h.. .o.B.i.bYV....nz.G.\1)....7]...a7..S..?N<kjOF(G...\|w.........t.L.....B.P.l.c.eBD..?X..X./a.m..L.XS....51....6....y.3....v...9.D2.A.]..t...a<.nNX:..S....F..$f...!e.jw.{...'.r..9."!.......r\.4(.yf&F......M..<....;!^..3..j5BI?L6...}....r.X..Z..+..:.>.....O]....ih/.bP.U..v..0f..gwKk.\|e;..I4..J....0....+..%d.h. .&D..u.9U._..j,m\.W....H...5.po...Jp.........$...$6.4.......0m..03"\U....#......\|c(\,J.W.x..u.3...lC.[..*Q.........a....D....o.H...I..%j...%.&......?.7.:q7.KRL....H.!.._.).........X\.X~V9

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fr-ca.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	60335
Entropy (8bit):	7.366379436613895
Encrypted:	false
SSDEEP:	1536:PTkmfMaLkRnrAyWCfRhbKy5Lz/MizHwk2Mz57:ZfoUyWaRss7Mi99
MD5:	5B912F69D64908847B6407454BFE3F33
SHA1:	4853C97745B493532AB43A68389BB1489B2687EC
SHA-256:	A7D0789CC80F21C4B0CACE460B43BFA1DC5B6F904380519381176A5DB3307092
SHA-512:	1A0B5F668B66C5520549E7FC9772CEB3106A406862BE1EC06305FF32B559FE010E9BD77DB0963A5387EBDD6D6395BE509AAE3060BF9F9EF07456C7D7399932B2
Malicious:	false
Preview:	..4y..`.b..b....#.D5..FP..........:d:Kx4k5....).W............q...DV...^b...).r;..s...{/.../U$.,.0..m\|_`Hr.....,;Nl.<..o..W.(....x.N..;.wa....&..)..#......@..{.5W..?.t....&....1..e...2.2.....5......!........>{K.I....sq..7.9.J...w....~.p...AXw..]I....d...}fQ..u`Is.`W.$...7d...w............>....m:]"B...<.a....1.nc.3Fg.y.q...Ym.$...N...OS.vb.6.H.(b...5.$U....r...H.C.].O..O.+.v...x.l."...#k........K.Q..K.)......R.t.P.....;.h..8.}.......W.<y.l..e........T............=C?s".OSe...G.....$...g#.\......5Y..zV....}.!....P/d.N.H......+...:w#O.....-....\|N...]X.....C?G.o.?.._.G.g........I...~.94.`~..3.?../G...5;.&...Nsl.....&..<0...t.....tC5....iC.m.of..J. 1......0Wwj<r..ha...})G..fzI.h...,..\|.a.....n.....Y....cx...]..v...A.m.NG....:...8}..(..z...k3\|...d/s.P..W.!...F.yg..DJ......R]...4....vc.O...y8.........@..Kf...9...8......[V.{O.8...~ tZG..3.Z.n. r.A..H..3s...b..@.}..X.'....Q>.[..J...Z`&.7.].;.9i.t..YdY......rv.3.H...3V.&".N.......T...&..Kl ..u.......

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fr-fr.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	60751
Entropy (8bit):	7.331843581935864
Encrypted:	false
SSDEEP:	1536:gdQaskvJNKiMsQStaZ2UHLt4n7irYBceqzjv:gJHJBQS8ZprtG7irEpqv
MD5:	114A36CBC83D8C766C8165E35F584A15
SHA1:	61182E31158F442073F7224CE3999B3D7FBAEE05
SHA-256:	C9DF9E9695BFB2EDD19AA87F106B43D723B41D051F17F49A1A65E420FA9882A1
SHA-512:	8EF92D201B152DE92CB13CD895AD2446A6E0B82A1EC0337D3065DE3A9861927C5F9EB42ED4E94B1C60D578127D46AB35B8A60D30A3C5938839F4AB4957C44FBB
Malicious:	false
Preview:	..PX.g....&.O.}h..[.....V.$.7.2..3(..}.Oo.1%.'$.b.j..e.C..8.(..>...].l.....W...............c.4....!f.\|G..l...k....d.h-....}.\|.@?sw.7Lp-...../..JS.z.<o ...E.......b.{....&.Z(.a./.N......?.L....`4/.!...k.....`.T.kgDzIb.p.s...;0P.9./P..&..R9..Mw.i.hY..L..>S.fR.WZ_Q.[....W.>............a.'`9..n.!W...s..[~ic'.~...-[.K,..AQ{T.T...XN.....4S..v.N..n.p...^D...L.T..L.S..8E...-.h...C.N.uR. .N.=....p...8V..J.....a~...^"@....$..I.S..>...._...0OF....u.;)....G..3.$.fr.]......>..).A.O..u....IB..SK....M...236..[...2..+b.....]..z....e.\|..7d.x.{...S..1Z.._v..,.'..{.=+_.M......m6bL......B.-...q.....sm....xE....yW.ZBC.hF......Zk.....f.k.h.a.PE....\|...FU...kn.6E.R.........T..........!..9..0....\../L....\|6...K..s..\|."...Q.R..&.O.._.40..\|.Y.....@[[....w...&'Z.1s...Am....l7X?..4..B.q.Im....'..L....4.I.....H......u..wsiT[..VF..Foc2..EO.)....3....N.B.....N2.?r.5..R..0... ..Go#i..J...BD..Y.I.....$s?@/.........qP%m.g.M../. .ln.p.a..%I..h.D7m,Wb\....BP.....3r..dQ.W.

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.he-il.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	50607
Entropy (8bit):	7.522154823149884
Encrypted:	false
SSDEEP:	768:zM/6wiJi+s2gcdO7OxqM9iCmnL49yuoVBBXOx9OsJqCeROmUfgqE:zYPL9cdWlMxmnLs7oVBBaO9CewYj
MD5:	D8D6EA45071FCBCD0677ED55D86B602D
SHA1:	117BA172D5A8F259845BEEDD535D87E4FE10B9D0
SHA-256:	DCF3E46B59E8659A8BB205432F2486823AE288D62B627163255CEDC7375E7E58
SHA-512:	A368401A7BE72E0BAE7A9480BAA749D04AF7583FE877DC821104D954A604D39A5FD3D315A7E716945EBA0ACB846D5083180CFAEEF4449A9452104A8A1152E85D
Malicious:	false
Preview:	...t..P........S. {.h......B....M<....."/gu..p..0..}......sE..IY...7...y.A...]..%...;[..;...q...aYHkU..P.W..yy....$>.e.j...?t.. S...7.....7.#U..e.S..&4T~..+...9.ON...$hg>.UZt....BJ$8r..V...K.@ ..F...;k^..........v'.".4..iC.-.jK.1.\Y....~{G......C%....C.J.@#.S.$.S.i.s..... %.N....!.........Z..Y:....?e.b....z.jx.yd.@...c..>Z... .%.=.B...'..dy.....U)..:i./.x.Q 'S]...(....a#{.........4"..x.:+..<2../-.j;.Y.m..r.]............oK'..I.v.o+..k.v.xE.B...,Xw....7'~.k..H..@.t..C.3.6...h.e....b.....y[./M.&.>H....jA0....{.)6c.......l.......P%............-...\..uh..g-\|Ou.M{.x..".3.W..O....].N.G.#w..g=VU...$.........m.....5aD.+.F..}...0.B.....*Kzu7z."..0U.^.....2.......\|L.. .......9eoq.<)ek...8...}..;cI....\|..p..Kq...!j....:...".r.L.H...\|....H.D/d..c...}.........h..F;.5....m>.........s.....[.sw<v......yA.h`!....87~G.......v....X.+!.Y......RT..Q.....\(...:..."....u.\.Ek.?.k.a....z..Y...+T}..{..@.t..9.Il....J Z....bZ..-..o.cc\| ..Zo.b.E....(...].a..-.jLC.V

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hi-in.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	60231
Entropy (8bit):	7.280129759819727
Encrypted:	false
SSDEEP:	1536:yV6wYUv+Xs3z3PM2Z8bMetr1kiIpPzsnzXztpzB:S6wFv+EubMwSiiPwrzB
MD5:	9DDCC3CB12B7328A2776EB0D00ADAEC3
SHA1:	DCBDF146439A14C5839D2125117B0FB7EED4AD0B
SHA-256:	A1997D5BE3CB0FB7DDFB92C70C2FF5663F4AC8A9FBB261319A729341B9E6F91E
SHA-512:	1180A89D5F30F54970EFC3FE1CD62103468371EF6B21DA919AC169E37904497FCDB4E1DE9F4B352104027CBE2FF74283880976724BFA1064DFB3278453E7E851
Malicious:	false
Preview:	Qw[._..2..wbA..~....k.y..z...2.a...sQ...1.Q..!l.C.......Kf.G..17Xa.c!.7.h....F.6.&..LI..8.l.h.....Q.^5mh.,%e^B3.<E....d...)..Yn...%.d..".I+0{#.Z$.t2...NCU...MP...x..4..2..rPt.XUx.e...j.LOJ.......`~.<n].e..v.....5v..Wt..pZ~.k...O^..G..6H.3...S....\|...s...iF._..,&.'....L.\.._..,..~......L.'y}.D......O.M..h..=..V.?..9..Y.....%...\|....Q.G)x.F....F.l8........y%.wo.I.H1..Xw<....}.Qw.f.....:z...x.fL.w..=2s....t..P..\|......A...u).k..W....M.....~3..o.f...$.V.kM..k.{. .\..[._...K..g....,.$ .J.?..c.B....{~...of.2....k.N..z3s..H.....7... .3_LU..b.".c....a...j_7....V.....n9uP..J./.Yn.K.R..d...0.....lDAq&....y.....RCO.l.r .)./I..c.Ul..^y..5...J.J..\}f..^.(.d.<.S@..8...LA.T...}..^..o.x....R.\|.:.1Za..^.Wa..K.:...C ....=+..0._L'..D.&7.0.l....p........^..i\|...-.....^].....oJ3+........3Fm..r..4N..E........S...;\.y...(.......^.P.DsF..".}%..t..o..%q.7.r^.G.u.......... ..=tf\`:....\".Z.@+......=...@{I'?..6....{.g.B3L/..*..E.......OF. .z....Q..-..MJWX...{.:..

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hr-hr.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	54599
Entropy (8bit):	7.6352318831082275
Encrypted:	false
SSDEEP:	1536:dZFfgtFKKhAQvRWG+60NvwkNzgig7sNzV:dZGoKhRvRm62oWsHsNh
MD5:	33F7AC15143D84B9CBF4E170DF65EE5E
SHA1:	6877B26238A9E13CB49A6E0745A8714B5B4F3BE0
SHA-256:	79661DFE44B13C232D7BAA4B6F466D2EB5207B1A3D2DBDD17FECC78049CCB237
SHA-512:	C43C5AE6CD5D1E9169910ECC7DF3D8AC09CC233FAB8684395701F87BDE61682A15B8A37712666C4864803859E584EF2F4114405633E8A1F698EEA2A959588CA5
Malicious:	false
Preview:	.B..JM.?.9.b...l...S.....]..b...sbBM...>Q%......L......=.3..C...DG.A..^..V)'w..]......$V.....]....1hC-...).r...<.Y.K+....%.].+.<..{............+n..!.......L.(.8..<...x............]....9W....n..T..M.<..Q.{\|9..u_]..Bv.1..F........s_L.}..k.7..0..............y.A^.1]..r#..?..;.".q-...9......W#....m-.'S..+".X.Q....HI7....a..4..o.!-..B9..Ol....."::..n..h."...VAu...[+2".~........3...=!.9.~y.g..b&.1.u.....&.}.......B.p..I0..{h.o...l.W...i......}bt.7.oE..+..S.m.3Mq...l.-zQ..J.u..H...n.u..\<_b..[K=....Y...."@~.R...k..XD#.{.........H.e3/..i..Ox.).L..\|.q..(..........`.....,..#...xU.........rO.....J.....e....e.D..J...'......bl..............l$Sp..8+........8.a.........rE\|j..8b...w...."S....c...a./.>M.op...I<>>y.g..#.........:..Q.o..AA...;.H........E.......-.6!./2..W..l.~.}..$GU.d.S.Y.Z\|..NE--.1.3.9S.:%<^Lr.`...u........\..G..\..k..'..t...,.bs.2........qB%O.Y....a"......(>G....GGz.....B..Z....[]n...GO..Am.]=.....;ci).......B..\|p..'.g..

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hu-hu.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	57567
Entropy (8bit):	7.465844302438304
Encrypted:	false
SSDEEP:	768:0PrtHkybYk77X74Eq8f8Iyg24VcYHkCumv47XLNsc/KIvUo0nH6mzmHnsFztzv+:MhoU09/rgBVeWA/KIvJ0nHtzmHepzm
MD5:	80BBAA2C9EC2119ADA2173625461139E
SHA1:	5E2490863C68FDFF6652FB19A821B7B66CF96795
SHA-256:	633520FDF6D462B0CB1636F5FB90B2868CC52C1D26DFC3828596200DBD63EA43
SHA-512:	25E0323B3CFB2E29F48C9EBF378000A00664C5DC4FE851ED3F9FBF79BA7C666C533FE41EDDE6C25D82437AFFB2B3E0DEE5248E2390EE815B291DFC07E4C44F43
Malicious:	false
Preview:	Gsw......H...........R.G".L......M...%...6..p~.t....._.u.r.....r.....y..\.JKX..u}..O..Lp.(.R.y9....p-....Ro...<p3.E.......(....u.....>..!...~I^~...U.Z.~.u...r.zNE..&i.Q]m..f.W..S.m...]o.T..\|.9e'~]...k..iv@&V.:>.V.\.1..-.Z....Qj........3.GhS].}.l-..<.M.H.u9\..zu. ......$.C.....L.m..j6...+.$s(...[..#b..i....pX?._.i..'e.L....klH.A....N.].....k2'.=..kO..pr......0A_..z...8..$.LB......q..F1...:....}...Vt.ex.(.]..\.Gp...h...............jm.S).......J.A.dl.m...e.b.A.~.E.(X..n....;3..6............(~-...#16.....iW.wZidn...h._......8.s.`....A..\..l..w^...w&.e.[.3.zM.3O.p.Z..PM.2...7...../.......Ob=i..M....(.<...?U.....e=;.....Zy\..S.Mi..73....x........v.T.oe...H.#...F.?.p..R.eNf.W.x...fF6..h....=.r..l..{..x.3..\1..d....(:..;.CLW1...di..f..8E.jDi..@.e.su..;z...fG.cV..Qq....'....".$0...K!f......M.p...$B.T.........*...Z/72.w..&.3..;.dP.i.w......].v...c......`%..R..6.R.O.X...2.#d 7.Gh.O....x....d.MA.$...r..#..u..t]!.v.6.e.#..N.l..L.<Q..3.5.Q.0..

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.id-id.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	52959
Entropy (8bit):	7.551477462157761
Encrypted:	false
SSDEEP:	1536:sDFj9ubHcq1/wMa97UctDGv/nMHIBWFAV4:sKw5tGHnMHIUA6
MD5:	61524375D2F1906C7E9C22B2A089CA6E
SHA1:	027B1A53E53813FF813CC5EFE171CC6A9DAD545B
SHA-256:	8CDB7B72E4AF2773D5224BE1CB6E0BAF141F3F1337723083EDCF44070481DC42
SHA-512:	3AFBE3704A626C6136A4A014955A41C6CB1B5C310F23504E7E82F72F2907E0268FAABDA6BBEF93B2C95755237D05BC5DD942A0A9A6A8B4710371AFA04F366824
Malicious:	false
Preview:	..p...Xn...M O.j.;4.+sB".0]j..V..~.s.Z.;.N.%...(..m.L..4...%N...".FF......l.R6z.%QR...\|..P.R.;.=...X.n.....c....3.CH9s.m.q3JY..E9../.{.8...!....Q]s...EI..->..K..!.o..8a.S>...0g...jW$.b!....g3.D-..'<Y.x.U..t....... I....^....cG\.e...."..&.K...'x..k......W..F..aP.......\|#a<.I...=I.e'.CW.T...K...,..rU.-C.fr..h.Fb.'..7.....ZG......\|....3]gh.LK.3.pH.........EDc@...w..m.$.j8F.~+.Sii..K..o`%...3.2...hL........cb.2%..Z.)..KbHLM.e.....8..o.^>]?..3......Z....,B=~..=.B..y.MP..ko....v(-%.{.[.>.!...%.I?.d.{..1I.{..F.^..c.A+%.]......N^..M/YE...z\.w......F......\..}.j.b%..ru.z...c!c....#.e...N..._\|..........0n`K....u.B.bO ...#1..'\|...%....u..Od..b...71.\..o]a...'1.cr....S.A{.......)..o...A..N..(...s.R..g.../....=>.....jY#].\|...^..]uX.R.r..^.w&W..l..(.G....yQ..@.I......V;w..8...V.k.M\|q;..]...0..4...8.P.a4..j...q...\.n<..?bt.SP..H.{..ER....F..#......6......5..{.5.W.......>...W........T).RfPk.`r....Ac.u..i..Aq.....:...I.%..!.`.>.BQ...j.P..K_IX.-..K..m0.......x.

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.it-it.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	54999
Entropy (8bit):	7.570504014039286
Encrypted:	false
SSDEEP:	768:2/I+EUUIcFQSmRkcw0s7EskpmKCcfcZB6P+lRK0CzdNTF4tJz2qhK:IXHUIc8PLsAIucZB6mlkbzjTF4zz2j
MD5:	E150D67985C28C0503229B5CD0F95F4E
SHA1:	C58A89A03C25E5CA1050499BECB21D970B843C7D
SHA-256:	2D353F7470860D5EA02CC27D44702E29E8A9F049F9055CDC8610EA0155909B44
SHA-512:	980AFB38B84C380F13B01F577D657882F41387A79BA3226932468F38021A8FAAEA314ADBE87B6DA7AF2AC15FF764C6153682CA8A9DC3E6C9C648730EB534B8DD
Malicious:	false
Preview:	.w.}...NR.Zr9.....l,..r..E....+..D...R..8.&.....ubRE3.l.m.\|.l./.&.!.-[..%Z.p.AH..L%.\|....,D.v/..V.H#+0.L:...(.-eh...w..M.#....K.R,s...T.Q...VW;..).R.L.A:.U...Ri..Q?....Uy..WR.z......u>..'...K.jRy!i.3..M.ggRX5.....`".........l.....\|Gm...a.Z..]B..3]...~.5,..u/T....fCd..6..gV.}o...x.H.....4.U.tq1......?...5...=.M...........@0...1.(......p.S...g.yi.....!PM......xgM+.i...W. ..f.8...b.....#....................$,....3.....)..^....Y.rS..........s,.R...U.$w..H.S...m"..\|.+..'.T....CO.._M.ty.(.l..#...K?.vG.0.h.<yREl...=..0!..ny.%:....0.q.`....l.\|..w.`.v.C).m..._.V.<....4...<E.._..e/2.L._.....{^.S.Qi!.....]&.../..........g.~.#...W.;Z...E....!I.."..e..\|Lt..\...T&.u.na:.c..e...e.e...z.M.3.p.Jq.PW..$..Y......P..w?.!..bj.V......3..I...8.1.0.q{....y.R.5JM<Y....Ik...?.<3E....K.}..e...\|...j.',...A.7&.R......Q83......Ix..~....D.^-.V+...oGt.K.u.*.^..`.0....+.Q}...8O....=..C.7...O..Xu....L@.8..V..9`.j<...E....n{]c.......qO0.ZQ...Z.z.....O..%'..F......o=.9R..

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ja-jp.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	59719
Entropy (8bit):	7.089453274502232
Encrypted:	false
SSDEEP:	768:wb+BmZRCWQZKkleoC1vevri+5BYzewPOt3udwJsOR3ozaHn3/UJz15c:w7IWQALw35BYYIdmso4zaH3MJzDc
MD5:	E0F610E2928CA757A3D499321C31E5FF
SHA1:	370AB5FBAD16952E7AE60262A12C42C0EE0D03D7
SHA-256:	945E62F98246CAA6144CB120A445A1EE8F706AA7D1F30B8B2ED7ADB60B379546
SHA-512:	DABAEC1B06904B2AFA01B948E876095D318437BB7F6A73D92E4B2BA35F3739E3242CC41B8423A41D2F6DD3A2C90D1F87F7D3FA5D0E8E137873685182F060EC2C
Malicious:	false
Preview:	N..&....`....t111C...@....,.........Id.Hj.Hh....~o..o.jf.]'Q.\..n..r9(..x.x.m.....{.;6.2.I.._..`d]-:2v.5.s...m..^...f/#'&.`.}NQE.,.R.<...C..Ht.p...+..Z...IT.oh(..[..m.@).k.;...m.3r.Dc.(..M%8.M..'..rf.35..b.v...=...D?..6..S...L.......e.,.f.M......:ko...c.i....O.......+..R..T>..#i@....H...1......w.1..)q9m.....zFk}5YD.....Cxji..i......}P..R>(...y.....W.-8..?`.20.vU.s=....D....V3^..0..`.P.\|~.RZ\|.J.t\|c(..`;&.X.;..V?_...._H8.M9./(br....^G.br,$..O..k...d..8..Cx(..G.C..\|L...1P>.x..`N`..=..8_.....p.3.........Fy.>.$..<........iF."......q.q.<%......)!.z.T..R!...G..).{......byV..V..2..O..%..f.t.z3a..!1.P}[..?.ca.?..h...<....xDm.&.7.....u.G........6`X.I^.d...VF.;]...=..5[..u..w..(.I......'....l..RR.5N...0.d...W.....' .....-....y[b...;..7.M..?.&....7u..'wms...ct.s..9....g..Y.f..cf7Qq.Y.....e..8.o.C..p.l:!.:...I..4......'...0.!..F.....>@..9w....1Fh..S..}eI..Yu.......&~...<.....zI..N.....a.r..k.h$..n...B.L.}...W...'4:.t-.TW...w<...ys.N.^\|....s.....(...?

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.kk-kz.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	58799
Entropy (8bit):	7.116049730130705
Encrypted:	false
SSDEEP:	768:RNDM/3ZDUWsnbJPy9Ic6XhzKN4VTUwzQlw84wkCk9AMN0zRfK9b0M9n:fQ/3ZDibFPv3kw84w4AMN0Ff2b0M9n
MD5:	C5C6D77E91F3B0D982D26F56BEE9D871
SHA1:	6563246EDB8444828AA53F8525EFCC751C086689
SHA-256:	1D2FA20228988FDAE89345EC954293A850467674C77810F177FD28B6824AD4BB
SHA-512:	75513656CCE017D92113404186AD8A67FB757B947E7E3340054BC52BDBE57B16C2AF0B90CD5C0C617C10AB2E29B27B1D13E9CB049C761325DE42FD8005B68D20
Malicious:	false
Preview:	...5.Z...4J...Vp.?.^..$.c...O!.I..8:......u.P.".e...Y.`.^1..7..I...`.gZ...x '.].(@.........O.....Ag..w.H..FM.@.{#..n...dW.)....+...c.'.V...d.d).G..Z..6._..7..l...LI..[#`.>..v.K.Yp.Z.6....#.{.....%.x.M.q.)..:.vj...O.]..dX.2........K..X.......E2{.p...G.).......E..+.S..E...Sz;+v..}XB.2.$j......r..n..@.:.0......!....5.1'.7HS.._[A<.....L..';...Sc.o.......n..........{V.EK.q....B..b{.......L.\|...x....$4:G.w....fX..Z...(..\L..W.J...#..\|2.xR.m...,B_O].......F.....OA S.Hu\|1..Z.............'.X._..;!...\.c..3?..F...J.....g.;....iU.dh..n.i..(...I.r.2 ...$.hR.mwpj.....D......82...s6..[E...\.).W...^..h...B...w5.UG.8.E@...F5.X.u`..S.@.R..n.BU..{...T(...7J.+.D...J....@..s.?...zN3.d.GjOn..m......T+.PLY..".\|...e...q...`...y.b...._S!.glZ.,.-5..xr....4.V....B.G....K....~w...\6.Pe;C.<g....z+..[.#..m..R.)0.=?...(../\|.D.'..^..e^....5T.$......]<.;=,...<.:e.O..iz..I...7....~........0..^....ZT3..P.l>.f@.g~..e:...Si.~;...\|...Q&...He.Q..3jMC8..`.`..

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ko-kr.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	55119
Entropy (8bit):	7.360459896361319
Encrypted:	false
SSDEEP:	768:vDtaqgFxCwG1w3ibRIpoSlWhpVDnF5PEe3OTsu8XAaB6/GHmz5iIaHDzg:zgjCwG1zQ/WHxUZuAaB6/GGz5Vajzg
MD5:	10935913DE9F2E8285046295B1171098
SHA1:	10B33C2DA93EA96A1F002A113041E1107939B1D9
SHA-256:	A23BFC92B0F1A5992E366F52E61F3AF8DC5DCE63863414D47D9F1EB2982AF07F
SHA-512:	F865205B5EB2E217EF695EA79D0D82E341A199297FE12B9EE34450F292EBD99720278444C959867866112A853A3A101BD287A43D36987960B7886CFFB5DA2CA0
Malicious:	false
Preview:	QT.......5..-hN2\....d..+.(.[....K..Y.(..ef..+....<..;`.H.V'.;..%.G./.Kf2UN.,...;...I.......dreM...a\|#..c.i.3.e?......t...[...>..G}(.Nu\|.e..._.........?5.W(..a8A.^....-.-.....8.5Wa.A...Y.u......Nr.F2"..c0..JE...cB6.4...."..p.M.....(kv....E..Q.....m..<}.k.......L.{y.]...ub3....K......1....+t.u.f.&.f{.F....t.J..?9....(j...c..3."...U3..qoF.O....!=..`.W... ..G..3...n`e.\|@...9.....Z3..v.Z.cJ..0.<..a....nE.1.5.:....s.s.z...G.=.,.....j=.J......Q.;'.<..).e.A.......\|..Q..2..XCY..........LM..l.T..';.E%..H.W..........s9@....3/.../k:n..........F..]..=."......V.l...jw...0j5yv...Tx6..x........`..[O......&....?.Pf.n........s.n..R6;.&.1E4.+M.1..H.S.>..&....W!..\.}..]o{..I..W+.c...V..y..PX..A.....n6..^..[..1.8.....t.....v.>J...f.\.)...4.4.m^1R.+......w.W.#..i1....B(...o.2J...y..[i.a....%z..........w....o:.Y...O...WB8_..h.{i.X.}[....&`G7..u..PMU.M}....c}/..s.........fp.Ak.Y.G:.a.]..<.k.y-..-...Nh.4..R.V.r..n..=w.....R.%i..'..._..x.VAM....<...]..4..c=...x.ng..rT

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lt-lt.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	55623
Entropy (8bit):	7.666738074838431
Encrypted:	false
SSDEEP:	1536:nPguqBNqgprjerwjsJM6ELtL/U7VidpmgJAU:PUN7pnoTelU7Ev3
MD5:	212B6B7B648E29EBF4071494E8C52ECC
SHA1:	C4F913A1B925A9C02C888859C315A16A662073C7
SHA-256:	9AE841DC419AF6D84AB30154D1E62D45C76B9247134ACDB77D392FC9364EFCA7
SHA-512:	379E013F427A7E1F2D378FC88EBFD70CE962CB07600B52EBBB8BAE072F2CB9D6A7CB62DCB334307D94DA197F1A6AD9BFBEFD320A1FC3A33369AFBF9C0EFE57ED
Malicious:	false
Preview:	.E./.X.d.......5.&.}i8....!-p.g...{....4e\|zx..C....yZ.yS<b7....k.......$....d..........T.#..q.J...C...A..^.u.f..3G%D}.Aq#..g.V...q\u.M..Y...8...~L.9!.&.9...:0GQT!.1c3.[.-.N%.....`............JV..{...b.FW...le..1.?.K.J0..K..>Og)b..,/-...`.g.G..i...;..hL..HoE....WbW<)K.NYN.u...e^.(.~.V........l.`..@A%x....p`..(...Q>....{......#..G...0>...,..n..F....9.R......[.....i5..X..Z..2...U8....P..'n...5....C..J..,T.........r]).>.GB..>.,-@BaJ../.o...JK.n.....J...X.@F.<...M.....3..:.W......)1..5W....v......V.'.....U.w..B.!....v.k.3.1..].1..........y$..u.Oi..`..J...a.v..V."..h.d...1#....T..TD^..]u........../..#..@C...J..B..;.+.6.j..J..1...@..4......s}X..."cin.......-e....0=W8.`t.8Z.r...g._\|.....c".l.$5....Vy6.e>....W.....f..`3...!..a........Ry?....{.....3.E&@..Z.. .z....u/8r;]..r.\...Yg...bXc.&.J.X.b.Hk...2T.",...Ur.$.p..'9l.S......-yi..%.....jE.S.2.$.t....kK..m.y.^Ui..Qy.u.M....P.....'...E.^O....,...e$...e.1^.3....Y.E.m..^..k..^...""..v....*..!.)Y......(

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lv-lv.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	55631
Entropy (8bit):	7.584301984385477
Encrypted:	false
SSDEEP:	768:XNxm147L1YBcfxrovBEpLqpalSa97srV9Vss9XHYYRV+D9HV:Xl7L1jeQ2pfahsrnVVX3V8HV
MD5:	07898320DF00ADEFBBF6F44333AA4CE5
SHA1:	C3E539F383EAE87A0F2BDDDA591203DD298A324B
SHA-256:	62D9102B45EB86EE4856D0677FEFD120C4EE6851C42C52158EC68F462831BDE5
SHA-512:	8EBAB8B64317006A970C12431C61B0931064323002E45AD9D29E9DE2429455C143661816F542C19AEEDC0438039FADC45AF97DC9E90D2C890EB76D920D166F96
Malicious:	false
Preview:	..bd..............R..W..DQ..T....._3\|ZR.c..;^.HV...k..:]2q..jvZ.C..?.....2.......4...l.{.^z.H_.7.)..,y.[..\|z...S.hP.%..\..iE.L..G.A$..n....6..A}=......pA`..^....d.]...n.6S.6....W..3OW.<...Ln..h..w\|r.U9.E....\.s..W..)O...=.......O...?K....../.&./....,.P.....[.09D.h...q......B)..'1...,.z..uP.Po.xs'.M^.j.]n.A...;..w...:.@.A)%...P...R..l...\p.-..W.t%D......\.\|.p.#GP.......4K8..#........'.<<PF...R..D=.%.j.y...R4.....'.S.aPF..f..g0Q}.%'.3d...0.s.+..i"\|.,6.Z../.lq.!...q.b.7.e.K....\|.i.......F...o...=...g.s.#..5t&....C.^..Xl.DP.R..,.aRS..@.r4:$.6b..V#... 4..z...(...z.Q...2$'r.}f..B.q..i.....&...a../>8....u...#..0+..>.N...4.p..w`.Q.T7.3.^.]s.8..Hr..Y.z{.p......J..B.9...^..I2.,.YZ..Y....(.W0i.;.ep.Q...?...n...&3...\|.u.Fs,..{@.>.64..>;'E.t..p......e..e.......>..69.Kt./c..,....4.._...TV.....z$4E/9:..@...4..E...;.9!.5..>.~.....P3.+\|a......L..b.T.2n....-.........Ba.,.3........@...S..-..4<~..u[...2).}{j...0;JA.q0^.L^..6....z..5.J....G..?6.

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ms-my.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	54495
Entropy (8bit):	7.561695178639237
Encrypted:	false
SSDEEP:	1536:/VJxeir/0S15/4eg8eBOrUVRIz0tbTzkxE:dLe831/KkUzIuTsE
MD5:	16B77E7C2170708825B0B3F94C50283B
SHA1:	17B0D76F3F59FF6C91FD9F2F9033E2A8444202C0
SHA-256:	04AB21B94FA2192255D7178638028FD8CAA7AE04F981AD6BC1F2522F762DF6F4
SHA-512:	98AF37944D4960122370AE3BEE6C29B7A7031783AC4C8B6304113FCAE54DB2CED1971BB6DE368221A8B8D959A28395F2B1B8A686DD9AC01578F5EE8C4044660E
Malicious:	false
Preview:	h......8....kC.53/;.p..e.^p...6.N^.....S@...k...b%wbs.ZfE.tx.k....O..=S".......y.<.qN..>...gu..0..V.t:.T;0c3I,L..W..<._..W.A.^.v..Q`.a.cDQ.J.....Q1..0..@.A<..n..8H.~..N....@1U......P....l.b.1..._.aN......<.0X0..w.v....\.q.f....2g.g..}...T.W.=T`...=...o.sl(%.....Gu........`R.F.<3.....es......k.9...b.X..Rg.Tv.}...6._.=x.b...?e...'..M.....a.VA..R.NFWf.H.....s..n..Y.^...I..8.W..._..K.s...U.....1..V...$G....y..)...pgp..p3...1..T..-{..L../?Y8.1..F...f.A=.j........9..s.a..-...B.Q.... ....=....l.h.N...tu.f.2.P..2.%...V.l.......&n-...}.2.+.......$...Z.4.2.>.7./......T..CB.E...`E.#.:.5...ER.=A,T.....d........I.j.w.I..p...G.g......./....'...#5Y.Vs..B.E...;...k....t...h...z.w).af8\Tk.....N.8....F.'...=C..... ..\|,>..]>._.Y...Qh.\L....T.....\m..j..%...~.n.h......O_.)..\.3..Fd../..A.1)a**......z)v..^....b..,.#.S.`y..iNL......B6Z.5]..t......\.....N.j-Jh."r..p...z3.....`.....@......sP.@......\.6....`k.~.(.H-..W..S.O...<...u.DE.9".[.4)..Y.W^....

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nb-no.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	53687
Entropy (8bit):	7.51999649738086
Encrypted:	false
SSDEEP:	1536:rvIoYc4wCuqfvg2L7Dpyu14BjCHZTFgK3NxlV+:rCc4wnqng2L7Dpyu14BjC5TFgK3NbQ
MD5:	62727264848B06FCA1564E6879B8A1BB
SHA1:	150E0E6891A97BAD05D68B0462B3B38604896672
SHA-256:	0AEE6ADC5905EC686986276B5B37F33C1F53679BB3BC1892EB11F59114FA16C3
SHA-512:	A1EC57F4BA650EE841E00F67FDE33EEDF3E1FA847E62176C06C96B9FC6CBB61E149898407F9C8E34D8C7C2CC120A0B87EDC9A9D9CE6466AF3D0EEBD6B4BB8DAD
Malicious:	false
Preview:	............d.C....h...f&.).m.`n....4..v.^u.IZ..c...}g.....#nt ..{Y....$..&...n... @./..,....G..-..1}d.Y8A4...?....[}.W......V@,..V...;......,Y..h..~G.......m.>2...l6 ..h.C@..O....N......G..~)9{.:-.B.w..l%S.4j.0.<......D7j...?..>7........s3.y.(CU.DE....]v.`...l.F....-..Lz..$.@.&Xd.j...........[..D.s.3..[...;n...@.R.?....C$.N..k...y.Z/7.{ZJ0(p.i.j.^^.....[..&.y@)M.+.....Tq.fCAH....df.Jg.Q...>....d..O....Q...`..R.F.....C....pl........d\...l.....@...}..oF.s.t%2]`#}...2..~^...E...&Q0w.>. ...W....\......D..~\.Z.k}ljc..q.4j..J-.......gO>..:;!.d..Z....;.(...`{.....?q..Y,B.#._CL..\|....c.....eT..;..J.s6...N.};.m....nL2... Sb.......s=..FM...`8D\|...._...KEyb.......v....$.1..q?.6z..{=.H}...7.$O5.....S...LM.4g....w.s.[....$G....JZ.....M.k...@.c.cI.IXs.h.-].....[.y9...n.B..]>.wT....m..FTTv.Zt.d..Mb._...a..y.\|.J.r.[s.8...^...}...h..w.8....pb.zu......V.....\rGB2U...X....B.v.(...c}.y.A.....L..P.Va...W.......=%V..x.\r.Q..[ ..C..@...l......*..+..

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nl-nl.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	55111
Entropy (8bit):	7.503738516399077
Encrypted:	false
SSDEEP:	1536:dL6cpCfe2605Fm0u+NCqDCnDYzDuK0ygzV:VZAeoFm0u+NNDCnDYpgR
MD5:	F859D2C17A18E7F7FD3AAA40A7368763
SHA1:	C52609B2CAEB8FD549CE02817BF39C14DCCF997A
SHA-256:	B4D5E5F6213F7FB6718080E555B5E0467CB51ED7C373F5DA97CF6A5A13CC0197
SHA-512:	C8A066020484FBB006F8B42A485A80D190342AA0851F69AB1D0A535B3266D53395363380F358AE3C27A6FC7B2ADD348AC2797C14D914C317250C42DA94EEA4D2
Malicious:	false
Preview:	$.k^..?.....(S..=.s.p..o..fIu}..L.0UIu.e...4...'....s..Mvd...../..@.]. .a.'.....Y.<F..4b...o5......2..6=..>5..Es_..........c..;P..R7.b..y..U...e.^.e...g...m../.3>&...vctX. G.$..L+......f.:...^.f5...c..O64..5.F...@....Q...z..y.F.:5...S...~k...[7.<..1.I/k..:..p...p....\|[.%..z}.....r...s.3d.}...y.r..... ...Mt8,.A..+F..%..'.af".k......B.[_.=.. ..~u(....L.Y.1....w....f .S...k...Z>..2...].o.J.Ens.Lx.Y.!r.\|5....Q.M>.Q.=.....g.x...@.R.7....{H....j:.-!..\|.1t....A....%.e.....2..&...\|R.%}........&.F...6g......s.\.2...1 .9\|....O?..&\|.".;..2Wh.n).N..C...z..OR..B..m"...q..\T....o...y...\...5v..z....... ...o.#.{Y.U;.....].....3...-E..do.......uU.u..lE.......@J.b).....s.E`...../%..g]............_.[.. .U.#..-......#../....Z..iB.ix......j.5r..(..+x.dQf.v:.. ]@e......IzX..ku,...t....../.=A..5b.zr..~w...NJ.A...6+R/.R...G)..X....9b(rK..`..d.l.=.9y....o..c.".....g.W.K...Od....e....k.~.........'f.../FN..l...L.)*cc......R.@4l....._t...y0d.D..Q.@...I..,..A......f.

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pl-pl.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	59831
Entropy (8bit):	7.541974526367187
Encrypted:	false
SSDEEP:	1536:oPzNVbPKMx5CtKxIFnziMdpnfz3C9eHsZzd:kNlCmDMvnfLb8Z
MD5:	D6082DA3D714A50B7B3E3D98CD0AD6CE
SHA1:	067F9BB9EB1650234EB0C4DD98454AE56BE0C5B2
SHA-256:	1397859DAE2255C2D5FEAC2122048E7A4A462A7004D55B9FE252F298918BAEE4
SHA-512:	54E1E9DC3204AFDBE99CA6416FFBE7352772C7DA1D87F0FBFEE42AE0D15C805FB62DBECFE58B813F5986D6AF428CD868B839C24A18B5890F1284754EF17C79EF
Malicious:	false
Preview:	..$.>~.m"....f.. ..-..U.7....D/.X...l=.a-..-Fk..r.....d...X]y..Q..`...&.v.E.+.C.}..A....BC @.9...\|.+.....2<.'..}.5....k..%...=0.c......W.....F..<.?r.y..0.G.fHx...0.).W.Z~}t(..B.Z..u....V..%.Y.`S.m\.....m.5.^.F..u.._@G.}.l.T....k:j....c.>0g..w..'y.6.u..1.....:9.l.....f.~?^..C....#v.HO.....Mb2..^..".54...o..m}.....p...+..>nA(^....E..'.PR.........\/D.u...4...W..K..pz.Z"6.G..d%.T.....=DN..6..>7[..zk...c7....=\..(./.T..A[Q..6b.!.=:.i.q...R....f."...0tbO:..2o.......@.se.V.L....d.3N......+..!.N..~Kc.kwpdx..:....lh\|..r>.](<M.>3^K8.?FgT8.'..V...<.P(..R....m.z....XL.yid.".GSj.V....Q.j...:;..~.s;........p......~b6.`-:.+4..7..Y....d[..H]a..A..L.d.[Q.....5.QT]p.<.(....l.....Z...4.X.V.X."....._M+.....^i..Er.MJ8...[E..W..).#U.Q.=-.h.C.[.}..N.....'f."... ..0.#5..(.."@X...L.W..p..K..x.$W.......%...d}9..n..0....]....'..8.L.i.D1...Y...,...k..k...<.m.;.s,.GC]qM.?.....b.eI..#<.s..,+...-?..w.p.~.a...P.....9.A.v..;.t...88..5......@....\|..v.#_.W.F.l..g.o...&&..^u..

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-br.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	55007
Entropy (8bit):	7.5053970650706505
Encrypted:	false
SSDEEP:	1536:GEpRFFv5ZSr97KWZt1O5YHAyEmOz3nfdIz0:rXFFvYKW9nHAyETTyQ
MD5:	8D70B3FDBEA2BC157213C6642A0F5B6D
SHA1:	69F13BC5F2539A5142FE6047C8D8B8CB813F77BA
SHA-256:	729D85DC0968271FB80677D9CC64068A96BFFF61F06CB78655F9B92B6276A9BF
SHA-512:	F23297AEE1275CA853BA7001F97D9BB6FC6685969F5968CC9E6D8BA4F320D95B51BFB80CCC087A66EF7869C7F289E02493B56EC257697E35DA6ADE362D8B84F4
Malicious:	false
Preview:	.sj.F......%H...a...../..9...{.......$........Q2.q.^2...:C.K...`..#.^..1V...k...).)2...B(......<.5I..y.!3.;?%.9..4gU.j.P.W0B.![.[..=t.M.2Ku..{H.]z..)2.l..........&Wh....L.>.;.>.My..E../.9a>@.1.a....c.#..{,l.L...\...U...Kx.....9..?,<..Vm...{...+......`.@mu.....u...... .g.G.....HQmM.OSSv.....8...{%.."^..x...z.g.'6Su).'PGC.h..... .S.c\|9...f.r3......1..A.,!1kw....b....&..".}M'r@.,..:.:.v...p....a......yP..k...\|.1....<..`J.I..2aE.8.....<I..;.E.w. -:+..6c.......P..l....!:.....+.4.F.M.S.).[.`.....d./l...i\^]E.i...a./j=..a.T.,..L..F....B.V.{.\.2..7[.}.P[.2..\...jmE.,..r..9.IO.-K.qR..OgO..p.a./..=...2.5Mp9.\|.--u.7....9.;...\..@(....Zt..(Y.h...L[...p>K..\mb.~..;..}.. ...")1:....}...}...J....O.!{3...T.j..eH))....;...^.K.Q....V...,...]..L.\K.9$..J..m...\|..#Lb.....uG..v.<$....$).;N..~.@}.Ri.l....<]..c4....l....J\|.c.........\.T.T"..._$9P...pz.?..y.W.6&{3LG....S_8VQ.4{...T.~.7K..qj...'...K.0.........f..s.\...'...>..7.)..eX.P.h..............Z.&.j..r....V8.......&p.

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-pt.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	55519
Entropy (8bit):	7.533804752684562
Encrypted:	false
SSDEEP:	1536:5mFqk+iLomtWJzv/Cb/gp350YuRqnhSNv9y:aomtWJzvE4pp5uRqgry
MD5:	06D46733A94C506B0E30C481135D8F06
SHA1:	763DBB1EA049B7914A4414AACC1E7B1104E528EC
SHA-256:	4E680B04F1E8EE991521BC2A01BA29BBDB5962870F30FB989366A1765598E00C
SHA-512:	19693D2993C03612508C4040F52774CE8F6A29328AB8EB3D709D3F971A833CE7E9FDAC09C940EC361BCBDC615BAB7261412985220319A5B1BBA73FF8CFF31AF4
Malicious:	false
Preview:	..E.1..^.n..#X){8o.i...I6...;......;.L.5..]..l..P..sR.......^....q.....@...+.]K.Q..F.F....t)@E:/....}.F..G.U..5.R..N.b...\|Bi.DX.d..rr..w.T..L..#t.F....i..(K....J.hGja.L.~..o......O.5..0:.......g.NT.Gp.).)...7.B.Qc.o.:.=.P.A......Z#..f.a...Y(<.j.\X.)...r.x.2..-...{.9..6...."._Z..X.\r..O..Q.aI.u!y.29...T....i.s...X._...0?9...7j.TYb.(..0..x.(..n.t.5.t0.6gA/V.G.......'.4..f.'..7x..@..rS.JM...P.....3. Q.-#...<...v..E.....+F....bX@......z..Xc....S.a.e\...qfi.>-..#N\XJC....6f.2Q.^...I........'Lg;.N.%}......E.r/..4.T...k..v".....3\|.e....J..Q...N....t`....v.KZ2...O^S#\|.9.0pB.F.......E...h.L...d..].-.T1..(6L).^..8g+.<(48..,..Cl..c...H.j-.."9#.O.........-...h(r.y.5K..t..._'{....Q..(..n.".Z.%TY^.U..{.qN4..P]..#X...~zyE..h...L.C..O3....j..LjD.>.[.0m.....v...E........_....%./.[.+.rA..1S4T..Q(..........+.f..c.(....d...9=...0...ax.._..^.^c.k...ec.D...xJ..o.b.k9..NO.GJ~......z.4\..[.....V\..w.To0..+.H.........X...+.....K...Q...`...........b.6..R.....

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ro-ro.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	59207
Entropy (8bit):	7.168991442766339
Encrypted:	false
SSDEEP:	1536:JaHgJD5MHRGxjtkQmdrzneevJ6nBzhSUiDhzI:JaMKxmBEDhs
MD5:	001A40EACFCAB4D720F2367A525546DF
SHA1:	B1EDA79A5FC9EDF85A3392790DC4621C881B475F
SHA-256:	7A25996E6B8E9B9D0AAEA90B0CD62AE76F7B98BFAF56F5C07D6FC2A91B3B2FFC
SHA-512:	86230406C9AE608BF9468E8E9D0E12F7BCB8AFEF98868346419988A18FB908865184B64E573D7CEC9D6BCB1DA87D492EE87638C07ABC1999822B0044FA7C0F58
Malicious:	false
Preview:	.S4.P.y..$..Wm...<..........G5......L.e...z.6]..p..A.G/...8..]b...<.8..;...T....t.B....v...Oo.]..MR%8h,.qd;S. .M....N...j..X...]....l............!.F..S........DwnV..9...m.....<..,'kcE^.W..8'\3y.. [#....Mu...=i..G.[W...M./x...VC.....o.FX+...:.]V..Y..B._.U...%5.A.?-_LZ.@&H..8d...Z.V...f)g.1V./...]...e..4g.R6U..LYP....(gm.p.sY.w..pD...W.9.[C./3."}..2.w\.a.~......>agP.....t.]O.N..B.......Ot.9R.v\..\.....[..SW..".vB[:...:......BOY<.X..w......4._..B.....x.D{...!.g.!QH..'@q.m.O..(..q.QG...q..g/I...&...3.^.F..X4.$..w..b.r...Ae.]...^.>.y.?.. s.-...}.....H]nu..A1...c.4}....;..\.d..\|.+.<a.C..a.....i..=......@.u....x......N2].;.b...S..)D.......%.6...HA...7F.....,.-.A..Y9..V.m..........l..g.Fk.+...............R.a....@w,..a[._.I?....et...y..7.V.AvX.....o..X...S.).^}..hu...(.a.E.3e.e%....k=1.`g....w..j......#.A.~.7.}}...C;..9.[(.=x..X...`{.7...y.......Q..a......3.i.t#.1!D9...@(..\|..O..m..D...s....C%x.......KP.......?.r/..E`......(im_.~T..I....,.\|.

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ru-ru.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	56647
Entropy (8bit):	7.487441659276484
Encrypted:	false
SSDEEP:	1536:w4JlOKTMUNOrKdw/tGosDQavhtJjz10+2X8:w4JlOttrKd8tGosDFvhtdpGX8
MD5:	66741FDED697E9D8E2EED52E1BA00417
SHA1:	DAD38E03C64A017EF9F8235B78B88E63DD2B4F85
SHA-256:	876D5FDB19EB74A98937D873805AFA49759EF0802CC9BF0B70A23D641472275D
SHA-512:	947F3348115433511E85F1B08AAE2246B78861CAA9AD5BFD684FBFA54939959EDAB8DB49A092391509A4B3AF8B0362A38DA2325AF108065127954378F43A5748
Malicious:	false
Preview:	Y....IM...;...a.,...Tx;7/.#......Y...u63E.g.3...5l..E"T....A..KL.?.7..].MJ..QV{.ls\^R..'g.^.h..B.Dd. ..Z.h. 4Il...B.N.l#....b:.[..-.Q,=.....%..F..~<9.3...s.F3...J.F.....4.v..(..(.hj..C/t...l..2..D...........+.......Et{SY.g.Y,....;.S....C5...3..R......[.+....{...TXF.X..a..nQ!?P.Z...;0.]..P8v....i.H.e............z.[..G....k....n....fe.R.h......%.c..gd.1N...k.$....]..n.._v.1.FI?.....-.x.$..aW4...s.5.~y0..e.%..)...<......J.Q..4...._...7.....U.9L.]...m.l.0.....A3.xV.......>...G.Vz=.R..T..W.b\...1n...z...i..K.<#.."......^..... .'...?..C...PW ..u..98.p..K..{...'...+.x...[.......;..WU..n..Rg..TJqi}khZQ..z...-........S.9.. .C.!.q.G.l.7N?*Y^....f..&.f...s.........3..4s.dY.....3P_).N ..J....>."...q.V.....b].....:7..t....=G{.u...i's.)R...}.B2.!.#+..o...>..b.=.y..nfr....Vx....&.s$l..5..h...A.S..j6.y..o..\|..&.FG..9..O..k9.\|.q..^<?.5.oK-.`$...]r......6...jI.>rdd}w&T...\|.~i.N46\|...".t...\|... >........{~.......!.GR.X....#.1...t.._.

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sk-sk.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	58583
Entropy (8bit):	7.206091008831505
Encrypted:	false
SSDEEP:	768:e2Y1Lby/+RU/YM1BhZdrlWlOHj6a/BdGo3dtzv2oeh3hrhGXhAhGPH4jILhHhJha:TY1LWEmTxMlOH3v2oLYO04jOD3dMpE
MD5:	77C2D1DBA541451CA68B5C412D666CC8
SHA1:	DD4CB771ECA47160E51F31C73C89F4BA11A5F84A
SHA-256:	10851A230967DADF71309203E0DF5CD511D12332EE474446F5F5420BC44CC347
SHA-512:	4D6560F07A6FF4E9A9C5672773709842D7A860C0A67CB7F0AE41CC7D2E68AC911554E124BA143B49262E7363E07AD3D6984FC0B9E0C2D63D9C8813076549E436
Malicious:	false
Preview:	1{..D...].,..[3..\|aO.........l.3....U.x5G.8=.Y........V.....^.%.{._CJ.%.O...T...l ...r...,..O......\|.... .3.=l.........C'...............JR.F.J.?.................?W.[...L...q..y.-X-......M....?D..)A+.)...T.x.2.lk...q..B....C...]..)Y.Ck..%\.>...h;h..B...n7{[..93.L.....~..Q....R.:...+~..S...Q.hs...Se..^;.5.-...DftC14...A.e._.,.eKS.h..;..C.$.F..u'.U....N.9r.#.....Kk.F.5.....V...!D)....XE_..-@...qYe..E...m...m...^..O.<(....A<.N...Y....M..HnB.....D'!...^.4.....5.....Up-..."..1S..G.-.m..3.......j.[!..j5.%.{..\|;.......-.>bGcxR.T..MZz;v.\..}...Tg.7.F....z...G.(R#.,....k.R]...i....e-R........'...3..'[...hM<.Gd...S.../.i.wA.,}..S.^3`#..p...6.S:dl#9...S..\| .C....)..&@...-...........d.d.N.....G.....O.k...f...$.W.Nl.k....g.............5..K+..r...'...v...=7.{\|p..W.....v.%tI..L.e........>J H.ng...\F...Ukr.vuW..=`..kU.~. BS9....0.........+!.Z@}..p..C..p..I..MI[..F.(Kz..=o..}-!....k.381.>.U)n...\|.w=..O..%..5...%..c.4!l.....z~/............,k.... .,O&....&.C"4.."

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sl-si.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	55735
Entropy (8bit):	7.682270853201382
Encrypted:	false
SSDEEP:	1536:UVnsKpW4LUWoSTMP8+95Twx3sjuHkzgJ4dQ:UVnvFUDEeA3sjuHNJ
MD5:	1A9498B18539F12D7F7DACFD6A3C1D75
SHA1:	9F210883C8B279467DE1129659F5E58DF799102A
SHA-256:	096DFF75DE31AA2025AF84D56D1DA12AF3218794B716076B41385C4260237757
SHA-512:	E5BEF0C62525865AD15516FB9FD12BB82391918CAFDEF4FFBA5652252304CFB1B32D2DDBD7118F17453BCBD5CB5522241F4842B0020BEBCC19EFDB70207AD831
Malicious:	false
Preview:	fK.e.TW.q]............Dj".e.s...pbz.....%.\.kc..7fG.).:ZP.....;.OAff..S.7..s......r.6.x..\|]5.,..j../..J.......\|...k-...55.#.8'd...%..p."..D...T.V..Gh........q-..U..1..&.n3(...9...-J......rX./!.z."....@.~V}._.........!.:..b..s`29..V..H.....[.IZ.+.....!@.~@.J\.v.k....\/.......V.....rW...?h.^_o#. ..B.6..v.....to.{...Ah...g...z3.i.7..,.Yt8.....P.#.....(R..[Q..=.../p...+...c.;.0cx./..B/..7c.../>o4.....{l...]..vk-l.O./.p...#.(#u0 ...>=.m.....#..A).s.....-\|.=s.`d.;..f:. .n......;.&...........6.I..<....%-...W.p[p.I.....a...g.?...9.l.1...)...}fch.r.......0.O...r....B.?..E..z{.y...~vC)..x ...D}.&....Z...W..N~]..).B1......@.......)......w..l8k..{.~f/S....6.;..=.}..e..5P".6S.l..#.....n..:..]?.\....Z?&.@..G.........k..?ny+r{..z9.=...+..^..iT..@5.L[.j.6..>...:.2...JL..8.mG.....A....u.pV`.17....heb..h.76E7.gQ.C.{v.*.~.T.....KY..f.....xIi8._..$..XZ....=0...H...............9.p1...CqQ......uS[...%.I...x..G.E..Z..o......"..+.......#._

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sr-latn-rs.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	55007
Entropy (8bit):	7.6900415257742845
Encrypted:	false
SSDEEP:	768:/yoKLdrUoKc0Lgp7YBMfyB0TlkuIkh/Qt7JwsXwdAIEHUAIxpziZ0IPUEzNy:/yTxvKcKgppO0BiRJwsgdpErIrzsPVz8
MD5:	2ECE51563A372A02B19137DA0D015D47
SHA1:	53B1616F3F1D8B042239C8F35ED7C02FE9E19BA8
SHA-256:	A05717E8515BFDB2BA1BED94D177DD3AA1CA85DAA2DF3E783FBBB9C2E1733258
SHA-512:	8F8770BBEC4AA14E816031985C15EB81F79A1175B5BA4384CF3142599EABF8DDD901C2375BEED7E54430E0A62C714CFCBF5BF68CC33A56D513AED538A8F81EAE
Malicious:	false
Preview:	L..c...ki....... M..r.p..w...j.F1...S....R....H.....?.8[N..1.[w.Y.eg.9.W..S...G.&pM..".M..^......x+.k.(._..g.....L..7\....I.B.}.'U^...5l..Vzq....Q.U...ET.9.$.#C2.<.....T...bp?..}:.n.....T,..5...._........Q.KV.>;.E.8..%.\|Y...V/.Oa...kWI.....Xv..y.w.?..O..6.I..2&^.8...R.....T.Y...=>.G5...4..S...X%.Qh...._.gi......-..2CtA.S..2.G5C...g.[.5......K..1..7.d5..}uE..._0m....'..JtG..L..<..]z.K..1.....W.}..6.&.Y.....U.?..D..s_....'.H/.x6k.s.u/&a.e.hXu.......~...?.!..r.L.K...R..\..].k./......_Y...'.....^.8.u...=.`j!..>..[G....8.^......f.h.....A......E..o....n7..v....O...k.w.k.).Ne.>W...NL5.].......vnJ...[...&.u.....M..J...5...w..n..y.>nE.B.[05.Q...\|Vr..6....N.4...KF.....I....4.._.-..z.a.....".k.`..>O..Z.BHgDn..:..o.hH~WG..C...J,.....l.Qb..Y.u.o.......NX.T.....m.{M=.(...h..SD7....m..._b"F.1..^ei..1./.Ga.z..O......5...$.3.q......+.[.../...u..$.!..)!...l....VN...@X0tF..rH..z..X.....(..G.pE.Odj(.qc.B.....c....%5...20,.O~.../...n-A.!A.)/...D...EF.

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sv-se.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	52447
Entropy (8bit):	7.5595493542339804
Encrypted:	false
SSDEEP:	768:D705PbOzoxQH7tLv8TzLvxoodDE71HLs6qtlQnqfnfzR08EXqeNtazXdv:D70pO8i7tETzLv3SuBtlQn8fzGb92zXx
MD5:	3F7AF49AD9897A0BAA7A2D258DA7D6B1
SHA1:	1E0D682B989F7B88E5833BC692CF3E1D11AD3AF2
SHA-256:	58B1BCD8F12318599A664224095E3183EA47710FB2B7B486A443651649B66E42
SHA-512:	0210F541CF84E01A037643EAAB8BF26908B3398320BE48B82D2CB287372A6AB149B7E485207EB0932373C46B6A5C3E41418A0CFB9E229FC552B37C5C748121DA
Malicious:	false
Preview:	P..I.Y..#..?.w.....B/.%..1.02.....c.3BJ..X_.M.R..O...H52.RHz..[)..)..........\|..x....Q2g......pOU..O_H...........Jn.M9...%..@."..U.e.%.W.i.&...i.pf.L......<.E.....d.....1C(c~@.-e...kb........o....!G...Gf.xE...7G.^..@`...b.#..r..U3....^..uo.'>..\|...M'K-..M..-%?..0..]..-....0.v.W.Z\...Q,q.?.R.&.4t....!.K......t9/..S.7.w..v.`...]........Q...h.Fi\GY2.z....R.l0q~..Ws..i.ke.-.....3o.R.......~Zm......,Vz.FC.=..6.L...\|......co[V..`..<r....b.Rg....)j.j...t.......nY:..sc.<.........}swl...`.<i.8.0.L....,A,....83.Y..HG...Uu4...q...34....6dc..M.....;.ns>..M....6^A....u#."....;...d........\.G3.........WU..;...t...0D.9:.5.8Trz..=r.D....j@..........#0\.N....Kq.F-!...#.....^s&".Z.t.C,..2.H..9[...._XE.%).B...\z.)..'^.,.j.H.....iyWR.....N..0F..WGg..T$.;...eg.4.x.1A.T......iT.,.!.?..[.g.J.5.Zu.....AP8U. ....6Z.............gPV.1.l..EM..#..9L......mC4..{yu....._......ju.Cr.(.B..tS.?p..o&QpH15R...x0j.9..f+......4..[.'q.f.....n..@.......A.AI.'i....p.S.

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.th-th.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	55727
Entropy (8bit):	7.3698016278482585
Encrypted:	false
SSDEEP:	768:x+FTcwCTyIR9UGhMRlxnhwvIh1W94f2SCZiW+NURGZh4dBM19dpsWFx1f6FTy:x+FcwMsGaBKvJ4zxGkkcdpPqG
MD5:	8C9A71573B80F4DF1B1A13086F39DF07
SHA1:	F6845476E767BDD6E81BA96B650FDDA6B9865019
SHA-256:	1BD431DF21DFBB4945AE0EFC12C7D0168D6ED6C3B82EE72BDCCEA986ED92CAEF
SHA-512:	423F4480B951DC43978C39ED2F4F51FD74C4A4F12A1D90F53B3EC9323CFD2103B9B6A8239F63C266BEAB762CE6CF26775D4E8A7CE4E1F1F0CA29405CF4A42902
Malicious:	false
Preview:	\......k...o.,V..y.g.....z..........-.0.Z$.{T.q...lP...h..U2p$....3)Xs.(...;.?....B..q.>..}...y.s..........~..g.H.S..$....B.......97..:........j. ....:2..3'.7../......].I...yQ.4y..6...Q..'.c...e..:.2..1....1d,{.'...../g.d0.0...=.o\ny.,.=`.\..2'.u..^a.!...!K.d.............J.......9.....j.4.=w+.^.....'.a.F.O.\.@6.......%.k....H.Y....Fb.q..@....r...de..."...q.-z.3...r....(..U...t..Pw....K....!..Ddo.V..%X.._..........O..`...N.!`...8..H..=1...L...}2..F...JG...,.G.wf\|.(Q.......!.?......{wh.....h".F2.@q._P........8...@l.........M4..R....L...4`+.%@......VB!..P.7....b..QO3%..LA.....f...Y.F..../@.!.k9RU.o.]..N.....6..&..D..My~E.....A..R:....5....E.Z..........u...+...)U..n....w..K ._...... ..C.t.........J..5..[........(#W..._.-.....E.{)'T.=N<\..Z%........a....z.....+-...T. ...!..?....Q7K.......l:....n..."T...j\|y?g.K.......~.WKw.h...i......eq1................._8Bt4q."...b~.sujC.6.,...........x.....5..I?..N..aE.M.).l.j...`.b?...9..`.[i

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.tr-tr.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	57567
Entropy (8bit):	7.24221392822806
Encrypted:	false
SSDEEP:	1536:zZVZjojfvyiWB6SN3xLgnDNvUCEhDI+6MUDtzR9bkVzfY:zZVZjojfvyiWBN3xkDN7Eh36jRXbak
MD5:	76BF1640BFABC0649AF2AD2FCA4DA30C
SHA1:	04C8C3288100CFBCA7000CE1CF53DD2A10BF2800
SHA-256:	12F5F459FDD85AACD13EAF8B3AA74B2FE30E8A32C5C938D9802FB70FF4D63480
SHA-512:	926DF0AD919678E20E742266E61699C06D5F0E47258CDE889E2BD2D67C0F0AF182A3614568187104619D8278A24BA42D6D644C07DCF093D57165339C4391EB12
Malicious:	false
Preview:	]..../U...a...d&R=.0.b[Q..4.!.g....-.P.....#&..f)..'Co..\..?;.r6.$.d......OO.-.tp..<.G........Fy..A.t.t..g.H{..,..,'-5..\|>el%..=.9P..7......o...x....H..i.\|\,.\..;..[...YC..[1X=A........n..ca.p..U...t..Oq....(.....Xe:.....EX.91.w..N1...OKd^..=.,....,.UJ@.$.V...a.6_....!N..x.X...Hh.@~..3.E..4...;.L..z.O..T.%........M....9t.Q~.I..CeH....Y.>u...e<.. ...U.....h.Q...b.).#R.=^C..8.bYVD.{...$9.=..)@@a........(&...H.Q.'....\|.1.S]...Lz.v..t..&..\..Tb.....0L....s".......g)......Ra..#..,.!t.b......sR....Cr.P~.......q..E.C...O..g..N.?.@v...6.m..[.W....8.........v....VP...+.....K.w.DM....._t.gpA......W.QF._...Kv.l...V......R....\...7w.....O,=@>..]i...P@...=[6_.\._..z..\|..U..q[.S....L...}....j.....8.0...~.H.@..I..c.d.....s".32)f.n.......@NV..S .d....~s.>.P#......e(..$.ZBJ.C~...&.d.J....K.U.....RK..K.w.0Y^.u...k...R........XF.NQ..rB.}.....E..`...u.~".......~J.7.ir.l...QL..."1#93(...d........2..K]{+`...Gz.8..8\Y..=...D.c.P.K....#or.X.8.".~i+..,U>

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.uk-ua.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	57775
Entropy (8bit):	7.524488991575573
Encrypted:	false
SSDEEP:	1536:w9dCt/FzaIBhtK3QqxsbUr5kEz+Cq6z9u7:ECl8IBhtKFxsg5kEJBu7
MD5:	0D4427731637A93338F080E444E3F3A2
SHA1:	F5DB05665607031CA10B19AF80EDF9779EE31AB0
SHA-256:	F41C90B5E4274750C2E918C96AC15985B055643E352F0BD8EC90D7489A9A69E4
SHA-512:	F944F61EC39BEFC7236A15D8957142DD101431A5B7626CDD4392ED981B8FB52BC5DDD13B7B432BFBF739EEFB1DDF5D02ABD65E6BE02F87D1F788D3FD50C07B0D
Malicious:	false
Preview:	.v.._...-.e.G........7..QY..r\.B.\|$JU..Sr..?.\|.f.b.\|......Y..e......1^0..L..::.,.?.l./o.n...[.......p..L.%.p;.u..D...bd.3..U..`...X.....".F....~-.$..<ae.IZb...D.....Q.vHX...~..GY.......A../.>].{s.-V....r..[..I...L.......>.[q9..P...Y..w.F}C.\Kk\..K%.i!.....m`...@.2.ag..0.=....o.].v.,F$.3.;@.vd..P6...T.N>.......&...Iq....!..3....E....,...%.V.XA..\|.....8:.r.G.cq.x..K.......E..M'.-.T..W......>T..i......7.h.Ye.)..-.A..:.#i.{......L......s.....m........{.}.S.S%.Df.H.w.F...({e...a.%.09.%...c.LMW.~.u.u.7....DV.V.........l[.#.[.....$..o.XZ.:+{s.Vm./4....d.....+...I..q.....!..L.v_).....C,.+,-Wa{...D)..M)..D..(...k].........'.<..5M!.#.a'..u@e.`.L2../]#.A...@>@:..Y...3...2I.[...w....3q...I..q.I...R...J.!j...X.qR..E.."....t....L.............7..j~...6Q.."...a....M#"'.......(............h....n....1X.N....^.........!2.Z..4...w.<+....w..q.&..\r.:.o..7%.Jj...G...4x.......p...%...n.....C.N.9....i........Z....cm..Bjn.Zj0..i.e..2...*b.-.D.U....`~....pI

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.vi-vn.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	59311
Entropy (8bit):	7.166126663900686
Encrypted:	false
SSDEEP:	1536:OpLiXXECW2e9BNOmrtnPekKbFUtyU9DSgGBMgrz6eDqdDD:OpiXX/W2e9bOmrtnPekKbetyU9DSgGBy
MD5:	4FDA31F93DFB0439FE199E015074123F
SHA1:	7D6F02C6777504B91222376FBE876143E2932E9D
SHA-256:	7DA9E8CF7AED861FF4E99E79BA02D9C86C036894541CA8232618BDAF3C4B651D
SHA-512:	D9FF87659EA7A0439F2BFB6FED02E3607A7D9ECF702E53B4DC7779B9029C964175508416290DF97A5B0FA628DB88E773ED947392F5B9304B73E5C2E2F381D8E1
Malicious:	false
Preview:	.-.D..'..!.H1..Y...u%`Re.".@..-....0W3..B._.o....D.K.S.S.3...<6.e}=...O.~3....`......\..>h..V....Z&8.(@.r.....b)...N."...,..H]N.{.u...Q...!w.........Y..)\|n.....^.j..{....(I0$.5.?S..<..!^..(9....99up..k.!.\7..b.7.d..W4.xW..p.\8J.].....w.P.....B,N.A.cb.......Ru<.v..p..X.>A.,..}.QJ..%P...K...(F....j.[..~.Z..<P..J.~f..g.$.Qd....m).uLtSN.}..:...<qUQQj....eAg.......m.2...H..C..=N.u.....W\|...kA.....j..gR....lI..kP.....c_..."....~.B.q.....&Hn.v...d}..p...-..)q.......{l.l....OsCL...K.4Gxr%F.h.U...L!......gs.r..w....Z....#.....^..X.B..?n.MGP...+.."...v.p..}3....R.0...<...mO8._.[)Y...6V...-.]sm...3.0Lvf..,..u.M....~j...P.....e.FA=!..\.hK....K}'.&v.....fj...s.....+.._..K....1....b...J.6.~Z.Q.F5:....O.v.?746k..{.\|6..=..../]xW....c.-..m....c.u........?%.\|q.D.".9..m........%...`.][w)je...+..O..H..:.!..Q)'2e...........F..?^..s\|7..Z..)F...#..?!.6_wi.yaQ.<....b.)..<m.I4.....h._..._.X..J.y..W.../.Ub.a...G......Y....`[.b#.w....0V..7nXX.{.pl.G>.=./..?..<..`..M.t

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-cn.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	50391
Entropy (8bit):	7.449974755003118
Encrypted:	false
SSDEEP:	768:PHzU4XYMr7yVosM2RNSAKqexiuX5nFEF7NTY9ss+wYR2k9G/J:bbF5CTKlxpnFEF75Qss+wc2MGx
MD5:	8CAC189770D5E9F94DB28279DA6CD791
SHA1:	EF9BD81E67B6AB87BEF8856C6D8F7741E2D91331
SHA-256:	DE0D6DC8EFA4F72083790513F8D2BAC1AC504814DF6DFA23B30DE0976EC8257A
SHA-512:	C3EF4AF786CC57B536BFB09797F5D5EB6D5BD4A29C22A61DC0B57E436703579AEB8D45E74B8332CF966A6A41A16B102733F8B07CD027C40C63A8E3A72AFC1C4D
Malicious:	false
Preview:	d'......8iW......$...x....7..h.....>.e\_.V...Y..X:!..D>....1..8.eX!.....l...9..2....D./Es../..."u@=..\...@.a..ad........K..M".....X....f[Xx..z..Q.hb.......\....{.>.....X .".....U..#.d.WC..mN....R..#?...?.9.G...6=.,.m.b...0..+......."....G....q./.[g..D...z.....}..-Q..e.t........._.C.......gz6..#..(......2...;zq....].V-...6.]j. 3R...k..............x`.....<.yy)M/.q.Fe<..g.O...:.hji.s......D.:5m......Ld..Fs.^.GJpZ..P.d..={.^...Hzp.E$.clW<R\|}.P..=..g...P.$.h.A.;...~.2Eb....j7_.0.hx[)&..w@l....ydVF;...r..9..^6.b..'@'..5.. ..........d..=.7.3..IWe.....0.O.96:. ...UvV...=.....4..f..p..4<...PV.....".z.(..Q..i3..)?wEv.rWt.Q........q.m..[.dJI0..q;...y........`-..'.`.j........yY........b.F.y..t`....2.....:;.h<n.uWp...?d.k...6..C.t...5.......].@...6....U..M.t....>...i....r.Y..V.-..~q..l.PT....b.. .....3.GI.J&.$.)S`._..:.!..C.;r1`.-_ ..p:.BA-@&b.8D........9.JjS.+.OY...;..@F..1.}Q.$.......`P.V\|D.[......o`..#.l(*u..a}...9.. ..~.S..6...O.9..3.z_.-.A...Ab

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-tw.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	51119
Entropy (8bit):	7.462821341325383
Encrypted:	false
SSDEEP:	1536:V6wNU3cncyMjsvl+EP/swX8D54cqBK+9a:oUU3ccFjsvl+EP/swX+51U4
MD5:	FDFCA72A94774E41A2ED44F0F29328BD
SHA1:	9F38F444478E386190C797D61A09CE8AD88831D3
SHA-256:	F7F4C13ABE0435DAC4280B134B65FD77DAE8D5EE879B59D31B6EE40CBC38F7AF
SHA-512:	353CC12FD320E9A465C4ADD9E804AAF05584F12BA0498F04FE42D8983D5A53FFF711290342D067E2E2DDA7B68AA77E42C3390D1D063AC4B4902B8F2ACBCC2E19
Malicious:	false
Preview:	.B.#.....N1D.5s#^.h.._.E0..a>hqQaC[n......d...=..3\|...~e...A.!....y ........L. &3/.u..W.`Y.a]...i...b.%.....5..M.l..t.<)bs/.3...........V.9R...WR...T}SG.........clT...>.{j%=.(...@..p.^].Q...1..Z...2+AOV\|.\..j....q..QT.m...Fq..\V.$...&...?'..2c..^..q..Ld.a.s..b.Z....E.....1..,..8l-..:.....z....D."....&.....~...I.^..}".H......r...r`..G.8].p..6.2;.s.....o.R..d..w......dI.Rd.+...j5.\|.(...aM.S&.Z...(.T....g.........R.{A..4%.U.....'........r.......}s.vc.....i.....d.%..=.7.z.............:Y0k Q.J......"MQ"l......x..>~.&..)....&......~..g...5.0M..2o..W....H..& ..~.._;.....z...7+j.6.r@.S.b.b......j..j.f)..h..P.....A.u.Jh.+t.Q...]........y.dHr..k........{......(HW;.IN......D...Y.q}........ l"..o.t..(.i..Z..!J.=..9...,.Q.F....V..9.......#.)Zu.{)/..,.v^.1..s...?h.h....g...{'...W0C....;=...........=>...HJ..p...?...[L.x.q+\|b../....r..H\|...G`...Cx_.~#..p.o...@.m.O.... ...R[.q,...wUu........Q.W.up..W.._.(......w..y}...-...h.0Z......*.N.[..{.@.

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2934143
Entropy (8bit):	6.58289746830898
Encrypted:	false
SSDEEP:	49152:JoVAnXcJ3HQ6+fkW8pUHF0ehW4UJz6L34hFQADMfCYyUsf9rhrctmY8MSLlWL/ir:JoVsGHQ6Im+H8ljY4Nr
MD5:	50BC231D1342A3458D004F4E156A4DF4
SHA1:	412207E7DADA97F5F5701D9995C9E8D625CD0034
SHA-256:	2C253315EA4B245FE4A5F0DBF3614A28F6A5C055749474DB90FF4F6768A68E15
SHA-512:	62E179DAEEC649DF80361C3C9F147079D573BC475AF98A4D27E9459903BD1447CA812067857CAB31524B306FA78B59C6B75DD3BDE1D29AA33274DF81F7D6BD2F
Malicious:	false
Preview:	4..!.O..OB^..=..2U.....<.u.D..dk..}g.M.....}....l/..#G.4.....p@vo!oST.......\M....f... .Y9oRWQ...[{#O..W..<aI.!9....M....H....J.'......{$..........8....v<A..Z..F..S..T.......70..ig..06h..............c[.6..z......h..{7X. .F._.y.O.....@[.i\|s.A....%w...J......4.^M>@....PkYcM."..C.yv.N.......n.%.....+....wL..._.......q......R2,....1Z...i.....o+.E.....H..7.3.`......B.".'...D.u..:x...;..:....f.....\IX...I..CAr...`YI..}.oK.q..j..!B.U.S.,owi.f..n......l.S.{G0>.h.....Ld?8Q4...Z.o...........Z..z..1.o.....4.%k....fMw....>r..6E..%.......a........-...0{B.a!l....AWM......3..Ph..}........BQCc.....#.g.1..J.......JB.....@``.3.?n13...\c.<bxP+..'.F>........Q..L.I\U..jR...M...+.......a.K7 ..J............#;~'.....x........`.[.'....L 0a..V..Lc..*..oi..t.s.Q..l.o.4.......M......^...[}.]9.D...C.o.\............(.;....1.o.z........./.,....>L..}.n\|......JI.}.\g<."_!..o...$.)...A....H..5. ......'7.....z......(.j..7O..0:......y...gs...{#~.m._.q..j.{l.......X.#.

C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientCapabilities.json

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	390
Entropy (8bit):	6.117738121403814
Encrypted:	false
SSDEEP:	6:8SnNx4wU6eCSJ9kU67dCDK/D/l+8lUEJaraXKhlGYaLzPLS4zjNqdwMHW:DNx4ISJKjxCDK/RxbJaraHDvzB3C7W
MD5:	F6EB557D29B229D7EAC48A6C67AD14AB
SHA1:	309AAA150DB27E961DC504E52D37A561A6EE5DC1
SHA-256:	4DA229FF584A6096B8891E1A7FEAD44878AF47C4EE8C0C36E58413E03FDCE663
SHA-512:	B98E4C21627E506A13360025045063CB4E4FD6DB344F80B5A75BBCF254F3EE899DA64499CCB43FE00D1A1F2623854444FEE25E318C2D6BEFA335CF6F608957EB
Malicious:	false
Preview:	\|..7...[B.KD.Cj$._}V...\- ...z.!.....QM.D.\|Sq.......}{..o..A"@3?.2<.H.2u.j@...6.,._.P\|.X+...e..s...'f.t..{.f.;.7.D......"X...".y.i....m.m.......L..%.?p`.t~.....b.w.....(.,,..?..../.r$.....c.zz..EM..._w.+e.L.........7..a.:...1..G7.]...L<....]...../.....a..&......................................................................................?...............Y@....czyzk0zzhil.

C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.man

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	9437
Entropy (8bit):	6.830252859110004
Encrypted:	false
SSDEEP:	192:nxYZfs7x2Prx9etlmadyeJYAqZhZZ9KHwut9daggo:nxYZk7g9eTFdZJdzgo
MD5:	E5B261608CF6D128235194283939A9DC
SHA1:	69D75361B87292136F163C0BE7ECEE42F9B72E3E
SHA-256:	4EF81DC9942D136363FC461C6F3194167A2B65B48833FDA3D2123EE54385FF55
SHA-512:	89446181E3360757B341C6D3539443D7CD73CB1E069BB51A39C39B210D6C8EE9710755D1B23F73FFA630713B2B8FAEE8689723DE7E2D23CE3259E8083D00D095
Malicious:	false
Preview:	......%.......r.-....m....B.m@..t....4l.P0v..u...3..@]`.0.%A.jC0.F._.....'.......(..^>.].9X....k".....0....;...P..D.M.rd...ug.R..B..}7UQf..A t..tY3....0MX/.%.V...V.~.q..S.C'y.me.c~H.z....x=."h.H....qd]..X..q...Q!.o"i{<.......c..&R%+;.-^...Z...G.lf+.?ID.....r\r.(..........+..........kM...e.9~...Hy.....BT.TD...Q..J.yZ..G@..-:....$FA..!.j$.....B=A.C.u..S..L.G.D^.v-..x.Ib.L.B...u.....lp]i..(.v..A..8P.k.c1...P...#.:.H.E.d.0.xb ........&.2...Q.V.2.....9$.....O.$\..K..NFk.%p1.+...A....oa&..~...@...>.t...r\|.W ....u....N=.W..T!.>.M.Tf.8Q..7....ThP.0[..^]>.@f....'3......~Lre...^.1 .4.Pk.>.]0&.5...}v.E-1E.}......T...&.......$.2........Nk..A7_..E.l.e..sS.>-N.....tI7....".B.=;...UV-R.^..s3.\.w?{.$..9....#........../.&.(8..'$.....C.TD....> q<pM=.'.)..@.v.. ...U.=.8h.z.m...6.P%.D..2X..Y.u..h...0B%..0.e...?..p..wh.#).u..........W......q.ts...5.._'.E.b..J[.l.{..$....h..d....Y..#Q$.........}.[.....F....\..k....-.K..2..I...+..;...%..y..-. ..-+>k...0}TQ.oM.#.

C:\Program Files\Common Files\microsoft shared\ClickToRun\FrequentOfficeUpdateSchedule.xml

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	5235
Entropy (8bit):	7.922664745809919
Encrypted:	false
SSDEEP:	96:Or4sRySKguMziNodYVD3+wVN9Oyd1P/B6vcvhyeTPQOHVzABqfppypwfHSFjcTMa:OcAKWziq6C8iyvnw0vIEuEyFjcTMwhnp
MD5:	AABA32A11D5CBE963ED8ADC71E37D20B
SHA1:	24D92452C579990C1F1578BE5B7A2EEDB2320898
SHA-256:	5C175F7E52CDE1A76A160B77DE148E3A4F7F779210F9B662EB273C8EDF4DBF8C
SHA-512:	43C19843DB5B526F0AFB0989A148496BE9FD236B580D59AEC69BE9202DD754FD88B366E9A4CF7174129929BFC46D36BFDAC0DE3A08D9FB210A4DCE9F25795E56
Malicious:	false
Preview:	...."l?.y(.Z.i.O.CRD{....J..&......40H..A.+...R..n&..<.A.R.c..#.B\|e.s..-;...Q...^$b),...07..R...B....C....Q...z@...[tJp.CY.Pl.<..}%V~.C..n.Ej[......O....Oz....o'K.0....\W......t{.0T..p.Ka....(..-Ky`.A...XH/Kfx.i...q./.IC...mH..Z.q..t....,.uAC..`.6J3.p...h..[.4 .z.q\|.]...v.E8y,(...1.a.y)...5..e.K.4..>8..m@4.6t)j.._...Vv.....G.."...K.ol.&...9...I..I..ey`..9T3,....$..W..fS+vq.5..h..9...6~.^#".7....`...."..?gC...Y..pEwR..g.q.7.{._....;.}...A]n!..yWa@.8D..}7...E0........0.4.w.qJ.E..@P..I.X'..)..q9ci,+P.Jc..i......m.g...f..B...........^..`a].T...l.E.e.......g/j.gr..T.Ve..G...W.1.[..M..vF. .%"....T!...h...\|I..:.........Fn...a.....~r...h.k..<w......%..XV..u..P\D..........E:K..K...(Ks..MK.4..oQm.ac.l[5... %...)....d25,L.DT........\M}T.2...m.....q...A>S..~.q.%#..M.C.$..o.W.A...YzQ..n1..$.O_25l=my-Y}7...k...O...6.1..`...@.Wuc......}..A...nA..A.C...>U.6.)h....n(.^Tfr..q..G.........*="g+j\|>k...0..DA.!.9..+...O:...I(.......c...w.m...].P.S....Z...d%.

C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	49399
Entropy (8bit):	7.033105866830125
Encrypted:	false
SSDEEP:	1536:gatB3p5GCRaXjQ/qm25FSLNt0SGejzlY1lZszK:TNay25FOt0SGejoZs2
MD5:	B21C581743249F26447CDD2630287A1A
SHA1:	2D79A6A57CD38E486BFD1887FB4CE5BDF2A8D356
SHA-256:	9FBF6DF507641BD3C6E31A7C0D439D4517A6F0E211580551F1EA9F6935D1EDBE
SHA-512:	068CBB8B4999E388EC59CDCB3A258354A54713B5B96A0E8684C17D545152DC6BA59502B1D5F03D98D824797C4156B3B3F56686A4D82A688196DE279BB253CC1F
Malicious:	false
Preview:	j..X...r.C.3.xO....g...Q2.....j..Q..V...V.<.e.38.W.;$....\A......p...-./..J..K.G..@...$..h.!..m...3....6....8u..\.....w;../....u.'.t.y...B.....q.S.r... z7...>...O.4.&..>lo...Z..]....(...k.}....n~..2.g}.s.... ..F....f.y<5\>xK.,...,G.j...[..ZKHmp5$....w04.....S....B]...7.../.?e\|.S...I..e..H$..V%.?.6H..6...$.....r.i...mz..1.X.;..EZsA.L[...,..5N.AL...........2.S.h......'.&.....?.3A2'..2.]....!GU$JI.2..Y..AC...o.S..(..@&G.......e...8.[=....\...fb.w....0.....`:...J......E=........!.J... .w....f.{..k...(._O?...R............I.W.D..&\.R..&.....\B....U.A..I.b.1.....jw.n<.\6.X...s.....a.z........_.....\|.......N8y..F...#.4z.J..(t#..Z..}..{...p..j...........5Lv..H7h?....k.....*o......Q.e..aa.k(..;J..;)#........4.o+..3Jz$..M..i..;....j.Y.....6Rk..`.hm.y..[.N....J..pn.....V....^U..kU..X..$s.B.s~.pb;.L..7.....6U..#..4....p&0l...o.[v(...\|.?;....'}.......9c/..].BJ).#6..I.N.............../.{......SD...h7.a.{....Vu..A.4...b..<9...?x[......#M.&_L.....3n

C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	5294959
Entropy (8bit):	6.471738963788193
Encrypted:	false
SSDEEP:	98304:2pkbpfwaKQ838O7GVSxzNO7nZyIaJNLk0p:4+tI38OiVS+7nZyIaJNLk0p
MD5:	37CBEDADB0A26983C3D45CAD233A4CF1
SHA1:	01F5507699A88D105AA72A5BEEBCA63ED841C24F
SHA-256:	08A6BD2BA23890090CE00CAFCACA5315E04A9A5730B63343218DB840B0AB2691
SHA-512:	4C1911A58E704F0D695BDD023EA35EE6F7257D48D7D17EB3E938306DF40B21E63F7EA8EA7A7FD71EFCC324C92F6061112C0409A90A9268EE644143F76BDE4475
Malicious:	false
Preview:	....r.._W...l.n...j"...Esc)./.....0c...........k....\|.Z......H./...<...d&..1...=..#d.x.[..`.+.._.a .f.6.i.'4..L1.<..~.v....Fx..{..x.0l......QQ]...^..9..xe.MG..y.....#8....L.~..&y.<S.8..p.L..&....!0..-V..$uZEW...........r.n... .<.fR..&......tC..Cm.&.O.aZ.\|.FV.....E.........6...K..k..%k+..Ks..S.0.e.>..g...9.H.C{....A..]FJt.I2D7 .,~{....)A....u+.TZ.rw.(.BT...(.....o.H..~..t...wL=........Q.s.'a P.h..#N.........V..l..X-o.'.....Y:.g...........p\|.Iv..I.y...20..;..X<..d.....S....d}..Z...z.-.......BF.E.m....)6.K.J..Q.;..~.].o.....'._...0..Wt...YI.qn........k....;..N.UK.63gPn...r.2K.J{..V.F...]....C...$.....%u...L].$..{...b`.s$'.cO_..:.A.>...F. g.F..d_......Y..3.pP'..V.9<V.a:&.`.qCu4r.6N4..qpj....^.E@...$1j...B......../..t)..;.k.......PJ..P...c^<.>6......]"\|..WHV.<..S2d.%5..wa....oA.f..)=W...f$....H..{..!...-.......c...PZ^....U.c7..K.....aa.`k..I.0....5...[<jwfS.....f..<\vX.../......s.GL.[...KI......SL#.......k.Z..(..._FQv..{.g.@-...

C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	195351
Entropy (8bit):	6.739651880961261
Encrypted:	false
SSDEEP:	3072:BhpC25Vuu1iEThHo8+BSj/tnj0W4J6oYJHDHI1xvP8k8xAtC25HOJ8:BhLVuu1tThIP4hj0W4J6oYJH4xvEkmyL
MD5:	C8DE05B5224EC50AB1084F6EE30AFA08
SHA1:	089FA313AFCB038EF35136871673E2921FD8B022
SHA-256:	DBE02ABBDDC83BB2818460113496F12BC4A788A9E5578241BE0AE14E82192887
SHA-512:	CABEE6CF420DE14A28A1F9F02B7423245EB19EE86615DB890E9C7A5F43A482BA09654382EAAC6BE122FDCE57373A4E7BF1987FB98504112FC206C03027F90122
Malicious:	false
Preview:	F%[S....>..;....x.....V...q...30n..5.....w5....`.x..El.........HB..F..8.F .7.N3f.t....G..9..HJ...%..=C..5..o.Z...?.9...Z.5......D.o..<A!.5..sL...pUd.t.e>sn!...C......?..".....m........D...d.....$.B...#wi[h....."-i..:E[K.X..Cu...O..a..{d{...f.C...f.I9[...l..T'v:..o.U.!9/..f0......Uy$......5.@A.;L.G.<b...r.....77...3....i...p->.>l.7(.G..m....'........A..A..+S.b..p+..F......xEhQ!.f.w}....{."B.\..2.b..].v.............!,...9.1b.k.K...T...'>....Y..~.0q.v....4...:0.......O..,.O.s.[F3..,...F...Y..I._..w&....@;G.?YV.J....68\|...q.y.D....$>...uD.?......Ax...2z.\|....9.>..... 6/8.%a....~<.(.K....> \.8.w..t.\..._...D$.c..{....I...'........R.o4....'%...B.....-.V0.!..L....,.\.VG25Es.,........4HX...l.5....Y...A..X...,.;...rc..J.....J.d.....w...u6....qi.4.{%.Z.d...@.zhG.a;...1b...].[.s.2..$..M...#$\....(H..[I.>.@.....s...\..gDR[....[UY.R..g.....HfK...._u...#=...[.....m.l..9R..P}G...0H.....t.,..^p..2l4..Dg.z. .../...E!=..v...$...S...?..vf.....o..).\|f4E..

C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2283583
Entropy (8bit):	6.564298740127849
Encrypted:	false
SSDEEP:	49152:u5jBll1k9ZZ1/zOsJxQ8/zNzVHeq7AvnAFXi2UIYpj6c4a4NVCCgT:W7l+v6U7evAltPNV1W
MD5:	EAFC02D65416E39FB427F4FEE35ACD5D
SHA1:	E0E8E2E35B57529AD9B88D8AA117D930D8C6C9EE
SHA-256:	82A715B4F328C1FC30F04F40919B9E1B276E0EB37846235B2E6F67E516B032D8
SHA-512:	0B073E5773040167A560CB0EBCB3D87E3DFB799FF4DF366A8CF0F2AAA7AC9809CC9B1F8C9F30F0971F8D4E7EA307D925459E5DBB88D3FB533D0AD0D32756CF0A
Malicious:	false
Preview:	.TP3.....z.U...5B......@8.K....r<9.`..p9..r......K-m......./25..4Q..........V..mk..O..,...._.J...E.e.!RXq.....S!.<..._eTf...x.Q.t..gl:\|i.9.(...7......+[].....&u...YD..G.I.Nq74..js..6.72.=.1...G_2.......p.%..Q.;1..X..p.P.6....f7.B...uM.N6.\|.EuL.....?..8........p.%...17.....q.z...t. ........g. ......A.....o..sj..;...K.".b.,4...."'..m;.\(...F...p)....YO\|c..}.....m.........,......S.....6>.Y_.b.D...\.ik....a#`....s=.U...g......#..b.._...g1-dW....b..Z.%.{(..8t#......q......#.$s.q....}7..>..L..r...nv...=.!...k...#6...[.J\|.........8`'....}.....d.!Q.8.A.evQRRDY.1"..e$.0B.....X...e@Q.T"....q..2.8\.W^..c8.U..#.5...[..BWQ..D.U..&~...(?..6..y..i..kQ.$X..h.r............8.......y......:.S...O....jB..S...X)H.c+......)2.+.K.'.\|,.z.e.5.s?s.#....Sg.=.T...i.....g.E.....I.R....A...E...P4.....<.,..&i\|..<\|p.wD.n;...R..E......K.Z..,v..aP...]...~.P7.(&4..= ...(.\.c..R....r(v...F1.z1......6.V.M.#.0.C..G.t..(.L.............{...F.`xc..t.H....w.WB...x=

C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeOEMPlugin.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	133087
Entropy (8bit):	6.418452447815929
Encrypted:	false
SSDEEP:	3072:YYzSuWG6p8se/reTd8XRoKXVoUjsn7Xah8q2awVN:YYTh6c0aoKFonD1q2DN
MD5:	DE147FA3DBEA4652D0A666715A7AC39C
SHA1:	21DAB9294FE2CCFFCAB28EBE7ECECEB5DC6E1945
SHA-256:	4BCADCF45929D26D979ED11006ABEC932304FF2387FD2B75F096F93E0B968AA0
SHA-512:	D63A4D51B7004D634621C00AE2A7E1C7506DBF2F463F9EC360D0498810B2D50DF2B0F3FAFDD78C13676907826803477116ED750E0665BC8F8643487EC90AE6D6
Malicious:	false
Preview:	F...K.l7.N.;.%..~Y...#......0.....r.M..n,.x...p.. [..i._.b]..B..Th<..0....}..d...&.3..V.W.... j....A..\|)..@...807...f.._...)..g..+...M.9.....?....;....X.7...ys.K.}FvI...R....Y.D\|.h..ZZ.j{.qL}....,...v..p...t.P..p.b.......5..k.^6p...?.M.O.f;J..Fx..{R.EU.H.E.,.9....9l...I.x..Mp..N4.:."..a.>......<.o..[....24t(..]..2#^..[).C.l@.<......f...\.E..d1.v:.s-.`z.x..=.>.p...W..o^wr.B.(.wmf....'vx.kY......-.2Fc...K.....H.6>t...o..0Y.....j.m........1+...e+}-..S...u.h}\.7.9b.N]v..}1.tn..8G......&a..8U.M.~.....h.{$.e.$q...u...f.......\..U/...ve.>b....\...[.....15...7.v..~^d.<)......Q2S.j'.&M>F4..jp....@../...;....`..g.sg4X.w...P9..S.x{{.zR.S..(2.4K..../.[...QP_...i;.M..V..-....z....nV<.....-aL\_..3."..xv.aI.gJAR.?.\|.r.......?........T....E...f..y.T3i..X....m.M/.h.>....2.D.b.f..Fa...5...\|x'q..w...%..sr..N..{...k9_R.SJ..g.w....Cv.i.....@.l_.V...7.?N.k)3.W0{...F..._.(.....`.......xF.....X..6<z...fi..R.=R8#..#.m...m..5.>G.K?k..... ..@1..xQ<......I.B.

C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	4459
Entropy (8bit):	7.91011640656495
Encrypted:	false
SSDEEP:	96:iCZBxwklETuqVXkR3TEBUw28uZzD9nasLzBWcIOneayj9MvnSHW:iABGkiTuqZkxwA9nas3BO7Bj9MvnS2
MD5:	75D4EAAAF189AC8EC1E95318D0111FD9
SHA1:	C911801AC5BB7719A2D86E5BC6B0599C1DDFA479
SHA-256:	422370949F34EA9C5A07D5F1609A3A486B3C40BDC12A28F204E815B8E94127CF
SHA-512:	DD2C7FFA08B3161DBD827E3E2018E1715D2D5D89473151A009057282E89D3A9F3EFBF75E662DFF5920F99BCFC176A475C1F4251DDAAA01A401A04BF56D2E8E61
Malicious:	false
Preview:	..7mN...\|..w.A..6_.7~x0>,.nUL......Y..W....VB.....P..=]........w.yB[.n..6..V...P.c.........?..$57.&..b.....>...".Ds.........+O....8.:H..a......\k..8.....p.re..c.'..T..e.H{X...6.,'t...5.B>...W.....Y.......2....jF.I........\..........b.^Cy./...uqom.r..N...N\|....m....A...v@..J+2eh.o.4n7......pd..Z.?X.\|..@J..}....)N.GNG9..#Lt.....<@....`...H\.-&.....0.9os...... .......0......."...Aw.....h.U.'....:...]\|....%O.......)..A....y.~........t.}........\]..BWE.kf. ....m.{h5{.o..+.\`..="... ....4.c.rE...7S.0.K......`ez.s}y.7`v%...d.c....]a....F....T..B.uT....2.-lc>:..X...CM.....o.5x....`.^N...A..=Z.....Ai..bP..\......J.).Z(r2.0.mE9%...!'.$.L...r".%g.....2..~..\..7.MC.s...<(D2.W.....fb.....cC..U....9.I.(.]....;...>......T...x..U....r..Y.H?.U...>..&7...F...c:..._..x..[......S.L..9..R..'r}W...d.1o.vU...n.`...A...?..MZ......&%B(r..zM..8.-..@@.....Z.?/+.......)\|....E.H..."...X..S8.`.. .mB.d..]...3h.w.mvD~DpHGr...Tgd..\._.A.:.-G.....k.[2_....

C:\Program Files\Common Files\microsoft shared\ClickToRun\SharedPerformance.man

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	537668
Entropy (8bit):	5.828112817767329
Encrypted:	false
SSDEEP:	6144:ZctCROPR0u0Blfojw5jfb3mu+6nAwm790fl:2CROPR0u0BlfIwjfb3mu+6nAwm790fl
MD5:	6F7A4A130773C8DF8F3EA46584693F3A
SHA1:	CAA7C61A1257A4930C376E008B61ADB1FE00D5D2
SHA-256:	0AE172F7F989B4B44294D0C5310019A2DBF120A252BCEA08B88BE9EACF0CFE6E
SHA-512:	4D44B6622D91045E92E102C5837CFE4A53813A24DDCDC7F7CAA287430619AE88FF6C6D0663FE9002D11EF4B601C6DB1E73DFE4A0924A7D6D5369A0035AD0E646
Malicious:	false
Preview:	.....(=...m=.N.\|Ol....c.4\.v....8..51\|..........1.:.XU[4A.<.r...F:7...]U.:r...i=h..J...G..lUh..CI'..r....K....Z..dJF.....&..ztL.....f+....,b.r..3...0lh....c.K`.U......f..,..DF\.R..5~8..3../z......V.I..JH.Y....WD,.sD..y...r'..^..hy./x.....r..;..K....,...#.2..F.uF......\|.S...cP.2..[e.....~.....\|.._.oO?."...Me.b..m..n..q>x.........V'J...R..\.m.,1.).yv....=.....m.b.\|..s.....;....4..:T...As....~W.0y.........V..9...>...p.c..\|...!~k..W.9wt..6Hy.>.2<tn...J...8..o...4..uJ..]......So......y`.8@W.rd..{...93...~ C.".hygHSIE.Q@....z.R.`...T..Ci.Y?..m.k..#.U..B.&.B.._.X....w....'EA..0'85..L...........cd....m.].;+D...x6..1...."Dj.r......".h]~+.!....J:../...bT..o..@..}.e...'..R..4..m.5...<T?D^>..@U.....}}(a...N.&.AyI.....RA...2........3..~.R....._.CZB.#......3..[6....7....GX}.u...Me.m.......~..=..x....<..qV..Q.M\.@c........5...`.......m.$..=...x.%.O....-.E..[....o.XX....6^<o.'..2b`w...$.....`.Y.=..w......'.......o=.9...PY....j.0.Q'....gJ.`"o.*Y..`)

C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	3670503
Entropy (8bit):	6.552569086451925
Encrypted:	false
SSDEEP:	49152:/6KMO0287KDB75vDGYOeF1hVMHdlFZLYU47tEHzgyYarxf4KqDPFka3xMeoK:C4aK1dROrFZLYKGWeoK
MD5:	747985F67EEC7D922DE59E88FD77ECF8
SHA1:	351E673E66DBF79A15DD6FFDC8CD16FAD07C0919
SHA-256:	D99C56C52C30C8BC64DBF4D38A02D46CE02A0367ED025412E4236774F4CB3819
SHA-512:	23E0A8394203B747F082001C2F42A1732411209CDC64182C0EC87CF34C6C5CA50D0C80591E9F7B27EF3D7CD47C8C1D5F4C04F3496FE08160450820E7D5B022AC
Malicious:	false
Preview:	.i..Y\x...Y...z.........:...t..{....t.&.U..\|.z.%.E..}qIW.Q.6....(t6..Q..zJ......Q;C.;..t......<.)E.....2....Y..mW.....g/...".....#.k.... ............y.aTp6.......$....pWgxg..Y..kT..e.~fMa.h......c.Z.c)..^.p.v#UH...D...>.Y.z.........6.B.F_'.C.R..b........X.r...~..Vr`!..........h=`..[.[..E.A9.w.#d.......h.. .B...}.I...#..m....I..J=G.)......7..k.V..i`.?#VH`.t.../}w..#...pUZ3.pi....5..P...t5. .......j..3.I.9...r."\|....n..6.v.p....N.....R.7E...v...c..2[.k..,^..._Z."...:hc.....x.x.L..._..h^/v.......e...'...7yM..@S(.. .4%...Z..............U.2.l.6"bp....\9....R.....s.9.j#a..r.4ood.....U...fY...r(Y...Y".D[@~I2Uu....Y..j.m.&. .c.1.._..2s.5...tCS..R-..6x..cw.g\|.+[...DE....Gd#.<....M....5.6.[..fL.>*...z..'...M......).2n..7..a.$N..2..T.((....._R.th%..<t.#a.~.K)..!B.OJ&...n..F..mJ..E.!.....E....+...9C.d.....b.~;..E.S....M.g..^=y01?..i<....Z_'...;....(..5~...<.U........Jk..........i.\|.@:3.._9....s-CR.X....">..{.&....YNq..P..}.J.GR.l.N.H..^i

C:\Program Files\Common Files\microsoft shared\ClickToRun\SubsystemController.man

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	27884
Entropy (8bit):	6.534421510477239
Encrypted:	false
SSDEEP:	384:gDO20zcPS4VSlgJAUdZ/MS6vLtzWmyei9X+Iyan/+YcONJXzm3loUSNEB+Gbl0rz:gDOejSleAS+LWQBHjbV8a2V2yT
MD5:	5C444146B95D9325724DC3FBB52847C0
SHA1:	0785F8537F5852FED84BEEAA20E56871FB6A5FEC
SHA-256:	30C45C4697ACE0B6696F656EB581FE6936B8A4342DA9B26EFA227B24046688DF
SHA-512:	FDB0B878C0FF8E78EC4340508472141157DF818CBA221421F36A5B8A5B2B5641B65649D8DB1A3E4E05F98C8DBD232E1A27DB5BEEE9AC56C005DD2D66A8058C36
Malicious:	false
Preview:	....0.{:Wow._...b#..'..d9....KTv....`..L.6k.B..[.r...Z..i.c._HX..D.^.N........z.<`_.7.u$%YV.g.E.'..w......SWg.H[6t...."=.[.....n:..1..b7aU@.R&.A.NE2...~....x....?Dk.j:%x..Ri...KnE.4...L..@.R.sb.l.D3r.4.WA...B..\|."./..=}4.Y..J...\|l1...6V0{Rc..e<......w.s...>&.T..b.@..j...d...g.. 8.=.._j...T..d....5..n...TS... .,....QQ..^[M.Z....<.%..Fl.2+.~l./M..j..$nv..s<.$......h....&V..]..Ty.g...e[..'...~.{a.d.n]....O..u.e.....!.j...."..X...$q.<\E}.t.+k[.v...4..).....=:..<....B.C'.hr;.......5....,.e...jP."+...r....0........e}.'..63x%.}..R.).tw"...3.;.g.e..g!2.E.#.J..j..p.d.....T)W..h...GO....;k..,.~o0K.4p.uz...*....:.Y.c.K..\2..l..'.y.....Mr."Ze.E......J./..hPu)#. K...X...8....c...t.KD?.........a.....-zb........)....TG..(..\|..I_....!a:...."p..$}.EQ^....1.?..~\|8...r.Y.@..rn#~..k.3../qF.2...t...0~...3f.5.\|.F..{."X....kA.0.'Omk._k.s....=..L ..5.Sc..1'.b."HXa...e.m...=.a...^!....^;W......D..@..."....0.)Vo....AR?.....p.......66.[.....>k\..~e..3.I.

C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	18951
Entropy (8bit):	7.701436080245609
Encrypted:	false
SSDEEP:	384:RT1YGnKUGiJCHjbp0/3hgtEfZpcjr+3PRumn+CE5:RT1YAVzJCDdXcymm
MD5:	A6E6DD544FFA6AD506E3F175D2394A7D
SHA1:	8C43B415F85545C3A8D994815E1CDCFCF35E7673
SHA-256:	1467E90826AADF1E72F84BB3846A7689C817D55109F292144B3718E47A90E4D7
SHA-512:	90BFD1EAC58B4A3345DAB2CEC1F447EA46E649E0418A0A1F5D102967A190198B268768F33F3E2734A373C7C4C6B34D3D69B801F91F8A00E0F2097DCF2CE1407F
Malicious:	false
Preview:	..PT.@.alI.\|..Y.....Y..`..E....p../....~W..-..@.k.0.;..g..Z.!F%l[..PC.w'YD`-.$3b...l3...Y.Z.....e...Pbx..i$..GX..w...2.Q]...U.%.....B..u...x.r.Q.S;AJ3.q.8..j.Y+.q2..(...mkHp.9)wA..,.-h....Y..8.5.$.\..f.m..J".pp.\,w."..f.3..F}..i.M..r..?B,..dP.~:.Z(.=.\.I."...HeqAA..a..Q.^...I...xXy%U`......B....%.x.$...d,0..KO.....Z:p..t...>.].........-QFDL..u..v........+.=.w.D......u..~...#..P.".....8.-]k.F.,.}9+.O\M..0......$...:/."...... 5tn...=U.......f..i..w....W.:......$...._8..H"...(....A.h.....6^.%oF.E,".....!yWW}Yq.!$..".r..S6........e.2[..H.....`.-....[R../R..(.......W...mNG..do[1#3.).O..w......O..2......c.@\|...VC..Hs.:A....X.-....5@uy..P1%n9._.u9....:...k.l..;.8.'<....AX.a...01@UI..l...!.&.0.D.....=+..C\|...U.Hy...p.......".....j)..d...?f.IgY..K....~..M.._.............:IS.....t^......F...9w...vL@..+..m@.7Q:.$8..k G6...sW.X...P.X%...6. ...(.6.C.......d.Xg.~.k.....>.5.....8.a.?<2ForM.!...2;....n.B8.2P h?..j...hN;C.6.......PL....ACG.Aj>...Jr.

C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	18951
Entropy (8bit):	7.702763877060891
Encrypted:	false
SSDEEP:	192:M9cnwIspLe4HM2LVLx61YaOCjTs/GfeNpujUPy+8zWNlZdVWQ2C2Wbs7WqwejPRR:MBpLe4DfUX5fMpujUaVS5sW6DRe1nWZ
MD5:	253F28673212A9A3005C6CF3EE34ECB3
SHA1:	5B1B30D4099AE97894D30D32363564A05736B87E
SHA-256:	CC073E60579ED6C1A1E1752199C14E5B86BAA185FF5DA9EDEE9063B8FBC46E85
SHA-512:	26A5573507F38FC6330AE475C48D0270F832A12B4448C3A3457283B6A724CF34E16F6ACF8B644FE802486D7973EF521C77A1E9B7799A39DF27AA40FD1E36BCB0
Malicious:	false
Preview:	.Rb~..q0..].a.\|.I..99...[#B...XmQT.)....+i..~.2.k..e.....TL\|.....m?B....... .4....N`..A.G~..,?...K...j...t.....0......Qb{..09...5!'.x....<C,.D....h.(IN...d....{..G.X...1I..cz0.....H.U Ix.WI<.o.W...S.Be@....W...f...R.4y..C..~.E...Vy.d.R..Mo....f..j.f`..&d..g.J......&....MN1b...s...c.y..p..L...j...s3ot.9.Ae..._.$...^......_.4.w.EB.Y.j...#.?.5\.H....../.}......@q...j.i.......0\J}._.=..{..2...<_.:.....K.gA~9.=\|..6=.p<..x.y.q.....R4..D.f.1.....m>.v.>..h..P.iN..c&.[...;.....>{u..gv.k.?y..."&.uLU.f.\|Sj..K.....T.ju.....HV..?:../b.TI.......9'.F....ys.......vFoc.......tVf...%....oV..Eq.'.Y7...i#.t...3....+,:S.Im.....A.a-........Z.WbY...p.6.g.......xm6.._.Vv..K..l..?..@'......;7.....s.s..(B0k-?.tuZ.C-Ykx.9m...#..._p .C..WO......W.]...0..u..h.......f.up.x.se.}..}.G..$...U.B........f...q....)1'...y.}ga,R..P!.Z.....L]..$!.26de........-.P.rtF.B...a..b..}.......1.fFu=.9..D.)!9.{.@T>.H.-......F.b+.S..T.j_.0.r.CA1B.C8'E.A..%..........Gbez..Q`.Vy....*.

C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	21511
Entropy (8bit):	7.63179601278774
Encrypted:	false
SSDEEP:	384:SPRX9HUq26Y0ThW5ZZ0yffVp/jal7LeGs66pR3:SP5iF4OPyOf66D3
MD5:	598DFDF0A5D6174F0D379F59A922B6C4
SHA1:	62B6D5CB8C620EB54E6D9ABA271D16FDE82C130A
SHA-256:	D4B679218DA40E0D2AC7C728F82E2BDCCF3CD1FD2F828FE0A4846830474AF228
SHA-512:	4CE7DE97C1515E57DA4AA07BBB21C9DD0F7F8E3B62F19B1832286F0A1989A678F833D5EE71A3DBB559CD8BE1AAD8F08951489F4521346B9E80BC8D7B5907DC73
Malicious:	false
Preview:	7-..;...)g...i...ux... +.9VnFEj~.Z..$.n..EC.Enf.:..4....3..M.\M.T_~....Vc...=..q...;..D...-A........yP.J.o.t._...&Z..2..g.Hiw......$$#T..U1..&.DS,.0..6....GX\|...(...K..7...!.bj.xT_....}..>...@....."ex"4.e.+?..w,......./J....T. .;.y..d..1:.p..6/S..~.(fw*.....XE.s1.B.p<..........e.....1..=y`.&.]...<Q.._.M.6.]c..&...;Y#.......u.#.\|pp/-......l54}/"..".b....A.......'iY.<......:.LP..,..".}A....,O...gH.D9..f..<rk;..1(Y)3....".`..V..t..q.!.T..X .0....k2...LC.XMI....T9r.s../.a.1..O^....s....?."~h...q..;......B$.H.......A....>b:......1.\..4].XwR,.c.`W..6....]Xc.g.X....U`+.%".....>.2....,.1...(p.~...g..^.mH.y.....z."x...j..yL ..$.P..\..8.;."......+i$....Z...yz.._..s........E.c...b"........%q.`...y....?h..eT.j ..5.m..q.HI/\|.N...Dp.."k...F.........G...Vo.\Q...2^........F9..!......B...4.....`..qPA..$...nxh..R.r.'.G...3..[..aJ...$.j.mq..t1m...Hx{D.D... .?.\..9.O..N.M..M..r.J.0(......?.^..s..tuh.\+.........`.$."{P.u..&.A\|..n.o...g...F.^...$0

C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	19463
Entropy (8bit):	7.709445206749247
Encrypted:	false
SSDEEP:	384:RiYIW/Yj4uzJJGdP3e4pKj3OikwR4cRjNCmWQ:RiB4mJJGZ9U3RjNEQ
MD5:	64976C1FFDAC89F7A4F166127781F2EA
SHA1:	D32C580DC18D0E61A7CE35791B6A5AD45F8A665F
SHA-256:	230A53E17359DC97597375EAF8FE3E3152AA484C7F2162FCABDE22AB8D574FFD
SHA-512:	73B004DA8FC6A54B805488BB1691524A46AD2E7AFC8484DB9857AE2A5FE127F9F7673019716C51E7FEEF754B110D6B8E83004B54BDBDD8DEE657924A838035AC
Malicious:	false
Preview:	......0.Xp.f`....sf...)I_{.). ..}..C......n3..n.$K...L \|N...`.f.s`:..W.K...-.6k....................u.......b..$'".._.g..N.M.4.3.p....9s.gO./E....NX<sI....#....T....hg.y....^w4.I...O..a.j..Dmc...w....'&..=Rj.g`...<..m.D.4.T.[..C..5.X.-.B....I]X...S.....M....)...&.,....BDf^.F.F...U>......#.r.%\|...L..&m'L.....H,.z.....]...N.6\.0L.g.:...<.k.Z.3\|......4j.....4.`V.!....tN[%z..............&...(.:.3..g.I.....H..1&........A.%.N.y..........(bz.MHm.4....~/-..\|.W..Z.(.p.,..M....cU.di.....O...J.F..=L.wK..v.$.....{.\..kg..,.z..&8.a>)Ao.. ..h.rT!zb..<J.?...k>...X^0.j...U......%......F..>..K..(?....k.<.p...%...`Aya....\3.-f..q:.-;..........J.0...u_.\.t>.A.{8y..r...{.`..VN.s..k.....q..Yd.e7D..B'...]..1f\|*..Jy.G.r$s..&&..fs.....s....C.....P..k..oC.=.:?.wl.....+.dQ@#.......`.B.6....\|...:pJ.3...6..{&.y.......AK..]..j`yQ~y.^..L.,..^2n.....J.=P..i.. g.3...%f......h9.PY(.K.w..8@...t2..L...u....~.z....4..q%.e..D...d...6..D#......>...7/...?I..w...$.XYLX.e.3].

C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	19463
Entropy (8bit):	7.7071737319206965
Encrypted:	false
SSDEEP:	384:gufRmhXqCcFij1bAppOjQ8lGbE1WMjdIPEdGQg//:hRdCcFaevgGCQCGV
MD5:	024BFE1E988D91295CA3DD39F1C19058
SHA1:	C33C78D390C04558CCE5B1F5365F231368C100B8
SHA-256:	3EA8850CA9897321EEB1B4D12018F9AF024C7D58898A8490F64181CBF563D457
SHA-512:	38DDDA65C0C5CD078A1DD61515C6CDCC185FFB42203CEB234708F68C9A2C35E30F8F79AAC4406890354C4B075F864B7DB5401C726A0DBE7F05A8E82DD8E00490
Malicious:	false
Preview:	~t%H.:..Eq.;..!...7. 2z(.0p..2N._...59..:..-...?..'..a....b.:%-..U....X....pV.............u.&r.Q.......ee2.TI..C{mMw..N.~.Q......h..$.II.........h...M.3.UE...g.Pri[.cd..q.L.%.Z.K.5%md.A.1 R\..&.3E-..~.[....\|';'Q...1m.....EgO.=%..57@....[......P..c.....<.C?..6J..r..n3........Ly fGb..r.(..\|D..=.v.g.....`.B..V.....4.Z.H..F..}b.V.{...$.....$..i......-D...U....L..@...._<.p.(.......\|..)-Y ={;..<..'.gF.} ......<"......:h....y..{.T.Y#8..j..1.iAlj!.[r.......84..ll]......lw.v.m.Yk.Z.3..Y...y.........f_d.#...m.x>..%/Qz.3C.g.Y...b.t.....WfGH.......n.)\.....`..Q...E.D..pa ..VZ..7....M.6..c....d.....+..C7z..=4..Mf...I...`....S-.=...S2.6a..F..2..m....uT$g.(..J.....1.t..y.2.M\..6.!H..K.?.~l..K.Z....+....0.0...aV...........d...g4.x...D..._.H...Y]......6.p5M........#'...!.....;q.....Y....R.s..~Q:C.....e.X..........^.G.........-...bP.....C..1.x.5..@..\aoX.._.i.1;...^KsmQ...p..,z.....d$b......X...b... .%.!.j.....:.....O.....F.S..4..:R..7.q....

C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	18951
Entropy (8bit):	7.701038601776139
Encrypted:	false
SSDEEP:	384:B1e5RZhnLcUn2WaAfop2jAQYTzvjcHLtNwaSf:B1+RXbEyh6Bf
MD5:	CEA7C17E2CA84A661060B83CF846E10A
SHA1:	2E84E510E78DA06BCFCDCAC71CF3A757CD1DAAC9
SHA-256:	6000E1558B9E8B26B5AA62A542F905ADE50A5E6A315ED4C4328A0ECF7A3539AE
SHA-512:	B81DB52B0BA372D70E1A8CDF73C16D307A18B5CC707707547AA5CC8C280E7E27F9AC6C1C09064C7FDB898857EFB0D320ADDE845E2627CF8978EA5118889A83BF
Malicious:	false
Preview:	...w.....[&.K,Xuk..8'<.M..7H...S./.m..P..8.w1.c..a..t....quwR..a.....B...r.8T.....r.-S..#.m..8U........Z`o.....f.I........3;.t^K1T..;.0.Wi......2........Q}.o....aq..\6C..XQ9...0..#.,.r.G.........@}.?.M...:.Q.9\....\|\.........$.!..T..M..B.JZ.....}.. J%..i.DC.$....p..L.B3Uv'.,i..8...U4.L2..p.q..(...o.{..&.~...u.X0k..T.Y:..{.......}../;gTM..^...t...y........A..b.g.#..@......ns..,B..TvH..L.\|,X......I..G..&...M..."dG..z.d.\|P_..[[1.w..e.....Vd...F.../.x......>.....8L.k..d.Z`sF4.i.xb?.^I..<..`.'r.....M.~.2...s.oE...../KH.>..T.....s.x.a4..<..r.L..h. .... ..c.r.Y...?pI.;......t.".{....)._\|.!..z...4.oB2..DN...P......d......f..{..........M.. w...x/w..x.z.......F..p..I...\..j...z(....z.q.wo'..M...[...=}f...d....m..........]t..:./],....w.UYC...w.s...ux.z....S.Z.h..(.S..=gG...........A)h."...R.p.:........:/...`..-...~..x...........s.....vD.b.Q.4........DF..#.../.>(..'>.v....A..H.%.y...G.F......"...\ ..[=E..=...o...C....=..a......aW

C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	DOS executable (COM)
Category:	dropped
Size (bytes):	11943
Entropy (8bit):	7.7879551796984225
Encrypted:	false
SSDEEP:	192:kjU8L+SzMSalBqs/AMPALomEABsicNG7qXfjVaAHHhxBNT0672rDj:kjD6SzAvPComFsicNykBaU66iXj
MD5:	55D33DF794AE788E78FD8A07F75B6E47
SHA1:	3DD38A56E48177D3898C4706291CDC8947241228
SHA-256:	D2A9133E3967FE0134260E9D0BEE64A511CE47D6627818CA9B224AB8F5DE2B62
SHA-512:	DB9F0505A86B84EBBAC72D45B5A5A512E65C02DC24EF328679BECCCAF5F21BD90C0CD04AF87AB87FC9DC7181A64E6B68C5A84D75E7722C903E5F5BE02C68A1AC
Malicious:	false
Preview:	./.{!..._..a.Ym.).L[..c.#:.$d.a..W[.;...o..J.b.".-8..8..h4D..1m7.'m.%......}.K..i..:..B..fpW..Z..._S...;..U....l. u..).C%Q..~q.P....Q.....8..z.!}?.y...c..4.X..yV...A........j..X.m\.....?.r....5@A..h)...`I..`.N&.d..8u...,T....B.!.......R%.K.i..g..7..'..B....."..;.......,....y.y...3....5q;i..N.?..J.4...Q..&..I..Z.R...j..0...d.b.h7.y...F.....p.z.:.U..=......cjG..H2.A/-L.GK+.A.\.....Oo..l....Oy"..6#..7=.\|.=..y...,...8..>d=..3K&.7\U.A4}.I.'I1.W...P...QK..t.......F..1H.k.H..=.W....4....i{....+...f.g.b...@id.Ep.u...~....QX8sx..5....4.$..!....2..jfb..P..b...g..i+#....;~vO.R.H....v~U........A..(._..\...\...7n.........1.. #W.U. .Z.-8%....9b\.>.Wo.....Q\|.e.g.#....&B..h./a.}.../.~..C.,.vg.B.u.Z.?Gm..A..,}#......8q.M..)W(.-M[.K..N...Ysm...=...NkaJz.6.D.q.!........V...Yt...L..Ts..~0C..qe.H.4.i.aT....%.x. H_...W....J.....%0.....U.8.E....l..2.Jh..mT.-.m:.....'f.}2.......ji...Gc"..A..r.."..rc..EXJ..5....F...?.+M.>-!.'V..<.y..(.2V...uJ...G8.........

C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	19975
Entropy (8bit):	7.7043884543448575
Encrypted:	false
SSDEEP:	384:Gm+0+2NdfyN5ZnabRAjGfXK3pVj70Oh8CT1/u:Gm+z/7FOyqG53hT1W
MD5:	476FE0595AC069E159DF840F0AE25320
SHA1:	6C1BCB0B4ECA87CB315F4749781B5B158F6FB2EF
SHA-256:	F3B843600762EA0E019F4E480BAB5ED01828C02FC2F905FEBBFB7AF052ADA4A3
SHA-512:	3298D316B7DDD41B455529FE039468A6FA81FC24BDD1FF72E1F53BF3BC1FB67F111719F5832EC6A3C956BEF61202B189CE21129BE220D43E9FF8613F7FD12B6B
Malicious:	false
Preview:	v=..C.a...$...CC.j..T...aE..H.+2..x..c..+..j.....3kN.Q*...V..q...eg. F..<...M...F..f...}.j.6.......vsE....3.R..M.!.'"S~r.....G......T.4...8.6n..&fr...e..u....#.%......R...V[,.E.N.`...Y..O(.=?...a..-..#....7./...F7Z)..4...>..R ....hSl}...s...U..~....H.l.?k.M.1..&.H.t.ah...H%.(.......)..9.......Y..L{...0N...p^.M.....%s7..N......[.!..~..Z.0b......'.V.........6d.:..Ry%.8..gq1`..$...6...;..K..........k..7.`..+...0fH...;i..6X.?.o...4.....d.zb......G.@=j.!.......GW..U....h......!....x... ......;a..C......K..q...........q.\|..P.....W+w..W"....."f.....am......j^.'..>d.N.9.Of/.$.....],.d.......%......_.)C%5.\|.\|.O.>.iO0U.:.yq.n.......f......r...(=.jx.;n............>tU......6l.....~...\...Y...t.XQ`.T.u...r.Z.8.>....ai.d8L....'....v.>.Z.1..^..M.a?.oyOi....$6.W..7B.6...F^..4.#.......U..\a./F).Nr.;]=4.qVv..Q.!OD.. .....V.85....$..._T..$.y..N.Q....Q...B.bE+I...c.`f.=..8.o....O\.!(.......1...C..(.,.;..>..V.T..k...p.x{..i4....L.....^P6.e.%..gi...V...Evo.E"Rt`vw.

C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	23047
Entropy (8bit):	7.546821620154197
Encrypted:	false
SSDEEP:	384:/IsU9e87E9BYf8dW2vz3iAvGfvmTlkMXo+SBAFFWcl:/w9etgw7XTpnJvtl
MD5:	69C45BB98526F60B433AE1DEDB10E9C2
SHA1:	2554E4F4548FCD896EFC6F3A193DFDBCCCABC560
SHA-256:	434C5F85E5EE0E48BC78DA674493169C9253DA9BF9A7166F6DE0F815A9E12FFE
SHA-512:	CA34FAC7EE92714A1361391D715A5798C599A526FA7B50D3EF9C074486A02A5392DA03EA4CAA8F6A7A44EB19EEFD561A01CD262C15B5EDA166E793555F808042
Malicious:	false
Preview:	=.............y..\.M.=%...........0.T....W...J..tb^.lW..N..kg.v{..@..3T....7F:~........~9.R0...kIZxk.s.L........X.Vg)...c.#...l..n..:.../.[...R.....Yz.b...lZm.....(_..m..S...6..:..(.......}.Q:..1..!.9.3.R.....0...O....r.-v.;m......Z]...#...D.....h.......i8..@S....p{6...0.....{.e...D.=..sk..R..H....s........%..g.2..b...{.c....iG....M,M...O3.....h..oL..qA+.]Rz..P.'.,[......,....sj._.K............;..J!.-..B.b....{.".]...d.I..gio..}.Cv..s-....vo.l;.$.w.l.Yd=[..O.../1.....[.v.[{.$D..R..?.<=@q............A8.L.....^.kN.x.`xI@..J.(..$.....a..L`...PV..../:...(..L..2..A\......]M..4..f.2S....t...eB ...~......>0.=.;....kZ.T.2.U.......)....U.....J....`.&.{!..B...l.I...Z.a..B.0.)...%.~P.,)..U..\|..?.}hA..JM!......!B ..9..g.0MK....}.U.....7.q.e.....!. M.B....e.#.Yg...b.=.].Gt.._..."...m$.H.....vw.Q.fY...'R..V}k$=(9w;@....V.OJ...2.a[..omV.~I,.B<.8...'*.C.3.....R.}..k. 0.....A.....b.'..@...8;.?.J...A.4eQ.]......A....hT.q5?.:^.......#.a5.GK+k

C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	19463
Entropy (8bit):	7.7077408539448715
Encrypted:	false
SSDEEP:	192:sFakWxXw694WNJEG2yu0COAfsA/4PP9Y7SM/nGeepFGjS+xaUa1RWjhAHXFWQ4Sp:8fW5z98xPsWSUGXpIjJa1xk+fDtgwmq
MD5:	B3AD9378495EF9233A33ED7ED2FE8567
SHA1:	FB361059B2F9030913B5BE0B1C21B123C89FC263
SHA-256:	C06254A0A46B312B85BBBF6B5FB82D58D69020FCEE6950D1FD65754BEC5ED5D6
SHA-512:	C29898BCB01E6870D66DA76F0BD1D7231F8637DDE33503392676D8ECC35443838F9480CD8CC2C5CC0B3D73B9FCF075B0BF8ADADF726E001278CEA333C4BA2503
Malicious:	false
Preview:	T.J..U."i....^..G-..c....P...eq......7.<.,..'3.q..z..k.G.:.....cN.l...W.[..(.^/.5[u..T.........2..W..O][-..6.K.E.:..`q....P.........'?.:...hc.....z....W...F.F.O.+g......%t..2u..S<Yf.KJ...<.h.y..M.{)Z.`..._....."MU.G.O..........`.TzU._..$.Q.....qr..)K......8....p......6.......g...~aL..]\|o...d.k.)..Y.Q..Z....z.@...F6.Kg.E.^....n:.+.R1.L.s.U..hD/d....:...iV..$...b..Tj..aGL\J..,=..Q..w.^..p7^..=...v+.p..#_.c."......iy.....9.o.r.H..\|...vH._.;-..{[gMG...].g#...zP.v..1..ce..(z48Y5...^j.....s..!>..v..J....e...)..u....4C.!.F..0...\|S.S..t...\......[PDY.W...D.3S..T....]G3.{.8.....gh.......N.........A..:....u9.;0..os....q..W.2.l..$..[.Vc..,..")d.Y...o..FRl...oE..C.Gw..t..v..7H......,..8...v\|...0.6}@.d.%C.0um.uK.s.-...w..I.9.q..+.v..zy..B'Y.....<qC.OE.<}.>..:.6.....Qn@..v...V.I.......3............+..._...-W. ..W.%...Dj8..@.....[..S....^`...nN..Z.5.I.RCN..=.0..d...F.A.k...o?..../...0...&..s...7.o..>.wq..U.\.q..#.<G..v..-...D.AZ.U>...wO..!...$.i..w*p

C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	20999
Entropy (8bit):	7.673194025304189
Encrypted:	false
SSDEEP:	384:kPI28ShzH2wGSyAoGfQ8BjfNrgYnAbVltKCP:yJ8CKOHG7
MD5:	741BCA7668C7C496B7FEBFDFE499AA76
SHA1:	7E29AE7F0F8A68626DE302368ACB1F0404B890D7
SHA-256:	AA51BEABDB2BFA9825F47C1E8135E68D44798B7DC6020F50B977169DA9E6B28D
SHA-512:	DFF227623CFFE88B03E13B81972A02EDD9BF5A5BE2936F360EB3F9B3957CEFF25A694AEDCE06521D8832832F59F9B45735ECD0D2375CF574711F4F5F46F40415
Malicious:	false
Preview:	.\....t...b.#....n.....&...h....=P...ZB..~.L...a.[...X.h9........b...q.c..fN.r...9..?..\|...^..9.o...'\..n....v5........+D.zO..k.;K.p.Z. ....F. >.\|w.W....}..Rl.8W..3..X(.'....b\d.dB..>h....6.].G.F...R.q..&Y..1`...6..i.P...-.C..$...#+.J.hy..ni...........3.d2.[.SFq..1.b].....eE....A...@....h..u.w..Up.Hc<...X!..\|....^\|>.o...... .B.yl.K;}..;...r...\w.&..].[c..a'2".i.....o.G.],.s.RZ........2ukLF!]...iu#.:..aX.5.-..18.G^@O...L...\|......5.n...Q.3n(........>.Bs&...>..o..[c..#&)..g...7..b...c%.O~f.&...?.+N.k...z...NA..4...).3E....S..W....K?{...K.?k.0-.......tJ4Bw..u.)...R.l.^.rdY[...30n..oP2w.L.u.....'...e../Qi........[.+.A...I...o..5DY..q..P_..~.S._N.Fv.V"hn.)%.g<.~.Y..[).{...e...>..Gw.t\.....=-(.G...O.\|(9.c...kM..y..... ..=.M...x.% ...... ....k\|c.....z+'.0w..1t.....j....K.>V.F.G\.~...X"..?...$ .Zq....=.fP....w=...h_mM...4f)q.1.""W$%."...#..6..<.<R...-..U....r.p"/.=C.>iu....{rJ(.Py(j.R.e..w.....#..).....1P.R.sfD....Y....i..BWb-Ca..

C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	19975
Entropy (8bit):	7.701016482653678
Encrypted:	false
SSDEEP:	384:oDfhmwclLeARGfQp3jInD63+h+fAdGPY0:NHlLt/0DJ+f2Gw0
MD5:	41922A84B5096B30CC5E461884DF97FE
SHA1:	91D8FFE3E316A9E1435F6EBD891EBB2E3EC1C9BF
SHA-256:	AD77210D68ECE1F12452F91679E75C4F7D2822B92F866F96B557BA62A47EFC80
SHA-512:	53F69773F71E809A8B2E5978003671C4607EFE714C71A74233480A36D8804A9D610D18AFB1FC80831105971AC9A17E8EDFED7E9A631D8D448243C1E8197EF149
Malicious:	false
Preview:	..6....M....7W....5.....[.y..>$...6..q.&.....]NE+0d......9"...%..TTf...L..=.ZF.../Q.-......sg....s.....Q..u..j......9Zu+Of.......YFH.R.-Nz2..8.\|.v9.......E42...^d1.5......v$...D[.4_{..g$..........l...5....N..:CY.U.EU..t..a...`.~....{.......P...lB..#..k.h.........a..A..X..w..G..G.h...}..)]t.......m..3S.....Ro...d../.....O.L..F..MC.:....................&R{/W.......... > .&G.w.Z.?./......1 ..b.l...u...}m'.q.7....K..:.......Q..kgj7{!Q...2...j.3._.'..$t..X:).(...........5."={.=.....uTF.1.Z.....U...L... 8B.%.y\..x.U.;!%.I..hu..G.........>>..s.^X..tI...s..u#.T[....M..>..Z....F~_/..^`[Q...O".sJG..{QMM)......>.......8....3%.}..FL..#.......o$.F..I...-....G...8nr-l.. }s$V.....S...j.c...0.'W...8..4`...Tet$......lz.'].8..0...y7@..I..5......E...r...K..Z....t....X.aC.;u...H?...~F..{#)9...8...=.2..i.Ue..w...s.......~..?O......Q..Cm.U...g....7e.....^$.C..q...7..N....vAR.....M.T........,..0.0/...P...}R.H...k$/..m..v.c.....O.sW......oD6.@e.

C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	19463
Entropy (8bit):	7.713814657682762
Encrypted:	false
SSDEEP:	384:f3p0Ka4LqfuanyelqvxaZpUjjxH0EAZtlwIrV:mWLqFy4kxsUhSSk
MD5:	4E11784342D14E5CD9B4C2C82623C710
SHA1:	B7CBCEC0316D742063F1C29BA13774736AEBF6DA
SHA-256:	74C4A0D0CAEFA1B42F3955CB45D01BF6C8276C966D245FF216EE8A8F0B64C6CD
SHA-512:	1A88DB956C583901E2C6D55CDA01AAC375EF375D01F83BCECF11CCD8905519827C1572DCC1FF7AD537CBE923FC345335738CF0A64706042EE8A8BFC6EF2DDBE1
Malicious:	false
Preview:	./.v....5h,..t.\|@..m.y..N2.AP...:.....mN?....Y..P.)...L{....3.&i...f.L......A.....E..ly+b..#.N...B...E...S...!]...."....H.....6.j../..L.:{..i...........H....u.y.)#{7.@...?Y.P.-,k.9.1=......4K.f.......DUy.qrv.d/..xW.[..W...K.1T...a.A..@E.:....\.JUQ.a.F.\.m.{._...R'....<..Q..].S...7.r.\..~...;..0h..=i.&.$....g.d..g.3.J.8.l.D.....a..i>.>.s.2.\.r....?j{hO..^..sK6.:..j.f4..O#...0c...n,....j.`..74. d.......V.I.o....u&\8L ...<..lB.G3..m.PJ'-..'w.QX;...h.5.._.G....)[.M.~...6.n.. ......@....J..F.e.w.."k.1.q..^.9..`.2...<... ./...2..D.S\......Y.0..+...3.5......Q&(a.....>.YduSk...7........Nz....V.....<(\|..^..s.:uG.(J.<....e...0...Q2k[3...Z..fr1..Zz....+l6...4B.0..P.X{$t_c.71._.Y.q.....P....j;f.J..[h...+.$>>i.@...X.....B.Fj....e..{....W(...}h...mh........=.........a....xG.5.G..[Mf.......rG.T2).e.a.Hk.].V..Z-G9.4.......h...7;8#.z;.D...y6..@....K.O....@....9fj.,.e.m_C.>z...p\.$Y...;.....D..(.....\|..y.}9tD..{..+.&....+..\)e.......#(0.s.;M

C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	28167
Entropy (8bit):	7.344345357932763
Encrypted:	false
SSDEEP:	384:5ZPPvVuxk8qk7hAm57W29sb4MASGfQ0ZsVHO4sBbFyMFW:5ZPPvV49p7xNO4w8sJsYV
MD5:	01748077E2630B842E2B264C4D75E8C3
SHA1:	DBE6D226C673786406C11407CD7C153687FC84F0
SHA-256:	C9F7C10F4994773ECAC788482E8ACDF399A9D284CE467DCF1F64FADAA1B4BBD8
SHA-512:	C4994027ADBC3C993CD0E6E28AD8019BE3FE5AF42BD7518D267B382382B3E3030419888EDE2DDD6B6748BFE78ECD4A7A0F0A3B5302FB8691FEC9D72B435589C9
Malicious:	false
Preview:	Yp.Z.^h.9.[....0.<.........'?.4....<.\|f......2. P.0.E.pA.X.w.m...._.D.+...f`RZ...@).....6.6.4..A....IH.I...... .Y.9c.!..?...:.~.!.M.Z...Q..k....6..j;..i..;@.6..gO.)...D...L.tu-....9...j...,'.SO.u...........>..YV~...tS.aI..zfT.F..$1.u...r+....~.dX.a.V....Nc j...>'._.6.. <..t.3.\|4}.#.72...vo.T..v.X..+....0V..5U.O.RmFi..M..}NiwEr.Cj.?.$E[...Ba..F..&.Mx....^P.?..f/.<...S....z!..V....:.2....h.....F.......4...C1.5M.z......kP..K........(....iq..!... Y.Y..E..../..72K..............C,....s.5.A...N..UI..Hk..:..8H...v,.O..xa.@...E.....D.:..U.!.Th..L]S.3VXw...Q&E..d.l....Bm...._.....X.;....KNq...............'..V..D.......... _5.$..(.D....p.q.....?2\R.r.=....a..H.&~.... C.z....!\....h..T.^+.W....N-{...V....1.<l=8Y%.B.....sV.........$8I...<.l. U.\~.2?...xy..-....6.....\..`..\..?.."0.;..d.'<\G..-A.A/..m......F;F..B.....a......JqIS.8..A.H...=\.....m.(^..'$......J.1.I=I].......'15X.!c.....e.Z...-.....c......w..w...GB\.0pl.........p....M.g....H...(.u...

C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	27143
Entropy (8bit):	7.384886118623722
Encrypted:	false
SSDEEP:	384:2M4cj+LmzaIrsrUjPmI8JI6cCpG3ZSodXeWqhWhgbVX6mPpzj8/hOH34p66PUZnC:2MrjHvQGPmI8JI6RB16O05yM668ZIn
MD5:	D252C6A026AFB63439E51E40CEA7154F
SHA1:	255D8CB928BA545840D6656ADF0ACA85EC630468
SHA-256:	CE812C34B228A124805DB5474A576AFF8DE593D7C9FB3AECF1BCCDC57BCE4D5C
SHA-512:	0970583430BF29BA3EB0B8A4323BFD62F69AD01399C7DA1452EF3CF61ABA825CFA56F8D6EEC999EE313602DBF580C847BC6BD7E154BF6BAA7B2105793F6CB709
Malicious:	false
Preview:	.........l.d..`.._Bf...........X..4.aE..^...%#.h..r....7.q...8Y.$.;.._....Ybjd#.`........_Lkf...}K].+...\.....>k...7..\...U$. ...=gr....zv...........;.....]..I.3.Z....Rh..Cu.....s.GgC?....V.Pab........d.c~1h..3....Z\...rn.c.J...?M.<KI\.......L,....xv0.........u+W./.Odq.....1..r.x....0C.,W..3.....J.W...R....Dk..F....M.A..kC\|.Kv..nSk2RY..}....(..#. .....1....>.Wf?...XZ.7E.T.0...5..~j.. `.....r...:..R....../........M@.X.pA.m'.W.3Z...}....)9......!P.V.......I.{.&...$...:.).X.\|#z.S.I........bw...-.....\.....z_..&......;..0...Z.P....&\.....i..[H=....%P.0I$4.).X^:....'......`...rv.+L.Z9=..".0U>.lWS.z.mMJ..:... ..D..w.nRN..o\|n.2m....#...e.....b.......V,..lU..r.?..&.8..!...z....AE..L..FYW.U..J..&_....P.lsC3..>.#...8../K1..W..?...}.t....i#.i.5 .....M........5..%rP.I..d.n.gY}. ..,.L.,....?.{.I.E.9x.i.....~..d.....l~x...\0q...\.E...z..*..1U.j.......j..y......U..v.0..4M....=.>}.....4J<..C....#.r.. .<.\.xrs..YKG..e.'f.)..t.Oy^Y.}.9W

C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	71175
Entropy (8bit):	6.420570860619636
Encrypted:	false
SSDEEP:	1536:utiDD4bFA2JyPcvxoWpD9d333gkZns1PvOaQv:uiDD4bFA2JyPcvxoWpD9d333gkZnWPmV
MD5:	CB88F98DB939334D15AB6F6A40E025EF
SHA1:	9758FB2F5F07827D65E05EBC68225A0C44B93D72
SHA-256:	D8BFF5DF9C420C86FAF20837337E8B4A50B2EC903634A9169996B916C29E767A
SHA-512:	566055B1F2BEACD6F9111389E86EE9C2C8B8E5C1EA560274FA9F5276F325ADE260BF8749AD8CBE0DB83259E427B82E832110816D00F23906D515D3EA1B430794
Malicious:	false
Preview:	..<!.._.jg.:..#..KU..].b6..\...J ....l..J..v......n.3J..~.M.....a.y.\8D..Y.'...9L9..L..v%.W......1`Bi.^.......5......p)..h.........;...T.t........9......D.<....._fO}A.8. .8.2>........=D0....@...i..E\|(6.......+......s...`Jq...&.OP.%V.~#O.a.k.........Y..j$4Xs....=rY._..CS...$....f....v.u.@!i.Z.....R.....S.................n....wl...3.....Y ..^.S..............0......)....y..$~8....3..Ng.s..$(T-.H.y.U..34..4Mf.+...>..j...W........Y.&.Bf>.A..3.[U..t...Lu....#..fluc@L9...)E.."..O.3S.....R..b..l`b.n`L.....D.O..t..0..'.p..s..uJ.z;....9...LZ..q(o...z.OCs..-....C.....O.=....D.p;`.K"..M2%X66FS#.t:A1.......Q(G..<.1w.(........p~...._.5..?..-i71..K....!...KO`....+....0(...R".0..K.^.q\|..%L'w.C.d..i....~......1.j.K..nZ.S.cV<.cph......r.RU.l.fgCP.=.~..wC!....i :....B<..1....]g.N0..<0^......lR.E!.j.g.....d.K..W2.....vqg.9.k.......H..If+...>I7.<.I....n.f..TWF...o...;.J......0..~...yn.....c....B.7H.....T...@....u.3.@..ycD.-....^N?M.lX....{...K

C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	19975
Entropy (8bit):	7.701262760705453
Encrypted:	false
SSDEEP:	384:NEeDquTqrzzybIfGjbMABGf7paj1KrpQCbGs4t4wNI3:iqqdzzyQ0jAQwo9C3
MD5:	9FD54846BDD9B43ABDE46C34FD497DE2
SHA1:	812EA027F63C988F11FBBE85B479BC4AED5968C3
SHA-256:	99B4DC7DDD033A61CD85E4CD174BFF66EB1B7B41471004732A540C1F9B29C6E1
SHA-512:	621042202346C8F186D2BF9B643BE3454FF738D48FD189853DA730D4466BB04AC6659649A76655F4B8AD7E69A027A620B304993895F76AC58C56214DA3B3E756
Malicious:	false
Preview:	n...O..d9.. ...$w...T.....c...a..!,.....>F....'.r...{.f.b/]X{...E\..8.E.(.L~.\.......3].....s.EU...v0z...e.<..C.nT.cg..g}{.C....g.^.X.$x.c.".I0.H:.$[....-n...Hl?.I...hS.Nwz.+7.....[....[kS(..X.M..L..+9.Z.O}.t\|....8..q.+>..6.._?`...,..:....Qza.=O.7.K..{T..C5...p..a../...K+.....3..+-.....7..3o...u7..m...LBPd...T..2Lxzq..hsdx.?c[...N.7......!..xi......QD..&\|.^...1./y...S..9.I...>....A{...O.S..Jm.}I#pka......ev.<..P..P.2...._.b....1.C.\.I.fw.u.;qc..<%..Mg.L........p....9..Y.Te.Y..V~.......:.......MaU.h..w.&sSF....Rk...9pys..X...._...sx.....A.[.'5^..>..[a...~...w.zA.=...u......./..=....?..sj%N....n&.6....g..P.F=\|<?C..v.s..&0.g.Kz.x2.\|Kza{..q.1n2r_..O.......@p...\...C.4d...]..pN.....nk:k$y........t.....S..Uo...sJ^V..\|%g......lW.[.._v.SH...6.......N...#....<.=E............g@..d..9.f Y-C.#.m..f.\".......4......e..7... .p[I...fn.C......V...M,d...~{.N.w(.......\|;H..so.W..@.+..a....T....._.......:........u.........!.{..C)...3.,bu..c........-

C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	23559
Entropy (8bit):	7.530522248152242
Encrypted:	false
SSDEEP:	384:LJqccCiat5ihW6gQXAdGf75BjE+5YRStWcxt:LJq9g5iqEDZt
MD5:	9D7F19C82456D5D6DE27B26F09CCA2BB
SHA1:	267E52648E0147C32713D4EB0DD8813F544D5144
SHA-256:	BF5C9C0E492EAE94BE817690591A32075AC9C8543ECDDEE098DB46A31DBD3350
SHA-512:	7FFF79F628E5712C4BD084C85093DBC77D98A1FEA4C1C9AFC92A87E028C34CCC6D740F76D316BE084C40999ACB86EB4F0DE99C82D963BA3FDC10EAD0D9E9284E
Malicious:	false
Preview:	..M..........wj..D....7S.\.h...".........5...S. V.b..$.6.l[d..eJ+.h...s.9....g.Rr.\V._3VP.....0..(........s.Pz`...}.. H...,G<+......'....h5X.....'.d.m....s.......i<.r}...l.......\Y.@......G.b..8zz..6 ..T.jD.?d{1....).j....H..a..................m:a.".....b...<b.0......e..E..U...}.7.?..j.M..._..X....g.a.m.....w...U\..>.0.$....'..L...Z....$]...:...6'..F.....&Z..G....lX.$...w^..2.N.Z....t.U.X...p....7!...K...8........8._....c.s-.G.I..G..c.0..<.HT......"Sh .o.....T.@....@.J.)..#+....R.N.Z..S..j.....7=.....^'C...>..Ik.P.%x.. .%m....\."........q.v..4...&J.l....Mj.....~NA..x...7Tu.#.\|.....7....NW.Kf....@.Y.=1.~.e.r......,-1.!.n.Q.....$E....4.6..m.....2..w....J@...-..s.R......;^B@(dR.....v-J..@....es.9.7.D~.z.1G.GBY.......V7q.f1r.....$...4....~.bC.D,;g...0.3O`..n2.P2..I...1...I<<wb{...+#...4.A&.BXhsN..'.u....(...@a.E...j..4+...P.<Z.I.......@...@..b.nl.1...g-..o.X...y.?d..h....).V..-.t....R.l..T..w&....g}4TE...T..bn/m#.!..n...1V...w.{m.

C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	25095
Entropy (8bit):	7.485666129523957
Encrypted:	false
SSDEEP:	384:ldsizTSScU5Af9RbL/WZuWqbxAsGfapDjogsAnDIM8:ldsGTjAAOBhAgsRv
MD5:	9712407DE843BA4F553BFF545B9905F1
SHA1:	97B7CE8B6A8F55E5AC7E18B6EBF6F23EF5AF35B1
SHA-256:	9D4E91281D438129962C7911264514F0369A8153DE4E124F8367FC4C74B8BD19
SHA-512:	3025B3965D019A28114DF40E19AAEA764DA0398DB698B41896FC76C243A5C8931B77CC87B11C9965794A091E6A5578A256CC1EE6094ADA31302CB3B189C95AC6
Malicious:	false
Preview:	...#O9/wg..~.U..Dj.y.]b.@.....:.+%.m..NU..\|....o....dm....>f..0.q=.<[....(......K..'..,.3.d..o+...Gw.!.+.....h..t....t .)..;W.8.`.R..K.5.az..m..z#)..7....D..t.7.B.(y^...F....nx.._.vQ..+O.K$k^...&..Z.`..A.....Ec....pY.U.c...q....F.m..H7.X.m.#.W..m.5.l$...X....9h....,..>.ty.....,j..Z.>.+...4.2)..#p....>@q.w.oyJ..+z>.x^b<V........B....w...9.:......O..........p.....n...#.2.).....jp.3....5~..g..;I.]&.i";g(....R.(.....\9F..+..:.x.\|....a.6..6..J..~u-.s...p..<.H...d..u..U.W.2z@.'......'...?wP{.C...A.o@^.g{....tN......+.K..h..4\|..UD..ru........b.kbY$%(..+..8......>):d...Ir@.m....y&=...?..,.....`.N ..y.........z..D.......C.8.j<...........!...X..7bn....m..I.pcG\|.....e..".ie'...{`..F3_V.-..}..C(.Q..A,H.S=.S.......\.....r.....X..C.....b.%.`O.M...[..K.....;?...c......+/..dU....B..{.`.7..7...gaY6.R...s...vP.t+.-z..z.!..p.L1.+.......e......c.p.:/~@ .k.`.y.6..`.b@..@...Gd_....*.N......GQE.......xW........8L6.aj$.NT;.SChb...E.x......j...EIYT...Y..<

C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	25095
Entropy (8bit):	7.501351209800322
Encrypted:	false
SSDEEP:	768:B5RY/K5VQgx3SbwA7aIkF10JokhsKxr7ZN4:5Y/K5VQgx3SbwA7aI/ikKKxo
MD5:	25401270630ACC5310D51E6072E5AAF1
SHA1:	C96E827F5D4C3889E322AB906796B0A3DCFA3B0C
SHA-256:	32FF9F69C79BA2790B6E1E214134AF9498DD7062EC187E7BE0E1B28693283EAA
SHA-512:	3EBB08F6D39A26EB5BDA0E3068F27A7D856CBE7D2456DAF6EAA4EEAFB7D55A4DD56035B42E03DEAD086F4085710B0D8AC0AEB7E3B71939389B2F2CC03F254396
Malicious:	false
Preview:	W-.....P?22..Z+..6~...^sH.x.+9.(..P....r.g....7b...WJ.......RL<0u...Dj.X_....x...?._`B......@.`0..s..hk.....A..T+.g.....U.Wq>....h.].U.p......0.....V/..8.t9tg.v.h..E.....@..s..>.J.-..t.1Lb...P.Bg...%.....,...`'^.p....Q....QL.M.1....J..HH..!..I...,. .;5m.P...y...Y..g.4,.CX.U .qCz..^...~.N_...5.l..9...=l.'...iO..6..........J..@PS...[G.....s.H....,.yh.\|r%.....+L.&......q.IDVG%i;Y.......)..9...o..5..]l....T.".UH.Y'.@.s'...q...,.b...NE..G.<..jK_@...e..GG.M.N..~.T.Pc.b4h.g..T.v...:.J.f.#......W.LiF..k.$..H~.....l..E.......,...A......q]H&....."&.'.H.c...ZO.d..6.~Pt.\+A+..n ..+>_.......\|..7.....C1.By...!.t.Ji....8...[.K.'.,.K..X..K.........y6R.._.fM....?v.....9.l...E.d..Q5c'sI+.....+.`."Y.5..;.o..R.T......#1.wu~..pg..."F\|...0.......k4B........9...>.%<26...0..B"ar.Z..Dmi;\|.. .5%}7)l..q....V...36...D.A.E^F....R..n$..9....>G.$......lf,&........V."..z.....x.;f..'.....2...V...U..}......A3.... Kz..k..r.J".~....#...T..V.G..f..N.=..=..R#a.bU..GR...

C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	21511
Entropy (8bit):	7.639810156969725
Encrypted:	false
SSDEEP:	384:S43VpBHr/VMYy2Xs3KJFdxhWv7OP3fNpTjg5BZdA+hdbCtOwc1Gm:HFph9j5Xs3kxQAo5bQHDm
MD5:	242C78DFD1016B62A5C46D3AA9D9B5F3
SHA1:	7FA36F42E71598F7064565A4059640215CEB164F
SHA-256:	920CA4BF289F4DF420F766626BFBF447543FC2F9F996D4F7B0AF3DD709DD778B
SHA-512:	B22E08DAC7B8EC597364B91D15D4F02440263D8745B97416D218FC8AE972700DD56FFB3ED2F7BEEF8FEAD5F2CA09C3B4F30C24DBC68C00D3B29DD0CC64DAADBE
Malicious:	false
Preview:	.7.....B.r.#.......l=ZW...%.).0.r-...E.^...}.,.Q..I.:aC.I.6u...&...QO<T.....&.<.....}.1.....].9..+...P'....!w......#ng.......Mk.=.t.._....`....v.....C......S..[CN.a.OJ.....#.uV.J_..U;..+.@D.Z.J....C....z....d..._.z.....s.\...].31...P.~lk.\..PV.8.....yO.Y.._k.d...+..N.w..l.....v..3c)....W..7....b.?L...O!k.V.B!c........g.._.{D%...9.{....!.....y..+i@....eR.P(...E..v.cvu3\|...wZ........6.Xm'...oY&[t.".z...=.;...-M.... S3....;.l..<`..PPtW.9r..OOz7.\..........G.Us.w..D..~)YR._..k...IU....$f.?5..4...^F)D.3:r.X.;.72u....C.Xm.h.....]..#...X..G....r...xS.Z..b..t ^...q...^....m........%C.q....u.....J.s......{.DL.R...j.....-..fv.U3.......h.`..l.).c.....C.@9.@o........&...-R...p1Q.}...Q....2..WZ.T.iR3.~u.,..?..[9......V0.p.@.Z..Pn.t.14.X._d.Zb.O....Z*..0-.#./-.%j..L.m.....y....>....$Qpo4^.HuO..F.k...Y6...._..d0.;aH.&R..$.s .Z.n....C.e.\'.n.Z..^.....QvT.^.N0.j..i........_.Z..l..).&....N.......`vo..>]......R.T...4..}.{0o.Lj!_..?(<..0....................

C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	19463
Entropy (8bit):	7.709283303523837
Encrypted:	false
SSDEEP:	384:3gytIvLuIcF/5Bu1ldIpFjvvpjBjYtVEnhx66hU62:VtYLuIcF/XwaDxh3666X
MD5:	51FC142679C4FCA79B1E497BB7546CA0
SHA1:	53215F9BE7CE34A3302E9824DF4281771CE3CC17
SHA-256:	A7DD797B2F7D2EAB8FD685D1094B84AC3469EB73F2E8937DE45EAF17F76592E3
SHA-512:	A1862F538182B65FC1744099351B2A0D362B2DDA8E60827F4A99E6264EF02125959753688D7150B734FAED3B108AB90413016FE3EF18160305F7047A4F713692
Malicious:	false
Preview:	%r..S.e....{..(-.....s.a...w.1..(.Dz.j..C.2.. N3....:.......1t....f..]...v...5?`a...J3..j.\.....m.R...... .....Gd...d.......x.jel.......e.4... do.........).mh..Y..E`......'........X.'._c#.`y%(...;.i.-..Ffg..U.^../.....).I.}..hi..E7=.....~.#..V..{....al...La.>........<.6.c7Q.nX.....h.W..:..%..G.....aT(.e......,5..Q..S.~$=r..$..\|c!..,..>}.....cf'.!.iu.SS.....{e..:...4.&F..(.?.sX...l.Zu..._.....W..cG..3.........N.\|`......c....z.{1..:........Z?EV...l.Z...N.....Y!R...L.&.N#X......2....]`t.bm,.ID..n..F..nO%+xQ....F..t.......G".!00.)"H.ln.JA5..p?9.^.=.S..B.v..{v..e........5..W...qO!.:P.9.7.....o6..y..m.,9-b_.z.#...^.j...D.F>>.}..>.w.L.A..MD.....y..........M...HzT.0e.Eo?.g>.&PP.&K1.....Ht.".+.'.......PH..+..........K%..m..p4-.,....<.(.)...6n=]........f..l........%.k.....qe.L.6$?..._..v......+.En...3B..BQ./.[..j.b.j4..2.Gk.....C_...p#....`P5..OG.h..P.v.b\|]..1Y......&B..T.....zR.x..Pb.....I..{.....T........-g...O.@jm..}MZi....QO.....@.....

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1627983
Entropy (8bit):	6.415276908334105
Encrypted:	false
SSDEEP:	24576:THIXPO4PoBOSipLtPFM6dUuaZvTpUDNxacz+C01n2S1DlPMaYRu0VN87iSlHQ:THIfOhBQp1XUusTpeNrrs1xlYRuoOQ
MD5:	66BB2B7F42B6EA0097E7CFEE0CC53050
SHA1:	83C3EDDBA606A4BA25135449E9A05A74C857FD0E
SHA-256:	FC471E2DE67060A8ABD10E3B54DB25A17DDF2D6CA16F7A928F96F739BEF756CE
SHA-512:	CC5B6595D8214F673283B9A8A96EE0EB3E76C758859F7AEF31546E7C586970F00ABD175B39FAE7097482B147901DB083FD1417BA51E91CC824D06A77D0143E8A
Malicious:	false
Preview:	.c...k.Bk2.\|.~...."...kHL~....4e.~..)......\..DL..+.\|7V+J.....t..Z=%B..=...N..&...p..k..Y..}"j."..p,.....M.}....uc....$.6.tv.'3......+P-.5.3S..e1#.1G....et.z...tk.s.q.1.... b2k}.B....i..(.~....3..c).....6..A+<%...Y%.u.CZ..a1.4....[`......Ed..?..+.2.(q..EM.....xx..%.Il.ps....I.`.....]N.`h.....G.`....D._.......Bl......h."..;F...O...}.!..M..........h._#.....8._."...G_b.....6R..0...<.&..i....=..R..Okm)....kD.......O\|.... 8..._Y..8.%.~7!..v............)......Z..7]9..#..K...f..<k5........?/......\+..u...G....^..pR.>JA..~A..j^..<.....!..HB2S..._..8..l..lxG..g....`2.......>)z..A...Z....JsE. .....b}....-b..m..y6wB..Z..l.{...:........z... ....??55().H..../.H..Z.../....pq^..i...\.5. GJ}[...s..0..6..n....2..i,P..2.;Kd.F......7...r.sF...n...G.9.b...z,<?...W.g...g..H..{F?......aV.#+.q.u...Dqb.4.;....>..(pN;.q..]D[...m..W..............e..l..{...}.......so......W\|.;.x....P..s.....@?...."IO..-8...[..6..{.!n.....tj..JD.\|$.Q..L.>).....z.!n@.<g..oxC.TC#.....

C:\Program Files\Common Files\microsoft shared\ClickToRun\c2r32werhandler.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	132855
Entropy (8bit):	7.013269027571604
Encrypted:	false
SSDEEP:	3072:cD5cMrsPoKfBNV7/wUJ35Ov58FM/rlD1pUsY8FIVlSXOu:cGCwDJNFZ6IylvF/
MD5:	5CB9A789CF093E8C5ABF27F3E5162E36
SHA1:	3957D89375F8FA986709A9FA952375752C858053
SHA-256:	E51DC8C1A1EF3B07E72244F14016A9E4DD1C78429E9DBD88A321890CDC7E6EC8
SHA-512:	9F3F796021F2DD945A795F8DB77771DFD8D08D469DF8FC3AAE99232992D0E5B315909AFEC1D77F1F1E3B7CB383F01715BBCE3C784D31588934B64693D7E32123
Malicious:	false
Preview:	$.@!..n.u....c2^..<dO....x+...gm.e.....XK...=X.......S.D.c..BQE.>Jc....J...5..V-b.........JP...l.....#...!....v=..>..y....H>$.+...!..S'.....+..o.H...8.C.... ......r,...."/Q^i.B'r....u..D.z.h.XU...&.j.h...Z.....].8)..p\|.....B(....5=.<.....5...iX.s....a^.wX.g.3..I..3_6....t ..jm.....j.&...U..y...U(.55I.2.Qj!"....u..u..........)..z/p.S..Z$./[~....."".&Y .d..\......_P>H.4o.>...9..]............Uc..m........k%.S.g..I......{..Yf.E....BW.n..~.....ymi..6...J...~]..4..~.....^..._i$....O..r."fK.l.....$(Y..HE....6..7H(T.u\.\...x. hX...x.30....:.b...?....l.....7p.xP^..6....U...f.....t.(..N.jH.eK......~.....H/I..Cotq..k...2.0.?.\Is.3{...x.p..2...M..3.u.Md.....x..<.....H."g[S.{D\|\.K'B.`=ow. <..............D..VZ..`~` ..Jn.;l=....C...(>.u...'.:...EpL,.71.q..&.5....D.e.yK.H.Aew........v.y.`.x.62.[<..AtL9.B.\|.K....co.N\|_..fu.'.AR.cn&k.\|.m....$P.a.TL..p.......:.......D. .q.%O.#K)...+..2.!........B.u(`......+._..._...$.O?....N0}.....G\....(...7........I.qD.

C:\Program Files\Common Files\microsoft shared\ClickToRun\c2r64werhandler.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	182999
Entropy (8bit):	6.764941097426882
Encrypted:	false
SSDEEP:	3072:5LLG95dIQWxp55ba38PXsGuB08vmB+bkGAJL2oHZkWZyOtnyUoZviffp6iMrQo:5LLG95dIX5tVPXsGK06mgk11N5Dy+Vfk
MD5:	F5D2BCBB0FD62AF7AF487A923E7078FA
SHA1:	CC00A5A750FD606005ED978252435B3EAF3DA647
SHA-256:	C5457025F53DBBEEF16C77851D97F9E90D6EE48B8780E3CADBA9F014F6E642E2
SHA-512:	1395F01DD0D52ADD0615C8D2A61487BA1E448D04F83AD44AECAD91E0F8025D6A432FEFF8AD04162490E5976C277F3A08D608C6C01CBCC0AA42895EC100EA6C37
Malicious:	false
Preview:	....8!wX.G.NE\|e(S.tFy.........`R3Xo..h..Rc.........`...%.....c..^a^..JI....pW...;.#...[lx=......[.d.{.[....!o._.{...D..R..o..a=....8x-(#@1b.......<l....Y..BA...\|5......mo.z....Y..m.r\^..Q.`12..$...H..F.T....o..+....%...W......>_yOJ~2...~...j7..a.W.B7Y`.....3 .'(.o%..LYj..G.G...y...}....uX...\|...H.\..j..K....}B.........k3...o..h.e..u..<H:.2b.....nD.#.j..>.a.M.../=.....Q.GrL..?)".(..(-jq..Iww...>.j...J.eWUX.....H..j#J....I.........M..8,Zh.r.. .R.t.....N],g..O.znx@.=K.T.=....<Q..4..J/.W...G.4._m......!xaz/..6...-.... G.m.+.......%.......OD.a. Mq..sR.#...)]?.w.%.3..'n.r.,./&......7+..k. .`.z.....;....de......3..<.u.....DTER..\|S..#=z1.G`C8/p............` =.:...x._N{.J..[...o.1..L.....h.q..'.....B....m.o(......H.............U....2..#.+.b..vH.....c.g?..%oz.6t.b..........r..k3...&.B.......5(7..1...`....L.bZ...:.`.O1?...,.....v[.t.x0f.X+...X.m.~...:....h.=..a[..(s../....m..A......e.;.@...+..N._v.7..o...,\.B%...c..cA...b..7QR.#

C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.cab.cat

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	32837
Entropy (8bit):	7.469160150955454
Encrypted:	false
SSDEEP:	384:YO9rLBn9Sb0OEITBADM6oaxrlwe29h0DfVODwjVKFtHpNQYxDMXC+ziM9B9Rp:z+0OEIIZoa/29h0jVjoFqzzigB5
MD5:	7F8DFD2759BB8DA6D85D345C7CC803AF
SHA1:	D9EF511B36669F25527590BE3016FDF1F961D992
SHA-256:	3E2C6062D6FD0F873482B4FA3630F3E68AAB6F3E1F4310DD15F77AAFE4AC3DD4
SHA-512:	619599AB771394E5D6D461EF10D19B295565C892284F8650F8361CF1F0B55CB9F28B7CC6D89634A11D55AD3A72B2E2D34CC7E460D5A548D105BF60BCF4F5336B
Malicious:	false
Preview:	#'..?.......XW..]A..Aj...t.3.EH....{1.E.'....I........G...^....=...37T..>.....#..R].L.Wv3[O.......$.}....Z..Fj[....B...r.r.........JNK....{..O.V./.....m].R..V.i.B..Z.%&W..1_......e..xH<..'#....#p.(..-.J.....X..G.......X...!M..6:...?I....-..y.5SB..[!.9../....-.-dv..........^.vry.d.o....}.E]..cbt8 ..L[..1.Z..H.u...r.M.......O[R...W......a.7...S.z...2.N..u%.F9...B$.}.........Zd.(.... ..zi._N.#U.m.V3.&)uT,.1...E......t...9j'+......x.E.......0o...}B.A.....o...W.{..tI.&eKY...X..}.\.. ..A.1\.qI.b.M.(^...,.r..r.[...4.%.a./cC..Yl...6..h.=......9Ch..bv.. ...a......4.)..5yA.h..........K..O..:.....t..f~+.S.Y...+.<T.....!7...].........?.%O/...I...O\|.a.....L...C..3...v`.[.A.3.....u.G.F..>X.H{;H....6.05.......,56.....y....LX..g0...~..cJ.c.[Tl.nZ.d.Vm!j........c.7.Vf.M~._.Fy.I_12....V%.R...RR..1.NW....Oq.UaZ>...z...^..:........U...x a.,....q...S.!e6.Q-...w.......#..1.....f.s.P\.O..N...[...-@[$..d........7j.7b.....l.o..x#9.Y..d[Z..m.7.^'....&

C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	433
Entropy (8bit):	6.039097332590005
Encrypted:	false
SSDEEP:	6:H/HJXBtfONarYDGwdDtug85L3irBjPJ+7E5EnUtI4J1vMAUHW:HPJDfONxDvbn85rirBjPJXtFJWpW
MD5:	EC1418C8E49662419058FB57B0BFC0C5
SHA1:	882A84FD8040A19C11166E7C8D32D65AEB5BABD8
SHA-256:	25291675247238356025CE99DA91845A4E1E9A3CAFE75F61987FAC9B27E00A50
SHA-512:	567C839A7561B5DC0AC6F692CB803867F71DBE3B0C26EAEA10E52280A021B01CB6993283A3F2FC5B665D537B718E8C0715990E0FD62E79CE90C2A2FE5D58A36F
Malicious:	false
Preview:	.c..dA_.@y...1Tp..{......P[...............U_/....;.TI!... Ke.7.....1.6...0...1.6.8.2.7...2.0.1.3.0.........-G..UE.a.....02..#..F.....?..G..D6.....t}....v]...t...zy.X....._R.7..B..._s.&I......e..X.O...{F.#..S...}..\|...61....Ka7T..".Tt0".....f./&....6.d;......#..8...'c...jD..U.[{..p.,....s..0.i........................................................................................@...............Y@....czyzk0zzhil.

C:\Program Files\Common Files\microsoft shared\ClickToRun\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Common Files\microsoft shared\ClickToRun\inventory.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	5415863
Entropy (8bit):	6.610451945928821
Encrypted:	false
SSDEEP:	49152:ayehjrFy9Nk8YMofmBNBW95jIr1n6WNA6mRZwaL9oduRcqDQQNhCmt1GXxf52qpr:ky0oUU2grMeXZ2lzZZyP
MD5:	4BC011C1CE0FD3C53F29D1E0555F405B
SHA1:	4E341FBD9FB3709A70775EB907276642F8907012
SHA-256:	45F17C886C78C22C90F2895196B57B3064994423A704B4486FE82026B191D232
SHA-512:	F3EF6FC6FAD30C5D948AEDD1590CCF80BFBF4E65A762AA60D393D41122AEF879568C3362313F88AED3D80EF710217EA9945148D62E5720DA58D9BE2CFA2B112D
Malicious:	false
Preview:	..gt.9.V.&Y......M..P..ab..F...mE.).i+...cZv&@.E........hO[...~..../rb..k.C0....C.... 0Z.{.oN..+.OkT..yM..L..)...........S[1......b..Y...pe..t2.]@.....).q]..F....es.X.i.....GU.Xz.qC.[.9...X.6p..X..WZ..L,..d.....`($..L.J.....hr../......]f{.-...>.WI.\|H.....0-W..<..w.A......l....L...q......-.K}....Z....eE..i........,{.....wh..yD(..7.U.w..K./VZ....P..0f.....y.,7.........L.....n.k...#G..'P.O/.-.ey.R..VZ;...a..e..........C6Wx.=.....J.S.Cck.)}J......3z..X$=..&)..c..#G..&....s.'.JA...=.&....w.R5,SR..&.v).U.G.D..@..............0.8x....S..-..?R..C.....WH^,.sc.....^..p.90dt..#>dQ.....A.).@..<.....Y.7......YL.X....]5d5.... ..n .\vh...C `..7...?.dEC^......=..c..^.Q)....G.pv#.w.M....]U.a..{....C..Q./\|.\{7../..@....;#cMj).....t29...(..T......c.#S.`^hr..v...t....l.N,E~........D..e+W.A..x..3..$v...BF.q..w..3....!...I...$.A.d.../.....EjDl.}1.a.~...C..i..@.....i.R.6u\|.[...M...Y..q.Q....0^.wcV3......4 ...._)JU.~.tc...&....?.dN...a.Z#\|..p..m

C:\Program Files\Common Files\microsoft shared\ClickToRun\manageability.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1507839
Entropy (8bit):	6.54540408595883
Encrypted:	false
SSDEEP:	24576:miZrcLPUaSNAkcSi0lYazkG5OB6zF9oGU1OLmWOFkdJAdS97QKVO2jPvlIK1xG0C:DZlncHUbw1bsidu7QKVHBIK1x7TeXPZL
MD5:	24360850BA3E8DFF935E5DB2197CB88B
SHA1:	F9867632F6DBB9FF8F2B92706F5941724DC713D2
SHA-256:	8B0EF07E31BAFCBF8BD682D5A7A415F2F62BDC042463B7757845D50FDDD6659B
SHA-512:	EAB355062CD28E19D4A87BEC623A2A1E479BA431996795475B7EC9CF88F59EDAC55CB1546C588D9ACE869375371AB8D323CDDE729D06C44ABF97D60A1292A47E
Malicious:	false
Preview:	@Q...6sL.U..P./..H.?.8..nM....j.YGj..../&.....n..^..`...Uw.+.HN.o>_.`_...}..q...9/.... .jw.umQmS=.A..9.H...RL.;R......?=.x'..d~.X s..}........&.oV...0pr..Qq.fb.A....Q$..NM.=........k..s{...R...... u.......oX.......Th..Y\gJ....U_.Y...).-...._.........D.w...._Ima..e8.~P.'...+s.U.x...U.r........'..:n...b-.R.....vU...n..T...) ....F.../o.S..........G?(...M.%...w.u.Bm....v....XTL$.Z....z...5(..Q.....).=.6.b,.... ..I.k)-5...x.0.#-:~.[M..\|......9N.......m$.....8...e.....\Vc....".'=...H..y.NK8../6...'..U..].}0...k.xs..E....1....P(..S.....+.j..m...9.....s...@...q.q.y;......=.Jh.mk.E.d.m.[.6...g.3..o._p~.t.LR.........fOZ....I.d4...P..].N.:...X.F.B..1.4=.._..XxmR0...YD.o.F.g.z1..kyI.....'-}$-..d...C).te.z~...k...U....M=...'..wA......}...m........u.'..*p..!..0?.).[......'$&..D.&.:.......j.....VW.b.O.^v.c.7..J..k.up...&....{m.O..1...U+Y..^p.\D......4.CG..zA....f.."...5...ho...`E..:l..kVF.<..d..ilqP'X:..7.N..@..(GG...H.J....R.3Q.w.+zo?....7Wh.....t.

C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp120.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	660463
Entropy (8bit):	6.636104658495174
Encrypted:	false
SSDEEP:	12288:8W2E6o8GBe4IRv4x0e4CHR76+n3ZnlYl5t0G9xH1ggmGUjVpirEKg+ehWodEEPaw:IEpG9xH1E+rEKg+0WodEEPH
MD5:	8364315E16D146CC706361F7B5A0F624
SHA1:	820D7FBC2EF3626D515F36C0495F1F93192D6DA3
SHA-256:	D1FD83F3521FCCC629252DFBC9EBA666D5106AE94F8FFD1015F11E8176E1C811
SHA-512:	583F96774C5A2A0508A19015DFC93768AE1670C852B41E930D13890FCA21815E6F629C3711DB839FDF83AE7BDAD2CCF6474F0694A4821D8D5E7C87E05DE8591C
Malicious:	false
Preview:	."v....E...b.1...XoVk..?.v.Q.B.....gt....p.q...i..)R3....$.4.e.yx.......#.....N....?...2/K...[.h:.?U.d...$...c.7,........qR...Z..6.38..v8~.4U....O.es...`G...%A.jk..Wz...Y......\.....T..{@. ..f.o..\.vu1.lO...%...v..k..[..$M.No...}..1 ..6..I.....+.#..C8.{V..m".L...b<5.\A.y... ..CKg.N@Q...P.K...6>+.0aLRm.d.......0.R...........;.\|DJ..`].?..}.......z....;@.k8.?..?o`..a.W&.~.$.<8.X.T..a..d.u.9.6..P.0......k..t.NS.\|.:3.(d.\|.QYy..A. .Es?.......=."..@.. .....QjY...a.~........u..=.L.....@...A.6Gd.{4?A..!t....v/..Y.nW.g..c6....G..!...g.E.s..u.,.A./3.'........%.).....s.+.O.J.....B........L..M...O."..t&m.7.q.]..U4...<u.....L.>.X.3.7ys.5ep;....S..#....A.....h...u.....0.V.:.....Gw..FM~4.....n!..gc]ci.d..Tj.......wD._m. ...R..\......(.9..-5d.>...D..........x}...i.D.pL.....].....W....l.ND.q.....O..8%....3N.....KSxn.....M..8....~....V.[F..q..~#.jJhC..{..S..A2...B..9e....[.nz:*.._.-.......{2/..4...bt........+.[.Q.q...... `q..S..)@..x$......%N..

C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcr120.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	963567
Entropy (8bit):	6.86933868489397
Encrypted:	false
SSDEEP:	24576:nDYaMdJtn0GLc9SftntTgjdmz5061eDaqhL0OUb0Ipm+ySYms1:DYaMe12cdRR3L780Nj
MD5:	DB62782F8CF6B7FEDF97B08EDABFEE4C
SHA1:	22FE584931C356310BA5FFA7B38B8DFB1F0A615E
SHA-256:	BE08B8604C1B8ECDAA9D19874D2B3215BE3E4991AB73E69380CAB1B7E1CD7A24
SHA-512:	60EEE348764480ADE258AA1BF403FD164516042DF612BB720445FFD2BBEECF3CACD737A6B664005AC0843C3186C32AD463F8637285EDE578745F96DBE2A43F61
Malicious:	false
Preview:	/........]..R...B....v.p...,!E..R..l@+..zX...1.7D..R...e......@6..+#k...e?.1...^I..h.?.j.`.....m..s........O..."B..E..22..... wE......\.T.....T.$...\|..%).79..N.....L%Y&.W.....jl.0..<;-...WZ..^.+P..3.'...-I..n1[{........6TJ"...-.i...c.C..?.7R)tF.......&.r..C2..".L$.P.=m6..d.~...E.{(...Q.........b.F^.<.\P....l.cBP].0bC...9..........cV..o~.S.)..].Ru.\|[.m#H..#.O..P..v5l...4.t.e\|..U.7...g1.B.../...#!..zI...}_a.;I8.7..H.:n...r2..s...f.2.:>Q.......{.w..7.....{.'EG...[\....:...<>.8.2g@..,..X...k2.(X7.'...J....m......%".V....z.Nc[D...P...._:.m.....D..R.^.JS..Ps.$.....t-.S{4..F..i....,.dv..J7./.D..'..b..W&.&.MWp..f...\|...vu....R9 ..]BN-. ....X/....4._....lt...i..W....I.....%..y. ...E..:{.\|..9,..\\|k....;.,.......T..M..;`.........wOBn..h....n5?C..3Z7.ug5.T~..yT=.....Z.^X...M.....r...t._.c..h.F...T.....5..q/...".n\|...A.Q........g,"...W.._......q..$.s.+...l.m.U.f......].....C...^..\....g...:....j...b.r...m.xp.O.!(...8.6a:..,..".].!.. ..

C:\Program Files\Common Files\microsoft shared\ClickToRun\officeinventory.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	620847
Entropy (8bit):	6.670986739100602
Encrypted:	false
SSDEEP:	12288:CWlb6XnIh0hqMuxqPm+L1WO3RPr8Pb5jHBLvsoJgdGdu8UNz5qFBF3fAq:yxhGM3mJggUNzYh3fr
MD5:	29DCAEA65F320D303B3AFB3B6CCACF2A
SHA1:	494E2AD109E87D18A636F1B270227D9372F66E0B
SHA-256:	CE7E190F3DC1DBDA87F42D3646AD51EC3043823529555DC5F2F2AC8675E9FD9D
SHA-512:	7310474A01ABC1047BB54EF0FDBEB02BE2FB425B70C5F7588F4A1585D057E84238B277FBCF173A083587FC823459C6CC046CB7305559F393A0747E65B98FD02D
Malicious:	false
Preview:	S...=.,..:.nL.._..4.G,.kE....v.........JJ.E>.>\..K..0h.`.5.5wp&....j..cS.X....b.,.b.?.[..T.w,\|.......U.$.j...$S"-..`.t.vf.FV,....G.Tt.....t...s../s.{.A.r...W...o5..U.^.p.C..r4.$$g.NS....>......P.9-?..;...c.6.........R....../....vp..h......3De2......B..v..4S?.wvG..X~xH...3..0..E.?.1....m.Y\.T>..m.....M.Y....(2..G...dn...u.-...hrn..L....i?M.6N:.................A....JLGS..[ g.J .e..Ty...}N#.E.q...d$=. N......3@3.{..,..n.[..X..6.C....`.c.?+.%.....%.v..Q.m..k2..=.W.0.......+..u..+....\|/....Q(.8O..6..9.7!R.XK..&......Bx$. #.ls....4f..5..B.Q.Em.......:f^.l.k;'ZI......l.H.....C..O..]..D;......^..{....e...O...D.*.Ml.....[Y..Cj.v.w..P.KI\|\|...C..U.M#...A.\.u..av.^.H5(.9./N=...%..\|.y...".f...a....+........u..E,...8.C..\1.il..<!.~..{..}Im...d.J.)........>..bv.....).r.XC.........O(.OQ.....m.I.........P...1.........8.:...;..N.j=@zI........D..jQ.F...53.nF.H.oU#;...Pw(..R..A.Ns.{{}..@...&.iEu.J.......o.;[&./.. ....7..[...[....D5..E}\|X\|.h..F...

C:\Program Files\Common Files\microsoft shared\ClickToRun\officesvcmgr.exe

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	4413695
Entropy (8bit):	6.652497254733089
Encrypted:	false
SSDEEP:	49152:ndyo3SQ5jaU0dyq7Kvqi06EqE9ezk1jthUTP4h0DgTTklA+m/H/bFQrpP5zMOQY4:Hqyqui1eNPi3bFQF5zrXDmIW
MD5:	6C98EBCA3DD5815EF58DC70228792910
SHA1:	D813EB79F6792EB7CAB88B9A19FED0DF5A985078
SHA-256:	6E0881A1B90C393103BEA03126982C257154CFF5DC22B80D6A09B7155B70414F
SHA-512:	9F7F3B7A7944A42B976C559541A3D186F847A2269DF66A18DD61FDD3B8D58A4DD32F99E967EA53B9328415E131A56BD7D1A66F3B8EDB0AE577CB1B57E8E6BF5C
Malicious:	false
Preview:	....,a.J.....6. b.f.....8l..x.o.........fZ]....J%...T....%..^..).A...+...e..R...Ji."..+..3.B.t9..SZ3..........m..b...]...`...(.M..\...{~.4.W.!.......?v......a>O............-..q.EK...a.AG\...h.x...#.y.$...l...p......{.0.hz.)...c.t.1A.`.&!..tr...F..w..O....aa..qA..8.....\kr..e.EI/g..A.7N.<.......$...l...V.+..!.k..}...U.F..i.....mS.b.....UT%.1).m.}..v...yR.8.....j.?O....7...V.2.9H.&..h......bE\.....B{...+1.XW\.....b..d'...Q{.H..&J.C..6.....j.f.E.).\|b......c.%.CPY..t.U.._.dF7.I.?t..t.J..">...F>./..".._.M..HX%.K..-/..&...&1S....i..m..j..J. .&......j.x.J.c<...l0fB.\..~N.IZ.....wU...v....$.h5@.-.oP.....K<D........I.f...... =P.0...k...R.=..D.".i......2...[\.6..cD.\1\.kk..l`d.-i.>5.8!4/..D.z....i.P.R...f.bp...,fe.....gn?...i2t.g..D"$.+}.l......B;.uK.}y...Ij...Vp:c,....>.V./&~ 'v..h..?.%.%3..Y..M..o.P..^...$....t.J....L.?N8..g...:.-yL.1. ....`O..at...C5..B....3...\.1..F...^c...M.D...B46#.;..z.Pc7......ux.....q7............./........

C:\Program Files\Common Files\microsoft shared\ClickToRun\officesvcmgrschedule.xml

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	4993
Entropy (8bit):	7.914957594703964
Encrypted:	false
SSDEEP:	96:x9C4eD4LATWEiTSdxrdoCm1FD2iN87LmmS1PO5fLSdutuemVn+1l5eEye7W:x9C4C4EkSdxxoCm1F6iK7LGUTSzfpklQ
MD5:	C920BB1BF28883CEDDF4D5DDADCEE962
SHA1:	EF1C32CAF8AA1194C0F5E15E89681EAACACF85EC
SHA-256:	B792E49035FB757E2E6663AE4081D4EB0A14C1C4068499A75EC7F20DD00F5F06
SHA-512:	0ED666FFD6743258EAEA37748027301624B73530C3778DAF48F11B3510A8557E714B1826A757A6E60D31D4770E9C007E473B13E51ED0360275B7E3F12D819833
Malicious:	false
Preview:	......W..O.(^..>.\|........X.._.{.Lk.h..]...E]...V.3....M.^..tG.......;.....t#..f....<.'.......d<...x.a...&hMo-?....#.2.l......3.?cq......9R.X.hg........4........{...I...)....M=....]..M.C..\|.a<$._b...vf.h.1..G..............:.Q.} .'aP.p.%..,...T..4.....n.M`.k..N..$Pc...X9s.#..R.N..w....&..O..# LV.C....B.C....u.p.-.....p.....\|...E..8...X.F\|.....#t.Q..N...M..+..8...W.`k.\7J@..F...\.....OwN..n.O.tM..DD.H8.hD....$YV...mu!.kE.Ot....3...h..B...Dc..,.@u..R.R9./.M.C).fD...vi.e;I...."...C.f.'.p)...X...eh...b.y...u..b.b.xo..teD&..u.]..eA..<@hd?.Oi.9......G.K..gs?......T%D.Wn.].Tc....?.1...2..._..w......X...o{F.V:.4.V.....p...D*...@.... ;..<<lm..v.".+ju. %=.....................J.Y...y.E)rbt..........y.vN.Y..._.........V.P"Bz....Y...LPLe..O.K.bu..k..&.4[.t...@.Hd.N&..f..m..k...T....&.y..i.>%J....2t..-..a....z..H..gp.0mj..........N...9.uQ.)...h1.,!......\...}.o-..........KK...K.;.qK.+.......... ..S...H........m..WZ.=B......e0\].M..."/.

C:\Program Files\Common Files\microsoft shared\ClickToRun\offreg.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	87311
Entropy (8bit):	6.851684078695232
Encrypted:	false
SSDEEP:	1536:n22ajb+vavghQBSEu0RvQXbkc2Cd5a0cqvw+PSAd0ffcu:n/rWgMSh0RvQ2bgwgZyUu
MD5:	ABC7D4B8430F933421ECC5F507812DA6
SHA1:	D7CC44EB4A487EEA7D90BE240E55F92117633A7C
SHA-256:	FF013801F18FD78D056166259710117CC1390456A8FF05DF296FF0ACB3E9BA05
SHA-512:	5E9ADE8C0172AE994CC1CDAD4DB3B11FCABD14A38476422946F0815E0636D6B1AE63A9536BE442283E0E994A1F56A3B003CD329634C32D0E31E725F9B6ECB911
Malicious:	false
Preview:	....J.u....} -.....u...7).k7v....,.....+..j.u.z$a..V..+..6.....R.e..f.3....L..WYl, K..<)m.j...R.q2......+u...#oR..I`v...J.?%0` QR.....3.s.:._S.(......v@..P(f...KS.b..@F.sV=..7..L...6..7]...c..N.6...X..K...9.....+.R..x../...7,ecO..p......(.B....1-.i?.n=./{..&-=a..H9..].....m.A.1M]..ay.FP~.[......:.x.2.6...S.%u...26.......{...i.._.m!q.cr6.l...i.R.6....u../@T..........,.3....F.q.<..E-.. ....P.W?..4..e.;...M.\|.^.M.G!.9......A..h...x~....:.q..A.......f...o..!..l......o/u...u.B...A..u.eB...X..'..G=A.e....o...5..}....Q......'...........]^...h.C:`.WUCRF=.0t...@...Y..'b9...1...bg...Tr.....{.>.Y..~..T.............S..........h....\|.@......M....[.b.:...zc...b..6B..2}D.A.......z....P..%&.b.../....`I.B.v-.{.*PN1...t..#.!.TI..n..`..-.....?.T..>;.....".!<..y...<.nh..c:......Y....Ng.p..o..gzS..;X..;!..E.i..9..1..J\...7........\|.P.P.G.S&.ln..2..v..ZS....?..>.q....d....Z.;..p.........4.M>h\|.,E....R..$..i.-..$o.FA.vZ.I.:.I.f..\|.......pXTeD.aW.....O

C:\Program Files\Common Files\microsoft shared\ClickToRun\policy.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1435503
Entropy (8bit):	6.552396395795317
Encrypted:	false
SSDEEP:	24576:SF45IxbJXYQmgiJvWMWq4NV4OB25Gt0crWDDIK/cV6VLUYKDm+tBRFXE/Xen/wHm:Xy7IBVG40FYIKRVAYH+tBRFXNoHcwZH0
MD5:	C6AB82525AC97C4B9ACFB1BDA7FE1733
SHA1:	F7DF609CF874199CCA5A07B2C0A4A8B687C538AF
SHA-256:	E939761693CA781A81C06DAC1BA08EF03343CFF09141A585A1EC30AB1553F409
SHA-512:	7CFF70499D635015BB48E833DBA6FD2985D9ACC122797DE3FA3E9FD0EE0CC11239D97B2C620E138BB1C64DA4DB23C3F683A7A3C0BEB01E4F9E30F55732013AC3
Malicious:	false
Preview:	.s6l......D..+.7.J....TR..$.W..../..!a..c.jbi...AE.b..>.:{.\|.s. o.~\|g..3m{.....U.x..+6A;a.r-..k.B.C ..d%`.Xb...G8wY....P.^o.z...{..A=?."Z..Y....~..Tm...u\|......W./..4.k7e..%-....y....).....}C.]\|T...<Zl1.0O....}./a~..'~.......w...A..u....k..6{-}...l...>....g:'$.G......[S.,.M.....4..e4N...Y.~..N~...B.h..!...d.Uy..^..(...f........A..{....?......H ...x....[.]...A..m.A<K..j....W.E3...zW.mcU..........w.b.^.6.5.._.T@b.#[...Xq..["..l..G.J...'~..s..P.d.....<].v._.{..0...+..^...%"p.......... ........H...\|w........#.Gh.wc<$)o.....Q..!..p..u....u.t.uwR..M..}E.pzkA..2.0.......bf$.}'...N4...f}.+.........a=$.-.W..?.:-.;....D....._..r+.1Q9I.z~.s.'....TW..Y.V}.'e@8k.....c..Ng...C......txn...>x....E.^...........#..{.....3......k..A.dp. 4M1^......N.7..=......2.l........._.`..^...e......I..p.G..W\.B@..H..PR4t._.Ew.b.TD..+.....L.i....:C....M8,..u......Z7..w6.z........c.$.v..K}..*ns..9.U.[uI..-B...B.;=.....RndC.I.0..0....J...j......Wba-...p.G...

C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1124135
Entropy (8bit):	6.897989300391655
Encrypted:	false
SSDEEP:	24576:WjnNWWM2qHQeQU9x3xPQR2yce9bLLmDNk3zYmivbZcBy/yY11N:mEhUQxPq+e9fCcdYN
MD5:	E2DCB2AB59CA6E0C1A43D5776EF8B4B8
SHA1:	3CF69C3CC23547B33CB160C48CB5574A285E13C9
SHA-256:	0F3C81DDAA67A4BFB143A587C5BA4447B0D26182FCC495C68BCEFDF3535476C2
SHA-512:	626EF331CED4ECBB7BA71C009999F665C8DBF2CB691751EBB914B3BC26986FE1961DBB985B61AA7B113A511CBA934812730E6E71BA6F9CD9B52E65C1732E2B58
Malicious:	false
Preview:	j..}x..k..xM.X..g0.v....9[.~..e..G...;NZ...=...!............t'..-.XQ.[..G.<.....H......c...j..+.i.......exv}..x.;o....n.=?..h/U.........O^.......L.........D..j}.6....M....l1p..B...G.l.?.J-O1..S..$..H.5n.X.o....:g..^2(..R..+..'O.g(..H.w.N..t6..T~...E7.1{?PYQ..'...4+v...1..5.v.s3.e..j.w.`...K....3`....E.K...U...R.+...G._.}...<..w...,%....@..6....r...Np.).9<kO...d.+...g.....w...ME.uM...f...9s..:...]...9.E@...^kp..r....rAGBe....:..0?...20..X...Xw...=...2.......b...b...PG..R......U1...".....>.\|...V...S....c.}e.]..../I.r....D).O0H.K\|'..V..bI..n`.....sN...u.8.\a..Y.`. .27T. O.I>...{n_.<....PQ^.CQ(>.._L.:..~..t.....\5.3p.jp... ...b..\|U.........b.R.D....B.ZD`..d....Y.K.<I.q.....C.P.B..<....J.].v..)X.J.=\.?P..Xr.m......Y...1ho......3..h....S..L&.f...7'A.K.8L..i&..\.....s ..Z+Ut.M.t.82.......2qH,kN..2..*.U5cX..X...(r(.$m V.J.._.I..y..Q...4.3@....L.L.n..^!&.@3..&3......`........`...y....f+t..-..CY.MY .=V..~..Q.M.u..... LS2l.#..98...A

C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	COM executable for DOS
Category:	dropped
Size (bytes):	335063
Entropy (8bit):	6.31961582755333
Encrypted:	false
SSDEEP:	6144:NI/npy5jDlJY8nERVj2gEnrlsz+RrdD9qRTORw/TApua:apUJY8M2xrlsQR9+iRdp9
MD5:	8EBEB0505FADC9DE1B68BC44540D7C43
SHA1:	7711E17ACA7B91A60215BEB3FC415E008EC72915
SHA-256:	BD4D2005B62D92AC122FF2C235634D6E9E95A5799204A16F4890A8C0BA419F0A
SHA-512:	D5FC120E676E9FC56CA52CCBB9F5CD4FB9FCB008803234797934B82E9C400D1071DB61FE5406522B17B6C50BE7BE76F412584C5207D1D5541DC7009507E110B4
Malicious:	false
Preview:	...".....w......;.... \|b....H..&&...3....6{.'...r.I..M....[..W .=L./.\.c...B.H..%S.q.w.i.0SVS....y......}.>.?.k.i.NJ.........X.(..MD.O..\|]7v..E+...3.y....3....f.J........it>_{...e......\|.F.....D.l.......1.........[...wV.I......A4g...\|IZ5..i9...P.q......!.3...5.}~nZ..].....LL...(..^...X.g..h.....j.'.0...7.r)U ......(...X}U.....k.4A.39.......b. .rSk.n..$...#c=..m&)J..n?&..L.t9?.vY...ol..7.............U......c.....hq$d..6...#..+....}6.s...JN!...D)"r..-.Y.Fm$...;.=.....y8...h....(\|D.@.e.K.t..R...#Q.].!T....&..%7..)Y.G._.R........T.X... ..us.]Bp..,..Dh..^.6.~} ....(.N.B...P.j^..[/.{...oP_...-..D....G.o.`D...1.H..@...gt%...L...r..kj........W.J...Q.1(.\|H[m..7....0...z.n...5..N]...,.....\|..P..B.....zK...Qi....A2.I.kI......[$......g$...,+..=.-.83x./5...../...z{..nm..o...J.R..F".......d...V7G.H....%.7..%...7.... Z...s,...q...b)*.-@ZS.KC....M..4...j...Q.9.?..'....x..9.;...j.......d....9!.o...\|~k.S....#.o9(;8Z......E.P...#....ey...Da.cg...W..6.

C:\Program Files\Common Files\microsoft shared\MSInfo\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Common Files\microsoft shared\Stationery\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Common Files\microsoft shared\TextConv\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Common Files\microsoft shared\Triedit\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Common Files\microsoft shared\VGX\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Common Files\microsoft shared\ink\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Common Files\microsoft shared\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Google\Chrome\Application\chrome.VisualElementsManifest.xml

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	740
Entropy (8bit):	7.137085305276049
Encrypted:	false
SSDEEP:	12:fRngVhN9WWOnAMfHxnGmMK8QKbgX3NQQakeyVUFMfjmd0oGwOjoO8LLvxTXzFXW:fRn4hN9WJnx5xYxgX3CQaGffjmapdjxt
MD5:	FF3E3F29CDBFD66358FA8ED9EE9C4CD5
SHA1:	395B3BC87B10171680CB3A87E4763F436B61CBD1
SHA-256:	CA1AAF3C413D8EEA901CE5076A45F1AFDFF7BF972D0769BB4AEFB001F24A3DE5
SHA-512:	9BA73DB45EBC7B1B2587DD20334E489B5FDB985F3BD08E37CD35A6BEEC9F7560EF8C66EACBD89C8626DFC0A26D18706D12B9BABFDC9286492B8A1068C195311F
Malicious:	false
Preview:	._......."..B\........_$7....../....F5...I.='.....\|&.g..JF.\R..f...../..F.&..cMn+P.........k].....\.&.v>.f........-..."...^U..=}I.[.......Q.yk..J......q>{.#<..7....f..\.....kY..lZu..b.U...."......gI8...L.8.cj#.x..;......".{....."H.v.F&3..~.g<z0.m..V..])..7..LnM...>?.q.....0..iF.+....W........}..\|..gr...K.u....l.(!....`..;.....#*N.NF.2f\|B.....3.;D..^..d..F]8.(;...A'#5F6368'/>..</Application>.......#w..j..7.CEm....C.+>%.ak..2P...?..:..?e}f..pI.......#zq...^...Fq.....2.P...G...!\|.......`./..y..J6...y..QpN=..3.......l.t"..r.x.Y..Z..>sJi..g..pM.;...-3.P.....P...D..f.D\|n.p.........a..Y!T4.}.c.......................................................................................................Y@....czyzk0zzhil.

C:\Program Files\Google\Chrome\Application\chrome.exe

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	3242599
Entropy (8bit):	6.817352388757712
Encrypted:	false
SSDEEP:	49152:Jon4+0cWvR6wMmlq4aENpEMcG4wswNRkWdqAaq/4DL2:Ju/4v9swH1gqgW
MD5:	94673C0E328B096E07CDFB294BB7B570
SHA1:	37194654D25BEB23F3AE9ADF8A5E092E62252FF3
SHA-256:	67E497023E8075D85F4D62B0B28B8FCC9B063A37B89F996AB053639654827938
SHA-512:	682D641770A80AB24F87E72ED1E1DAB5D5FF40B3A3D90BB207B61EDAFA5733041ACC402B6CC477076B9BD94540AE6B336295C51510756739F047939F45D28978
Malicious:	false
Preview:	.(,.s...`.-0v..I....q...$..P...b..#tq+[.3[......\|.=f...%..fz...Htb......./V.....z.Zv../G..5.s{....~.....7..........hP..,..........b...j.V$C.....G....J.G.dV..../&G.\)f.......A1;$......r.._gl.........EO...a.a.....~f.4....e/.nX...d.p....._.8.).}W&...l.._<...>.E.-u..V...>..;.O..../n.Z.gx.....R.~.Y.K$..^H#M...QM,D...A......9.....-+p?R../:O.#...+.-..Y.o.p..P{.".Vl..?.....R..dEV.p.....y...+NW.....+/...,'t........>..0y']. e.{.........F0..CM..../%...b.Y......sA.K....V......... .gU.HZ.L.....7....{.y..t$...t..b...Q[.Pv..^..&h1.......8?.\K..v/..C..Q.5N..7..i..OL'.&"Zf.I.Jt>6...a....,.....N.b=\,T......wC..b\|...FT.:..1.D.6.......RS....G.........U...4..1.}8.V..q.+d.e..6d....s:>.>...z^..<.......L.3K...S\.....xE..).w.-}..j.e..\.Y{...N^.....+R.I......G.k<....Pq.....8q.......1.*.......`qG`$.....toj.y...."....V.O..z.M.b.k..E..5...^..1..B..U@...@.....w.?m.I...5j.....k...A...'...........+j..n..N.z...Ia.....Hz.7H.G6..5.H..ET.[z.].^.=\|......EQ:....\|.2

C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1210471
Entropy (8bit):	6.748567408064907
Encrypted:	false
SSDEEP:	24576:/BE3z0y3yuHK/CnXuSWwe8FCOnk/aA9K5pC:/BS0AZKaXTWoFCOnkz6I
MD5:	B39C841EA5027C169DD4A248740096D7
SHA1:	A16922DD53833264B4D67E74D3C9A6E4E90C73A0
SHA-256:	2C812BCD8445DFB31711D2E315BA3BB5EB918A6AFF58DA7E7F141B1E8E4B5AE8
SHA-512:	BB229A15A31504446720AE490A5BF79CD1C3EAA82C874E330EDA7B4B98DBD17358F2DD6BEEF784706AA3503CA66B7CA86ACB3E5CD692B22CB8668D43C67DFAF6
Malicious:	false
Preview:	.........T.u%q....@...0..K8wb..v...n..T.D#..\|r.b.+..t&....,..E.L..P..m...X.\.........g3HSE[.....y..v.......3..4U.%B1........=$p[M.Uc.g(.X...B..QfJ...AM.Ut.>..v....D..zZ.I.`......d......x.....)....%-.."..l.M'T.b.".0 .\|.J7s.!.Q@..".......P...N.s..-...j=.9..(y...y.p..s88bX...%NK.m.&,8.......h.l......}.x.........A..........Q..'..T...S...>.ZB..b.}.[e.6..!.=..%..S.sZ.[...3H...e..%.....Q..l....cA.~r..V.....$).........Q...(.....$-.............bTMHT.g.;.k...Z6}['[..X8b.. ..c@lqlN.;..vB..!p..-...%XUh{j.7].. ..=3..\|x....@4.....4]_7A....n.9..a...j`...0.fXn..]v...,.?.7.....j...P5]sZ....I<..xk..#..........9[X.Y T...%..;O......U.....l;.y....Mw.F0...s..)...b.7p..<..ro..2.jEc.e....p........:f.G....[._.R...,6uz..~.+"$.Y.H.D..+..A...s....3..!..z..[..6x.h7ZL...w...f...$....+.\|j....t...._...}.I..x.....X.1>s.R...?.K..Y.]q/.&..J.N...a........1. .U...".B.}8.vP.X..E.D......."G... .5@....7.,s.;......e.....pLk@...ss...k..![~=...H.u..b..H...$-."qO.m.jz.......6.`4<.

C:\Program Files\Google\Chrome\Application\initial_preferences

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	547313
Entropy (8bit):	6.5539601555619535
Encrypted:	false
SSDEEP:	12288:VwhOYrUgDc1DPM2oy/JBPlEfv5vcA4kKe4owkPwXnsLlzwCJKH4:2hOYrBwxDf/JKhp4kKxw42zHD
MD5:	D503A42DED2F243E0F9141C316DACDEB
SHA1:	92EE284932707C4F7578F29F576BBCB260519D99
SHA-256:	BD13B7ECD6EB3A3DFBA17E39588B9BA48764CB7544BE7ECC468BC6D4DEB38BF0
SHA-512:	53FA057E42DC146989C8629FD2C07DED37179B3011DBFBBB76EF2AF5A5BE7D802CB87EEBD1102B11F5A8390C4B34D34B9E75BB123462DA50D026C199A8E2DF8A
Malicious:	false
Preview:	dR.G.7.b._e.;<Wu.^........x2.e...WB...l.9...k..U.....x........uFs.....N.k..r\i..,.........X.k:f.h... ..[.Hz.a..D8....oFZ.K.......[..,....,w)...;.`.^....Dq....H.2.l3x...qw...L.z.#=R. `....+.@2.q.~..dm(........}....W.$.7.%...d.a...$..W..3h.VH...y..X.Xt...p....z..C7..V5.E\.r.e...!>..S..#......I.....6..s.....O...%..3.(q}..}7...'.lZ..f...BN.6..T.2......fg..b?aA.s....0q....AFk.-v.9.7.......95..:b.@...V.@..I...{.....4.5{^\..n5}...j...w...nX..F[wt..V{T..FG.B.Q..%......,.......7)y......BO...'h....+v....p.e....;..2~.%Bp.SX..kM....~e..}............8.......b.d.~.9.pM...E.....Q=.op.....P....LPM;.c.6`.x..<.NbKn...j.i..@.{.[.H.............k.(.d......_...9-..v.1..N{.X..9.n.."..-...Q..}.Bf......:~F]5n.0.....T.^.......u.U.a..M.V.&i4H....X....NO.......YA.~(C`..Ci.:d..GV...........T.L......._\.f..s.c.!....h....=..)...G..\..,.y.{...RXs}#f.d..5.).CZ\|4..n...../...:.Fp........".5cXfR..<.s.g..3.0D..F..6;....0./LQ........<..^..`.....G....C.E~.C e.......f42B..V....

C:\Program Files\Google\Chrome\Application\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Google\Chrome\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Google\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	true
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Internet Explorer\SIGNUP\install.ins

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	779
Entropy (8bit):	7.141980389502492
Encrypted:	false
SSDEEP:	24:u3pUobm0PAg3r5NUTSgGzQREOJTukUyueW:ujblbrUWgGpyUyueW
MD5:	2507CC28C9667D214C3BCFEF9AE861D4
SHA1:	028FF799604A6990B1D5D9AED87D3E901BD37539
SHA-256:	0D8F7932F682E1E02FED4938ED695240342152D7E356119E93AC73BDE3275267
SHA-512:	1A16C2866F37D11FF374739BEEE07B0CE58DB7E86833CB809B0CB065F284E682A01F3964CD8B02137FDBB8B3B45CC9379B39048474AD36F9DFFB182181F8F2A1
Malicious:	false
Preview:	.G.\...D.1...S_(.#\|......\.8..".. P.....MQP...V.YY.Q.K..v_\|..6.]..,q..'.j.:.......n......W...[...K....\....#G..?...v{..S.q......i.y.).....6.y..'^..k.;E.a.G........g....P.......xwK..P...".m.$.C....T......vk...nQy..?.......p8...Xga.) ..5.7E...OD.._u.1r.~J.....+v^..b.V...F.....H.'......;.T....-L.5.O.. }.U....S@.No........p.~.xK5o_.JvZ..H....`F5.W}.>$..yxU....T.\|.....'ek.....2.r...F...w..?...h..Z.]7.{...#.....}O..VwP..i..TF...........l.u.....~..W/..xR<R...46+....rX.#..-v......-I.F.7U..Z+?.U..D.ny....W..d.B....:\|..(..L ......z..z[\|......L.v.-.....@'.m.V......V...=0u.;z.)P....vEf+@...1....?..i.C.W.................8i.'..C..}h.....................................................................................................Y@....czyzk0zzhil.

C:\Program Files\Internet Explorer\SIGNUP\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Internet Explorer\en-GB\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Internet Explorer\en-US\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Internet Explorer\images\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Internet Explorer\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	true
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\MSBuild\Microsoft\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\MSBuild\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	true
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	5294959
Entropy (8bit):	6.471868027017766
Encrypted:	false
SSDEEP:	98304:kjjE3AeB8qbGBnYr469zhVI8JhDaJ84XkZ:07QrGxYr46JI8JhDaJ84XkZ
MD5:	58210A6665C9D0F284D5E4DE829DBB58
SHA1:	F1B5091C94CB012CE6E0F664D92A2615191B6A15
SHA-256:	12CA50772E866BA682843C1A79AC7D252737BC5AD119704BC935A036927FD432
SHA-512:	BF34C5861E61AFCE592BDAFA9D53D886A7E9ACEE5177DC446579418233F3096BDC8B94369B841597BCA863A2D45AD60ACFBD33C0F3A74B97369165989164CBE5
Malicious:	false
Preview:	........;..{...N...e....1ze.G....iZO.f.X.z.G.K..x.<.A.u..}..MD.#4R..H.o..Oz...e..!....c..+^.x.U.[r..>h@"g.....O'o..p.5=.T`.7./x.).&....C.$..3......M.a..X.1..mu....EnWI].[$_.vH....Z\|d}b.;.O.N.....1..t........]..h.F."....../.s.[...Sz...._...2x._..%P~.?......_..q!..&Z.0+../7.(:...RG....n.6...8.3.U...L!S.7..Ih/...>..'..S6.=7j0..O..c.....q.\.w-..~>.U.t..A.........\f.h...GC.jw#K.w^.......p...k....b.9....t_m.........i.O.0F.bb.z[..'.EBh....i@(.=d.jo~R2.D@.{.i\|.6[N....g...~......x>4}.@.)...iK.m...fw...j%....X.=3H..2_bU.7~.:.f+...)....x.k....:cg...hk....bC....8._ax#G^...gd. .U...G.$<Qk/......KUA)...G...j.z.G...."{.@a.6........j........o./.>.}@....-..c..AJ.F..P..y:lE.w.2.B...q....K....B.W^.5............@1.;...G.2.0.w;.'...[.:...8.P..m~.6.oB..4..K....f...G....KS....C.v...b..{#S.......NP.~#tC;E..0c.y........e.!.P<..B.....d.-....)E.2.0\....>.C-.#...P..r.".%TOnp.5......x.......[{<D/8.{.,e1.U..m......e..y..^$...Z..\|.fI.......j.}.l.%....l.s.21...../..vV.{

C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	5294959
Entropy (8bit):	6.471730147753676
Encrypted:	false
SSDEEP:	98304:4dr7IFJfOwc1Rmyrx+zLQsx4DmaJQ2ONd:qGxE10yrTsx4DmaJQ2ONd
MD5:	A14D8166DB48CDF607D4A7EA2C9D02A5
SHA1:	19F1F75E40CC9D329A070D7405A9E5D9725488C3
SHA-256:	B0DDE618A49E1D75D96E1BA8F72014427F9A32E95E9F6F782D33BC8A75F1D4EE
SHA-512:	7FAF19C9E431D5EB1B41D8A623051D024F4D007EBB6028B0E095BF3389E6A67D3DDD981A22ACB0573AA377C1D0C6EEC1A013F621D160DF9BAE71D9E963517756
Malicious:	false
Preview:	6...B\..V<h..{...Avv...[rP.`..>R>@~v...F0v..og.....+.."4.59...nU.8...L@I..4../........:...O...#...8......{...l....;..N....3.)../MUb...H.....84Y....Y.B;j-./...7..........#a].R..8$..d9.Z.M...k...Hh...#dd...}G.!...E...d`.wil...b.m.B^.d..."C6.!..#...Nq...w..f._.G.2.@u.,...~...."..iwth....]bico...........j..w5..(#.y..*J..V...WEq..+.a._...?.'..3....I......V.%.3.rBUH....X9?. Gg.$.u...'d...~G`5.,...\.%...qJ......`..}.X..z.E4$NJ.....>+......C.\ ..eq...d.\|....l...\...?_%N.(%..}....~..s.C..E.%I.bE1.$.G+.z.').J....XD.k#E.....3.7.S........s..."..+....eL...c...!...0U..3.:g.l}P..&1E...=sJ..g..y.N..<.;._.;.@..Zu...+.v......\.../}../...q...r@).lT6....p...z..c.vu....o..[.Tq.3YnG......_...4.I.h.....:..NQ.c.6'......\|......Rg.L$?.i.A=.,.R....C>.)..e<.'N`.]..U!l.D..3.T.....M.%$.J.c...`.g..!Y.@..of.J.Gs...=..<....o).3...LK7,r.r..s'.......21.}..>..\#V.ln.u.@#.K..B...c>....q...V. ...qs;..".bd.;>x)..ti.....L.M.d..Q. .>...!..@.GV..z//s).....pY.."......P:.z

C:\Program Files\Microsoft Office 15\ClientX64\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Microsoft Office 15\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	true
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Microsoft\OneDrive\ListSync\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Microsoft\OneDrive\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Microsoft\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	true
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Mozilla Firefox\AccessibleMarshal.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	32487
Entropy (8bit):	6.573715690442005
Encrypted:	false
SSDEEP:	384:v8X0JemrZknDYvDW7IPGwmc2dbpydnsGEmDGNqE9mFfmFAN+oKQmt/PEGJ:v8EJe2Zkkvq7GGQ2iymDG8EjANxsiGJ
MD5:	C6123DCE1774F7D38C192AD284F7B82B
SHA1:	7C5E37435C0B84B2743AE85C1C9FC91AB6FF184D
SHA-256:	2C288B569CBBD23BD22D545AE4D8F0D4C1EF56B71816273318F650D97D7C6F8A
SHA-512:	01DD6B62B54362B34015D84862AEA3B5D03FD164249C7F16E797EA8A44E7991D4E0F127F3E5E6AA7772C1BE69F96ACD2B48B155FD983FA96039F63AD9057CD89
Malicious:	true
Preview:	...O...x\.j.lZJ...1......G..1...R..._0....K....\|......\|< "S.g}...V.E..8......c..././`.;..$.-..QZ. ..s!W...p...r.#.=...s4. p.d).\|Z.+..{(....p....>.R .t......&..q...........`U...N...4.._.G.!8...V.h.eE{.,......".....Q.U... X.qp..x.....G.S0.k6....r1.z.T..J...n.p...R.Ar.+.<H...2.<.......~D ..a..d.@.>.JMFpBt.q''...P.8...5.E)...ii.6.........:~.....g...p.Km[}.......4z.l.P%..._.e..f...s.....2.....r..{..-.)..c..@.3.n.6...g..;.....28...A2>..,.J....Ph`..p...@=.a.(.._92>(.f.4...........8...DF.Wy.V.]..P`.#.]p....oJ...Ugz....U.^2..H...r..dd.....V].......BD.....).="..^>.....L;@..o=..u.9.uG.z...dY...I......(aA...l@..}b.r..b.....U_b..J Y.4{...$...R..L.......X.N.j=...\.[p..\|..3N.E......$..6.U......!H.%)..6.L.Cn....F.B..+.......\.\'../...AP..9....+3N...l....9.,uq.Bi.P.f...dx..0q.z.=....I.xO..S....e......CYbm..E>LiE.....?..b....?$.k.l.A.&...(.Kk.B.g.R..-.&.8.8....g6f.....~a..A...g....j.L.U........p..a_U]...\|./U.;.j....n..hjh..4..JF.u..5Mi\|f..60..<...I...O(N.

C:\Program Files\Mozilla Firefox\application.ini

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1226
Entropy (8bit):	7.59406241417233
Encrypted:	false
SSDEEP:	24:eyUsV/xD/SM7etfqYNvXKEntHybfNcjbPOPaHxJkV+OtT05Ej1wZlZ6W:eOR/hhqXKETPOPaRJkV165g1wLZ6W
MD5:	4C9A67873385C836B015359E5C7FB8C4
SHA1:	98BDF784177A5D6B5221B115BB2973205E8581D0
SHA-256:	7D75E0D5EBF9312E4A702CB1E0A276DAD4984926F591FA647D218F806AB2B22B
SHA-512:	1BFE55BE4B26D5FD0640E43DFA2C15DCAAF54A0CB470F0A182807555305FF3A70BA59221DEB5EF05FDF0843984776CC5CC1F10F911F40DA2301710EAC1297130
Malicious:	false
Preview:	.].4.@#.Z.B8.'@..D.8/.%.2w.w..G._e@.:..pq..&.0.....k...+q.).\|...(t....A..u..3&...\|.1'.%3BY.jP...8.l6.3.yW....Ex..2t..Y.........y......A.h.K.....Ut.9..fF.g.t...K.c'.Y.!.\|\n..~....a..AX.....t... B...L...\|.....d.\Yt<../.r..f..j...S#...X..)].)r..uA..K...k...ax...F...O.b.z".,.@<...~_.+..jJkV.!n.~1.GK.s..v?Jv..^.l.......h...+(....tY...A...G........!;.Yr'.f.....R.^....../.....@C....O.D..D.H.bf..@..1.-....i:=..@Q$.b...P.;N......D..N.R-..T.......~]...........i.:.v.a...SF..q.n.~.!.16&.....4.9\.....0......[U...-.h....~!_6aF.e...~....d..c4j.[0<.B..".b......ta...=R}..w.S........=4..F}..%2...d.....p...lg\|P..S..;\T.R.<%...R.6V..'!\|K.T..@I...$.^.cX(..A.A.&.Z=0U.Mj...g7.s.$}..^'.....&....g..:W.n.......;.o...FJ...f..).~..I.u....0\1..en.\|y...73.{&..m......<d.y.L.U.....V..a@.... (..-.....a..bA..........O.g........]..`0...7...I..`\........X.NO.!.T...Mml......L.......].....\|Vb...+.K.^.}..Hv.S$..-.}yr.:..n7.gK.<.S...p....`..Q..d.[\|...S.P...XI$".4

C:\Program Files\Mozilla Firefox\browser\VisualElements\PrivateBrowsing_150.png

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	15991
Entropy (8bit):	7.974427387044927
Encrypted:	false
SSDEEP:	384:9w2M9EYWlAco1CGW+fbPNAbazCA+pkIMzapl4V9ei5qtNoT5wmtljD4:FEfWSyIhAbjA4kIMT9VK0t9k
MD5:	111BC4827EDEC887F6891252F48C0C4E
SHA1:	4E0707CBF23A32B3C44DC3B7D47409ADDDA0819A
SHA-256:	AEACE2C3B9214DF3989B415CD740483F39F2B21F602E38E3EC672C5110D60F65
SHA-512:	F1DC84F2F332EF54E3CEAF230FD182B4362982A6FCA94E10081DB4C60E94E325C6E746A59D0F481C741D6EAF41B7D290010082683241CE623B74BCE235896318
Malicious:	false
Preview:	Oy....\|&..1...Se1..0...^.p..X.._k..Z2.H.[.u.-q[......@KE.7,.ug.20.F...$..GX.P..>....).S..B'...(~..sX...{f...7rl$rx...=.....</.,.A..o.e.C......`........L.hW..6n.N...7N...H...m....!G.^=..2..l..........~F...e...W.@D.......0....S..!:.Z..$....^.`... .MW......S..@a...3.Z...hO..1...k..z...\|...K..Y.9....e..96U..=%,O..".i..p^..2 c..H'.cq.I.3...6.<....V.;...\.Y...LL.s..t.3e:2_z......@..P.a.0.....:K.4...#...n./..b....J.....'L..Vl.....r..:n.....m]..\|...$.....;..3{z.qJ.N..x,...V. U%N>..9. qG.,5.e.sJ.-.(....1...H.\|.3...0..R.......A.(.[.8M.......D........x.l..%...{."..i.....n7.I......cH6..G...Dn............?u...f.wl....<...Z,...g..g.%....j\..:.-. .:..T$......t.l...Fa.h...kf...G.\.W.....C.......5..,....w-KI.x..&S....:.w.._......Dp.I"%.}..<9y..%....^........?77..,.......Mg6.GQ.N"}.4.#&q..g.@..$......D.-.3J.#..E.S_yo.9T..A...b.........d.;...V.....U.>.....R....c.o.0.._..2...&.U]P.....>4..:........c......X..h.....J.pe.2L.@.T.E y....[....XQ[...zWJ...>...<.}..S..#)

C:\Program Files\Mozilla Firefox\browser\VisualElements\PrivateBrowsing_70.png

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	6079
Entropy (8bit):	7.9414542789895295
Encrypted:	false
SSDEEP:	96:T6oIKFxtKQ8ye5m+wLZlfx8tGC6MHf2b4LLaYDhjTDnCJPpNZVHlPAYYIxhnz:GSFxtTmwr+GC6MHf2sSYpDCJPzZB2VOz
MD5:	AF6080430CD63184772E7C7799EEBCD0
SHA1:	50EC2416A68719070D42656F895B4940F3F1B29D
SHA-256:	BDE2078A2E8E0E92846DD30CB3351B7F8A5D462EFF05E63CC1B30C8F04610586
SHA-512:	3049762F5B19E78CC465A4727BE8E24D13947E3E983AA4DE91C7E70FA3EF2369D69354169D5F6D6CCC3F8009EE6E4CBDB7411FC2F28EC91A136229FF052A9584
Malicious:	false
Preview:	...7B....6.[.S..1......b......k0.....k.L..O..TR<...j...\|.s..`.7y..A5.aX.W..0=.R.....-2G.A..W1D.G..@.PzU.($$....L....o..l\......dB...=..P ..54~...k.Jyb...QV....8.LX......%VU.\$J..$...;..#...v.....7.'(}.B....^........?i..h..y.&Lif..L....Z..;/]<.:X..G......#.E.m...0...x$.{dy;..y/.h..I"v.e{..Nn'K..o......=.+....y\|.....x[ ........4.....,!a....Tuw.&.].svt.....1&W.atN..p4y$.o.Q...nn...:.\q...Jh.....1Z...t"...21Z.=b...D..N.U<Pq>i........Y.....\.t.E=....'...=.Z.X.Hh...P...@..P....(!.p.%.....o....e!k..1k...@rQ..z8\!.NkP.........O7B{ .f%.[.41...?..&.x.z..k..B.S.jV..Z...x...e.....M.1 )si....X..U.......)..Q-;.c.E.G.G.V.w?..C.v[.ah..`..4....'.}..[..l[.gb..T.^..O.....,.=uvE..7=.i.....C.V.w...n..6.%.l.=[u.....BX.I>wd...G.....j....'..@3.......r....H.......}.KC.?.......\......T.....,...Y..g.E....\|....rP..\|..F`?uP.d.G+.]O.;..d..)uR.....sa1h.mo.....>q.....H..kGj...g&)j.I3.....,.q.@.#....=..q..,.Y......?..V....C(....s...@..v..A..X.X>.Z....j..]y@.....Y).....i~

C:\Program Files\Mozilla Firefox\browser\VisualElements\VisualElements_150.png

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	23364
Entropy (8bit):	7.9759604720300725
Encrypted:	false
SSDEEP:	384:MMrdwQUKIrZTjlz7OQ97TDxXGK4cxCnQaPJmL4bw8Xiv6p3wyAWLLXlCfQU3lv3H:MMrhUhTZOQ97TdjsJpcvCp3w2LLXhWRh
MD5:	BCBBAEC9C7F654E808B2F18F5894B982
SHA1:	5049C193F8E1FEB803CDAA505CA1EACF163AB59A
SHA-256:	312EBB792C39456D148BE091C92094FC2298AC50F75C6AA7CF1BC0D096950CE1
SHA-512:	45F5D3827A31AA8FF4EE5C05A0279C1B3509C9F435485610D0A23EAC1EB7C2A0C047CDDEE343951E7A3620C963CDE6271C655B23312AC265050A93974A265FCD
Malicious:	false
Preview:	=IFr..G.....A..Q....g...?.Q..G.d2t.;.e....i.-..h..i..n.R.Y.2......QT./.....J.S\.......U.-{R.(p@...5....,:..Ri.W..Q..........n.[....X,(....b..&....g......+Bp.f.i........R..%.J.......~....d.S..yd.u...\....[.cc.&F0@..:......}d.U2.....x......R.O..t..r....I...<' Q..p...b.../..d.I..`f.p......}.A0...7".....B<.1.M.AZ9!.....%......'\|f.J....l..mgY+......T.6...b...1p.u.H...).5.[..c.9.....KA.......%......QB(..}k.AS..pH..-y.i...j.W..?..>.\..e..i".Q6".D..l.y...I.1,./.q.v.5...d..........nR....._@.,...sp...~d..7.\|......5+...v.u.i.....?b.B.ZJeG..........N...,z......[].......t..<.%.....5h..2.i%n.Y>.][....<.......<j..b.D.......:.....b.Ux...mX\|a.....b. ..H....9.9..:V.>.^...=.P.u0.7......#C.8PN}s..G............7..x.e.DD...2.mNW>.r..(.`. ..$G..-..%....%.\.kM..^.a.T8........\G..R"....W.OU.Ju8@....`....!....(/.,5.-..1..>.l...5...vw....bV..f.(....@n...@....=e...}g.b<.uo..e....D."S.l..R4.v.CH<U....p.fY..H.JKn...Z6...<~.x..l.'..d.Q.%......75.\..*..).&B..D........

C:\Program Files\Mozilla Firefox\browser\VisualElements\VisualElements_70.png

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	9090
Entropy (8bit):	7.960598807215626
Encrypted:	false
SSDEEP:	192:0xY8qElpTwG1NnjjfhT+AdVat9EOhV9PFHYFtStTu:ck2TwG1Njj7Qtj9PF4H
MD5:	FB2460177BA72A4956EB43D972E64731
SHA1:	DA3EB1E9A0F70AC1BC9AC5044DFE1D9D72B8CA71
SHA-256:	698B5D1B530CD9D9EE1A1FF4413C918EFE28FDA8AADD37416DF30EE15A42FF31
SHA-512:	6F98A2B8548724B0FED294DF42B262DB68CF8C90E1C61B5501ABF490367A485C5851EA313B3287D51D7A7809B66B0B2D357A10A585F94BF5DF4B4FB29AFDD2A9
Malicious:	false
Preview:	.....V.V.O.=.=.j%.H)..4.....r[_....?.O...@..%..Pai..O.......~.X....\...Z.a.. .B5.....u.M...{.....8.P....t<...6....~3.......#yX..^/'}e...9K. '.%...8?B;)\.`A ..r.C.6.r..1R..r.Y1...=A.=....... .....I...IjcB..]...GnDe........I..2.R........?.u....Z.i.8........8..c.._$.........^...%....K0.<tv.xr....... ...U.......R...Q...5....'..:.....j..ZKC...{.H..^F..~c..q.(.9....p,.g.`...q.7..$.k.r......xg.<.?..Ord.y..../...L........\...SbQyW[.".J...c3.X8=.7.....dS.>.........>....(w....k.............. 7.X.;(e....v ...Wp....+..J..A....f.6D...;<DN..&..:U8...w...8..7X.C....Wz/.........m.Dv......h..f.).iS.....N...`.=+..oqH....-....w...!8j}FX..RL..M..N....l.....;tA........6.t>...b........]....+c.. `1...i.5.....m4ZR~..R.....P.FCpT,y..DM.C.&....0.E.I.j...i.. ......m+.......X..E2.t...m.y{.7%...H....W..D.oInMX.'........!.f...P......V.]..5.k.P....K..?Z}.=...N.b..].\......]2...b.B.\,..q.m.L..-o...$h......k.6....R{...$o.:kI1.;.T.}.........F.....v..f.

C:\Program Files\Mozilla Firefox\browser\VisualElements\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Mozilla Firefox\browser\crashreporter-override.ini

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1114
Entropy (8bit):	7.48912405960151
Encrypted:	false
SSDEEP:	24:XoIgGO7CyftjVdLc6Jbs6GHQcdEHahcOW:XhMJdV1cgbsR7d5cOW
MD5:	A85A630340B5F0DC5B20DB5F16EF4607
SHA1:	64FF92BBEE71B614597E666D2D4EE91DE4C673F6
SHA-256:	7DD3067940D9F259357567A7228D7D351B11E726377A13CAA9B7B727026F1B46
SHA-512:	5954C9070F8F9A625D48613159690D3932BFDCB98274FFF4A74BC6F6BFA434A6805AC58ADCC0519532AC66CA0602BFC7EA6EDE754D04B5FDAA768D0EF94B8CD6
Malicious:	false
Preview:	.....\H.#.+%..i+".....I..."0.._........6..%....L...Z6{.yQI..F.i."...o...R.Q/.@C...3?.....jk.5.)A..-..K.W.ccp.....%...5.O~.<...:...CD?...%2.....S.18....#_.U.H0...C.HRN.m..h..G..?BaI...).//t........h......[.4U.=.r.D0He<&.6....p...s\|.......9FT.{.../D..2.9#....)...."...\[K.PED...g..b.3'...h....CDB.VK.gb[by...sw@....,...5...(.G._..u?P..Y.~..)..O............<.lD...9.....i..Ox...t.?FZ..(F...mKI...r.C.ifYmU..l\|P.=....$.".4..T$[..?..S\|..Z.th.8..K..\7.vS...r....S...;.`...k=..jfr..d..X^....NC.u5Jx...i...Q..vt+.4..{U....0..O..'.R.._}.N..G)E.....b.KEA..H..^.........jR.\r.{1IK..St^_.]..&.C...n.#....1.l./m,.9.FnKu...Q....~.\.~'7..fg..zp;......&..Z;.P.iE .=...\.kaj)..(.+=.....tv.b..MmYl.`.FYUp..Q6t.6...e.......uj....c.D.n.r0....~..=....c..m..us a crash report.....Q....../......J... ..gT..23.....2.............../.\|..kZ.O..<....V.=.^g...4P.A...ck.T.d.:./...t:...\r9&I.s-6.S.~Y.j..$..........\..X...o+5.G] r...)FA&.=..%....\|f...O.@..+....5/y.b\|..5.._...q.......

C:\Program Files\Mozilla Firefox\browser\features\formautofill@mozilla.org.xpi

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	139229
Entropy (8bit):	6.289947684240531
Encrypted:	false
SSDEEP:	3072:rBdoXXeGE9cn/+sMULRb50aSf/AKgAkHZD:rfoXXelsMULRd0aSHAWkHZD
MD5:	2C62B28038129D8A5EE2155BEC550DC0
SHA1:	AAB404821AEEF69E15D920B8EFE9FE0A379A6C70
SHA-256:	AE091C4FD0F4DF0EC6C1E7F9BAEEC99549F7E3544D1165108091AEA4AE9B540D
SHA-512:	319F4A7FCCF1A62A10CB11B8EA65CEB389213702A912D90FCEF20A181A55F28E22DD87CA4B0A317EC0A62AF12EEF093C5A3CC59387B7AF6625B4736B66F8C907
Malicious:	false
Preview:	...[f.vD.C.C.HS..i.Mk....rU_..<XX.kS..M...s...!..L)b...@.S........W..t/)r.r.%..>...gb%.lO.^......f.)#..`.!c..&..N$?.-....o.'.. .-r..3...#.D...r<.$....[cL..X........z].d[.m.P.{.......P...mM.3%.g....2..:......N..h.~&2...P.\|O8X\|..~P..7....Q.... U=..vv.#X.g....KN/.V..ydj...".k.dY...GR...].GDY....K..J..PW}...r...>h;....8..-....._..7.....&........!.....4\| -.\|..l..'.r.Mm..F...z......`.dg.S...\nZ..c..\..FA.k....R.c...c.q.$I.T.e@/^9........."............i.Oz.8F....z.6.%.._.B....]..'..o.c.a.9...b...ir.:.h.[..9.....j&I..&&.D.X.sQ.[........^...z..r.mbt44..p...K........I9....h\R..:......c.WA......r.L.K...'m".$b.]).....K7.i...w.....p...;n.......;..'.q#~,.)}....ohXJ4:...D.B.'8..}...W%@........q..R..f...d.6qc..i.2.)..%iy..<....z0.m.....7[d....G.&`..L....Lp.. ...Q.x.6.... 3+..X....:lS.A.Ww.^.y.l=.Q..{.V....XV..>..V.1!..Y..pI...f....V{L.!\|..=...h.......-..tf...5........bf....=..#B..r.2......z........^...g.m.... 0`.2...6.k.PT.e..r...}.Vl^.'J.$..0....Rw..

C:\Program Files\Mozilla Firefox\browser\features\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Mozilla Firefox\browser\features\pictureinpicture@mozilla.org.xpi

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	62574
Entropy (8bit):	5.89519919497583
Encrypted:	false
SSDEEP:	768:K+PiFMHYYcnRzcnHyXaiGLWZRVPly0HYeeC+fkzZJi:KQYY8zcnHyqLWZRVPly54ZJi
MD5:	EDCAE3F487E92ED7D2587596286F97DC
SHA1:	9296E45758382686BED91E1694E9D410A8A8241C
SHA-256:	D6CE2258B73A6A579632E34EEC280F6BD5A926D659626223C7E99DDDFD7D1760
SHA-512:	F821D32A89D664C7B3414BD519E44C077704F0064651E7DCD1A8458C8557FD424A3E3ABD4ED35ECEF955D800621CF7F76F1B6C70365CE732DE622A49AF599FF7
Malicious:	false
Preview:	..m.........h.......Wv#.L..c.Q.p.=.p.+.D..x..Vx.d<]..km...U.H..,hR....n.....n....u.9'....k.6..n.;:h{n.."...!.o.[.g.z....8.2y.R....cv.=..`.+..0....P..N...HqKj.a.....E.m{.z<..a.......k7..q..+K..0..H.k..X.g`F...b.G.p..S!....G....LJ..lh...7v.~...!1=.......3u....VL...=...C..L..c..~S(@1.g....XH1.w...i..y.1&....[).._.w.C5...wt..WJ2.q_T~..!W."rCg;r..}.ft\....X....3.p...9.kb>..?.F.2..)....KX.U\|.,.t$..^i{_..f...F....2.....9k.......<.....(...l_..G...\7.:../...q<..X(.s..#.-.r.O.L.j....6Y.E....)G.6.@._..6......E.$X....(.......M..!4U.4..ZB......1...js.\.....Z....=..u..]...,..\|./..RI....C.. ....)U..';S..y..hk.)..`.........M..!.Y!n...P...hS......x.A...+."...!\|,S}.I.&..R../....Abd..........:..............&..Y....."._}V....}.......f..l...'A2uF].\n7...6.ww$.W..O{.a.._..`.....0+I%...^...?....KQ..z.@..j.lN...e?u.l^F..Q..+..#U"...G.}.dyKZ..R.Ue.x.*l.'...oP`W(\|O.7O....Tc..{\2..O~.B.)=t...~c.Pe.e.?YB.uI...P.{...Q...H...x....e.].C\.7vT.[B.&......~..."..'W.VU

C:\Program Files\Mozilla Firefox\browser\features\screenshots@mozilla.org.xpi

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	172596
Entropy (8bit):	5.62677597599525
Encrypted:	false
SSDEEP:	3072:Dnm5pVHrSNiHUF1n604iTjInOjksA2Lw1ZSrRjmFv65Pn0cZxTpq/6nDMj+hM7sk:TC2w+nbTjInBJ0tmFv6tnJxTpqSDMj+w
MD5:	8FFFFE99BF539F45C9E8871E2EE886BB
SHA1:	E4B8E1B3EE26EEE62457A01BC7C4440E220F5891
SHA-256:	1075F673D942C66C34FA341C291F6ED7088944CB74C6DD1869C51AFF183B8CA5
SHA-512:	EB6CC68E985E99C30AF402015B4604FE2024184DED441AE1C9DEF9AAFBE4FBF926AC3B8E0F9B1CC7521B37C8C401A196CA8389444B3993ACDBB5B604C9206236
Malicious:	false
Preview:	....ou.M....n..o_...r.m.......M.. G...S.e%.o.Nq.-^.G..+"..]..cP.6.......o... ...[U.!t...G..`.7...E.w.(./[_..I.......5.....8..)d...p.c...B.4.UFh.~..c.M=.O7Ci.yg..%.'.....{+..{.._..1.J0.~..7'._.&.........C...z../).i6..........`....u$U.,vf.!v.]T......'G.b.!.P_.b.i..q.5......[.f.(.....l.......T..m.....t-.Q..c@..>.....{S.d.B..{w....6%....Y...02~#.[F.!.{..DA.;.g.L....XR$3...\|..(.T+Xk8.C...J....7dS..;..D.V..",...../W...$b<..Fk\|.?.&..gw C....x..^V..........r.BVi.`.R.M........9.-..f..v.!..<R...'...U[....!..m0Q....1...5. 9.p....I).y....#.ep&..0...&.....b. ....Y....(...B.O....\|d....Y..?.....C.........+@..........g42........J.K)m...?..Bf..(.!."Q......kt......yb..S.Z.*..W#x..C.../..2A.`.xA.R!.ih.k&j....b....H.(.....4).....}.....bSrC.......N...k.v.....:.;<.o9.#..jnc..s..4.p..S.q.5..z..58^....].X.[.pv.+....T.;t....G..N+.q..]..0......u...........S.N~Q{PN@0T..[..f...........F.....F...au.a\.wk...&..!.D......r(.N...c..D.V.p6...D..A.$... ....L...._....A...

C:\Program Files\Mozilla Firefox\browser\features\webcompat-reporter@mozilla.org.xpi

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	31168
Entropy (8bit):	6.206503825850739
Encrypted:	false
SSDEEP:	384:lqLKGCpD2OPhQ73caGheYmhIBvz4JBXMMr0NN8jSO8sFsCW1PBrk/rZcZtjOC0Yn:ULjCV2OcJnIehaGe/jOCrV0u2AY1Qx
MD5:	9231830111D46FAB1727300C25E02088
SHA1:	0321C5BF05C2233138C4B4C90F5F8720509C81D6
SHA-256:	79B492DE9A25264304C217B353EA813086AF7901C705FCE537429E78D9D74233
SHA-512:	C9A0F3562472DF187A49CE1CA12473E2D39F4C9E497410FE2EA57F7489A60E2FC901B3FF8AD1F758D8F41AC7DBCA13C90E5C5A9D2926E8E67E1E49CD13F2F129
Malicious:	false
Preview:	....e.....G..0.idc...?.E.?)`\|@..d6.../.......S..I.....c0W..I.D."4.OmR...aR.I...!W..SN[]..C..!.'28-M6.D...?..0.B..x.[.lO..W.M.....w.......f....U.2I.s.s.J8..5.5..........v....@A.3.y..u.h........Sx.y...~......p...X.n. .......\..-........Pc.K..6iX..L9.j2..n.@.3.A...Rd..O.?T....;.`C..T.%..#.D...M.."w.FS.%.g.gf0..Y... ....Iz...o.....!.e...F....Q....h..u.{.~.l},.B..R..H...CFA...\5....d.a.E.$K.....p....CN.\....`.M...0.H4...".=K.uL.].\..q%._......?:\\|K....TQ.v.Q%;S.f. .R..t.\|...gn)...d......]...-}..I.b..XH=........%.f..uXH......1..&#;..^E.n&.^.Q.~e6$3..DW..L.M.....6...S..aL.OL.A....Go..."T..{.7....N~<.D..?.R..wR..Kh...Y.8..o..}F..tm.....R.....~.@sB...q.....`W.....}..=...@....I..rq...Z.qN.o^..s.._...}.]..=y>.f..q...q.-d.'X.....xj7>.i..f.p...kS..c.U..!.^..J....#....I.Dkm..i.a.........m.vG.j...\|q...3H......).h.].x.......)..P.M..k..M.....{...:3.`5....Y.T_F.)ehv..~.t.O..........D...Bd{....W....v.+R...../ZR....8.O.,.+...6.).....2.N."n.......d.=&.k

C:\Program Files\Mozilla Firefox\browser\features\webcompat@mozilla.org.xpi

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	424267
Entropy (8bit):	5.72856938794186
Encrypted:	false
SSDEEP:	6144:73t/h9EiLZjasqHoxTZKFtnHtyO68BYDLwO:73ldytNyzuGLwO
MD5:	C5D2B78069E673123CC140DA328D4F8C
SHA1:	912E3294F5EA347E36072A05C538A83131FAFCC7
SHA-256:	A13C18CCBF5672E796BC0849EF28D90E664D3B3F4C03246B402D7D862BC30B3C
SHA-512:	E6D0933227E345187FD192FF9FFF624A157B30701AC14E4F181C832E377068902F4E5DF22F243613E432EFA74677074ECF00621F76DAEC77ED33E44596E51611
Malicious:	false
Preview:	.....2..zs.G....0.nx..X.O...#W...Y....8.ro.L1..L.S.k...x$-..e..e....Y.o.s%.T9....^u.U.(7b..QL...\......,......M.[...>...$G.-.E....2.m.C:.}..(.......A...V9...h..FT.......+.f.FU..<...~...h.....I..O.IU....+.. .Z..&.{;...........U.?....F').....(&:.3.n..+g...P7.....b..b.vfo..@#...v...4#.J.....f..V.M.....x.h...A..y./..SNX...~aW.^..P(.T....c..CA{.0.^....L.=R..4...V9@M..RX..-.xNd.-l..\I...I..9.. .K-`6..)....d.wE..2[v.O.%.hU.X...3.m......LY.>..(.[2%.^t.....{O<m.A..1..X.hM.."\|.h..bl..#0D...f...u`...[......z@.J.....~fq.L..........+.w.Y.IG...Q..w..... <...V.....o..:".}.C......d9..... r....g....!../.M.B...(?...I<X&...Z..p..L8..Y..0/....I...n.QPS....<.........l_".>.7z."vG.`....R:...N...g>."ue..?...$uS.`.j<L.>..n...N..l.V.X3u.....~....,2.z..}D$..Z..C.'9.'#,`..K.^)........q...y=..4L... .Q].L....bg.....*....O..l...j...S#..FJ9^.....d.$.<+B...xf....8Z}...T.......Q.t..\D..+aL}.%.H.F.y.:&..;....b.SD%....A.B.lo"<.k.g...?........f\|:~I..tRu=S^#Z

C:\Program Files\Mozilla Firefox\browser\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Mozilla Firefox\browser\omni.ja

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	42504995
Entropy (8bit):	5.850812081412324
Encrypted:	false
SSDEEP:	196608:CKIoxrMCRr4b3NH2g7DK0YOYrZ3E8wr4w:e1v3NHdWNF3Eb4w
MD5:	6D32C0291D47C566797E08A66528A242
SHA1:	8878E6878FB49E6F1918E8BB0A21927CF24705FD
SHA-256:	2987EE16F461E723E9DA6F365628CB2BE195615B79F049C9284D2F169705F7BD
SHA-512:	B4B95AEE7BDAB76DFFAE5B5998B10B7C22EC97E5371AB019C68426EAA0E50C42C20AEDB639904503D78CA9E304E1DF16856551C969C1F1D2CE6AFC7B7116B0E9
Malicious:	false
Preview:	b[6..y...P........5..L...P#(.....\|.w..(...H.iy.\|SY{.n..........v. ....TN....Vf.(2.....-..'D....-.J.la+A.!...+....+..c...S...3...;ch..v[.0......].Q.N....{^>...qb.'.lxy.H-N;Do....d...B..../..^c...x<.Z8F...s/.z..)Fi.j..K.....@N.c%..$.i..ew........J...X.AM..e."..a.$..fN.'...cC{.S.j.B.\|+...)%..4.....^...;......+q......+.. .]...FN..A.Y...I.S0vM%;.....,...`.,..u*.r;.GY].)...q......j.."W.GI.]p??k..Z.uC:...Ky.OH...&..>\.tZ.'b..?.....uu\|..U..9.S..i..).b[UK..t..{]."..yQ..p....#./..mI.....u.W.....x....;..e.3...t..PR.o{b.._.. ..Bdm....P..w.3....@...T...R@..S.]...R....7..E..?L7.7..D/.3]....(l.^.'j.j...F_....N....$..4...GK..M..q...~.\f......v...o.f..=...b..V4B....X>...Ka..jo....5c...#P...V. .R.....9......3c:...{.M...u'.1.kb.9.....8...A..v.....$.!Z.'.A.....8..O?f.!{.lM...5...).....G..`q...`...-w..&.r.Y..N.......[......".x..B.....C..FBM.>./.Q...,.n.@...(w@...3.T.o,J...d.;=......]B.U)'.h1...<..).K...,jB.Z?.:..D..%>W.Z.t....1aa...e.fN..u.{.%H2O....B..

C:\Program Files\Mozilla Firefox\crashreporter.exe

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	259815
Entropy (8bit):	6.633352085828863
Encrypted:	false
SSDEEP:	6144:oGpzBcP4oh3nzKUCsBIGMvvy8lsvRX/PKOyu+:uPlRWwmfOqi+
MD5:	42722C7175A155014C6E467881838F1C
SHA1:	A7DE822F6BEDDC4372BE8A89E030E8D47B5E1339
SHA-256:	309A9FC31E83DB242D66597F38D56495E96570F8689220D19B096436E3C47554
SHA-512:	71085CBD6E9D23C72C4F387D389B7EBBDE6A92C786BB2CCB3E15B86BB66F2DCBF740416794D26C28B52D227DC6DC253A5172EF9F4898C58AC41167DB443ABF20
Malicious:	true
Preview:	.....D0s.........GU.v.JV..t.Ns.$..._..;5u>^J9N...~..,.....IX;.....S..LZ.f....t......Y_j...@.a...Y..aNp.......;...l}I....,d.<.:..m.\|.".$k....J.U.#.......R..M>_....J....&\.......:...v.I...J7I...........D.`Is..z&....I..5..c]....'........}.,....l'wt.<.b_...A%.!.....ly.lrA..>..1.m.r......)....x.y.y....LA.....gW.......O.....dA_..b....."o.k.....).o.....@.8#w..v.c.5..;RV(.)->^.I.+.... ..lQ+.y. y...lo..q,..........X..a..a.....{...`...\|9..>.1...%. ..!......(..Use.).w\|.Q($..{...B.I>........?a.$.86...k.Yq.h).Q..............{pC..u..q..3...>.bV.=}.]...'.....i.l6.31)......A..+D..........P.v%A.)+Zz;..e....V...l.....;.=y.D..=.H.95...[....+.\|..<.ze...^.a.N..Z....ko{.y..$....Q.8.&.5...V'&...!q:.e.@.d..X.?..Qy1W....od....D.z....Z...W..DM..!..TM.p..z...B.Z4......3...Z>\|`..*Dp..44?-........U6.y.U..(....&;......O...T.1..jEB.......R>............>~M.:...~A(.4&..;.6..P._..:...r.jA...n.#:...G....7.....d#a..........Q..#e.W..,.u0 .c..T...5...O...\|...B..x..Y..

C:\Program Files\Mozilla Firefox\crashreporter.ini

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	DOS executable (COM, 0x8C-variant)
Category:	dropped
Size (bytes):	4229
Entropy (8bit):	7.91210299173877
Encrypted:	false
SSDEEP:	96:jZM0y7gktSSND7UspJ0xqhbWlt71MMIABZNUYmOahsYcyXIW:jZFWgOSSJ7pj0Ss83AfWYmO6vXp
MD5:	9C21900AF980251F98696A3A5BB18A71
SHA1:	7E7475CCA97155182071E98BD04146D3D105811B
SHA-256:	2939746864F941397C872C8E9DDA2475F39EBC9680D82FFC5EF2D061427071F3
SHA-512:	E16799713A57902782B1E388125ABDFE378785DBB00BFB2774B1DC7E4B687D0F0898E53C84CBEA61C7E5C22C71B931D325C4955DB631870478780E8E75140ED5
Malicious:	false
Preview:	.'g.a..`W;..Z7...p..t.e.....8...5..{...R...Q+.vD{<.".)n.....w..iy.F.......aL...1....o..E.E~.s..f.5...h.....q..UR....M.S....[.#.y._.E..z...i..{..R.<e.......f.E.....k.F...OZ.D-t.......k..F?}0............k.vn_.i.K.hv._....-x.s(.V.yBZ....X...)GD...\..A.^..bo.F.x.(j..np...+G.z.q...3..X....lI...S.I0@......Z..I.L...`.XWo8{=m.....M...u..,.......W5X..D{....S..V}I..:I..:xXco!.. ...a...I.P.+vv.e.Y.d...~~.V..Pyg.}...+.-..........e...B$.<.....Q...<.;.N2v...^{..N8._k....,..&8\.rO..}..i...~s.9em..z.,..{...l.I\|......a.c..s...".m...I..^2e.s....a.P...i\|.;..!.1..........AV._N.1y.F+..S&.e...^.4.1'..G&..1....%.....{V.O...!.2.....W.t.E.TIz......y ....q...{.D........N.........p..@.\/....Z..C.?..S..R...I..1..}.wwz../..a.+6.:6......./6..Ob...v0.)H.s.E..A.1k\|.uR@.pw.f.....0...(..q........3..=<C...X7..x......4.&.....F.....3z.0....z.q\@.v....71....i....v.Y....n.@........l...!$....w.%U...).8.Z...k\.j..h./[YDt@.A.tW....'q...C..>........+.5..N.Z,..N.z...m...^...&A.....m...

C:\Program Files\Mozilla Firefox\default-browser-agent.exe

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	718055
Entropy (8bit):	6.4985735621948635
Encrypted:	false
SSDEEP:	12288:qUFzzHE88TLLwQzkGwj20B1P0zx46Xhvf+vT+IiSa6AGN:zULLwQGSl46XdfA+I1AGN
MD5:	D891842929BA0E7CD424C8DF7E17ADE1
SHA1:	881E61AA40556AB0C9447B0978A2DE3DD33A1E82
SHA-256:	C246F2CB1EE82F0960DBFC4D531AF47649261DB77E6F76C72C3EF41536EC1144
SHA-512:	A56FA074F1230F70AEBA1E02960E8850472D35DE140253DF0CF1A48227BA33E63E60F907E4E208576FD8A29DBB2AF56CB6BD4EE6DC5BC478CC20D34669753226
Malicious:	true
Preview:	..,m0aI(Jp..z.Z......wd.......W...G..B.....u.....WO...=...3g6....-3.Ny....(a...i..~..Y.....e....H...._..C..s..b~X.8[.....yA...t......C}..jdS...@y"nxX4.%..U.....:4;'.g....].?.X.....+.F)....j...\.^q.].PCc.i...1.-..h...((P.........k......~.X..b..nR..d..-X6j9.2y.v..P.Y...>.&$..E.._.. .....I..}...xi./.A...........3.n.b(......=H.G.F......... Pt..HK.')...w.=...IeD..C.~.g.M.i)2.h..(.>.1/..`...Jc&...A...L.W..m...x........gN....O......2.-9.^3-t......K...}..^VP.0.1>....4O..._b..=.\|....~.[..7..e.L!.....dQ.M.~#..........4...d....W...".j.C.{.}...6..9..SFY...(.p......NI..&G.1e.....z.)...3.a.x...2.18.\=zf..L.0..N73.-[#.ypk/.c.....l.l.k.e ...@&.........b.yq=i.VP...T..W`....o}pMHp......."$3%.T.=S.......5-........w.j~..ZX....e....\|.o.C..`.0yR.q.o. K..%....J.[....1'.....N>.b..W...........7.pB.Eg...A...p`K.oJ......8E.O.....3..d..?.:5.M].H..3........F.:.c..\|1..;...W.=/..M.-.M.+aEC..}.Ms31"...WX.O..U.D....En..K..J.[.:Zi...v.............J...g.`..=-.`A>'f....;..J./@

C:\Program Files\Mozilla Firefox\defaultagent.ini

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1259
Entropy (8bit):	7.553583736911489
Encrypted:	false
SSDEEP:	24:+yvd3Bp/LOwMXjOlByxs6ySv7jcR+c5YvhVd1DSr7/GbuCPTgg8WeWIXJEYp/gtJ:+MRp/ywcGBgbySvPmEvd1+r7xKEQJeJI
MD5:	EF037A360613E8382C54EC29E200E2BC
SHA1:	A74443010F731B6471B1C2D23A823A7301144E24
SHA-256:	7CEB12CBC9D50A8B6682B429D81F2E1A0C086FFCEEF35DCE7349AA69FEB405A6
SHA-512:	0E04DC46031F4FEDCAB7328FCFF4717B6CAF4D42508FAB606D3DA08A423BD66E51DD5BD2227FFBE8103336101B384CCC79ED4AA7EEB99721C1FD6F2D496ED313
Malicious:	false
Preview:	,..>1.O.<=l})..er..~0.!.AX.1.4....c.y3S..grG... ..U..~v.a).~I6sW..S.~.t.0{.a.g.(....J.FC.......;(......Z..C.E.K.7~......aS:..TvI.x--eT....T.\....+.@.{..K.]`.%9Z5h..>y:C..Cs.%..KU......[./....M.e.....SR..a9..8...>...Y...'9.kh..s%^....E.9#)0.B.,.@:.#......5.]p\...~.L.+..z2.-..^..IcxN....E.&Tb...:...........h....0.. ...r.$&>..d...(..q.E[.....e,...W9Xv.)T&6jLhy..8....V...m5..4...N....Q....A.7b..L.j~G.s.AY./.&f..bb.....).....@.....`..u...IR....5.{..[....9....g..%;(..F..1v_.6..$.:......N....qS.....6..9.90......R.S.'.."A..N.}.....g^..$..._.........}......G...L..}.Dv..V..q.."..Zj.-a...?..6&.....qh..;...A.......P...w.Ys..UV8-S.....Y.Z.K.7.#.H..._....'g..7}...cK..s.)...Q.%&k..$]ry..b.........4..-.7..i/.....W29eIV.rc]r?....>.+..-.u.9.o.......m....IB"......~-...........'p.B.+dBo.W{h=g.a...<^....A.GU..I-........(...6...$9.+..j....6.~L...s.#2A..Fz.'+p..U.z;...sualElements/VisualElements_150.png...W./.}.....*.&.#...-:2....u.J@o.f.m......Re.`.C_..:.>ykb.C<...`zb.

C:\Program Files\Mozilla Firefox\defaultagent_localized.ini

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1357
Entropy (8bit):	7.627259008835375
Encrypted:	false
SSDEEP:	24:U61D13dwzYC3fgUNg0xuVTj6AO2ZkXlhqawb+lQFeZV5bGfY0MOHW:ZF1tIYC3Ngi8f6AgXlhbgeZOfYoHW
MD5:	FED339919B0F091B95078A2777776B12
SHA1:	DBC23BC8C10368074F72DA7D91EB1055F3D5B334
SHA-256:	F7E77D3C7C26E278850F23E6012C66F70B59352848F6D8E536BBA0D18374E866
SHA-512:	A4C03CFC347D3674D20A3426D6BB985405B2EDCBCA97F138CF59976FA35F6D796EC36901C9D61E2A31AF2D1C784D1EA5915B083348A826C794B4A6CBD3AD2B7D
Malicious:	false
Preview:	.oem.(.....Fk.f.7.............\..i.9...K>...[..dd..w}.w,.....k..c....Q..._O.q.mx.=t..&\[n./3..CT..K..Pr...:3.....X....o..>........X].h.3..v.4...,j....(.........).LOkZ3....4q..4.G..fb.!8....4.<?2.P...y..U.g........O..0+....TT0-3...]o..c..}7...s........J..jJd..P.M>.e....v{.Sn..1,..F../.m..Y..1..>..r<T#.;<o..I....,..Se[....P....$j.=......9l..Q..\|...S=..MO...h....HT.`..3)j.Gh5.q#..G;...K..X......n.........V..6.../....IC..~g"kGw....I_.l..}......$:.U..b..LN...%.l...9"...6.t:..b.B.Q...&....kz......E...8%.dZ...)..Jo...u..x..P$..^...h.......@......%3Q...tY...N...>E...l..L{.q.i.s....X ...Pl%K........=..e..#&l.6.k.=...9..B%e...k...C(.....(.I.w..'5.s..S9.{..31..;$....z.BZH...0.....y2......3.7t....Y}...)n..X....@....#.=.3....../......N....nA..Nl..Y.i.\.6..>.0........[$!.....`.N..7<V...>g.pGM.....5.H..p......5....S....Q..J.E..L@...n..:.(.".N..J.Ue..b....S.)x.1.. ..v....G.J...._.(.4Z..2..(....g........o...".?n..f.K..r.....a..}.zi.i..f.O..Pt.4.....i."

C:\Program Files\Mozilla Firefox\defaults\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Mozilla Firefox\defaults\pref\channel-prefs.js

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	756
Entropy (8bit):	7.142337269800248
Encrypted:	false
SSDEEP:	12:vDox+6Q6f7MK/EypnXnWoIBAzDfpSXVG4mnU64ZFYUigjE6acYjhW:vM5Q6h8U3W1BGxSX4NzUiEcVW
MD5:	F7B870454C5FD17F115B5B04BF3D585A
SHA1:	BB9D893B4281FBD50D3D6F08BB4F80636F7F5B49
SHA-256:	E11A7C683FC3739FA8B0283DEDB40FEA60AE08E94254AD7DF1FF072CE16A4E5D
SHA-512:	E954F61777EAD54D511962C73A0BC19193AA6E1615949CF48B98BE02DA2AEBFD78D907A2A45B28D9F27D588F37C517CD0AC010ADA15CFACDE1EAC2190DCD531A
Malicious:	false
Preview:	N..Fl..{N.i....$..5.#u.Kn..B)..q.c.;........s.g.Iq....H..>u.jK.r.....7.`-.]K.N....A.F..cE.Q7L.1.2G"7.MX.%=......8..U6...qcPb....GJ.QHk...z..n..ir[Mn...(.;;...F.8..0K.b-Z.k'.D.PI...X..>4S..O.S.v9..N._..v...d..K...6lZ.C...B...'....3i..h.r......(.....BL...~.....2..q.//..9.J..y....#t`....{.^..Yn~..m...b"c]/.~G....(0T.).@... ;.H...4\G.V.:.(.-C...5..2Aw...\|..b.C.1...ile...pref("app.update.channel", "release");...s,R.A.i%8t. ......5.I..-{.vI...}__#.\.....U..A..C*J/...,.....w..P!..4.sN:H.3........N....X$Kl."~J.....T.H.c........&....."\|..2gMRW.t....m.}....../..g.M....C.p.{L.}...y..'l.`aC..T.c...S..[Y.m........................................................................................................Y@....czyzk0zzhil.

C:\Program Files\Mozilla Firefox\defaults\pref\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Mozilla Firefox\dependentlibs.list

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	431
Entropy (8bit):	6.215548647925771
Encrypted:	false
SSDEEP:	6:KglKnXKM/q/1q1zSbcVGFOhWfXdI7NgS/PQecrnbNb9n5uwHW:5lah/i1qJZGY8+NAecrDnc8W
MD5:	E7E5352CB4C5D2BE18D87FC0801AD79E
SHA1:	45E683C5A4F9B4F2AB489762ED46DF6ED323317E
SHA-256:	FD369FBAA8D1481C7A59681F3E83B69FBAE2A4C4823392F44CD9444020AB4295
SHA-512:	A394C6811DFFC5F83E4BFA884A059DE307BDE0902EAC0E9513C3D3979E5C636CFE12C76B6220665611B9B34E29F3D0A16CB3B00828FD1202C509AF759D43007A
Malicious:	false
Preview:	.a..(`7........"v...3_.O..w....:..k.....H..c.l.)z...bv.@b...1.dll.msvcp140.dll.lgpllibs.dll.xul.dll....Md4..-Z'.j.$...h...k...,.c(.P.8f....%.V..o..+R..&DE.1...y....z.+.u.+Qle....F@0..uSe.U\'..mM.I.'.W&.&....7QLw.=......Y...d.((..x9..+.. .ps..^..:..Wg+X.4.........H<'.D0...R..=...#.G.M:J.>....p..i....a....................................................................................@...............Y@....czyzk0zzhil.

C:\Program Files\Mozilla Firefox\firefox.VisualElementsManifest.xml

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	7.316061323513971
Encrypted:	false
SSDEEP:	12:lnAzW8ETaHpHtEX1OY1PZ7lgcDscbOfsVHliPabF8PgWvxtnxw42C+VW:lnLTTaHp+XfRhDlDFiJrnxw42CKW
MD5:	44D6EB256A8345B0B6F8746AA00DCB2D
SHA1:	891FFA72EFF39DFE4A40993117A9D260A3469115
SHA-256:	CA804E09A04E5BCD2AAB91DE3403CE50B1740A437E3A8A0D13FDCD7D9D039A8A
SHA-512:	E0D4DCD9BA6DFF109E89383EB6D94BC229D408AA3508E574C00F4B8DE34F4F7913585ABC8F8A84C84A91870545289D6A04B839A00C0A463E5A10F2F2650E5DF2
Malicious:	false
Preview:	..q..5'b".c..\.>.........47.8..X..+...i.....Ee...Z[..}...2I.K.`.HI.ny}.N.....H.i`.2\|....4.;gl9#l.s..C....mw.+.~1.d0......x6...&".._.YRj..[.......xH...Vj;.._.l.,.%"..Z.aFS....cf.r...m a..Vk.r.7..T.H.b..I.]..............^c.<...a..Si,...w/.C.D.-n.2...d.N.....=:.'...n..6...!}]K.s.B8Yc...U..x.~Q.z.V.m.~.W.!r..k..r.....j@7..w..?....}..V.S.<k#.^.a2.~jR.....'.d..P\|8("...f .....b(.SLC.@......@.....2.up..eO.u.0./...iF.q.N..w>\|......o.w1.V.......5"^.~....Z..[.....g.L5.......#..Wl.m..X..iQ.B}. BackgroundColor='#20123a'/>.</Application>....v..:..8h.9^.C........+ ....#H=\|....O....JZ..h}.'...npx.uW@.....]..586...a.u.y.2s......6".q..0r....5......_8.D..C..k.z.:h.....{./o...Dk.$.".j....O.<...EWN%R.....1hWZ.+...........".b.d9k..wTu.>B*....................................................................................................Y@....czyzk0zzhil.

C:\Program Files\Mozilla Firefox\firefox.exe

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	677095
Entropy (8bit):	7.029847255656296
Encrypted:	false
SSDEEP:	12288:IuD4wPpgk6EenAKGYcPwyPwmH5gFgJZPgIYuNMvWpfLQrUrMzJfx:Ig5PVcAXYcP9v5IgPP5ZNMv+crUgZx
MD5:	57E0B3379DBCABE744C8CD8BF905812A
SHA1:	B6B22CF13B1446969C986E81FAE97A94A71A38D5
SHA-256:	901703A9F97754F55D42999E3B3DDEB752D59BB00D1BEAA0AFB244ECC17B8204
SHA-512:	300321938C2D8ECCC269D495A7F3A96A777777B56914FF6696ABC9CA7E9E5B4739AB9B9797A48623AD540A4730F0AE0F2A8A6211D6C1D5AA7937E094917F7A79
Malicious:	true
Preview:	..HMn.!o......Q...@.".~.p.I....TI..Z........0.d-..H.D.."x.......3.C...RD.&W8....!~.X.@.4d...V..R..C+.".eX.....Dzt.n..t..<.n}....cOgN.V.(...)........P}...#...{.}.....,\|X.).......o....A.._MUn.\z.y....=.E.e({.#D.r@.x...EMh.b.x.....I....O@..........UN...6.E.d.O.<..c...Y....a+....3)../..{I......< +kc..`..f...8....3.D.%..2..,O`.j..U.......":V?.Y....5...zK.p^..{&.......Qp...%..........VA!D.DayIAL......uO...........R.(..".y...z...:@g.-mh.Y..U..P.1.....r...%...UHL.b.........g.X.o...i@..S.V`.'.;....=7(... Z...`......l8l. --Y.t..,...s..".z.8.w..XF0o....,..#..f._.Q...f.N....3..W(\|..z>.KU@d.8J7..t+...i......F...^l..V..:../.......$.Y%.y_..1.....qU..6.<..Ed.?.'g...n..UXI9oA....._.r.)..@....sB.w.......~........ .Wo..ldr.t....f...L.}....Tr2..R<.#.R0.Y.k[.Z'(:.=....\|....'9[.f._^.%........E..R...wR.:.nR;}...Z1V.U....JN.#.Zt.B;./..x........g.2?e..1Q.Z....J...._.p...$.y..2?cX.l/...Eh..m.u5.NNo.:#.".j...L7.J....D)vZL....t.G>2......z....!...!s}\.....

C:\Program Files\Mozilla Firefox\firefox.exe.sig

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1776
Entropy (8bit):	7.725676465680909
Encrypted:	false
SSDEEP:	24:XIqKFNKavZcmolIepd0pcW+4rBQ4/OT1MI2e0csFgDxxxntk+Q27T8W73GtEsA5F:2NKYEdx4KCGMbcs+xxjdGtEUKVFh57uW
MD5:	55567E87B2B0D591AAEAA5AA912C51FB
SHA1:	8A255A9C6340C551CE7FA2372E871E6B1557443F
SHA-256:	F71C89B4C2E489E5CCBC877F82531C0A3548616BFEC966A83BD1922E70ECD78A
SHA-512:	4F0715532BA4B74F737481043EC63EAE2DA6E5092AA5950240449317B46E567A7E035E9D5A1F8614F67A8AD8C26F427156C66A4FB8BDA40BE98E6B99784B959A
Malicious:	false
Preview:	k=C..M..V..%.].K.&S."....R..;......vt...\...B....p.[...6.w.t...w.0.......Z..H..e~Y...c.`..C..<n9V/....\|..B+r....A8...k...K.:.z.MzE.).....J_..Y...I.u..Fl.?.TzD....6....R;../i......!..L...R....+@p=8..N.H..u..?.W.Sa...Q/......<....].g.y....'...<...=P.d....3H.f.+.\...........T5..j.sh..{\..g...W..?n~h@...3..;..t\.~Dg......A(D...jX..E..j9h...t6..U].21R.......t..?.........F5n..r.L..(......7....}t...,...F...Y=..../Wb.s.T... \|"..@.^.. S.F.fP].......v.gZ......T...b4..>.!b.YD..3..,.....V...X@.9.B.M<'...wPy....@..b..3F..#.J..n]..uw"...[}.#.....2..G.&.`.....ZjN.ft..Fn.Pi. .....&....-....c...(D)o...+=..I..<.kF..X.Xm.l!e:.;.........T..@.xXG...8.....B4.3.._.;X.-G'...2.Cl ........;.D..{...b.w^d.2.. ).....o. ...OO....`...\..;...m%...@..+.......7.....T/.....i..~..I>.v..*.........Xt.....MJ..`..p..0...cH5c......h..Q..P}...........z..4.CZ`.A..5.v......U...@..9.U.6..?.1...@t.......@.U...........y........4."0.<..$7s.G..J.Y......+.BBp.u.>..f-[.6%.....~.w._ .

C:\Program Files\Mozilla Firefox\fonts\TwemojiMozilla.ttf

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1474611
Entropy (8bit):	6.655836930581603
Encrypted:	false
SSDEEP:	24576:yCvykT9ryWFBpdj2xWyheSplKN2MB0B08n20vtNqI6lM39M/U9ObnkBA0efAXd6o:DpkYRSbLxQM39UTU
MD5:	DEE408DB6A08176DF90A21020A64A687
SHA1:	A119F32733E9504CE2FC2098F779CBC7DBD316F2
SHA-256:	D8D3B701088CF0D7012606395E0ED0FEECA4FFB4418E41FDF1C8A0ABFEA71825
SHA-512:	E7C8A8B9F352F81A3FD1BC8889CB1FBA25FEABD9568B48F9EBAFF98B8FFFEC8D399A1DE3F6BFABD993814BED4C899B229D367A5D72F2F816DC8BDF4D4AAAB9D9
Malicious:	false
Preview:	.8YwmJ.).].....d..G{..I....Q.%b...@U.......<=:.B...A...I..'..2...aU.`e.Mo....tD..c.....x..3...O.8[.!..U..6F.p"..uT..y!..V.3.1.z.^7.......C.7.4T.\.i..1.%..;..Sz...9....0<%{.&.i....].86z..-.%....\|..O......<......?.....BS._G..\.._.6....H......\|..V..&.1....z>zBD...q+n..;.}...R..V}..J....s..3...~s)`..ZE.Kr......./X..%..cp;....o,s....}...k.pXG+=R7$.Y.$LV&.U+.P...!......g....t3.vwN$._.x.....0.:........8..k4j.$....5\|L.T..0V.OF.w..1.4..~a.....\|....>. .k/...ed..>J.b.is.....).op.$.r Ox.^.-.A4..g..Z....S5..-..[WOl..?.....z$.%/3 ?P.q.U3xe....2\|.%f....z..k..T......O..0.............e,5.#'.i@..$...... R........{`in.r.4R.p..-a...T_N.)]:6..........h..hv....GLF.....b.SqtD".>.t.......;.P...8j......zc......H.t...gJn.....s.WyD.zO...1j...>.1..-m4Ku.\..H..`....Ab..4.d..0....h...s.z.l.........v..nI."...<...g..Y4.hf..P.f..XE..d+...v/....X...7?.e@..b....m.....#.g15.;.Z..K..tj`.......N..cA#..zIdt..'.......- .'....p.O..Sv..fn.....O.....{.V....ni5...5.=[..\|.....MN...}p..

C:\Program Files\Mozilla Firefox\fonts\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Mozilla Firefox\freebl3.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	805607
Entropy (8bit):	6.826791828092713
Encrypted:	false
SSDEEP:	12288:ZDk3sW6QSiCvE/185aeZpmeXVlzezSiqT3VjOKqa3UOE:Zw3s+ClIeZpmeXVlz0Siqr5O2UOE
MD5:	B7CFBB89F0E3C28CD16136063A7D5E0D
SHA1:	EBEBAFDC653B30BC40E2606E48C7D8FB48E560DD
SHA-256:	BFBE4EC75460DF0D7070DF0B281174AEB01980C3B26FE680EE6270A14A65A4DC
SHA-512:	B8F621A9779FFFBC86359F7241BF450D6A0E6E921539F0ED30E9386B4405A2FF221771E8E6AA9277E5ADC4FF7B1D30542164A616084228F3251B6755891DE275
Malicious:	true
Preview:	.8......HD]w'...D&.4.E.......2...ydY-`.....$..aw...,x#o...).......Ld..).2.._9(.T%.,........8.V..3.)Y.y...D .&f[....A%...=.............._\....L....t..B....(._R..h;..;..4.O......M@.uh.....LR.S.. K!J.-.0..=A...D..=sr.l..."\|.....f'.lf..=...U...I6.z$).Z..1bq..~~m.5...$.......{.9...W0Qx.Y.....s.#.....Q......3d.h....B..$`0.?....>\|p..hah...(6r...^J...2..U..h...o.4.8.J.V.w-.C.R.'+ s..Kk.#_x..;........hm...{....".....I ..5m.~:.n.PO].F.=B/&+9.4Mw....im....g.f. ....O..F.......y....y.T[.&...I...'!.f.E..G...`..~..xe.....Hwa....F...Q.,...Bx......g.e.....L^....F...}......t..xo....#.HFI!M........;...sf.}.Z..E..F....!..qI.:.X....f....Q{.._.\|P....h...-...uH<..B...M..9...2#..L...ti..R.k..5....o..L..#jQd@.:.)Y!...."...+.,.....@Nj....y .-...tD....Z.....,F....*...?W.{.w.Y}.6......%K./..c..R[..U.<.P..gDq.y....y<5WVZ.j.d.+.....]..Vr...`[.+d....`l....4.,..~.a<..+_.k.hR.=...\|..E....j...p..6.n...^...#..F.G..w....k..A....h ..Q0..7..K..s...q.W;+'...D..Jo..F

C:\Program Files\Mozilla Firefox\gkcodecs.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	474343
Entropy (8bit):	7.087258537259811
Encrypted:	false
SSDEEP:	12288:/vw0BgPRSJtbqA9xLEPHrup3pC8kZkvSWb3kW:/vVB6MneA9JEPHrup3pAZk6Y
MD5:	A27EC7F100BCE4F38A00B4429057862B
SHA1:	1DFED70004A24CED6687D2C7658598F70E7CC8F8
SHA-256:	E66BE01CED2C82AD6C3CB8468DB3CCAE8C8ED2055394F5BD5F99C85293EE367B
SHA-512:	A1E16FBD3A41D33479626BAF5A603AC81D5C353335A6917DCAB786689E90BC50F627BF31188064683BF04160F5F187C8C5DB0E329FAFD82C991EFED2514EFBC7
Malicious:	true
Preview:	..w......^.......#.at.7 ..].......V.9v..>.d.[.1..U........R......{k.O.eh..K...w.c..<.5...z5.T...}COW..7@.a;..{.....V.@%7...%.O..z....6..D..K.u.`.,.R0..R..D.. .O.x.....J.F....1.Y.......O.A......I@.k{.ht.MH.Y..:.>...?#.U..FH.....P.B.c.C.E}.9..o.@..4..E.\|....#S..r..j..J......$.r....G.v.Sz4....B.x.J.V... Vli.(..P.../......qRBq9.....7...N.p....>.5..8.6H..%}.M8e.4%,..~X1....A.Z..R8....;..O.....2....S.6.~nTx.2...x.tYgE..UZ..A.s....m...B;c.z...:.X..L..b.....@...>1.D.u......&......0..'O. b....jG.1CM8.jB.D.p.9!Ky..h...U....G..VJ.(...)..uxf]...7.n..$z.C0..E....Z.T......Y..o....-..\..i:.h.wb...$f...X'... ../=..0.r#....8..hJI1....Z..y0x3..3..,,...r....F...K..x[....1..m6t.I..c?.1.wT./..+R.[.=...'.@.[..&..SYS&\|.<g3o~....."...........a........Y.G......Z......;.......y.~h...v....F.tZ...M9....t..^.......FP......6;lP..... w..&"....B......~.......%...5....g.....t....$..\|.........YO\|..<.....3.Z?G.Zft..M..{..IX.=....S......1oV.\...o...`.m[..8.ob.....;

C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\clearkey.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	107239
Entropy (8bit):	6.7832620055673845
Encrypted:	false
SSDEEP:	1536:I5BTOnIA4ReNkhPyJQmFW2S4s3ngjUXciiAqUyloya9qqwmKXPM/19ild:AAH8aqmFTSNgjUXcii2koyCU0/K
MD5:	1886B2B2AC892C5338FBA01C5B676152
SHA1:	03F9BF5D9BAFF39C0122468BE2C8A4E15D8595E7
SHA-256:	0558BC3E4E8ED34F31085B9FC3B48FD32FB201444BEA6E5DFD04687D9B0B926A
SHA-512:	362EC622C06580B1A29698252B240A7F41721F58C46638768F0153AF8CBCDD7F22C477837D510CDB2C9B92BBBD733C289C73E0DA32505649562A85E2D24DF86A
Malicious:	false
Preview:	....?.`9l.Gb..e.9......O\in...,.."4..&^<q..Y.}.%.klF......:......xw...o.:.E]KwfO.r...^W6..f..S.....i...`Tr>.;..L...y.\|......V.e-g..v...O...h`..-i...=.ck.ECP.......d.W....r.e.:..D.iU.V........sD.4...H....0A...h8b.3.B...~.1n.m..g.a.&.......[...m.w.....P@...y...<[B&.'..!,.......Z.%.e...m..w.t...".Y"0..z..E..TL....`..o.a...@..l.Lw.@.w...l.Cq3<q.$.U.Z..e...5...B.M.r........b...q^p:..-.."k.LOt..........aC+.7Y..../3..6.....7hX.7..~K{....8....y.@^.}...I..~...Gxps.h..E.5g......P...V.P%....+[.....=b..u.S......-~J..#.i.6.1K...1r.A@7N..7..G.1.#.ooa...4.)...8.x'.S..@.w<.t<....a..Dl.$..P.x'.@.f.r...x.<.)..4..BPc........[.E....O.S,......}....o&......?.u.!...P.n."........\.Q...7.l...ZR...W.\|..yT\o ....\....w.My8,Jvy.....K....e..m..l.Y?\|...<T...UU.\|N~....6..._28t........j.A'..h.. w.T..[....-E".B.hdwLW....J..X...].Y..........R_VF.?T\..O2...\..M..z.....\..a7h\|#.o^......./...,.5U.%s..Jj.m.q.. ...g....s..V....+.l.2..%...cOr.r..,8.IL..W..li.O.

C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\clearkey.dll.sig

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1776
Entropy (8bit):	7.7158469810101264
Encrypted:	false
SSDEEP:	48:5wCLxeqkNM1Yn1hWF0DZSAIen4MK8WcKAGuW:h8qlGnhjbKPcKcW
MD5:	A85F54871DEB9A5B42B31FA73DE98AB3
SHA1:	6493BE13490ECFCC1DE210DF2576C69E46C9FD3F
SHA-256:	CCF808C092A1995778744E1C94FF11FE141E91999ABA9BDA1BA63A761F409B10
SHA-512:	48266EB921A6C790C439BEDFCBF6C7EA4BA8F90E3F069673A2641ABFA2A5AFDFB43FB5471E8D7F05E7E5D0F62B6ED2C9B980658DE4C0A2BF61EC5F85BFC1EBA6
Malicious:	false
Preview:	...^..0.S.l....g.-n%...1...W.?MQ'...\..6(+...x1ia...}<.;....=!........$.......?t..z.z....RA^...7.......Y.}.hAH.g.;.^`<t.g<h.'.d..... .^K....b\..E..B..V...Y%yY......?.._5v.j&..&.+i.>....O....c.UV^ ...`.9..@ce......Q......=.w).,.UM......L\|B.z4....t.......?.....Y....Sr.}4.......O{...)......,..O.-/.......~...o..n.7.....O.(I.1}.%......y...P.qEL..T......x...~..^.$.V....8...\[..J..d&..8......~N......~1.....]i.j..G.._2..P...^.1w$.eP..G=.lt.....s....%g.\.[.S_e3jnZ.[7...8\7r.G..VT...$..A..T9{.?0.\...K.3...6.B.q..U.!.D..M3.......K.t1].~.....(W.Ng.......l..B\..hB..V...t.s,2t.d... .....m(d...=..(.>.<.:...{.....-I......M.71..S...F...._.P../..P-..g[....A...K....6nz.1>..E4...gO.\,1...ow....h:G.;.Y.5.....?..-..dn...h,%.'.1h.3..F..2h.)..,p...x.I....B.kB..th..`..w;...\.ul.`2p.[..A..f)....\.NcW.\...?...o.\|H.g.....Y>U...z..~k.<.}..u..<..}...y\....6..Y..R.wI...........s.0A..x..Q..\|i../.....'..o...{.ah. .u...l. ...!...y.u/....1.....'.Y.6.i....!.

C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\manifest.json

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	556
Entropy (8bit):	6.741632060043577
Encrypted:	false
SSDEEP:	12:Vw1rS8JP0l+V49SLMHtonEMYUmRGGcMD3oJtqEnvCSW:G1rR0UVtMHEYUkmqEnqSW
MD5:	0EB228B71B6334AB8DA6814BDE17A65B
SHA1:	46B47CFE30F835BC459DB72ABA2E815B8BCDEED7
SHA-256:	E33DD7E2658A6944936982F1438ECD79AA4C921994AE24A54699FB0DA7F279A9
SHA-512:	DF3FFD451F95B44293FF8BC35518EB0173E53E8DB2C575994F20EC1D42EF803098399B9BBCA723D138AC83BCBCFD3793921105612952E09FC4752EC2031AADCA
Malicious:	false
Preview:	....6}C;Z-V.O..@...!G...b.........q..j`t%o.......~,.H..k.(...i]..]4.(.....b.,yVjC./G..B.;....DC....K.4......y..1.W.41.\|<....< .@...2...,6QA..).".v......V.mv.$@...H..#wrM.'....6..me\|..": "10",. "x-cdm-codecs": "avc1".}...-....B<..U.;...$..-....E..Wf..1....)o*...G....... 9..4..!...h.0?..&5....RXC....Z.F..nl.w...P...u5\|....:I..T...N8....M.-.3.........M_.3V.!..ee...C.Y.m.j.... ..N.$.Y....K..Y>.6.a.x9.S...J?.H.Y...]....................................................................................................Y@....czyzk0zzhil.

C:\Program Files\Mozilla Firefox\gmp-clearkey\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Mozilla Firefox\install.log

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	25309
Entropy (8bit):	5.440541505372231
Encrypted:	false
SSDEEP:	384:JHwhffWj8m1QosdFAG6s/uJjTJYCLaHYUYUSYNyY/nY2Y+YZYyYCJ0OJkpj:mh3Q1QzdFOs0Y602kpj
MD5:	EE285DE3A4D54322CFB54751E0F2F481
SHA1:	FC76C2986532CEE5B86BA0EB3AFA42E541F39280
SHA-256:	199D505FA0E522FB037FD53C1BF98D28856C4EDCA6DA38E9C448AD5E3922B805
SHA-512:	E2F955105FE8D0B161294A45F69FFAD6B6A11686E9E2188FD76A4A042274591DDBAAB814CFBFBC76FA3B942A06C1FE490B79B7218F5A64936CCFAEA1E097BAE1
Malicious:	false
Preview:	.f..#(..#...........EM.....`.[..y.6.......t........e.G.69)R^.~wa.b...Gv]cx..I\........J..b(.0;>.$.hm.....l...V..q..yh.t.....\|....{..z.2..Ye.......$...$.k_.MN...h8..c..mZO...0.d...4.n..[{...K.A..OC.......w)...uw.C2.yDV@..5...(..@ l5S.q........._.u.5Os.....',}cF<...`\..U...&......`fS.d......e...<....R.@vv8.]....5.}Q.q...V.3xa..F.y.3.&At..>.<..x.....Si}V7.G....0j...4.........+.PW.)V..V..['..I.N\|....^:+.......2......&.(......0.!...N>{.6.,....O.H..9\|!..T..O..xt.U.v..#..~..Y.v4...>..<K.{..i..[...v'.TK=ud...>(..w.T.X...`'...-l>..Ex.G.%.Q..._<.UX....#\|.d..x.6..aM.6...u9.(S`o..i...s/..Q/QAPAz..[...ip!..z.b..=".y...d...Q.:}...F.s`...<..;........9..G.+.k.7(.&..;.. .H..n....p.o.S...9.v{...D\|...mAsg...}...b...js.@.........W.$%U..W...J5P...'~..T.......>T47......53n....?c...5]..r_.7^....3.....q_.....qZ.z*_..],...c.jX.....q.h.&..}.qz!.~.rn.&..@M...f.1..B6..U[6.C]...T.Zw.;S..M..t}S....-XL5G.:].$; ]..f..x2....N./.n.......'-..3\|........wE...R..zB....

C:\Program Files\Mozilla Firefox\installation_telemetry.json

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	789
Entropy (8bit):	7.203531171045832
Encrypted:	false
SSDEEP:	24:4k0HaR9HIGy9rwQc69N+2sATvqItA2ueW:FR9oG1gv1W2ueW
MD5:	2EB308A4CAF50CFEA55D8DB0A7CC4F12
SHA1:	D26A9D407F64E932E479451DF4079F64BFA087C2
SHA-256:	B39A374B681F8D6A383CE205437223951460379185505CBD6CAD107C57DC9FC0
SHA-512:	4F12D0ECBAEAF618D2BD1E22E1AA84B1F347F4A11A65578970D7F8CCC1052D6CC633CF9079E19440F705AE6FBE13B6CE116C6BA84D44E963B590891016E4FEE4
Malicious:	false
Preview:	~._.~q..J...p.r.{.b.mhv.@D..~..$.w.$.5]%.B..i....'>.)..T...5oA.H.I^.~..-B.....5ng..&"...[...C<...A...u6....m.(.4....&...t....~....].6..{........ C..dm..^.P.....A%9..4..j..~...u.O..S.Q....FZ..Y<R."J....C.(q.B.{.mG....e.1.!...w)...._..o;......U....-..-`.~w...0...`,x....>i.Q..s...{...gJ.F:.y.h......h.....xRS:.P....R...V...R..L..f).L..{$..*....H..m=.01......Lb.N$T.`.M\&Fq..%.....-....B.....ZI..^7M'....~.1...e....>..k..b};.....59.5.3.7.6.".}.....~..c:..dv.+.....:..~(..VZ?.S..K..).N.{.\..1kZ......T..H3..f..=LAw.....0.=...oT..Vg.../...`.O.a......P..\.s.Q.,..O.[......<......e..?...n...%....H.t....p...a..6...Lk......l4?.O.F.jJ...iM.....................................................................................................Y@....czyzk0zzhil.

C:\Program Files\Mozilla Firefox\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	true
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Mozilla Firefox\ipcclientcerts.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	217831
Entropy (8bit):	6.751432276699764
Encrypted:	false
SSDEEP:	3072:4094WZ+2MKmUsOKBlyJCZl5eXYsaZnIipqovvWgbv9t7IkSStLQxWKgU8:412MKJTKQT4n8a+gBcStLQx4L
MD5:	8B7188FAF140C1F37252F44051813729
SHA1:	5858C5AE5220EE5F9A15C31E26A6CF42602426B9
SHA-256:	384BC8AC66B320D81AA19074DA06EEDD99FB6B00C67822F6B429B6EDD0685E5F
SHA-512:	BE79BDDB1D91CE6363C28DACBB22EE5C127F875BD79E48C0A8D598BB6314F76A9311992DA8E8979DB3ED317B9D3A83413901615CE5A9052D2324E394E819DD72
Malicious:	true
Preview:	..........$......z..x...d....g.....W..x..........#`?.u.g..I.....V.F..9....P.............&.._..Aez..S..gGO.2.N.y.Q...C{..f..........D......9.....5..1...dCG..3....s..l....@..\.....E0U..Zo.,\|....).q...Q]...h........5.d,A....+..........?.[..t.......>.`..rv..h....8..-... (_...kI....'....dR5.-....6...+..!<f...9..:5...a.H..........P....v...w..=..b.......N./{.>.^..y.E.a.k..X.~..P...Jr..I-zP.S..A/p03..X..D)9FJ9..56.CD.......)....^.....lyq...c.-.L.d.-.)..."...;.)i@..N......bA=..Q..Z...r.,s...4.0._.~.e.W./...V.-..<9fY$Q.}e..0z~Hx4.WY.f)...p."F.+9G..v....U.u.[.E......6lW.#.....s.[..r..dW-..y?.{..z.W4}Y.V..^.42..W....im.WD>.\|...l.hJ.N..]...UK.Uu8E....Ec..@...\\.e.........S.....F7.&yG..cEG...t...%d. ..b3.x..e.t..rFN....#...#..q.E.#{H..W..+....=...,.......p....G.....B4......R.m.\|.$...(...\|rc.+}.......^P...R..V...Kh..Z..Xx.C.-2.N(}..@.w..N].v.g..\i..u..~..jhp$...a.qg..v\G".2..K.......:.H9G..{x..R..:.mp s......(....]..WZ...'.~w....t..a..AA....82.i..3...I...d

C:\Program Files\Mozilla Firefox\lgpllibs.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	41191
Entropy (8bit):	6.993375093296173
Encrypted:	false
SSDEEP:	768:f9fB9yHAw+tuHfH0sX05KIdsSAG8yDboDEoY9XSHY:rAAZsk5KRSAG8gN
MD5:	B87974CEAE9313366B5CBD2B5D662DD7
SHA1:	836330783AA821D739512B292F5E7F0B576096EC
SHA-256:	2422735264ED1013124ED0E4C2DC0396BCE8FE1E25B3DC0AC27E73228CF3A06D
SHA-512:	C7636C1C94020CE70FFBC3D83B7B5F2D27B843D52EA9CAC99346C660C01E97BBEED59986922426D38C117A155E5B60704B8C0527F29EE30671DA77BC0F470115
Malicious:	true
Preview:	.....43-s......?.o.H...5N.D.&..'......&...+.Y...<....e.......du.UG.0......7.\Z .GEH......4zZ......R..k..S.d......@ft.L.Cj.(...].,....sSpkm.s.........N.Myv......Z........ n...Uz.fi....fi.D.C......b...Fl.k...7.o.Z.kh...#X%j..X.....<..AG..%ccP.....]..9rqV"I.C....P....!@.[z.GR,......b..u...t/(.c...S......VS...MI...K...6..@\|]W.ae.9j.5b.CQ.LH..Rx%.WR.d......OI...7...yR).B?...Cw...0...@G...~}..^....Y..%...g'......L1...C-...Z.j.[x&:......08.&r. .+....d.. ...8.`.A..3.R.l.t?..yS.Qb.t".1...t..P......V,......`..HV-.nt.7...G...{....A.....As...oYC&.........~e....).&.,...U.0..wFW.L....5..osW....%{vs.7...<.._h#...q.V..b.M2E.T....4...jg..dz.}...Lb.....p.m.e.....9Dh..K9...]<d..).<..9.C.r{.6+.Mw.!_.........H.p@Xg.W.b.'P.eU..Zu}!...SP$..t.....4..j(l4..t...g..sP.5.f....K..A.}.1..4...IC..I..E.Q.i.R....d\|.IS>...(.G....)..z..B.!.z.`..1.J........eg\|...VOa.&TIf...-d8.i.C.y.+h....EI.d.>.a..tp....{0.....r/g.......4}v?...*......>...d..?......x..1.=.z...K....xm.@....=

C:\Program Files\Mozilla Firefox\libEGL.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	48871
Entropy (8bit):	6.882973781641627
Encrypted:	false
SSDEEP:	768:GUAX7HWoaVIGp7Syzgqo7F+KfYxIGttbrvHD5xpE7oSXmjk:c7HW1VN4D7EKfYxICbrv7+0k
MD5:	EBE961F2BCF5F2FF610D51C8E6BC45B6
SHA1:	3C7C65A8319F3553EA046EBB0A5C4351DA927D8C
SHA-256:	F9F03844A0A0B4FADD5F1BF26C7B04595F6C9E7234A7C5F4B68B2993982ECBBA
SHA-512:	4D4A603D81F95E493BAF832049FDE215068A3056249B81758A6C6B12DCF3ED77C421BB2D824EF9A4D5FE49F4305B5F66EE3D5ECFE8E17ED5EC745CB0E67D996C
Malicious:	true
Preview:	.@`.!).%....p.H..;.m.@].`.O....g.w....U."nG..T...~...5.i8.d....P.s...8i.!.7;..P.....%Z......c.O....w.,..;l.......DK..O../.u..c=.o....,1..'....I.<uEw.y..t<.F..nI]..V....]`.T..{.-Y..;.-...o.."..b]'_.U.......3...q.h&.[.y.m....PR.....3.&.'N......'7,..M.\.K~...vuI.sZ5P$x..e .m._j.....O.S!..[<}?R.....4\|R.......y.3E.-3{.."...KG..L..Vd]BA.Xm.T.U.3.....{./..N.c.e....8....u.J...=^O....].V...C.......W@......MG..V....&Kx(u.1.v.4.8Rv..&...N.'w..P.....,j..q.j....,..}.mRM.h...../...N.5.........9.F.P.....D..t.a.W3U6S2........@#mg.k=1!v....m..in6.#..4... o......B.....-w...<.....P....j..$.......C?.A....3./i^o'.vKn.\.(..8q./I.l...x....gh...'d.E...U....hb....h.Uh..^..U..L...._F..<..I*.. e.r..).R+.r...k...A..L.....k...W.....P...9;..R.....D@.Uu.JQ......C........q....(.JS...R.p=.-.<B5.es.4y.!'...f^...^.d..f..smC.&.W.Wa...I..:Q......X.u/....Zb-`.;.,.ca..E.b..4..c.L.(.....X..l. .D.hc.";\|#@..a......wx....Z........p3.x?B....!....^./.. ...L...p.....lC.k[c.Z>,JN.

C:\Program Files\Mozilla Firefox\libGLESv2.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	4998375
Entropy (8bit):	6.592981439664971
Encrypted:	false
SSDEEP:	49152:Iw8GsYB+JXBm2Uu4JkmbElh5KlnxdDCDDFE1/kRV0kfFUMFL69vf3KyZP4c:XwJxRX4vQyXhEB10iaR
MD5:	794FCE3C62D02F7AA62E64303B66AA3D
SHA1:	B2CA3319DF6FF5B2154D46A4E8E51E270EEA9A14
SHA-256:	6459481B0EC82F0F69D27934F4FCFB6C91FFD86072F85EF7CAD7D76C693FC6A4
SHA-512:	705845BD4EF254A4D85F115D41BE786F0F69CC6A500AA9A1AA2C49DFA7E32D7E529896B71AD2023A27EEEFF346A2B9E3FEE45FFB6AB22670E21AC5FCBF9F0C9E
Malicious:	true
Preview:	............>.h.N=..r._v.^p0@id......p.?^L..{2...:.f.Lx(!...B..o..<j-....3.a......w.Yob....0.0.WL.[.......y9....zj.y7.Kv.P}...,S...&$w.....<....s..R.{O..tf...nx.R..{Q...4.\.6y.h.Y;=..w.2o}............UK.#k{c.7ph.......^_.'kOxzo.>\..a.ki..D_.l.K7{.>...-.]....@..gs./\...&.2U..0ex:J..w.#.":h.E.j....a.Q.\[..FO.........?........JZ_Q...w....(.h..'....V.....h.+(<.V..6.W...c......Xo&Qi .1........Lz..2./.h...r.J}..M.N........._...k...'..K..!Kt.r..f}P..`'...%.......=.T....2.(P3...J.z...wn..........[.^M.`..V..#.J.....O..j.......~U.d.Au...i..^6ep.S.P..c.`.....{...d...V]3.M.C..._....r.."....g.)u..S.CL.c.&.4.{...Zy.&o.=.a.@x....M...2..D!.%.>h]....s)H8@jY.J=.?.@J....@x.6....O0...1.......%.e.o!.$..W:l...fD..n.?9.a..c.m.T(/......`'4..3.Y...;.....}..$..[.._)..n^...!O`<..U.:.i=R..#4..3.D\s]o.$.J.9.>.....RDM......T_..%..%...\n8...x.5..(k.........od..b...^l..@...e........c..M.....~A}.pJ.l..?.S.y.+..v.d...eUa/=._..eg...........'o....:...Gr..x".Qe<.C.o....aD_y..

C:\Program Files\Mozilla Firefox\locale.ini

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	349
Entropy (8bit):	5.906512257112814
Encrypted:	false
SSDEEP:	6:yQeMJrqGY2pg6nZXhz17Dn3DN2KG68xHhsMjIftKB9EYHW:yVCznZXFt3XqcfgBlW
MD5:	A20466FAAEFFCD341BD30C0B2B7578F3
SHA1:	4644F9946305B6667FB97702937B447099294188
SHA-256:	78B84C07D77EDD0472EE6F41C850D2B27934BD389BC6F91F59E973094B0E7F3A
SHA-512:	8DE02C6B4CD5AD83EFD61C98834D4C07A3269B172CCD3F89A52F7952CDA614C0E033EE1B87331DBD94BE60BFC8084B1B9D25773F7548F2B547BDDFA7E665097F
Malicious:	false
Preview:	.=.....5.._.z.....h.....x./.4Ew...7....WR.'.....(`Lc.Z..&.....`w.@._8.#..v......em..rF......$17V.O.x....a.#..0$...Z..$..Q&.&../....e.c.T..z....@.....).....t.m ..d.....y#.....!d..p..$.u.I.1.......'.Q...u..c0.....b....k.T.......................................................................................................Y@....czyzk0zzhil.

C:\Program Files\Mozilla Firefox\maintenanceservice.exe

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	239335
Entropy (8bit):	6.691010045790051
Encrypted:	false
SSDEEP:	6144:ktFcUse06V6qSu2N7+JXrWdJWqlt8DVSFQU:ccjrZubtrrIt8UGU
MD5:	8CD11CB4FB9579856114FEBB488C0223
SHA1:	9F4CC08DAA13D9CA9733354862144738FFC10F90
SHA-256:	ECB6DC2D1DA881B4EEE3605CB80D0877E2C47A8346E594C7FB44559612A233F1
SHA-512:	7C5080D0E758E3FE95AFB4008043B0ED60A88ACF355F9E4D46CB5142B582D5DD64CCC2E9E33C066DCC1277DBDD34C3EDD665A97E2A2CC84E7741137E89B00713
Malicious:	true
Preview:	\|[5."...h(..T.Ne.^.n...JZ!k.x.Yw....Z6X.L.3e.a.T..@U..... \..;..9....eXg...eKq.!...u`..9.....n...Xv..r..wf#.)OO.....4g..8.v.4I...n.W....3..v..V....2\.t.;...s..1om.~..)vBU.G.a..+.S.1...M.....RH..R'...>...dw.......<...A.Y..4.J...Z0^.>."J"f.5o..q...s..../5b.3X.".]J...k.64..IVu......@x;O.....Qf...!.....`.b...f.@..!+....s......s.t..v..gK..g..QQ.pG....SD...>,..R......$...LA)..U.p.SF.&z?....i...[..{.%R..W.q.y<..n......z........zc..D=...{1D.U......&..c)S.F..^..@........A.V.I."....).. z.a. ..1..g........}....R.B.biq.kB.#....dD./..r.w....sM..9k.12.RG.z<j..r.#....{..r#T..V`.....Q)N...!zH.......5g.Z....C..;..()wR.U.iy(.H.....NL9x.HB.."c;^.}.i?.._.5B.wWF3.../.l..JO.....4f..5%..o9/.....c........\.!R.[....Y.;..v.Q.8%.@.Z...QQY[rTZ.U.B..Y....Cv...7.Ul..u.k#..TU...H..a..-.:....+.....r3.{.J._...X*...x.)+..^.R ,.k.p......=...V...X..<A....U....(..k........]........m.b.N/..6.#.....J.=l.sx.h.N.,...f~.La}N.i]......Z.xn...=".....W\.-.C7..AJz.+13.TE.<K......EiH.

C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	188559
Entropy (8bit):	6.268599134826342
Encrypted:	false
SSDEEP:	3072:ST2XGfCOHtfuPoUNY9b0quuSm/RX4QtIBvPDmb1lpG4wxsrc1m:Si2fnKoUNY9luKpmBHDm5lpG4wuz
MD5:	2E02CB60B4D5F6EA2DAF944AA8BE4F9C
SHA1:	F13CEDD09670EA357FF1D049932E3BBB9778B9F2
SHA-256:	65531CA2E261EDE0EEE6DBC85F1BF554DC56CDC9CCE47E528E47687394FEA9B3
SHA-512:	4F7A6B754F251DDBC18A0172BFD5A60B8198147052192E95BEA4823AAD8B9A38A2A6B1F76D1A77FBEE52E2141A762E424CA67B46958294A787EF961950AC2585
Malicious:	true
Preview:	P.[.h^..h.8.....N......o.!.ELA5.\|0...l_3Am..Z..2N.`L.\.v..D.....z._.]3.V>...6.Ugj.i..w.$.}...M K...HvR..U....$.SoR.8:. ..SV(..&.N2.....fg6..z..9y.<ym.g.1Z.)...0`0..F..O.......B:...P.>...~.....s.\|6.'X..Y..=8.x.....}.&.C.V{.&.?i.{..A......uE...e$n..ti..9...f./S...w..&..`..=.....Y.s..[O....../.T.=.L:f.O...V........Q..D..S...XQ..]...(.V.AE._.t..<......A.\o\|.u.#._\...w..i....[.....9...i.....N.... ..YI..!.HG.u\.-...m#....HH..zB.nt.G.y.9.Sa...MV.)a...G.X;3[R.}...Yv......Z...".9.`%.&Pw....vF...?^.......~....,1<H...Y.!]3....gx...J.....HcrL.....'..6C7.,.V.z...T..R....v8&m......P..p...F....:....?..z.t.".N.C......t...+<.H8&M)I..8.b.\|3]...7.k9.\|?......~.B.../c.mF..c.n.fz....A[..=..}. ..F.^I.......F...L/#.P.U..c.O..f..}]..Pvw&.!_..T)+..=c.i....;..............X.wI...Lh.\|X`..../.....AG...`.`.w...J6}.!~$.2Q\#+'...8...)...P..9B.w..D;.O...].~J.j..0:dbO.....R.u.........e6.2=88.>.gpU.q..`.B....h.]+.0..dk.8.._...81....F.o........L'.X....3.!...vY.&Y....ZD....

C:\Program Files\Mozilla Firefox\minidump-analyzer.exe

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	773351
Entropy (8bit):	5.7776422490389745
Encrypted:	false
SSDEEP:	6144:t9SQQwUuQxaG6wgMzd0RLhXTAbLaI8Td76kr44d+ENzPpk86pB4vB3J++3NESEpp:LS/woXCHvB6UIENbs34ZD3+9d6Oqv4x7
MD5:	EBD8E3287594E8C2D9C5C0DA106522DB
SHA1:	CF85838983E84E3D5C328FAB79FEBC89820A1C5D
SHA-256:	66F483215DFAEF70DC2ECDF0FB59949BEC086550D5BC0AE2E0CD5A302BE33269
SHA-512:	31299D56BC9B3C3A45569233D9E304197083B41BDF660D026F20C5599F29A25013F0305BD92515BAD1DD3BED6E3D2F07258825F5D17852CBFDDEFCD2414BE6DA
Malicious:	true
Preview:	P......i...\k..F.$..O=n..?K.8N.-...gn.#...:...tu...c..x...o.>..PI...... ...nH...z....;...H..........!A.g..(..O..\|-...L}..g.V=..k.U..d.......I....>.6MsI..yW...T.H#7Dha...V...ij.$D\|Pt._bE.D....xp....3."...^Q.@.?yE.tS...t..K.M.9.....6\|..wT.+y..AP.... X.9J+..0..v[].2..m.....]..l........F......V.....%s.....I\@.W..^.<......:J........V......T..#.bxZ..m.1oqV....}.}.o>D......(..;.'...Y#.CV.?~.Z.pI.... ..@...........z..../....,.cH... q.....U..p....B..=2n....L.ZZ...w+tBR..q...u..p.?.d...)s.J..T.z.Qm.. .]..Dj....s`.....2.3.g.-io..;1g.Bm......IKe.R.\|j:..}....R...S."q)a.....p...l.w.TG...../!....U..x.l.:...g....cg..3F,.K..1......f...F:"n.......D..G........G...`.u...2.ebf........./. k.`..k...Nc..zI...../s.o...o,....9.ndb../.i..)......HZ...)Pa...V..v\|..3.M..X.A.y.....lF..u[!.k$..4..c....=a&)[b.O..y....$.S.X...c.p`..H.[.ks.....*...\,.b+.2...ar........J...g...kdS.~.B..../.}NP.....7.........)0..\|......zR[..{.2..u.M..i.......^.....=...`,

C:\Program Files\Mozilla Firefox\mozavcodec.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	COM executable for DOS
Category:	dropped
Size (bytes):	3088615
Entropy (8bit):	6.976027075418673
Encrypted:	false
SSDEEP:	49152:D5fclrJ5n+cDIO5M6HF/j+WUc/4Lx2isFYmSEibi0A9vMe:q+cVM6H9j+WR4LxvsFTS9buxZ
MD5:	57BD438333582022F64C507319605092
SHA1:	2A5CAC8A18047F9277F08CF3FE8461C62E3229AC
SHA-256:	46AFCDEB395A4202872F6A50A8E7CD3FA5E91D701A677C02F539CB950558BCB3
SHA-512:	97371ED5B4451CF749B9CB464E32DB982ED1F48AF5D9CE491207888233690B80BE7D8534D604F5487D0899B3DD4C9A3B8B1AA465BFCDC0217DA410603DBAD638
Malicious:	true
Preview:	...).a)8...^.X)..2....k...wh%....+.8.?Sd.:...q..l.....w...h.q...\1=.u.".../.Db}3.g.-d.n....;pN{z.....9Q.OPr..<Y.\.....Xa...P...".D.6....%(..D.,.q.-F.3.TkS.g.b.f]p..g...........O...?...a.dWH._.Of...v..U....Q..,).M:....Zp$`....,...].......].7)..\|Ov+V..<.w.......k.........e..'...n...G(R.Q....o.9fw5'.....${.\|".%....Ok.>.Q<.oFy<B;/..."..m..J^.dx....Q....Ka....=.u.D....G..+F...E..u9..hg3...M.N...J.h......b....3b&.(7S/.....:U.^.Vc......V.:4._.:...R2!.......{.g..n..T..?......_...-..#_.a3.....r[.K........ r.a.o%h.....K"..^......=.#N..[W.{X... J.;..X....g..8..45V...Krc..r(.lR.F1.B..u.%.v.......A..D....:..w]R.......U.,.i....6.....?..]..{...KG;.,...D/P..$...!...X..~.".>.O.dZ^#Y..;44LS..,K.h.5M...n.g.u...u@^..r.V.W39.s....+I..d.........19...=....8...<.t..<......:6xz..w../.....K.&......u.`.....:D..v..W.J..G...+.W..j$AL&.......b.. ?..`...0..........E`..`]....'`....J..@U'oECf.._K..V..j...... .W.....!.....zC.+.i.z....m..0}.QS.Ot.!xC.._.Ozi....

C:\Program Files\Mozilla Firefox\mozavutil.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	215271
Entropy (8bit):	6.485967451290887
Encrypted:	false
SSDEEP:	3072:zHrlZ+69Hi//RI6kPlX4D4Eg4je50H4yRgxqyMMrtYKKj322WCb5KXmdAnr4PjkO:9Z+0C3RIZEXje5zCj322WCt8mdAr47kO
MD5:	F60E9EFF862CD73A32288FEF58171195
SHA1:	48B0A7091B9C59C1F2E9F66A927FD462D4509A48
SHA-256:	374C023644390F3B067245383C4E4A3F4E0375B914324B18A2781CCF727E5492
SHA-512:	3B1FD20C518F02200BD6694197D2AD3E044EC5051FA62192FBC87D3443DEDBA6E3ACBCB06B8E7F2E56A9433D47BB6269D473413065F85E4B4A41AD371FFA5884
Malicious:	true
Preview:	....\.'.."...ub .....V."..."EF..v....X.\|\0]..2Q... ...?.Xu....s&S{H..T.i..........s...r...&Y.\|........X.!......,.@.p....%N&.V..t..,.[~.^~.............B.C...L.-g~.\.Jz.d.z....!.b.t.UH..X.a.iR.....J.....av.-..k.ge:..6.:..Vj{k...f9~.._R....f...~....m...8zG.A.Lo.me..M.......T......q...F...WG.f..g..{P6...U.`..+i.3.....:.s.5....de..R..N.....N...{....&.5{.[.K.v...U.J.QZ.\|.....&..j...WC.L.Z9dv=......oL p.............1#.o@G8......X.....$..kL,...}...V..@........;t..j.^6..0...7.%=d..S...7/.S.Di.....\|./'Z.......5.........i',.......... ..9.....ZL.mA. .6k.B..w.s..!...[.k.I.h.I.Y.}..$..cU..bB..].....j./.l.eP>..dF{K.1.4..#....-...5.>..MD..E......a.....4.............d..i...'...`..L....v...,....f./c../8#...bm...v...^...!93.#~J.+.....15...7.w..3..8.+.+...,..4.....2.c...=..{..9.._. ....:.Wc...5j....T..v,........v...].Z..$....5.`-.P..$N..x(.r..]<....BR....I..n.F.[._...aq5znk=..!A.X.O...*_+...3v..W.(..........R>Jw..S..r6...E.&........I8....n.{.....

C:\Program Files\Mozilla Firefox\mozglue.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	852199
Entropy (8bit):	6.795706840406307
Encrypted:	false
SSDEEP:	12288:GLY4ZLRD5ND0rSY8fny5nvCSb7Yx4rgvORzTMd/GeqFRlblNC1YAYYZh:e7Yeo5nvt7mEgGRzT+GeqpC1YA9h
MD5:	C8F661F098CAF81F1B10CAF13D78A909
SHA1:	FEF9E861B593404AC26AE61E89FA3B6ACE4F5FF6
SHA-256:	12DFBA69A85ED129015C5AD0E386F1D1ADCE81A763312185F5856FF35949B245
SHA-512:	3B457CDADE648B529DF713533A7BC289735FC6C4E85F2186E87E881B2049FE477BCEF02FDC98F6EA2875101AA4DCDC026ADE2150074401E55FAE7BA2A255B3D9
Malicious:	true
Preview:	......].?.GE......x}.+',..%.. C.{.@..m2..D-`.#.)....%D.QbZ.r......m.#..3......?.)..6#Z.l..,.....7H1......F....g.JF..".....~.....m....3N....c....W.y.l...<...).}2.zaM..SGF._...&W&......].r..=vj..\|...c.b...U^>..1b4..x.h.ow.4z........Y....}`.b...v.\v.Q.ku3I.wsZ.....G.7.z1?.{.W$.Iu3...$$....g.........pe[@u"4...L{.>.xc#....1.v._...C.........c..b4.T2...?......c.R..z...]...h.#z.@....q.0Y....( ...,...v2......b..Tf..RI..D..pp...1.F-07.;......cQ..GU.d.+U.oh...#.t.WER..4...u?..X.....3Jp.c..v.w=.........i#K(@v..b......0.......]N....;A.c._iF...d.w_....S]\..N1E.........v....LX}xw..}[..U....R.....,'F...........N..9.8vR!&.#W.T...G./.L.Z)...b.....:Y.;.Oy.?K...U..P....9+4..ZPd7/;.W...{.T...v.!.....J.H'.+S0.:.<.D.9..e_.l.L......Q..zY.`M...r.4.b.m..H..avBAp....RV.2..\|.......`.pl.....f.Qp..:.....7Zo.%lH.o..}(......IgY..y.S.s.7@6....G..v..Z....e.c.3....G..$..xm?.d.QM...KH.`.......>......"....^E../.7....z..(....v..i...#N4......F.......v.?...j.....]Rq. 9H{....`A.q...m

C:\Program Files\Mozilla Firefox\mozwer.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	309479
Entropy (8bit):	6.6605385334939555
Encrypted:	false
SSDEEP:	6144:Wlk3DatKu6qSdPI6eEx64V1Wdcp71Tnln6mQc0:W2zal6qqQtajWyjxf0
MD5:	8525E0CA1198174CDAB7D6A9775BB925
SHA1:	2400C30D651A792DB4E920EF25198FCF13D1BFCA
SHA-256:	86704824FC715B154491822AE8BAFA45EA39F914CA8B11EF35AE2C4E8819C326
SHA-512:	7A906B8AE0CE3222C48A4E6B5AEE8C07C5AACFD5D838BCD2A213989097567128ED8C86BF5CDA3E1C300C928F58BEC232A1D9BAF28E62725BE9F250A33D7A47A5
Malicious:	true
Preview:	.....>F&.....~.q....s...30>.B0%pxs.4s..../.w..n..b.'1........41B.V$...{.:b....]Dc...J..kEl..6..C.,.(J..'........E'.p..z...PH.a.............E#.C.4@......F....R....f.w..S.....Ns...3<.d..q.+....hy..j5;.......4.......Q[..C.l.......L..^.....4....b..tL.Y...Z......t.oR...w-K....S"9..E.....V.h..1T....i..O[m..........X..(.M.ACK.I<s..MG=..?...._..0.......CZ&]..R.kP....4Z).-a.9..D.)'..K6..O$.w....)U....?.\..^.M.Ph.....>......o%....\......j.....gB..SbY....?.C..K.Ni..c.K...>.:.+.q.......\G..[...'.M.i...b..j......z.9.g........4..]F.').,..2.G.$...@.O.l..]O.](.bt.F...&...\ ..$k.\..X.}......'qU..]..zF.".8%...sh..M..tH.....,.#E[._mf/..\.\3...4g..{w...%....s0q.g...g..t.q8.}..%>e..........?.O\|.7Z.....#....GV@...O..~f.X.+gX/.B1'~."..[e%a..O8.[.:...y.l..of.w...s.F.J].L..r....Y.d=..z...K.:..Ck..4.&..V.t..F46....1...)...D...^..?....Q...=...*.4..(n.>.wr...-p.Y.....CRB..kh......7oB.%......u../...6A..)./.............3!B.M.<..>{......y.B.<.t..E..KU...d.4[..

C:\Program Files\Mozilla Firefox\msvcp140.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	567031
Entropy (8bit):	6.776175007630812
Encrypted:	false
SSDEEP:	12288:QxPltKJZUEQXgKtLCyfe+n3aBZz+bl0bd789w84nbc2yxYm532kaZm+3odEEoLHn:QFfgyxH53LaZm+3odEEyHn
MD5:	5844DAE3B78BD6BE70CC05B358E99B55
SHA1:	B58C0A9E8D91DBAAD4E58C2487F4339EF8E4B37D
SHA-256:	5783D96EF2CD780DF76DCD61CE2C37FBBC43A1D87C735187BC373BF664ECE709
SHA-512:	17AC0679D5CB3DDB1F07F838EC297AA77653DAABFF9F2727B50094D742F0208D24D3AFEE2071CFA881C1A6E9B629D8B24881E95964B846B8C36EEEFBCBDD1ECC
Malicious:	true
Preview:	..).2.6s. ...b>.`...&......?C....Fp~.......48L.p.Y.&...m.`.._.{..n!I.R.s.......~.;./.+.J..>.0..+..ng\.be..AU...../..>I<..}..p.R..#yA...#c..0...L..j#.#MT......7...U@:E..o..u?.E4=.<...r..7 ...T..rS....U..^fi....].._J..1+.ov9.........mX.....'L...c.e....%..K.QM]..P.. E....y9n....j.9#.k.r...D.`.P..u..}.z.wt.;`.b{Y..E...P+,r...(C....K..!.VP......&WZ.6.E...]..bm.w.!...r.$].-......5P...\.?..s(...Ta{.v..XQ.g.C:...M93...`../...@.rn.:..-..........7f.............n..l\.v..\.QA.>T...p...,#..O..K.]:GHH.]&.L.k.....Tv../.V../.4.-...Z..7g..PA=...n..]..."vB..C..sgi.].Q.'6......8.........H?...Z..to.P4A....T5$..$$.v.`r.kF..W.@K...I...'.`..QWX.t....0..f..N........7..$#..m.o..#\......U.W/_....b..a..q..g.iLZ.i\|.TTxhF#.m}:FNKVA9..et..:.b.%&..a.....l...D.........BA...0t.......l.'..b...U..X/ zJ.=... ..c`...S..3O^O.u._..c...]GU8....X{@..<....B.ps..4..J.P=.Aae....n..uQ..s64...>.y....76y..Df.$.....!.n..q...0N..4;..w.u.l}?.....,.Y~.l]P\|.&.m.l. .0..s.L....C./.\..k.d.e

C:\Program Files\Mozilla Firefox\notificationserver.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	62183
Entropy (8bit):	6.7449072926208045
Encrypted:	false
SSDEEP:	1536:ayFJu/M55JArrKVbyw9TUWN/+WMSwQQ4xG:HomDVe2TUqbwQQv
MD5:	A43E458360CEFCE3D919BF7AACE327FB
SHA1:	6921150FFA0D923263A8D2FEE3331B6EAB65AC5F
SHA-256:	F116421B1876AC4C4CC8BA9A5EEFBEA43E7095090B97F0E468C9823B9442F095
SHA-512:	7DF8EE15FF9B78D3F62DEDD1FD1D5C3D57BF66AA8056304B52FB835E750CAC2C811C51A80CEC9C258AB52CED183639B0C8CEED2885817D7CFF016CB4BF0E176B
Malicious:	true
Preview:	\....`..HT7..hg).G.......U....&......SX.Y.d...{...D.....1..>........GTYU..97A.N.0e.p.h.'..r...........f6. ...g.L.e.U....Bk.&(...1.]H..7<.U.L.}P....H,-.L..x....!xg.3M...m....w...n<x.@.G.e..).......Q.....D.G...-.C.....S..Tr....r2.a(.7)5.l.^}.oQ}.6]sh.r3.y.....t;m.....CKj,..XL.......\|QQ m...??...e>.D.4.Wt.......U...%.rv[.d....N....p..1.Z(`.Z...:.6...z...nt....p...cB..o#......4s"...A.u&.L....N.......@1g..Z..P../a..i..!YK...W..Z...}...s.D..:w.:.....Q'\..'.Qd..#CP.LYUW.r..f:..,\.c'.d....o....}':@PK...Yx.\..........'..,$.{........n..I.5...c.Y...N.c..i....p.n%B.f.......2....P11.t..F.>.=.?F).q....IP..........u..4.[?..Q.g.'.5n.].....+i2...."..`8m^.....u.1..];.!...........3...i.P.....,.J..5...].(..{.....*.9.f8.j.../.V...qeF.\........CE........X`.bV...n"..u......i.~v.b...d...1G:.D.FF.)......j.!a1.....X._i9H_K^#].&.9....DJT5...b.....8....Dm.....>.....B....R..8..wu..M.D.@W...+KR.....n.s[.6n_<.p........Nm#.6..,.....c.lE....xbe.o.......Q.F..C.t

C:\Program Files\Mozilla Firefox\nss3.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	MPEG-4 LOAS
Category:	dropped
Size (bytes):	2539751
Entropy (8bit):	6.737922335080315
Encrypted:	false
SSDEEP:	49152:XVc8TzcmZzwzFrlyLP0DU5enRoOUU1vKr2JBsr4jk0IZgsIISzj1O9j:XVqmyp4emU0G24jNIgsIIOj1Od
MD5:	AE04FE0B382F5C831FD07F00148D93B4
SHA1:	B2907508B27885BD686254CF5F2F14A308FE077F
SHA-256:	B84DBF238C00C8E77D437A2CE83023BCD9E40426078443BF4B95523E59BDCC8F
SHA-512:	45FFCE79E10CE81D02ED1266AF7459FFC9FAEA19F63C201FE841AEA80373A9B24B4354FCA67A41E7DD2F9BFD23ED598AC90F1BA06BB152283C014B45E8D4EB31
Malicious:	true
Preview:	V.....8!..T..-....].....5..3..N?:D.J.. X..o.u..W\|.SH.9.X..c...I..>y.l......I./.Bc.,..4.........j...Ic(.....N..:I..,.r......;....OGC^WC....J...$..4..e..f~..Za.of...X...O.'..q....m.R.U...(At.~x.]._.\|....1j.d.^.s.FYZ..Ly.H&...I.p..^..Z...Bg....8.d..7&......NP~N..T./... o.f.-?G..m{....Al...`.[%..v.S.6..1.e..^..i..]..T.#...2...z..Z..0.....^<...P...N.X...v...r.....rP.JM...L.V.............m.y.T<.......S.W.j.....T,..1cA.M......xs.{...?-.L...w.F...AL..)..q.....>6...V... ...P.......i...S..#U.cB....DL92+...Y..:....S..]Y.*....}...'.v0.P...lG.2.@..Px.G.......m..%.\|......z.k.%gj>....pi.8.+Y#..Z[Q....J.m&Z...........s...g..X.s..M..U.y..~.J...wq.ICn...3.l.<...."..F.......!.C.H..4.Z.J..WtnJ.\|........V..pz.... .6.4.aL..EO\|.#-6'.az...O..e.T...`..$Y$.....3 ..AW.r2N<:.8.Q..?7..P..2]qC...s...o.7....%..`.\......a..#...<.....D.S....D...A...(.qD...bj....C......q.5/.".B..%.i.K.y5...d]..S..%.jz.%..%.......i..,Q..J...a20...c.)4x}.J.g.p........9.wy@...lo.TI......e..x

C:\Program Files\Mozilla Firefox\nssckbi.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	383719
Entropy (8bit):	7.368153387921183
Encrypted:	false
SSDEEP:	6144:HecZj5VJczfkOQneMgmJZXVNa2mo6inikYSMmT4Yh5QQ75E/HkGd:+yTJc7kPnZXXa/XzSMmkkQOas0
MD5:	219F77F2BC62E8E1605799A34C5F1486
SHA1:	9C12B6425AD393B6C61A3A24F3BAA91E7761264B
SHA-256:	03B22F25252A4C94D0E7809CFFA4027B8B37C4FD877D5F29CA1B9B476A209FF3
SHA-512:	E4B97E4CF785F9A6E325B7554E0088CABCA17C2729D293B88A3273921B3306F2C4E13584798ED8DB2CA7F1454F7A33D243490F9B9964FCBB8F29041807703EE1
Malicious:	true
Preview:	....y..9c6....-.......m...7...K.OO.{.=.2....$W.z4.......\|.....eTv....t.........f.V.@q.......4`.0<Jf.......[.9.....\|...].........Zr...Yr.L$..R.+)dV.\|.z]...%IJdfi....GnY..e.`..#....[..\|u.....=6.j..m`.c.,`..93.eM..\../]. .kPp .S0.Q"..C.......k.^...#Rt..:m..s.R..k...h1......E.t..^. .w;0.]....-.....3.&;.ts..q.......0.KKu]........s^...N...P..E/.."f#t..%l..6._J..{a....._.A.[.Y...m..P[).1.c..F..2`.."].#.._."..ua.F.g...c..G.....K....>t...}.M[W...<X.=...Y..".7.d.f..3!#I.....R..R2 O.c.t.,..t.C[d.{........3#.hV.....e.d.W..x.....!...eTA...F..0.\|?<.../...P..W..x.........c..K...H...p....U..+.....F...u.ze/d..c7.00..9.ZB.Q.%......Z'.7%.m..i.X...W.{..s..Ai.I...i...cQ.o/.N;.....n.....@'.W.1...+n>.ZLN..j..#.D.R...I....Z....xvF.....q..n......Y'.b2..J..Q../....}K]K.ht.G.P$wb....q.O.s.j...k..k......zX....\..............c..f.&.{Jd.....*K...] ..\|.2.4....g>...~...-.{.tICg......p..&1...Z..&.....t/8P.....tdi......0n.n{.>..<.RC..p...C.8h.)q........S

C:\Program Files\Mozilla Firefox\omni.ja

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	32908809
Entropy (8bit):	6.101040472790795
Encrypted:	false
SSDEEP:	196608:0Ujqc3g80VFJ3FiDJ8w/Jd64pBJ5QTOe71BifFXuqrMgX8:0q3gFrzjeJ8Oe71ZIPs
MD5:	722BA4104E34AB87F6199AACF4734C36
SHA1:	C544AE66A5423A64444E581A3E92315F6E841FB5
SHA-256:	AF19636BF4AA831D5AD69AA200EBE14F15CD6FC290B4AAA07029CAF6FB2A3AB3
SHA-512:	4067590A285A57C17BF4A235DB604469B6723DBD17B8F40E57D37748781A3F123E6E4045DE3423277B486BC9CA8F3427AEDD2AD606A88E29F2E8A1308251337F
Malicious:	false
Preview:	......P.].........1,......4...T..u..."....o?...5.y..F8p...z.d...Ud.&.]i..t]....@.\|...V6.....$.(..,u.W...{.Y~...f._...&.td.8...9..\|...S5...d.p..q....z.N.d>,.S.E.p..A.)(...I.\|t.......x}.....PfiS....MI.G.y..\|b \&./.V..M..[M<....]`IwHr...n..{H6.C.H............ ..50.CJ.r..g.]....E.."......Z.c.&.Q...A.....F.g."#...I,~..U...a....b...w..a.s.k.U..2;.P.F.T.....h.J..=V....G..&lE\1{c\|pR.[ p.....?..(.j.I.....32..6 .&...HE0.........^.T..r..`;...W=N.....M...[.w..Z'R....1.....8H1.".0..\.7...z......<..{..q....#.H.........1..'`.....{].f.....Q....8...:...'....@ ...ei..8.v....}...]....]..4...2.S1...UZ..2.4..}..+..d....DA/...,..o..I..L.. ......7}...Qu}......1..>"..!..P...)60.[m6....J..A...M..7.C....c..g(`[x."..f..........,@Zl0.(tG.%.^..//e>....xOs:./t.?aP%..\|L......2w..B....}...@F.r/..~..LP.T..........u..J.UQ..m..p..\.....KF.W.U.80}..p.HOX..4[.i..6]~f....\........g.lj..$.Y..p.....$..W.........w,%.hl-7..@T\.N...4...S.2.&...%.,kw3z2"..k..U.'.....6....v

C:\Program Files\Mozilla Firefox\osclientcerts.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	380647
Entropy (8bit):	6.66213418538984
Encrypted:	false
SSDEEP:	6144:1nSfi+gNoFwrChH2JvCSFFTrxKNBE9awEG5v5LiVFkrs:1e4iuGh2JpF3QNB4cx
MD5:	1A99499159CBC74481503D230B3B35A7
SHA1:	7BD92B1A26437EFB64E3EA64D96BFCD674D10810
SHA-256:	E9F5045AAE1AB63CC4523E0953415AE0C5EC888B70284D552150FEC4F3570C7A
SHA-512:	800FE1C2097E91A16F91F3751FD8518DC0A6323B5940F9D5A7C8BCA8FFD85B7465C79712700C656ECA2B71D2A002FB92A0E0F4BA2D25242971F1A43152195F70
Malicious:	true
Preview:	GC $.../.L...x>..W........=.....k.n.."......Q\|..G.O.........?.D....L..{.._!....u...{f..f....`+.:V..I....B...........,.W[2h.a..c.....'J.3.,r.4P~z....L#.c.2....O.5>.~.`s1pz.....7.D.....7.z.YZ7-O...\...A.z#..Hg(Y.~..A.Y..].u....'..)..:..P".v.F..mc.G ..C.N....X.E.F...k....C.8...j..X.".cF2.x...../..)mK..T.W8bc.O..+......i.)u.!..k.t..I..+\....9C.MR..i..Y.$.....3ato..my.e.6s...Jb9R..w..&....t.;....n7..Y..~.p1O-.6.RX.3WF.<.Pl....Y.=BIZ...........Z..JJ.Edg~7./f.#.6.aX9.`^.R........P....8<>t.R...K.....K.&_..S^./....c?!...Q.U..k.L/.]c.......(.?6^5..v..~..q1.!C...G.v.."I..Gyd....^.v....i...C...0.iZ...d..[h..)d...`.M.=..y.eU.%`...c...X...c.c.6''-Z...c.q.X5I......q4A.j.XlA.W.zL....Lw.....hTF.c-i.<q..\|.X.\X....R.L.....m..g..Zx(.RMG...-.P...L....;.\|M[1....A..........z(...j..(....(6y...!7.:...]..P..Q.r,../....@O.s....u.")...1}0....:..7...H.sOY..%[OJr..1......xfP.>)y.....!......`.q2..y..-.}*.!O.Y..+'<.O,j...1......7../;N] >..........K..2.&.K. .Uz:..

C:\Program Files\Mozilla Firefox\pingsender.exe

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	81127
Entropy (8bit):	7.012100661777462
Encrypted:	false
SSDEEP:	1536:pnuHUlh5JKhKysjFBXUX7GlV6r+90R0qdhEWTfW26xTnv:puHUZM5sjvEXJ+90umEj2Wv
MD5:	4F405A039AC2F165F431710867A7519C
SHA1:	CD69059149B078C2801DA2B5F80E43E535F15FF8
SHA-256:	ACDDC9C50AED31612913E6FCCB33A1EDC8B5F235DBF1C4A203B4F41BF9C06850
SHA-512:	1F2295945EB1D5545AEFBC90FBDFEB68375049FF26916627F2C7A80256F2D28A0543389C583A616A54867CE85F4EF1FD3AE2B43045BC994F30E3C24B71719CBC
Malicious:	false
Preview:	....t@8.wl...{..[%oB9J7.Lb.. .7.X!9s.....:....D..A....%....\|....]...5...7..8.k.Zlu.$...~G..Y..!.+#.<R.F.U[.....~.Y.2,.._l....Q..S..I.....$.i.......v6.).=.5.~.......IlM..............Ib.>.)....,...J.$..........._1_...O......MiP,....._-...g@......+.....m.9..l..8...c&...yc....uN.W....X.g..p..:&fr...N.....h..y.IU........\%Ep[..w&1..d.fMo.........T,.<...d.DI.....n..B..."..;<pr_G.......q>H.k..q..25JZ.6...R1o.1l=.wQ.. ...4....\.\.O4.R....I.TD=..V.=...E...H...E<..(r..]..=........X..RdF.%..;...9.q.J.......xj.....,..~.._......3.du#..5m&$..2k......g\k6...[.(.l...aO..].)H-.iC>b..W.;.Rym.y....r.....L.....Y..;`....k.G.5...l..I....3eI".p........q.).0'+B.n.pK...^...H.8n.....D...LEU.\|.#L..m.%....p...?e.s.....:c......F......."1..._......}.I.:.....F...:....,..B...S.4....r.s......[Nx.....9"<.0.:.k&.$...IC.f..#.$y&...S..>.X.....$..-\.E[...?.......@n.V..0..s..u..+,:..D_.k...oGP.KVC...dC.\1.....?.r.....9.W.O...d..g..l...(.}.`\T~..S\|(T.......LR.Gf...d...

C:\Program Files\Mozilla Firefox\platform.ini

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	494
Entropy (8bit):	6.537708855863972
Encrypted:	false
SSDEEP:	6:aevbrsIl95aljQNw2gXXgEHl6FqOWwl/IeHl3WMezFGlsMG1D3R3zEHW:ayrsIljaljQNDgX/M1JJI+3qF5VlwW
MD5:	D9599B4BAA181B6095C7A0F801236789
SHA1:	4541F5333BAF742EB1C3536B92B18AC5571B9E29
SHA-256:	8C0A408A24C514017DCF4531BD10482C8F5A365DA69397938EDD7EEBB5F2A84C
SHA-512:	79E7493B82DD1F35D80CCDA0ABC317D6BC0628AD882942FF41D1D740492C538FC3D25A9843302B7749D81C023284BFC6F9769BE1B2A5AC34CA7AE3DE20E0A3A6
Malicious:	false
Preview:	<....n..1....\a...I.{....`.A....I.m...:..b..6....9V.7.;..v...0.$.i..B..WS...)..9.&}\_-..[,...P.\|S)\|(..-"....u.@.7.......We4c357d26c5a1f075a1ec0c696d4fe684ed881.........)....;<(.$.&..<.p9.Nv..8:.$s.!oIa..:..^.E....8...<..e....P.........#W G}0"\.5j.u..~.3I.<.G\|....,4.!..:.c...,..d.`.;.e$..t8.-.."R....DL.\A..2.B..b..o...$9..w\|.,.@..$.]R ...L..&b.c...XI}.g.......................................................................................................Y@....czyzk0zzhil.

C:\Program Files\Mozilla Firefox\plugin-container.exe

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	290023
Entropy (8bit):	6.693792920908571
Encrypted:	false
SSDEEP:	6144:0s2jwjYY0faIOciWgaV42LP63n7gzinmj:0sywR0xsUP63nEzmc
MD5:	BDF39F30C5F6B7480D65188BA17D93D4
SHA1:	F60BB7F28FDE42559276EA0982707685BCA6550D
SHA-256:	F62E6A43346617384EECEA4C47B3DF0D2DBBAAEDE552224FDF7994116DDD9778
SHA-512:	999D6A9C77F4625D0A5D8D143AEEE6ED6968E5F79165D2E316EBCEA41DB6D5874C62C1368C8D9B857098E608A2E8657A0E9AA02A1C86F58DAA3CE12065813C85
Malicious:	true
Preview:	....@.B....#0t^..v...'.MD...a\7.<_.Y...r.....:............`..>... <.S.E.z.=..............eE...H\t...U..04m.x.Y._..r.]A...q.\|.K..;J..]..Cc..5e.l.:}V.zGB..6...";5H.H......-..6.dU.]...bq`.~.....Q.r...\M..T.a\|.. ..RC" k/.v.....e.n..j_.S...,...T....p..6..s3T...yW8.=.xC..c\d.!G.....B R.x.] ..Ak......u....7.n'.].68&.........I...;......h..C`#...:.ff6K...M.1@s.@.U........V...>...f.!._..^.s0/.Rh.F/.....us?v6..^c.=.Y:>}/2....d.e.M.\|Y..A....e<CX.....'.<Qk..J..?.....[.........j.e.....T./.AQ.......~......$.....m@....Hj.F.....@)..<?......g'u...N.C...,....,...au....^....uH...... k.b.zZ.>y.1O...G..DN...0.Kvbf.9.H.l...F..y..6.u@Py\~<}9^m..].K....s........w..#.....xhko..>......9x@.[bH.....0.Od...D......1.-.g^.e..T..$...#.9.c-Ra..._[...>....0.%.....3...\|...>..KYw.......)...A.trlc......hs.0e.dM.aK.Tn..D.......i"("..o..j&T...."....=...q2.b.Rw.......wewi0TX...<!....t..49W>.1.8p..9..#....M..q...<.\|.=c%M0b}.G...g.....Q.H..#A8.?v.".8L..O.&.%..8%v(......0]

C:\Program Files\Mozilla Firefox\plugin-container.exe.sig

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1776
Entropy (8bit):	7.74199170701281
Encrypted:	false
SSDEEP:	24:yLYkBxsuSrrgugWB23KafWp1JPyZXRkkgi9RQYCgDa61vpSykq0sIlSJU22JuuW:yYwFKgug02amMPPmBkkR9DNUqWo+JuuW
MD5:	B02F1E896FFE4B0A2C1AC5A45933C1A3
SHA1:	5CA9FC06B5D1DEB8E195857E0E3B566360FFC54F
SHA-256:	85E30E009E58D64466AAF35788E4AF6AC81DB80C9BB9CBEB245F1C9CCF424AC2
SHA-512:	D703B786F1F982D2CB69047524A7A3638E87241F221E0572E0B71A24CEC5E1102004166A2E1B7B88326E563F0B20ED82C194CE97EB726C703EFCA8C04ED8A954
Malicious:	false
Preview:	.@.8.jLq[....lZ.p..[.....K..T..x.p.T.^.29\.6N... ..I...&.....:\...[l\|$.:<.g...k,.U......@.G... .iQ.6.!....~...7N...-=.I..qT.cl.S...K..Q....:5..n..r.......G,.%A`.....6...e.,..ul...`6W...NR$.}....Y..?...s;)..;T.r...-.qQCn....I..;.C..Ml.:..7P.=...e\.<y......k..s)...x.x....oF...6.Rg.^...;:.9.'......\u:.Q$.....y..Tb..?.y.........5.2..&.R...\...1B..-. .Z..%`P%.HU+"3+...'..1.w".....F.cD.)%.oO..7..r ...CU.+."H.h.%.C. ....qo.O.a&.o..$.%X..[..U&..6......m.s....m.5.......!....L.L.....X..$Q..R.%..A.q.q.9..P(d..3.<.}..U..w....y1O...,G....aB.B......gU..fG.M....gG......d....g[H...,..BeCj....?.....fKw5..m..Z.}...E...0.k..;....P.........."....d.r..[.G....1K..eu.%..8.....-.l.Lg..7N..K...'W"Qe....f...q.#H...#Q......F..!$.<R..z...H..3.tX......O.!C0R.$W:..[..{.E.......L.M....V.A..)....X..N..9....WZ....x.]..,..%..@g;.5..e... ..~.;J.8.f:..k..G- ?6.\......~..+.W>.......bn_.].....Tl"...w..Hy.....{....F.`+h.Gy..$N9X..c....VQ/#..r."...-.&.hie}./.....ky..

C:\Program Files\Mozilla Firefox\postSigningData

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	587
Entropy (8bit):	6.934995419461021
Encrypted:	false
SSDEEP:	12:jOkhL4Pg6UuKR7lB04osX0UkSutkb3IqXuW:t4I6U3IsEUWM31eW
MD5:	BE6F5926633ED606304A1FF88FFC46E4
SHA1:	0F4763F9FDDD4FB019462D8318521263F0A4CAC0
SHA-256:	B0C2B02E904532FB3886906FEDDD42601AC909237F65036308B88201C4F232D2
SHA-512:	C6E4EF00DC653CFD013608EC92A2225205EC8DF05416118EE3B16CE968F12A6153006BAE7C6C60525AC21FAEA629C8CC5D5546790F7AA8BEB9BC5A6F25966367
Malicious:	false
Preview:	M..V....5.ooa.9.xk.W...x?..4T..K..17..@{-....n....G..9...Z!.....qW..M..<.".m..P@.).U..}....z+.b...>l...W...^.b.=L.D'.'.z..spF..:Pg......=...".5QO.S..Q.b...s....[....4(.30..Z./.c.u...h...4..C..D...._.._.r%s.P....{..C.....91+..@Sw....^L..2529.....?J.6..4_....(.....:..5.h..J.[7R....w.#.f>..\X.tW.~....X.....d.(y..2........v.2..pD......-.....:..t._.`....u2...x............z.b...(P'...W...XM..7....;e(kkm.........78)..R.v..Isi.*.....-Q.,....$....................................................................................................Y@....czyzk0zzhil.

C:\Program Files\Mozilla Firefox\precomplete

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2507
Entropy (8bit):	7.827698045532054
Encrypted:	false
SSDEEP:	48:XHWMLi1Vvg6oVjYIR7AMHlFx3CegLokjDcjqqhVv/BnkGmOSJ12X4QKqjuXJtQW:XHWMLeVvg6eMIRcM9aLNyL/Bko1XwJmW
MD5:	A853FE61FBF559257563447BCB52F9DE
SHA1:	52B64BFDBC496222DB37C32C46BB66DAF4A07265
SHA-256:	A39A6D290E3D54FA3E13E4D4BF7774DA0213918AE54F52D4AB947BA7E20A6F7B
SHA-512:	C4E0FFEFE4A7CA66E7964E88FFDAEDC3669395D367EE5797D7841F816E7FA8593C0DB8D72B66CF204ECA880F8289EF640E3B6A354994AA3ECAA2395CA42E9DB8
Malicious:	false
Preview:	...^.............C.....j.>\.....E.F......"{T.pN..M.v..NW."...IS.@.\|....w........n.....]..s...j@?...U]...A}.M..c.).f.... .3.eU._.A2:W.Zy'...\'!......=..P5.....(...-8.6....k....e.(.......b6.4.c1F.8....2.....!Y..MHC.~...2hT/..zn.? ..l8....e..U..#&F.D.cD...:....:7..%}.=..x..p.....^....S.j...{......R.bD.=c."+..t...=.8Q....)0......I.w...^.tm..k+h^CJ...T.(.zP..D..,E=B7Pi.K...D.....^..:]..@.....-.........G....] wKL.Tuy{V....R.%ZN6.S....i4......s.3..Zs[)...W.\.#.iG.=.........w.6&.,._..B2~".%!..o.q}.....>I...p......q...HQ....(.x3.5.r{.q>...{....O.....g.Q.!...;...<)...s..7.r_G..c[..{*~G..I..-QHg.59<0h(.X.:v.K..............UN.j..a..{P.;JM(x..x. M....z.z...N.....T.y.l.$.[.9...M..;.4.'aL...0hT......a.'[........5....Du..7.J=.Y...:.[S...S.X.~?.!.E..j..XYy.IT.4..)..=D.q....p.B...#.$....dJ...7....R.W.f.....F.s..)W.y.....e..6m..?.N..V..z)....0j..a.M..~.#6...J......d.-}.....^!@.70(..9..2.\|..r:..k."...[gm.k.....z.Jn$..E....c.R..L+T.i8.e.<.z..C.).p<...=....z.>w.

C:\Program Files\Mozilla Firefox\private_browsing.VisualElementsManifest.xml

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	886
Entropy (8bit):	7.339555801038866
Encrypted:	false
SSDEEP:	12:EuhwcfPlJkVEFFvBEillPUmaubFOgsPFnqYUAt2N579PFmFINQfAkCw2lk8md/JP:EFcjBLlPdZO5MEfAwZKW
MD5:	2292277BA3DD29B0585DA7F7DAC6499F
SHA1:	21B6EF6F18274A3FFACB2BEF02296B2FAA001E04
SHA-256:	7025A8724F6567DE962DE20D789AE2761DB924A772B6265850EF294C22B829E4
SHA-512:	AFDAC580F7E1D0C21CE1E429F04DEA5043B59F97415410F7EAF42F58B7146EE20832279FFE5983697E2A862D9B957C1C02BD213F1D480805C3A8CFE979889B93
Malicious:	false
Preview:	..t(..,..E..E`\|......7..+m....T.R.f..$..f..-Z...i.)......:0 6..Lj<..[.h..H.P..y...O....L.3yk.olL3.......Q...i9.m.!.H.._..Gq.Ih...xo.tq^j2....n.:.%.l...s..a.{v..g5Z&...o........_..D...ll.1.%..^.....'.9...U..1p0... 1..t..u .l.HdvO..RG.!...A..$..h....._........v.p?....2.tSg..SJg ._=.zqY._w.P.B......~...<...sv.&5...e..H$7.A.S....+....2R635y.m..1.......eM..^.,.^^J..)..s+D.....GTq....Y.H\S.g.\.......I3W.<J2.x.8..u...Q[<U.(.m.2.....#x<........f....`A.g..z.p.....A..)..#............... BackgroundColor='#14171a'/>.</Application>.......Nd.^._....K.....t......P.c."................f9.z..5.X........!u......E.P.....F...,....-.<..6...2..8.RtET.......L;.5......Z...I..\|....6D/.E!.G8e2o*.:.U,.^K.i[....v.)Q...%K...b...n]3D\|../V S.;.....................................................................................................Y@....czyzk0zzhil.

C:\Program Files\Mozilla Firefox\private_browsing.exe

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	66279
Entropy (8bit):	7.025591831773135
Encrypted:	false
SSDEEP:	768:tVkGUxJEko8vLHyzqvYkR8ERQiEDxXyHnb4syNXPZpF3iApe16TzdCkKb7ApTXt0:rZV5BBI8gQrDxCHcseXBpZw615RTXt0
MD5:	141D1399D4D8E052014A187B217DE3C3
SHA1:	069E370DF4B9099402CDD89484D738A8BCA8FC04
SHA-256:	E991CD916D19EDC890E4FF2E6A8188964FFD30786622F0CA5C3B92B9DDC20FD2
SHA-512:	0B4E2B467A5B38908A4A09263A6819391B2A3B1F5CECF281C12C1896C93C813F4EEF23ABE076957B8F17E823EEE7C0B78A040C2831251493B61EA9544397EB0D
Malicious:	true
Preview:	..k!.#.../...5..;&..Yx,h....Q{_.l..v..]?E;w.V...^..=u.z..$.P......%...$U;S...%....T.O5...b.........%.....K.X%d..^...O^~C$.#.d&.Y.ew.;m.J.b.....\3.7..f...IZ..#.2.=.(.I...p..u.?..Fh....~.-.5#....@7..o.o....EQ...$p......g..^.V.$m{.X.Q.>.Y.v7[.,...j...;.TT]N..C..a.......O..`W..e>.tX.[...1.^.:f.k..+....F.GR.i.M.A..q.....W....L.@o..I?.$...o.Uf.F=..l...\|.u..&...@ti\.o.........:...m.p2,3..Q..^.!..@.nI....P..o..R#.#?....UE..wc....N....xO.0..w./{...L....X....5d..a...)...d<PK......I.?.(D....zr.N.?.T/Y(..".Y%g6..:%1..Tv..C..Vg...D=].z..z.....t.r~.J.1....%.e.......Pr.D.d_....^..E..@...h..T....O...}....'..n.........8.9.+..#.#y@.....M....{........e.-fA.PA,.. P...t.B+1.FQ....#C.?.O.t..u...Ci...h.z.OC......U...\|.K..P...+>.2D..,*..{..i...q2. .J......{S.......9..6,.....3.6._3.Vic..i[...b..V.h...,2Z..E2^.v....ol<m...Y`....a.....<s.......T. ..Q..<.Y. .b.,H...v.-.....Yhw ..(.cr....<...6.....s..'^..a11.b..@.4...+...U....N.....J..]\.%}.L..h....=vE$.

C:\Program Files\Mozilla Firefox\qipcap64.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	21223
Entropy (8bit):	7.164918011157556
Encrypted:	false
SSDEEP:	384:xwTrNc2XQouRXGnH464/OHDTOWiZ2J4LphZKD427t8E99NNvx+f+owRR7p4:x0rNnXQok0Y67HBTQUD42WEZ+fxwl4
MD5:	34A77A92958AC9B1ADBEE6472F761065
SHA1:	05B54C7DCA71644152E488DD9CFD31AD4A99523E
SHA-256:	0EDA96E24800E07F70E2A9742DF0B35B622F6B0A205DC7530603221E79185793
SHA-512:	A841DE46774EAD6268053E48B1F08A008EB2E3AE1694DB646E785DA2AC8705737003611040EC307604F21CBFDC0E19797C2F6346EC0231BF5BDDC533581B21B5
Malicious:	true
Preview:	.....2..$},^o.A...cqZ+........z.L....in...^.k..y...s....4,N7.v.l..{.I..4i.F..'GcMp(....F..9E$.xSx...>+.@..)....G.WFcR.....F.A.z........].(...<.xv.r...g.....u..~.SJ....]?7......O..5....Z..h.FZ.Z..^..4.!'.......j.G....._.'.i.).J%UE?Y.$........3...t.r..R..da.k....R.UjA{.&.O'....?J..]..}..j...@j.6.MPJ.Ws<5...N.....=..].h...D...X.....M....u....F.@mQ.....K.....A...7.)8A...l...`.n..u.uV ......k}...S..)%`...VC...-10:...E..Q...1.N~.m.[.:p....%1...]V...k....Q.[Z1......_.}6{.........H....G..W.T.6.,\..v.l..GDY9pr.....4p.CZ..3Y7....@...9.@s..".Rs.><.4...I.21S.86..y..x..~..`...KM...!...Ny....%..@{..~O.u...X....n.t..x[.P.nG`".X..R.j..GE$&....d........A.>...W.S.(.Fc....s...&.,,iF...(...Q....'..l....j-..!....3..n....7~".C......dW.MGC.......?.Pe.k.w.o.:`\|..]}..#VS,..@].K....k.c......"..G......"._D4E..xR.....u...e.4.wF..%=./......uL....(.`vZ..%.N.".4...r...\...0.F:....,...&/'H.y.VC......=.~..{.\...O(..7........}...d.z........I.)..{y.d.!\#. Z34._.N...0f

C:\Program Files\Mozilla Firefox\removed-files

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	343
Entropy (8bit):	5.856927045336121
Encrypted:	false
SSDEEP:	6:Sh8L8aCibsjDinF425PajtvxpRCgzC0qmTYOVOHW:ik8aCQsjDyF4A4CqYOoW
MD5:	23BC5B205E542045C29D55EFC79554EB
SHA1:	52C5748353C341305982765815F723F574E04893
SHA-256:	2502BC31377517DABA7D9F45DB840F5DF66702496AFF414690A5AF0BEF2DFAA4
SHA-512:	0F74A9D7B5E4B9B8FB9E05F95F47C7721097E666DB2B3DEC055C543488F258F40A3F62A6485149E7635468990ED5E85B578315CE1C75829FFC6623B6CBF4A6B7
Malicious:	false
Preview:	..[.r..AkVeY.VWw..3p...[....~.[.<....c.!..aV..;`.r.LA.Tn..yV...p.x......Xtf.J..\..R..g..............p7...\|.\|qX.T......%..k..2.P..8..&......T..qUWz...(....d..A....]...?8.\....,...2@~...HD...7.T+.....V..a......2^..........................................................................................................Y@....czyzk0zzhil.

C:\Program Files\Mozilla Firefox\softokn3.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	317159
Entropy (8bit):	6.673339068656004
Encrypted:	false
SSDEEP:	6144:R3VJTwIgowFKEwINLwIgowFKCNaQtW9OMaDg9/slUMFJqcPqkRPnbqnGBu5:RFBwIgowFKEwINLwIgowFKCNaQteOMo2
MD5:	A5595103EC73AF76CE8957EC60C33368
SHA1:	217A88C1E8F86BEB8F1CC9850A382C8834A4115B
SHA-256:	78E772A5DC7E935329B594D154E348934622C729B05EA84B6975FBE0E2DFF242
SHA-512:	1E829054D32ACE68EEAE62980923AC272212A405C44E5EC6984CA5CAB9C243E97DD19E34176F04F47448FEB320B12693E1F50AAC6C51846171878252EB7EA1ED
Malicious:	true
Preview:	R...m............zhE....Z..$_.....j..U}....r...Z...YG................3.g.:...E..jP/.&_W?......u=u$6.Z..f7.%1D.&.,.q7.P..3V.u.....o.Io5U..7..>..=.....=}....cqk{H.......0...9Zxj.2KDh.U.....O.A.i_:......i....t.\.^.....&s+.Xw.7.;F(#..z.%..N...)n..p...p.X...r.....b.y7.+.O{'e.Jz....@...\.<t........)n.......=\|o..T.}...F.O....r..8........._II.K..W7g.iW.Y..?.T..e.n.....Q....)..57.n..q.........n..g..QZ....Z.....w".6..x8.../...%]....@.b....q....E........p...R.....Sz./K:.o..6...P....)PC.Q...........en.6.....0.0.._t".z....}.'.K..@.W.\Vg.`..@..55.I....c..Y...c.'.o.........."S.....A.x.......,...?.C'M#_...w.:=..c..u..........4].;Nb.-.]...9..Q6..w.)A..Qq.~o.+xN..s(.4GgB8.#.wS.%.o....a.4d..\..F>...@Y:.yi....9...3..z......+...`H./.Y.l^.t..wH....m..........6bY>2..?..2.a...._.7..)..................&S.%./..h/G..t..e....m..{<..(.......d..K=..;..M>H.e0Jn-.,.b^R.?.Bq.;%.[...U{Z..k.9..Kq.2=..\./..t.D...&.XN..ty..h..k`^!.+.T.o.g..p....P.n..X.mUX<g.+...

C:\Program Files\Mozilla Firefox\uninstall\helper.exe

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1259151
Entropy (8bit):	6.11566893230652
Encrypted:	false
SSDEEP:	12288:z+CJUXoPOJPsOJzQX9W29BfiODUdegqoW9Q1RVJ5HHM1g8gtrKXqs:zkom9sOZQX9WmBcAi1vJ5Mi8UrS7
MD5:	376C6B9E61950961212CBEF35A8D0045
SHA1:	3FE10705A20F91538C2182141BB41B362A96B645
SHA-256:	0943ED190BDA561B43EA95E58BC3615E025F3443716CB13986A6EDE23F319814
SHA-512:	C44323E0EF05D87B5C9D33157DC53655E9C510687E8E4E2EACCCDD7CA5D6CCC4CFF91A8D2EB1368F166312F8B5DADBA6CE8831AD039DF27E868091A8B8F7626B
Malicious:	false
Preview:	.D..K.G.....a.J.K..\....EF*..+....U..fF].x60?:......$.\j=..4T...'\|.\|Ux8n..=k..X.q.....P..N...h.x.f.....g..#>.?...7.1..b.....n0..w..c....+t...5..L.0..x....I?.D.....I....X/o..A(....>.S@lX..........=27...9...1..n[;u.....2...!{..... e...........o...k.]R.......Q.\.......D.,w.s....O...o.bUh....F %.....Ka../.i.K..D.W..BK..p>..a..y...{.<TK...=.....{.O`.S.a!....g.<$ ... .v.C=..ps2...&..`..mW.......w.W.a_.>..a.%..:.A./..b.._=O....R..2.R;...>..).`.5P.....j!@.....h;#.{....K..q.a..9..Y..^.H...iWL).{../.V.'..._ ...d..p<8.T......?...m..6...w.....!.`.-E.#q..m.s.iJ..7.XZ.......E.Z..D.........O..}..f....8..g:~....\|..(..}%..N.K.-..k$....Q!.u.]...O....).8=..5..c....<.....;.n>y..<).J....gY..0(.N..&~..."....O_m.......`O....x$.x.\|b:.n..B..3j\|..[3...m...R...".wig...3......q....&^.....s.?..'w..e.....'.'.....y:>..KH....MV........Rj.\...j.t'...KO...3.qT{qS3....`.$..~.2....(}@vO...........$..D..M..Y\|.....H.g.8.hI}G."d..g\|3........Gs7.;..s..@-Bi.<n.

C:\Program Files\Mozilla Firefox\uninstall\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3IdJKOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW63dJkRNsxV0jVOK5
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Mozilla Firefox\uninstall\shortcuts_log.ini

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	681
Entropy (8bit):	6.9278257719717455
Encrypted:	false
SSDEEP:	12:8TwE8X6OmZajz/DiqwuXRcPtjEkco5paAUy4yWsvSSW:8/SpIajvXvhcPXTvU0rKSW
MD5:	E74B338D4232C7EBC1C1838872960728
SHA1:	7B7DFE969137398A68BAF683F5CEB41A5BB21662
SHA-256:	0C53C0BFCF28E7ECCF2941FC68F3BDF568B2119F410FAF0F37851D5D4E732B34
SHA-512:	515CA1532006A96AA94ACCFC985FE4BF04526755C29109BBC9C9F7976E76B2600A1969C19F414CED48DD9D17838699E97ABDC310A5852921AF56076F1585FA02
Malicious:	false
Preview:	e\|.1wE..B...%.p.\.Fl./.1z........n..]...2..T....CP\|Ho.]S.).C)L.....7......7YKly.#g....#m k..L..q..\|.x....p..P.1.._$..R>3.rs.~.H.gDp.'...d{..........9.K....[..H\|:.P)G..5v.\X....z.a:....C.b..Q....J.....F.'.M....>;E.V.q........._p.8......B..C%..{.".R.}'..I..........4.?.w.S.a9...ZBy=-................RR.G....M.i.g.r.a.t.e.d.=.t.r.u.e....... =.G.b.o.D........a...W..a0..{"......4....`..B...H... ..)A...N=x..\...6.....J...Pm.vx.... ......K_...U....F...p.i..j..{.C."...~.........%.....:..Y{ .P..}......O>}k...{..O^.y.I.......~.UDc.......................................................................................@...............Y@....czyzk0zzhil.

C:\Program Files\Mozilla Firefox\uninstall\uninstall.log

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2345
Entropy (8bit):	7.786528001520806
Encrypted:	false
SSDEEP:	48:s8vm0TLpxNtQBBpOch+1o5p/IzIWMAgOXTaW:s8vDTLpxNmBBpN3z/Iz1MAgk2W
MD5:	DE017C6950C73DCD785F00A08649CA92
SHA1:	D7CF1ACE4B5BC4533B0FF57D293E0A9065E69E29
SHA-256:	593FA60DF0178B3245144FA0D82F2079555DB7CF9BA65C0C9DC51D761D320B8D
SHA-512:	474DAD6E5D3C2E14B6AD58240900D53621C02238A4D7E3EF383903F61463E14C6F02B29877B99B33F92B90E909CB560738305C24F1CECDCE3348E4FB0852C83D
Malicious:	false
Preview:	]5..X..fm..%1q.F...}..C\|........./...[.\........X9..I....g...~.O..h.a..S.~....F.;..a..o.k....te..!e...a.......<..p=......n......ud@.X.]2...UG....Bc.h.a...5.Q>$,....o......R....e.K..s...,8...y.}.7.>...[l0....t...g....Y....C`......3.U.[...<.Pr..G.....M.I...O..o.....3.y..tCx..4.0.oG.... '......(....t.he.BM..]D.y.@........'.....!I...\.'..."...~..D. ..AW.}.........8.K...6...y.....s$..WV?.<M.H.-..=..R.^8m....a..e.V.........#,.n..].........r..7...=7....K..[!F.`.kt..?.2V....1..p...Wl.<5H.A.d74xsz&.\..o....!..OQ..I.H..m..k%.RC....vMB..6c....@\..N..........b8^.ZLW.B&L..nU...../.....-c.4...g.#...f.$9.B...I...B.k..M.......ZB..P../T.u.#.9.{..'...0.C .*......t.pb.,.....T.0......+`.8#F.T..[Y......uh:. ..di......nU...../..+..]M...[M+.r...%~.5....$....&.m.....y...R...n.c.az,...4a=...P..G..l..j...-].`.s.'pW.^hp.a0.ctiu...4,.hP.C....KK. .......0....`.....?$\...q.z]6._..V;aN?j}....7.r.g....h..&...x..k.3f...u......"........... .&]U...<.`.

C:\Program Files\Mozilla Firefox\update-settings.ini

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	459
Entropy (8bit):	6.469935940249966
Encrypted:	false
SSDEEP:	6:4qXPT9SdpFbvXYazx8Pxp+CK3ADCPW3KOBH629i9Jli6dDERG+77lAHW:4qXPZSjFXYHJp2O3LBH6N9PVK76W
MD5:	B77F1BBC22F0BDFFB438B1CE98BFF6E6
SHA1:	1A4F956D3E67CCC22F1E3BA9E7CDAA4E34CE2A16
SHA-256:	5A4B89231E720EE17965CEA87B3D6F8E74CC71C49F936058656FEC6A2B4BCEB1
SHA-512:	1D63DA8A8DEEF2FB571954CD4D69589AD5968B9F726751E6D83E24C07E1DB3C91E41D7B59D09F9DF509419E26678FCA654D42F8F2280CB5D07130E218A969604
Malicious:	false
Preview:	..6.F......j..x..\.M...e..._r}_}iq.L....FM...._...Id....}v..~...e.V@........].f.H2.JX?X..V.J0uN..B{.......;g..`.PdTvV.Y.)\.ase...;I'X....6oF8.z[....N.Ng".c".P.5..T..o...k...+T.....#..p".....D...x.RR.....[....v'5..g.=5.V^. ....-.l7...~.,{.!..E....^.......X9'...@..u.. aQ...f.Ap.cnL....<...s4..jI...=X}......rC...)w'.z....L6...<......................................................................................................Y@....czyzk0zzhil.

C:\Program Files\Mozilla Firefox\updater.exe

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	414951
Entropy (8bit):	6.483442633136464
Encrypted:	false
SSDEEP:	6144:wyTLUyTfUmyUgDffN1psnNaRYpZVkecNANeoUxd8yXqjtuFT7Kmlu:wo5TfybV1yNawDcbdVXsQ2mU
MD5:	2215433C868D1904E7E63516359185FB
SHA1:	676C056A89228BA523A830DFE2722516CD822B91
SHA-256:	FEBE3911027D68D9DEA23CC0215351134B3F933E845E4F8DCE96C8BD4076F6D2
SHA-512:	BBA530CF449D8EE6E880D5E4DEA9B27512CA033C9AA153AF241899E3C765D1AF284D7990399D9B22F223B899177BCDAD285CF533B5348295E7607F36F379AE8C
Malicious:	true
Preview:	....$.."..I;.N.......W8y'...b[...B..o..J....?,QQ...H..?.b..:h.B!..=.K..V.....w.c...........f.S.EP...QqR.f......e..b.=..}..p........`d`M.:.4.....#....`6..r...g..8=............J..y..i".h....L.0.Y.1.i.j7.y..B."Y@Q...cx.....D....'nD.zMHPXP~..4F.........j.1.[.@`l.@9.mw.~.n.t.rwa..-.\........H.S/._..0.X0..u....K .F....QDa..(.....ke!.`.$}:..{.c?.'m6.L.A.....{..Y<=...g.2r.....#r.v(.j{jU(...O.._7V..@<.L..".8:..VT;.:.....c..;.T../.../2....-..B#....z.lh....e. .$j.1.(.[......~P./.../.Q'...k..+.$..p?..yZ..4.Y.\7.....o.1.J..6.y-.....;$;.x.;.....w..)..O..;"1.\|Ylc.....3.$.....T..y..G6i ....Vz4.K..a.C.;`}.3.2...kz..F7.oH\c.0.5..W^._....&.GC...7...a...z....Q^..E.s.Jd.xW.k...%..."..h...Y..1..an!1y.(...J,..E.\......{%S^.."...3.TyMi...K..+..7;9.7..d>...7}j.....!.. .....u..9h..b".....ZF.\..yA;......CN.K..AE.{a:s.._g.(..u...9Z{...Xt{#..@.?..t.h ...k.`.Z.E......1... g......B.c....Wq..}.v.$$.f..n`.k.;B.%...........dIz}..lOK....-PH....7..[.hO..'.\..[.q.....{.Z....

C:\Program Files\Mozilla Firefox\updater.ini

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1529
Entropy (8bit):	7.671083413085326
Encrypted:	false
SSDEEP:	24:M2TBj5kpjj3AbSSniy5e6rIoezOeVG4EQ188Ex1wV3b7n8sHGBUoeOEshqp42W:fcjj3AbniyoNXOev6xeVb7zqU1o2W
MD5:	53C9714A0CA4365F28CDBE0669A01159
SHA1:	B7F025114C2E688C85A1895D63417367163201AC
SHA-256:	D7C9CC5E1145D7D90090592D6107F5687F398AEF194AEDA9CDB73B1E09C15EE6
SHA-512:	84D96919F14660503CA296A9AE9F4A1ACC80DA2E4F005674844F2736CD75D303F83953731EC4260E43D893FF50A1404BE8B5C35EF500D7093A98CB53463BE408
Malicious:	false
Preview:	......@.W..83%s%U..w;..#7..w.I'......k=.Y..,.x...T....P..~dj....'..)..>@< .C..E(j...}....\|....Y......C9..>.,..Lj.'.Q.4..G...'.=I(8...f.,V.r..7.....A...bKS[.t....y.......3.Y."N.m......G9Z.SQ'@..vP.$..y.....^.[/K:L....d.N...<..2..`..!..$.3!.^$1#n..'s/=.(.D]&g..qZ..~c.{x..q.g..u...2".R...R..N..[....I#..(5Y/.o...F.GVB.}X87.q..6..T.@....!..2...ZZ...4.U....U..ZK.Y..+.....r/...E.....o.N.B.N.a8..<8i.......MBr..j...I(^.+....-Hm...v %6.WNTJt.Bx..!.'W......`q.4."[.i...CtaB...j5.i......`z6.{s..H.v..i.qr...:.._k.F..L.q..m8\.Q.".\|..+\...o.....mL6.+..I.s.WFk.~....I.-.......B..T,$t..A...}8..O&A..W.!.s....6.t.0..?.W.....1....wb..).p..S.y..U.GE.......,P.,Q..........QN.\|J."!....... '..C!.j..8.o....Y.........\..6...69..t.w{.9..#.K.t@..RG[...g..1~......~..}W./p...g+:`w.r.J.k>/.f..T}.$x....b.K...6wy..q.k#{.3........()fY..P?...)6.gw....]..\+..(/2.....\?.8...V6%..W.oIo...Ona..z.....2h..u.5.0.A..V.C.c\|<D......#................2H...7i\|p=..]...1..J.5........z..

C:\Program Files\Mozilla Firefox\vcruntime140.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	98551
Entropy (8bit):	6.811793548955996
Encrypted:	false
SSDEEP:	1536:SzpjAJZFFOTVIVQ3cl0Iqa4j+ox3Mecb7WzVq3GQzJR:SdRaQQqapox3Mecb7WBq3dFR
MD5:	24D5A9C394F0B953776CBBD2421C105E
SHA1:	F0A553C5862A719DD9DC6ECC9ADC76FDB99BFF49
SHA-256:	C7F156B3A91EF7DAA8D7CC51E291DD01B30FCD49B4C51E26DFD1D6DF40C0DFBE
SHA-512:	9B22120D7E627E89E5BBFE47FAC020A5CD592F540A19DC4CE47C62CABA3A917E732C587DD7E87D5BBC0C00D9EF58722CA260DA90CFB705B89AF9C192EB2E4D60
Malicious:	true
Preview:	-.Z....._.......Z8.B.j....f....W.XL....0...o.~.[.q....V..s....Q../..k...PBOE.tq.&...K..BD..[.+.....b".8R.......Z..l0...M..........s.\|...).....a...x .D.m1[wr......V..X-..i...(?......c_.M.l ;..4.....Z.n\.\|.Y=R.w....E.<.Z....4v...^,......s.d..).=....+.0...v.4.T2..$....u.w.........U@.........xZ.5v..E..IW?SG...l..~e#.. . ..+........Y.....A4l`.BZ...h...pp},.Q...e.P.J...0..8..G.$k.....4_..G$.0...D....=..]....l-8+$L..e'.....#.,}N...^.\|..z......u.<[...;....i....h." ....\6.d......bj..}....^ZK.......CM.Yw.......f.:.."L.j.<\|.....?RA....x.K......F{W..L$.;(\|.95.m....*.#....0....s;....B..3..4...uY..T.}WhmK'.QU.,..p.......&.P.01@...5j":u....`.../H.....I...h2\P.Lx......._...<v.cj..p-.....\..,......z....ar^..PG .;.XfO.Y3U.{.\|0.Y..zG......8..`X... ..'._f.C@..[.....F.y..).\|....z)...Ab+.Y.x.}....!....!_..F.......=F....x.H..q..$q...Q..p.........J....n.h^...f.. /.d.&y....oB.w.j.T..dl.{.W.'H..j.....v.)=.Y....;3.!.b.....k.......y?Z..{CZ6.>..G.

C:\Program Files\Mozilla Firefox\vcruntime140_1.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	modified
Size (bytes):	37583
Entropy (8bit):	6.865134985347844
Encrypted:	false
SSDEEP:	768:72U3SdTgcRCN+/9aHD/ptnxcLsad/fCkiMYSYfBq:X3eN/I7SLsOCkiwYY
MD5:	B04892AB3D2D9703CE8CF1AEBB7E0315
SHA1:	2600257BF39D7E29E754C12CF0725EF366863933
SHA-256:	7E6AC277429E3F13E72D71304AB82FBB7C6608FFCCC9D2AD1A913BDA72ABD7EA
SHA-512:	E3D8F27FE3B03EEA776D83619E509751BC43EDD079AF92C4D832B2F26FFC2B8D0896737F721EDC502B5677707F26FBEBD49A5F963C0F83AA09A48763FCBC482B
Malicious:	true
Preview:	.I.{K..I..5@.r.........0..g.u.f.6 ...I.D_.h..,.=.K.r..7........A..~.I...\.e.]t.a.`s#....V...G../..N....G........3...X(K(..u.....;.g.H....,K,..L..C......0...9.../...K.3..2...^.....k?...GP!..a.....JW...hg{...a......I... .v._..r..%....4.>n....:jz8U...z^iK...4......2..g..F'.5.......j.. .2..k.+.L...X;......9..Rg..\Y.9f\.tA...l......Yqs..Dh.U....N?.K..2.!.i..6.....u...Q.'w&.e70..@1...1.....a..$.7.....g.f...8D..f../<'..A..#....a....g..q......`.d3\.cO...rF......7!...,.m....nnr..n..AK..t..M.F.{.po..Q.G.hGe.....[..L..I...u...Ih....+...L.Y./.....wZ......yfok.ja.U...muw.....).;...:D.TZY./N.@..9\.w..7i........\.M!V....LA.G.gR.PD.doD...+1n...6...o&\...{}....6jX.Q...o.4..U......Fo...HY...1hR9.\.p...z....8q.c...F..n.>_.aW.,.h..b.c]..G.. ....n....d.....C\|..1%..Dh..h;z...:U1c...#h...n...L...{@....:..7....Z..p.:.(.q...dr...S.fP.a...M.h......q...'&..\|gnM....*D7...m.....y..B.jC.a....3.aA..GF.[.V...C....r.....d..N.7....D5..M$[.\ ...A.}.o...l.S..a.f.a..

C:\Program Files\Mozilla Firefox\xul.dll

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	131645671
Entropy (8bit):	6.666996399174577
Encrypted:	false
SSDEEP:	786432:NlOLxQrIRsqQ3ZOHXE7MSjSOsFU5oTeTxAOhEa/GKi/LFLmXYXW:NlOVRsqQ3ZMCMSjSC2ToxAbSXYXW
MD5:	ED41398FF57759188823D8C0C5AD609C
SHA1:	C7F54A6B4BDC905093D58E08AA8AD4B12C072907
SHA-256:	33FDE8D2851CF2DF4DAB5623ED1D158A762AA5B45AFC3C2A5B37B3C985F3EFA6
SHA-512:	61398A092CA6A8D52D76DD12926E5DC39E801A66AF6CC723F070454AFC6EA98218E7FD5CE8B718D2EF6431073B17910F8130E71FE9561F85E7562D47EEE28A00
Malicious:	false
Preview:	.6MUG...Uc..\..#......cL....i.S+..!....sE...vN.G?...U.x...l...I......4.o.,.h...@.X..b.....=#........,{....z;w..\|5.....>)#..../....U..].3.....z..f...2.x..B1\.....;&b^FT...M.w.[.].....p.....n..).OJ...6.P.$......e4.kS..._.;..!..!....S..Zs......u~z..L..E.B.CtS;.U....D.(q.T.GC#...wL.o5.:...w.\Uo.('..;..^.Fu..+.U;.M..[.:.`...M/......u...g[....?b.-...A`.P...Qp.\....`...}.E..[l.....).s4Y..-E....Z..`.A..f...'.M..;.2..2........Z.c0).b;.L!./=.....T.~..<.....5.Bj..p8... Bg...)\|...KTg...2....[C..w?.nm.B....b$.8.X............./....v.N1@.....#.2...[........_..PJ.I`.96..xovT....c[o..1..N......0....b.!....WDJ&.....V.5..2......(Y!z.k\|;.....x.0.!U..{b..i..LOF.4.S...+:I.\|.(.3......]i...,...M>q,..i`...u.....z{4i8....f.%R.......C?..HEn..R.c.r..0....NR,...hL._ C.).b...]...w.<.].....E.\....(Y<.Y.S..... ...?H.8.mo.].ZjD3.o4......e K.R.....dql..aC.Fl....Z..%]..n.FP..+/6.....D.0g._j.-.yd....vsq.]4..N...nl.J.R@R:o9(.....Vo..1......C.......K..C..O>...w...R.S.{.....qlCV.8

C:\Program Files\Mozilla Firefox\xul.dll.sig

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1776
Entropy (8bit):	7.736955041286625
Encrypted:	false
SSDEEP:
MD5:	986F194C4ACB79531A0DC38C7B5D1AAD
SHA1:	C36F745933F53389A9CD28A11DF1F4EEE6DE7338
SHA-256:	BA1B9CC21E95AA229EBA96757D2C9EDC9D657E7DFBEAD3C11075B638702BD748
SHA-512:	9C960513649FC5DE890D94DFE5525C322925F2034C52D1758530A7714EC9BB45777CA1BE2974B8EF1AE3CC6E3CB9073D389BA8058F9DA10338C7639F4E915384
Malicious:	false
Preview:	s..6..T.%...Y.W%....:.9.H:5I....T)x..0.....\r...}(9...'&t.[.ku&..b.......m2)?..&..........j.r...........OZUcC.H!J{.E.c...1?.....EEq.....a...;..&.fT)....%.......cP.Y..%=. ..E#.../.U}5E..M>..jv../..w.8.q./{.w..}.8.L.rP.,...q.^.....Y.n.A!.x.F.9..9.&Lh..,%.+.{..9.....h...P.J....8....sY1.(R..'.,.5..u..n.4ZK.-LWM.....5..b0.h.?.Zx -Bf.-tGjO)..>Kl....u.,.&...#_.m1..<P...T..._j..#m.....87Rc.TW.U.D3D...3.G.n...7...d./...G+.E.Q..y....../...... .:...'..7gZ.Y".J,...H.D..c...."5..F.c...\|.)].....a..F:.2E6..A).............D.`3.1..S...R.B7.. ...E..N8.........I.d$w.2..$..T...[.-......X...4.........)r...{..I.K.m..k.....rh..UB(.RQtl.kU.K..Q..p{D...i..D.4.Y.Yj...g...@..i...``..W.Xc.-.`..sI#....j..D~e]e..X...e...I.....t.o.E'.[.iy.u...D;.#8..X.%I.....@s1.k......m.8.a.<P.pW..9...(.sM;.p..^.g....Q.n..{)O.P.z.(F...D..5.2Y.-k5.y.....Vo..b.....P.$....v.g...n..+MEnyu..Z&...l<...ae..~.Q..E...?)..h.P.........S@.<..y................a:8.:..&...`[r.."-T&...{..W.9.

C:\Program Files\Mozilla Firefox\zoneIdProvenanceData

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	400
Entropy (8bit):	6.168400410556056
Encrypted:	false
SSDEEP:
MD5:	5F75CB260DF98C13F276ECCB0E6126E2
SHA1:	D6EC33002D98986D9F7F427E7FA2096D27693938
SHA-256:	549517DF4A5C056BD0D7F7C70CC49ECA00C86FDB202CB16B54444506640990E1
SHA-512:	1E1D97FDFF506ED4FD3D82DD9927551C55CC98C8BBB989083B2FEB26ED7872A7E59F5849EB7EF14C48125F39DB5CC16288C459A9EA4EC090A12A82EA89D050A0
Malicious:	false
Preview:	.T...U..@mw......{..c....\..U.@........K.].j{C.~.[w..V..orCode=2...I....I%.S....l.!.*....X._....3k.0p................k.c?g..@#.....;.%.....r..`z(`...hv......................k&N..o.>..%-!..)..y.9X...W..2].kl>!.a:3..=..i....?K...X...>.....$I....ej...ji...[1.Yz.....................................................................................@...............Y@....czyzk0zzhil.

C:\Program Files\Reference Assemblies\Microsoft\Framework\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Reference Assemblies\Microsoft\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Reference Assemblies\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	true
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Uninstall Information\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	true
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Windows Defender Advanced Threat Protection\Classification\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Windows Defender Advanced Threat Protection\en-GB\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Windows Defender Advanced Threat Protection\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Windows Defender\Offline\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Windows Defender\Platform\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Windows Defender\en-GB\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Windows Defender\en-US\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Windows Defender\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	true
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Windows Mail\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Windows Media Player\Media Renderer\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Windows Media Player\Network Sharing\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Windows Media Player\Skins\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Windows Media Player\Visualizations\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Windows Media Player\en-GB\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Windows Media Player\en-US\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Windows Media Player\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Windows Multimedia Platform\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Windows NT\Accessories\en-GB\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Windows NT\Accessories\en-US\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Windows NT\Accessories\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Windows NT\TableTextService\en-US\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Windows NT\TableTextService\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Windows NT\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Windows Photo Viewer\en-GB\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Windows Photo Viewer\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Windows Portable Devices\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Windows Security\BrowserCore\en-US\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Windows Security\BrowserCore\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Windows Security\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\WindowsPowerShell\Modules\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\WindowsPowerShell\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	true
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\ProgramData\.curlrc

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.79315764555362
Encrypted:	false
SSDEEP:
MD5:	558EA847E654616F5FC11DDCCA8A8F64
SHA1:	B243AD8DFC493E6D1EB0ECAA8DB866AA6BA000C1
SHA-256:	F7DEF3E2815AEAF0B458BEF121924668477EEEC690660BAD9DB63EE24E17A5DA
SHA-512:	0646E5C3AFAFDAA75163C3F22248F4B40C1597940B222AA71006F719318647102669DB411B17E03FBC40CBEE64007C25D8D66919410003342712DC9C582A92A3
Malicious:	false
Preview:	={U..].w..9..j.'\|..:. ..X._G..y"...B....b;Z.@Fc_.i...\|~.....u..T..`....@....@....a....R.7..0.nu...rf...y.em.W..`....[.."..nUMK....g.Q..r2.l...A....M.LW.n..=..2...7.d......*...(NZ,.....5P.fk..0\|...y~...}.1..`~gN....................................................................................................Y@....czyzk0zzhil.

C:\ProgramData\Adobe\ARM\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\ProgramData\Adobe\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\ProgramData\Microsoft OneDrive\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\ProgramData\Microsoft OneDrive\setup\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\ProgramData\Microsoft OneDrive\setup\refcount.ini

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.87014136821694
Encrypted:	false
SSDEEP:
MD5:	05C9FD8B28093BDEEB4A6BEF8DF27555
SHA1:	4FFDFC1D0EB87BF6FAF3AEA25AAD6BFBA0E67ADB
SHA-256:	A841DCB5F1139E44E05CB337CE9DEAE1500460C23442F14BC25C7041CF223947
SHA-512:	5D57D7269F2B3BE097E1344FE3026E21E7C47D99BE95C48C7A4154E42071B8F9079EAEC65A31F7ED2BA777C7C7A067416914876CBE782DF9FDE7B177648C14E0
Malicious:	false
Preview:	Yri..".`uiW..2...%.>d,..k....u\o.y.7.#9h.....v,.I$.......o.o...d.....z..zT..w...W...DA...5.M.....hm.Mm....&.o..e......I.zH..N...]..{..5:i...].".@..V..R...'[.-u2c.%..#.....j.....*g.c%...Ko..... .k..~9..U..^.U.5.....3....................................................................................................Y@....czyzk0zzhil.

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\UpdateLock-308046B0AF4A39CB

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.651570618220223
Encrypted:	false
SSDEEP:
MD5:	0F92611EF0521AC5D9E4CB533381B7E9
SHA1:	6ABBF496B19CECCDAE9FA79DEAFE139A666D87CF
SHA-256:	D298154AF85EF635D8E6341264EDEF58840D146CC6684C06FE39DCA543B55424
SHA-512:	7148DB8F89CDCF814583266AA4DD71D78E02D672343E6192F82FFC8B2CC75D8AB94B2C489E41F4E8D658204064311FF3C887E3E7FCE887D0A6A3D34B13AB948F
Malicious:	false
Preview:	..8...N9.....,{`QY.1pF.."...~.+.I....&.._Un...M..(..BF.z..q$E.B..X.&.o.z..2..c.5c.<O.d.(&.....-...=c..^O.m.82&IxN.... y...k.{..(..T..k.?:..H.+..,.p..x.:.zI.".....@..V...u..&..U.>q.mk..k..W..j..[;...\|.ymy.....................................................................................................Y@....czyzk0zzhil.

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\uninstall_ping_308046B0AF4A39CB_6c4d48a3-a9bb-4a17-a28d-f11a368ae958.json

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	7686
Entropy (8bit):	7.624945160293767
Encrypted:	false
SSDEEP:
MD5:	FF79F5F0F43F61821E9DFE328AE5D810
SHA1:	894EB70574763205E05D8FAB9C7E6D197AAFD000
SHA-256:	1254B94729292CB28B224572CCB4E80C87623780D1C4A087B55FB93AC4542FB6
SHA-512:	77FC1143C6E7878EAD8807A6DDFD15799C38400A38CD3C8FE0DBB3929E64C1866A6FA109ECBC44ECA560C31C8C23D6C3F8904A6BB89B364450936DA028069319
Malicious:	false
Preview:	...M.....U&.....Y%.....l..f..@`;G.}.`.>8..;..M$.......J....P.B....()...).3.......j.8. #.IQ...,..0...l.Nv...V.W7.x....7..Q.............z]..e...lSz.@ H.Y..c{..........=..8...K.;...8.....C....x...b._..]...M........t.../.BlO.l.~....lr.7....H....c..._.c.$u..r..g..9S.K......-...o.wl..@iI.Q.J8....P,._..I%.I..cI4+.-5....!...1...?....f.../..\|..C.Z.<Bs#e..%.[VZn.nW.)u_...-...`.C.o..V.E]?G}X?.WS..N...c".(.....e.".0..t.9.T.:Js...r..3..A].K+...p.....y..q.I ......@...,.....{.g.......G.vNr....H7..o....^.tz^...R.4..lx.?..>.~3HCP.....`.o:.0W)r..[.F..f.dq..a .j..F;...<odO..e.@.4@+....h.$..#...+O...$.I..\....V=0;. 5...\...h._...*dM.'VY..).U..I..?t.D...Z.mvm.....+..\|.;...y..kG\.......i...B.$./ T..k.......9?#...7...WhM..w.A.......>q.q.abW\D..n.`.u{..p.9.y.4.!.....%..>.r>.c..I4.V.5.,.(5....h3..J.../.............F..;B>.\...).._..'H.t:..0..5k.p..w...A....}.q......f].!.:xS...8F.{..n.....kU[............n,w<...]..Q.(.a<.i....Z....).....s....V.4(1h/5...m..

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\ProgramData\Package Cache\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\ProgramData\Package Cache\{0025DD72-A959-45B5-A0A3-7EFEB15A8050}v14.36.32532\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	650919
Entropy (8bit):	7.359294891721102
Encrypted:	false
SSDEEP:
MD5:	59FE101B323ED37E682B9863847951CF
SHA1:	888DE77160C24AA5AA2896ECF972FFB6F38E47E5
SHA-256:	9CE1E36264D02902B7D7F2DCD9D8041B769C93C751418E1D3A155FBF8A3C4CAC
SHA-512:	095B532E8CF341B7430C33816C51CE432A7A7B001DD733DF1943972886327B37C543A38F2164E6E9C7A5FB221A3E4DEE7E76C5A80E05F655DB0EA1CD404212CE
Malicious:	false
Preview:	_J....Y6s..'...W..%`..'.%Z.zk.....4%....x.6L....@ ...vm..J...n.A..2fEJ..}..=./.qQ.$.`...>.O.O..s..... ..{L........XP%. .(._..~.<..sd.K........S.....l.`...O...#.1..H'.RT.v..3r.......h.o:.E......K..D(.3.-..z.Am[f..)?f.n.T.z....HE..^...b.8....-.1.9_..<_.W......,j[?..b."{..f...N!#..v..;..+}SA..n.....2...\.....q....R...a.I6.:!.cr5 .S..et..;..Q. ...F...d"..=..PhP...i.............(..-..q\| 66'~.Jf.(.(n'.,.......\..o[.Y..._V....B.....<ro".t.uAO.j.=U..`....6.3;..6.'.Y-...0.1...\....$....F..._..L..d.}...A..4.b..9.t.R.MU.'mLf...X.Y.^..H.......b.7.c../.%6....Ii..t..2e.m.....-.o.<..2F.w....'.A.?.....Bx.<...g.$....M"...zz .....i.ligm(.z.......!^@..3......(.>.....,b;IGCc&f./....q_...&.MV..&.....(Y.....V.:....g.C..Y......o....c:."!l/ ...n.....:A;....j."..w.....f8E...U<.....8.0.......D.Tm..,f.u..@Nrx..u..OI.._.{ag..k..(+~8......6C.$.__ ..s.3.y..jq..t_.K...K........%.D.A)j..p....a.........J.....+Sr......./..V?L.m.V..}.....Wh..&....e.\|M.Pq~..C.v.]..:.r........

C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\state.rsm

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1207
Entropy (8bit):	7.412095323251706
Encrypted:	false
SSDEEP:
MD5:	FE59D4C3B02ED486696A1172E78644FB
SHA1:	96DDAE9A29B40C4E7F1213A0A7750677A4AD7B56
SHA-256:	5CB03E8EED7563A427689819F5E91FDD275CBA02B1041CA4B338EC1FD77D5346
SHA-512:	B711B5781845CC51E2449473B4D6BCBF940554458C9B67AEBC0E658B8B2935BA01DC63CDE2D60D2A3A261D792DA8AF960ACD27B70AD1858FD5C3DEA4D6348D94
Malicious:	false
Preview:	.>]...\|...H..,..$.$..Pz.-.I.rdt..s....>D..Me.\|3.(......5I......m....WX.K..F...k..E......kVCl...As...(.S{.D...\|.....v..t.rHdD...p&Jg..\|.+.l...d.k..);....D=`.2>._....^".A-<...k.w].k.!foQHf.j..mY....WM..\D.@O!..E.i...+m..J/T.X...._...@..nzZ..H%..].$?.d.K..;E.C_......U.uo5.*S}.(>.5..w+.6e....d.....>A..,..V..l...v....".....U%.\|....aD...i.W...xXP.FU.b"..w.8.....G}....,L.5:.A4.+'..].._u.Y,v..t...<\'.B..#.vQUe.l.,....qBJ..J..6mGa.....gqk\|.Cre!}M>.-1.H......8A...../..:....._.....AT.....^..0\|.0.a1.N....=.{+....X....WukK.z.#.Vn..3.:.C..S.b..I..-..7....EI..}.jk..LSd.-H...1..WYt..d..>.9i1.....?...eu3.i.....b...0..`..nG.n.qG5..#2.-.....Q8..;{...> GL.1.......<T......o..p....!g7..%?[.o...~.~.....7.00..a.........[...Y~.8.. .M.....gI...X..=.o.C.4~.....>i.QxIH'o...........t.H..d..G .V.s.P.xV.,..P.)c_w.n.l.o.a.d.s.\...................................w.a...7x.l..h(.=r.......8s..Rsd..~...ch.=.FFq.)...[.e4.x. .....v.]t0...L......%.^..9...7..."?.EY..o3..#...7._=.

C:\ProgramData\Package Cache\{D5D19E2F-7189-42FE-8103-92CD1FA457C2}v14.36.32532\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\ProgramData\Packages\Microsoft.549981C3F5F10_8wekyb3d8bbwe\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\ProgramData\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\ProgramData\Packages\Microsoft.Getstarted_8wekyb3d8bbwe\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\ProgramData\Packages\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\ProgramData\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\ProgramData\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\ProgramData\Packages\Microsoft.MixedReality.Portal_8wekyb3d8bbwe\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\ProgramData\Packages\Microsoft.Office.OneNote_8wekyb3d8bbwe\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\ProgramData\Packages\Microsoft.SkypeApp_kzf8qxf38zg5c\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\ProgramData\Packages\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\ProgramData\SoftwareDistribution\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\ProgramData\USOShared\Logs\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\ProgramData\USOShared\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\ProgramData\WindowsHolographicDevices\SpatialStore\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\ProgramData\WindowsHolographicDevices\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\ProgramData\_curlrc

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.7462635979579595
Encrypted:	false
SSDEEP:
MD5:	2CAAB8B8246A00FEEEFE2C91F1EEBD48
SHA1:	7CF14C33156E72B9FD5CC3DD39B821DF827232E4
SHA-256:	74EC9AD3F63DAE387A608CB8CDA2618C5B99DE83C6547B7E61A328233D1CF3F0
SHA-512:	D9E70199F7E394706E4030F39D919088B23EAA146D8C608B5A2A2CECD76454D9909346C4DA8FE1E622F590C10B0BF4B19940DB89E3E4E35D825FFAABC8BEE750
Malicious:	false
Preview:	z.T@=.......[4.F........Q.c...f]..s.l[.,...O.@..o.....\:{.....B(.........md[..O....(.\|....Z.....\|)2x.........ee7.....H.....A....^....bg#j..b....g.#.....4....F.K..!s..PT#......g8.._{j<..d:...2W.y..-i'....m.....................................................................................................Y@....czyzk0zzhil.

C:\ProgramData\dbg\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\ProgramData\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	true
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\ProgramData\regid.1991-06.com.microsoft\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\ProgramData\regid.1991-06.com.microsoft\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1326
Entropy (8bit):	7.6044988151184745
Encrypted:	false
SSDEEP:
MD5:	685E6946D07389234092A943742EEC44
SHA1:	7787C9D40D5C3034929166A534676D0E2E74C96A
SHA-256:	156C51E636529AA295A7BD8560CD11EB0FF79DC7535D495705774A01111EEE8E
SHA-512:	AD7732032D8F7D6CBB01628333397BBA01B0E8FD4F948AE8CA9A2E2FF0576A224482F6B86E3908A191B4CBC47327C2A05B05E3B0656A602489CFD87B0DB015A2
Malicious:	false
Preview:	..7.Ds...A.!.b..0........Q......)...O. ....B......&..x..K._0"...?D....D`..<"..Z:.u...E..st$4$Tf{...O......F}....'r...\|._..l:.......<I{iTJ.,ry..a3.[....@....Rp.........Tv.6.rw:.....Y.....p...R9_...j....h.....gX....Z....._..u\|.&'.4.fxo...M.........%.C....l...N_V...x..G..a.s.D...d..P.Av.z.d.w...;.....v..R......ij..8I...P........BV...{eo..:T.<..os....._...>.bH.@..5.....<P..s.y..q.En.........X.+t.U..4.^..-.>.....n.@...^...5$.f?4..0..._l..."_~.....#......!..n%i...mM....'`...02.....F....S.7.\|Uq\|.t...+.V.;;a..9.]..+>.9....$..,.f..W..........'W.~PK.#...{...>..XHZ..B(."z.j&T...;J`V..U.h\s.Km..........t....c+y...F..;.KwqZEj..gX.\|..\|..mVo...,..oX<;].Q{.$4..5I?y+.....gC.8x....d..?.........o!UP.&......T.0.....D..PC..6.$.<..B.....l...r...a.V..!m..d..'.....b..L..N..w..K.2_/.."....E99ttuv.......'E..s.UI6.00..oK..7..Xu.I.L...8....(..c..,..\|.WU...8...s.P......Dlx.A..+.........../.'v.5...#......rk.`.2t7....'..1..G.ator>..</software_identification_tag>...

C:\ProgramData\ssh\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Users\Default\AppData\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Users\Default\Desktop\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Users\Default\Documents\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Users\Default\Downloads\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Users\Default\Favorites\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Users\Default\Links\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Users\Default\Music\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Users\Default\NTUSER.DAT

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	262471
Entropy (8bit):	3.8904403117154644
Encrypted:	false
SSDEEP:
MD5:	66DD41B0A180B47A26D0854C3C7DE357
SHA1:	31F06B2017AB10679F2C05D535553F4BEF972597
SHA-256:	5140E04B4B379D03CBB875EDFF54D2A2CC2EB97BC4F2A0C71045BCADD5537377
SHA-512:	F8C1300DD93A30E785179D133E143489D298424B3CAEED60B1506DBA1A4139C44D0DB649DCA62E8D33E09ADE875C598095249AB11C59BF41B012C4DCFDEB6844
Malicious:	false
Preview:	dz.....aB...k.[.v......a.SR.....n.....7.....a......n....tO..?."D.Y=.....&..y.....+G4....1;...>..+..g...<xg.....9..LZ....].`..`..z+.p~Y{^CF]#..Nf.....7^.'A........ZoZk<#..o..L9..+Y.C$...}..D.!.9..,Q....Co.....O4~.:.D...Q4..Y.....\|.E.Z....3...J.s..b.K...........N....%LU..J...V].:.!..r.t6.....}...s.:.tS.\8.n.0`%%C...........>..V......<..V.6....g......y.%.G..Q.VB.uI.cYv)......#....z....,.B......d..F..........j..=...`.N.g[....t}..}. l.."......FiEj.Z.l........X..Dut.xZ....kD.Y.O.f....O...a}].{QBh.6.....8.I...\|}J....)......8u....g.$...B..F...5........a........BMvt....8.-...L...l65.0...u......G.,.J...D>..Z+..Ww.>....oV...?.R.?q....T)..Q.&5..G.hP.w..IE..E....U....BFn..b...f.....C.9......"\>k...pO.%..X/.Q~z.B.m..K)..P.....~.....EM..f....eh.l..A1....R...E.G.........Weed.2..9.".q..?.6..r.......ZY.D.>.b.7.g...T\|..V8..(.A......Q7W.=b...70..+..1k.1.p..+/F..3..*e.}..;.....6..;1...{.@e".....u..S..]......!.'\.9.[....^.$..m,.]..v;.dP...G.......<..`r>.{EF....

C:\Users\Default\OneDrive\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Users\Default\Pictures\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Users\Default\Saved Games\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Users\Default\Videos\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Users\Default\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Users\Public\AccountPictures\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Users\Public\Desktop\Adobe Acrobat.lnk

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2388
Entropy (8bit):	7.795267498702632
Encrypted:	false
SSDEEP:
MD5:	AB72E6DBE5E9C51487EB63BA27AC8628
SHA1:	A1F014B5462EFB5CB24842271E7367D4B8744879
SHA-256:	BA9EC7F23BC94A3614EBB59CC41BB683F5892D96F94A52401B25D3DAB760BAC2
SHA-512:	E6A8FEEA9775738D711B226207EE8306A1804B2C277AC9CE2A06140828D9871859BFFCC7366A73FD3566C07ED4D58D703FA00ADD526C4300FF2A08E04A77005C
Malicious:	false
Preview:	..W........N...c...s...R..-L'.j..c...n._].ap....:..z(.{.b.Eem"P.%._...5{........P.(?s!.o..........1...#....m..D...%H.j.8.p6..$=.Q....x..>!-!).L-\.cx....._m.}0.o......z8b..ZK..c...%...r..?...h...R......<......H.'7m.Zh...R....v,...J........g..D.4.X.n......V..]uP....=.+..6.([/Iq.........'%...~."..-.....+...>..D..p...Q...9.[!8/.}...%..R#....h.[.q#...QL...7L..Y[A...`..ur..s.......p..3.e.K...A.O.!..A....9.._.`.vL...2V.....0......HC.).Jz:..h.k......jto8.s.....<.\|W.<0~....-.p.o'....G..M.E...'...\|/.....#,REG...:..>..2.E....Y.0.sE5..Q.Bk..1.D.W.D.>A1...-.fQ...0).E.A[..fqgCH..9.s.:.e...7}.).nb{...D......2........p..vu..^..iD..7.I....Q....r.qD.5...{1.]7...=i......r..R3..0..%..E^..<..-_.8......>.F..nJly..&O.1{.cT...D...:.Rx\f.F..ssKjJ.RC.a..4....n.V.~.SBd...-..m.^'m.]W.=.xw.S.D.y.E...pYo2.z.JM4...lX.8.-\|.{ .K.P[.,...........Z.U.(.."u.....!.w...-...N.$......~a..L.C.&....g.J\/.?..}.2...W..l......p.....)....I.u<.bG....,..N:.q.J...E..G...#!.l_I.j

C:\Users\Public\Desktop\Firefox.lnk

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	7.550673783549488
Encrypted:	false
SSDEEP:
MD5:	D422E13B807AAD2BB779338BD94FA1B8
SHA1:	0D433BC82DE4971FD3EAE97AD9ECDADEA1FC45BF
SHA-256:	36BC627240412F0F36500BE9548A18831E073B0D384DA332AEBCDA9DAFFD0A01
SHA-512:	C24D31DD955A780F7C947687564EF49E39B59B6E09631724C432586850D6234DB48DA430231FC6FF41B60F14E692B86881D234E0FCAE15F1A21EAA2E21F6DCA5
Malicious:	false
Preview:	....5$.n5..)wG...d[~...^.:......[.=X......b.K....W.B=h......K..t...W5.....%...s.:._."...vYY^~B....x~.....d....\|..=...K.rI."O...J...I;.u...^e.f... ..\..f..3..8N.(....q.c....>.r.e.h.u...K./..Q.-6,..g.....s..L..H..!.%..GP]C...q.."H...U=.{..........z...[...80...K..z.tz......EP.d=...!>..3.......cz.W.w....R...g..'nw...,.....K.;q`?...f.Y.i^..6s(...M.W...L3^....\|.`w^/~_...KH/.<.'Q.......]...Z...\9m.\6.}....~a .9v...3.,...$.w..hv.B..,B.&.5~tO...-E.m.q..d..n.gj.HM.c..i,..zk...+....k..\|.@q}...z.....W..*p....O.....t...i...W.=.nw]X..,.....<3.U.$...j....Wm.Q.yy!....;...b.Nq=.7..Y.l.,...}...E......Pb..~....\m.Z..b...`..^ .OH.......L"phfP,K.......`h)+.P.`..c......'])5...J.......5l.F0l'.S.}K.........T3..^...o.z.e0.C,.........N..0.....JR.....m."...E>..W.q..Yae..0..).ZA....JB...m..................i^F....D......%..}. .:+..h..&D.....G[..k.BF.L..{....]Zv.......I.k..^..8U...^.9..[..>~2.+)+..TPh.O...mZ.Sg.WX......E.$8=9.H.....K...YM...?...................VH..

C:\Users\Public\Desktop\Google Chrome.lnk

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	7.8229236239257185
Encrypted:	false
SSDEEP:
MD5:	515C174193DA30F8911837E37737C4F4
SHA1:	DF7C4FC907A775B63F649784364F76B5B0CE14C8
SHA-256:	870C2152DD7BA6CDC4AB7B6EA830B625820DE0A429932DB9CD91758F9B82A066
SHA-512:	AAC1CEA2A4AA5B89E11B43D41C5DE5275AD60A34B1A78ACDF4A2B680C6450A9F8D682BF5C58BB293001568639DFC9E8BC14B25D15139E5F1141B71168407D57E
Malicious:	false
Preview:	8.H..B.T$......./...g....;.j...wV.r.%8.cV..%.=.2...t.bB...\..\|5.i.y.b6.d..YE.`.......0....f..<..........Dq..u@.....fO..U..,....P....G.@bA#.\.b..D...&....%(......bn5...A.....A..r.;."..HO...... ..=..S......k)K..X!...x+....n.......#...bz~..;...L3I.P@..N...X.z........vJ.8..;.....CF.1. ../....L7....#.qC..Y....V<........o&..g..U...}dy.{^.....U.s\..I.w.4.A.aG../..O}.,.1.D.V..$.S..(....\;....5...(I..y....._.'.42M.x#.....i..........i8...].........B...@M).Xf....D.....71B....N...Y.&>.I&..h-...\....'3.{#K.. ...n....>..:b.c....B..d...C..n.[.N+l...PY.1<q....x.J......H.?....d;...q..w..}\?.exr...zI..J<..^......q.H.l.....`.H..$@+..w.f0&@..=tS."....{>FX. .2.6.k/..H.I..b..{u..../&...sH~....=.#.9..#....}..6.&...U...p.....R..K..68"3e.-.....a$&a,.q.a0./.5.L...].!.h.i..N#ee...1...?.Y..\..l..^._SA.=r..{.9 .....[L.#....u..[...b^CP@..m...b....d.?..[...O0T..4.c.'6.}._...@......dSM.=.$...}Y.}.a...`*.0Q..".....)...;6.Qi.......9.40.\|..76.~...4z.2..5<.$...Ur...B..#=.

C:\Users\Public\Desktop\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Users\Public\Documents\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Users\Public\Downloads\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Users\Public\Libraries\RecordedTV.library-ms

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1326
Entropy (8bit):	7.593049569637795
Encrypted:	false
SSDEEP:
MD5:	B48DA90B13B3D9A03FA53F5472C0E6A2
SHA1:	7E900A6868A3179A39AC0757AC7B8716EA4CB365
SHA-256:	01798D6305A0BEF8F59CA0FD517CDE4FFD473D9530E263772461395057D0354F
SHA-512:	015026B7A364DD25DF06BB0608D2529B2F02E2CFD3E0AD94328335EE4231D9AD4FE488B6BFACD8B7CF430D0C8C97E17E9272CAC73D67FB60FE1DDA8384016553
Malicious:	false
Preview:	k......._.{..(........O...6.u..h..w.....2...qww....9[..j..P]V~.D.m[.3X...c....U?.u.;.R..o..KWsT.........._P.6#>..{}.f....f.:...$4..Pq.V.....n.@q......v....,1.g'.....K...B...nH..!=...N....W.hM....)........w.[...^.R.x...[..=.@..IL..D&6UAO9....>'r.I.......Q.jDw..I'.K..Ib.w..Y.P....Nd..EU..d/.Q....:.W[..7$W<....d...xU.cv..#U.\O{H..I4O.j......Dv.e.B....).....+.2.f...Pm.."d..)....P......"..K...30...@L.$Q?.:...4.W.,.<....H...Y...Zv...................V.1(../...Q...U\|_.j...{.M..2.1...2........y._..)...+.V.g-..=..Z.\|.x,......!.U...k...8.m.+.O..A...E...9..n..1.....M..s..CO?-.C...\0.~.<....&.pU....YA...8..va.K......a........ ..92\.g..\>i4......%....9...k..?.g<..y-U...zL.K.P~..........A.....Hw.........6.c...P....T.-........X.8M.o.9.....R...2..q...X.....:....4.....A.>].H[6.+.r..v{....C5&...'.A.]..Om'b.YnW;......!........j.o\|.ANF...9...{9...l.l.w.+?.p2.w..+...V.A`...T...Od.]...E..O.....g.u.L.y/..A .`........k.#.]>scriptionList>..</libraryDescription>...

C:\Users\Public\Libraries\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Users\Public\Music\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Users\Public\Pictures\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Users\Public\Videos\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Users\Public\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Users\user\.curlrc

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.739128196389113
Encrypted:	false
SSDEEP:
MD5:	3BF053144582B0BCC36A3FAF84F423E9
SHA1:	BFDC84AFA54B2C80FDD8AC0431154F81142F5DEA
SHA-256:	F60E77F6CF4BF0F2A92D98C88917D989088B3079B8A0F6CC289FFB3F3226288C
SHA-512:	381CBF69778E6B4976B8BFD8BBB3314B094DDFD98901AC3AC566E662227A873B751F16616A5A4449F131F2AF5EBF9A89EBFF6C1CE1F098CA573C9E681E624A36
Malicious:	false
Preview:	.O..Y.....Y"V...J.H..5u....D.<..@.X.....P .Zn`p..~N.....?_..*..u...'........\|(.Z.w.k..`r.@.].X{..).U6>I/..o].G.T.......@..]...m...}.B.s:.=$l.....!.sy..e/...:lc.3!...y=...wo....!..A.0.V..A(.gA....Y.C..)......................................................................................................Y@....czyzk0zzhil.

C:\Users\user\.ms-ad\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Users\user\3D Objects\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Users\user\AppData\Local\Temp\fkdjsadasd.ico

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	MS Windows icon resource - 1 icon, 64x64, 32 bits/pixel
Category:	dropped
Size (bytes):	16958
Entropy (8bit):	2.9616661784314777
Encrypted:	false
SSDEEP:
MD5:	A1FAD2EA0C8FCBD0875248172BB457E8
SHA1:	648F40B1CC77AB6B34013F696F1C07D7ADF303CF
SHA-256:	2E6C63AB7769F3F7EA2F3622A865D857ECB14D7F2DDBD4AB64E15B6C3DC5E14A
SHA-512:	034DC081B23FC5A42D23AA3CB76A50A329BAD1BC79CCF37A33C9C78CC642D941AE22649879AC43F87077000711CEF0FBECE27C80313F83C53195084CFE6528F2
Malicious:	false
Preview:	......@@.... .(B......(...@......... ......@....................0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...2...0...0...2...0...2...0...0...0...0...0...0...2...0...0...0...0...2...0...2...0...0...0...0...0...0...0...0...2...0...0...0...2...0...0...2...2...0...0...0...2...0...0...0...0...2...0...0...0...2...0...0...0...2...0...0...0...2...0...0...2...0...0...2...0...2...2...0...0...0...0...2...0...2...0...0...0...0...0...0...0...0...0...0...2...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...2...0...0...0...0...2...0...0...0...0...2...0...2...0...0...0...0...0...0...0...2...0...0...0...0...2...0...0...0...0...0...0...0...0...0...0...0.......0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0.......0...0...0...0...0...0...0...0...0...0.......

C:\Users\user\AppData\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Users\user\Contacts\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Users\user\Desktop\BJZFPPWAPT.jpg

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1353
Entropy (8bit):	7.586326637768399
Encrypted:	false
SSDEEP:
MD5:	E231633F66F4672DBCFBA132C32156D2
SHA1:	2C20DBDF45401758473EF6BA209304608CDAF342
SHA-256:	FE3ABD905ACC680977D02DF7D7FA1000CC412355872FF8CD89C5A52C12DCBEFE
SHA-512:	4129909AD1964E7CE75E86E3358846B750714AF186162F2F23A85626F5D55A1CABA49412E0C703AD257CE38F4BD22E1374B2B131B88B60BAA528C75DCCAC1619
Malicious:	false
Preview:	...p.(Q.. ...2c...V.Q.......g_...St.C....v..N+ruu...L....R...rC.awK....t....l....X.D...?.t.o.8.^.B...m.k.#{.....7*..m"...:.D'..........<......'..K+.B\|....u[..t..>Xj.). ....#9...U}.=D...!....a=V...u.}G....w..3.o5r<3..CO.."....E...Tl.+H-.....>\...u..?.......u..I...R...t.J...D'.Ug...B>..E.t\.....\..l..f.-..d.:gY.]=..J....>J...'..j.&..)....E.2..K..`\.V..ayQ.IG.r.h....t.tT...\|;..a0.......).....~.........N1..X.!)....]^..y...qGJ.sm.4..xl...6C....ycf..>..X.Gg^. j....."..P{./..".#.}.A..t...u.p..l..%...j...1...a..B..q.Y..-...."o.....-...c.X.L...RGY...].r.(.n.D}...>D.}Y....5../../k:px).c~ik..j....M..%...9.Ww.4n......=....S..r.'1......^N.;...3".A.R......e..g.D3..<<....$..!(.sw..O.<!1.H.K!........B.L......b.dK0Gek.g.rID..;..R.[...1..J..`...c...+^.#.9.`>;.....g1.pu..vt`...wK..F9..z.T_.NB....i..[....,.-.R....E.T..........^.7.....KG..F.\...p....K. .....M....i.`S..w.R..c..i3k.....x..x..%........v`..Q...m.....!O..[_Y.-...!.p=.#,........U.....s8

C:\Users\user\Desktop\BNAGMGSPLO.docx

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1353
Entropy (8bit):	7.6276095919359745
Encrypted:	false
SSDEEP:
MD5:	F9A3A509B91414FE01A7C20A87367CDE
SHA1:	A14DA3949C330F47FC10DDFF2C0731A344AD2FFE
SHA-256:	A1E249CB8FB0A625700A045F7DD8EB6B87C571B88B149F4CFCA86EE5AF32CD3B
SHA-512:	79346648FCCA0B7681BBF316BF6E5958ADE18F398D11FD12C8260E3C1F4EF5D79B52DEDAD10E29947380A111D6DE8808FBE7FB200BCC5BE77959DB8C0B418F9D
Malicious:	false
Preview:	.....^.7cc..\.......N..-..Rp1..v]X...0}..Fl.+.u....A[8.Z.+.g..H......[.l.q...0\...&.Wd..&.t...+..u.-..T.O4........$.3.....8f~2-~...x4A.{d.w.r...RB.q....=1..!....O?.iz......#z..].^.F7U\v..5.......X...-..QB.......T.:l.!_.....w.K..#....G.....l..!..p.4..q.....=.68....[.....9j..M(.Pv.....-...[z]zG.n7. .......O..v..a.....Mb...&a......!;.@.G..7\|....hdA.qL.6`.t.u.....Y.....3....uG.e..O....$S..W.$zB.@0;`.s...A....E...(....f.\|T(....3u.."6L.6.n.N.O..3....5.g_..y.wXyD..!..Ld.<9...D3O}9.%k$..8.5.]...,.......8....G.q@...Y.).o./l......Qz......._..><.F..I.P.\|........(]Z.d.$Z.<....X..x.S..(...rSG..H...q........AU?...:...qt.>.......S..$.W......ts.C....O.Z..&.V.....h.%T...1<......3...Sj....,>`...J..j....r.3....\|R}.x.l.V.=.x..}..N..5...#........*W.?.T.........\|..,.+kFw.F....^....2...#.KI!.aJ==......wu.d.....3....E ....I...,..iI.z-..C'w.E0B`..$.4>h..dR./l. A...l.&.....c.DY.IQ....E.\.s'......h.#\|) .Q.4.D..... ..;.i....VG..x.8.b=.Q....~L.>.wr?.C3..q9..

C:\Users\user\Desktop\BNAGMGSPLO.xlsx

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1353
Entropy (8bit):	7.598627987301034
Encrypted:	false
SSDEEP:
MD5:	0365DD9CC66AD388CB5AD1E457376DF2
SHA1:	1A88FB0D3EC1CE8FC6AA3A5692AFE1A8FFF11479
SHA-256:	94A0A4074BB0D06C29E289179CCD6E6365382AD6273EA1B278C351CE450152B8
SHA-512:	E0F1917192333EB86F4FD4D8BE0BBB80482C07F09ACB461FA12CE5B8444537A37A18361525EF85D786527740E9601829C5A1E7281F13BC8FE0A825465B0F2C24
Malicious:	false
Preview:	...m...s..U~....Y.\|.Y".t.`...M..B ......:W...c9.G.O<X.....C...r.'..._U...B.....j..9....~?..m..)....4.&..l88..5.....m..i..b...p ..i[..`.}j.m...a....g)I.-F..u<...U2..@z.w.o.ZiT..`..!....[H.~L...>#.],v/.......u..3......(..).!.8..{...lN.[..8eP..@~1...;.rp.^..-..:.....T.J...go+Z.a.I.Y..A..D1v....m........n4]!.%p..a.e....Q..+BA^....o..G.....1....Q.?8...#q...K.e....[m....?$O...q=........;..u.q...d...Z3..9....J.0{...b.....t<4.J..5..w.<Ws....z..Q V....bm.f.M1.D.....{_E:.A../..[..D.p...(..q.n.........8`s._..r.......q\|t.._1.'t.....Ag#.b..._...w..P..3..h.`..Rb.J.7....+..%...q....I3...izb.../VU%...p....&.F.....[..{.5..P7hh`...[..eS..Z.UB..K...i(....l....z2+S.4...U?.5.Kj........"{=.,...>..{\|.8...=...#.rx....$.?..-w......JI..8...L`s8..}.."6F.....7SI[..@Lu..s......w>9X..6x...[..../.....f..^.....^XVV....`B+j-...;. .`l..8.......B.uRI28.m.q..uy.........Lqyl7Ct;.J..U.n}.....d.....@u".....^....M.V9.5$...9Cx?q.dS.6..........\.-.@B.....3...,...2d..Q.J

C:\Users\user\Desktop\DUUDTUBZFW.png

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1353
Entropy (8bit):	7.593027210619753
Encrypted:	false
SSDEEP:
MD5:	CC88F8589C95A72AA0F65A73B5543E17
SHA1:	6D506F88DCF15A1B03DC2CEC4F5FF791B2518BDA
SHA-256:	D7B16FEE8E2C81049BA2B4B980A1999FDCFA00D8D8630258D0595646B50A73FF
SHA-512:	A714A101FCC6B98B95ABFF1CC4E8A732C94DA955975CDACD591762285C98B038BA614807AA4EDE239E7E0166A2507C77F94CDFD0B59E4494EF8C258BD178AAE0
Malicious:	false
Preview:	.....~`[.1.;.g.............\|.....[@..Z6>v)B.x^...C.d.A.Mj._....k...x~.#...i..h....{BU.Fi.&a.k."..+.m..W..1]b.D.l...tV...TyAZM..y.g#..%})%...%ZFg.c.."....:[X.......q>...Y.I.H..?LI....#......A1.5.....Q.U..r....s.4.S..7;p\|.5u.....0.Xp......U..n.?.hbd_..'n.Z....M.H.^.E..`....%....O".&...u.a.s....X...-L0}i..V.R..w..:.._......H.7....S?...c.~.Mi.....-.)[=.....CV.0..\~..v`..p .7^.:..i...Qj...w.......F."c.i..c\|DNh3..n.x..{....D.G}.3......_W......K..z0. ..r....Yw3..Q...(....di....l...3}U...j....t.x.fr...RGg.W.z4.U.z.'.Y.C.1.r...a....P..%...&LO......p.4?.........}.X..K........J.......b.5.......ix...Kg.)w8..H.B..w...\|...X......4T.c..M...6.x...:.E..K.....Vd.@lr@&..t....9.y.........d#.%..z..;\|.i.QXh....!.."..'..F...T.2.....:75...&...`./..@...$..e....HWa...u........)..~q.h...!...]..,@6..K.{....C9A.%.J.r1.2c....3M.R..8..../l..u.*.]..K.'...!.....\|...P..!..[..sm.......A....h.0.=2.>M.-\|.o...%s.[...L.@.\.v...{.F0...w.ZRe..O......iF...oF..[.d3...

C:\Users\user\Desktop\EEGWXUHVUG.jpg

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1353
Entropy (8bit):	7.626952020739746
Encrypted:	false
SSDEEP:
MD5:	441F063764B52A1633000199F2E3951C
SHA1:	C0955A0B8CB63FF873C8412A4AADA3725DA16E21
SHA-256:	75E342752697C9B2A1E37917A309C5885FE671591437886252F9362F84AA0BDD
SHA-512:	B9134DA4CA61008A52CD753482B3B51E314E658D15E1969922AC9AA13D2E71AB751B2449210BC43C6BDF3858C2D61C09461EDAC99402159479F159E700123E53
Malicious:	false
Preview:	.bQ..s...q.<...'.@]:g.^.\|..{1I.\I.4i........Y.F.........."~...X...1..8v.iu..cW...f.....nC..A,i..E5..h....1...,._>..x..y....#..<.._~f.. ...w'.l.,..@..D\7.jn.^R~.!...q."...f..,J..'.2..gJ.8vX.w=5..._....\|..O.E.....7..P.....4(9....g.>sm..z..k2.T.s.:'&..}.~?.....Zk=...5./...H...v[...T..WJH......C...QH.hcI..q..^7.^.Jw."-$y.D8.d^.2....s%...A...\|..SJ.w..D/U8..G..#.c.0....%At.LL...1......=..lXg#..N..\...........s......(.y.~.R...,..3q].95%...-..Py.....\~.....a......>5...w+.T_..JN.G..m76a.........MyO,.......M.0.2%s0.jg..Yw.V7..^C...&..W......:a4.L.....as...S.\|.\|2..Y...[.-.L....`....E;.{.m. /.Lo.ow./..u...Qb2vT..J.{.!.Fb.p2..\..~.....]...v.Y.......kb.V.b...Rr..dBq..?T.0...vl....}^X..-..AUQ..<..=.qKP.......g..9f.?..o.8.8a.=.J.R..I......X..........fB....fI'.)......\|...I;.......@...y'1~.H@.VK,P.E.\|q.3...&..y.2.m.o.....CDN.b...R%...\..a.U!`..\|h4..Wr.C.....1i.\G.....o.n.I....@...P=2e..b.\n)..J.U.>...[...v..;G....,~.Zt<I=.q..E.K.Z..3@S.I.^...q..l.

C:\Users\user\Desktop\EEGWXUHVUG.xlsx

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	1353
Entropy (8bit):	7.6121323457310766
Encrypted:	false
SSDEEP:
MD5:	20071F09A10778BD1C11E08E4B0A3A0D
SHA1:	39E465C26CDE66010E6139C6266B0866BE9EF271
SHA-256:	C745691A1C2DA67690A0961FC7B3167A9D1EC9F385CB394CBA0298ABE194DB0D
SHA-512:	F201B5D686DBAFF3286E4B9E6774F003367E18797BD1A79DA00BDBF1680D173A61DDEDE32DC08E259F6BC2AB566CDB453E0BAA487A8D6F82B893801E5CD0B4DC
Malicious:	false
Preview:	...wX....}v./iF}..&.......n....i>K.K}}v...'R.Y"b..b~C.,....sb#...M.....6 .>&m.0.... W.......;.)../.....5.~.bn..;fNK.b..e.,..0............[..H..s}...{..KSU.z.L.=q..{K.V:#\|.o.`.].c..\|/..>9Z.8p..Q@.>Ro...A...r.NQ.....9'..e...!H....k.....C..C\|z...eC..g.Z........r`2k.d..... ..$s.cA/...u.c8.....a......q.\|.X..M._.a....y..G.[c.-Z...a..y.:....`...s.%\|...T.. ..O]...Q.M`.N..9oIz.....1...y1`..`......t.h.o.b..!.,Q.m....:...G.&'.]e..I.k...C....;.wa.Ek.!I..1...m9...x...CNG?Td..]..`...p4..S3,.`.5.!f.A....(~..;ZZz.sC.....d[E...n>.7..2.J.f....N..?#w...H..m..$.....5.I.=.RM..;../....5,N.N....o.........Q...e.v.....0..._..m.w./...m.\X...+37...9...1..P..z.....V...b.....i..k.D...M.uw.3`Oo..~S..p..B.~=U-EK...i......}i..W.-..'..N........A....O.3.D...m.......F\|@.\|...u0Db2P;h....\|O=...y.7 .f..`q....9\..N.X)&.g;...+..F..Q..!^{y.3..6,/zmC.....K...1..,..v..w..IE+X.':\.U.....+.>.].....q...+...1.\\|w.:.......H.\.1o.e.$O..%..d.4..f.x>.33#.1.6...Y......!.7....o.P

C:\Users\user\Desktop\EFOYFBOLXA.mp3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1353
Entropy (8bit):	7.607759169961646
Encrypted:	false
SSDEEP:
MD5:	378BD3FC40799563DAC41AA5538AFF10
SHA1:	56F6B2DA34B870B7956DEEAEBF19F64E60F4013E
SHA-256:	EE9BA8717D28E0CF2892CD277C151607B345BA785A21E289DE89EBF4F74A0256
SHA-512:	378FF03B9BA865D10BA136978C4E0670BFAD82C44CC43121C33CD19613DECD4088EBBB7E2EB56FDB1F02BF66E77990D19A8BDFDBFB53F911FE0DA69E0FE6E0DD
Malicious:	false
Preview:	).k.....g..c<........A................<.. .q.<..n..(.b=.5.00.KT....f0{..)...k9.XXJK.a9............~..F}-Z....\.=..8cvf.CD.d.... U=......g.7.i....Dh....H....>k.G......0.>.^..O..w......hq'....C..-..1...i.z....,8.f...d.\.t._ZB.h..~J.<e..;..vjB........Q.....2u.h.'._.pM.,..\.d.L.%.+..C.l.S.\|..E..+.A...]..k)...g6e.......%.)C_.W...r.....2.4R...9:K^..T.w...............j..\|.N.I.^9.y.\|..riy...E...{..o6.1v.!.R.g..U...D......_....!.Pb.\..~i.&..]?......>.Q....%.....+[.D....^...+f..`.^.:.J.....!..^s$...L..]._d:'\|+..y..6C........=!.K>ex.a....}t.+.Tw..lF.yD]Cv.#..u._&.g6........e..$27\a..\...V$&@]._...s....^..+.i..,!..S......,..{D....!.=..dsa4w..:F.....q.\p..b..\|12\$)w....J.j#.5...N]..Y.....c..}....q...C..9v/~.....P..J.sH .%.#...k.xy.g...Np..i..a..l.Mz.>.......U...:d.1_.4U[..T1....r.......xT.....^my..W9.{..0.B._u....e,. .\|.:.7.+......Bi.S.~...RD. .K.a`.......yw.PIe..PWT4..N.T.....=#E.~Q.P...S%O..`-.8q.`E%D....a.-~.....H.F..c..z....p}....S..=..0.cN^...7Z.l.

C:\Users\user\Desktop\EFOYFBOLXA.pdf

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1353
Entropy (8bit):	7.616947112981957
Encrypted:	false
SSDEEP:
MD5:	B20A786C907A7C786BB5AE25F4CDA3B9
SHA1:	BA67BF78C5FBC18BC0936053EE3959D815DCED10
SHA-256:	F45C4FA1EB363F43A1B9F78A8762AE973282291798849ACB6E0B9D254004E052
SHA-512:	4308819B5EBDB3F37B13603CA2D2995485D91E88A243B31F6A78FD86ECEC2402949860EF253B619A2EB4EA134629A5E1283BFFF5146CEC46159BC1AE1EB82B3D
Malicious:	false
Preview:	..=..Qfc..f.......J..v.a.#[..Z..n..S.....Y\|..._A....u!..y..4.D.W,.o..k.k...Q.5g.c..(......:3....l..>;f-..$.L.O....;..\-?......%W..r.`..1...x..m.7......a...}`....~>!drI.4..(.be..J\..8....wL.i.......l.Jg.t.}.>.#........0.......i.Bm.Q6.6..h....1....X.Q..M">%`..K.(nL.<r6......Z.."MEYd.J..3.U.d.Q..-w..k.r..V .$..@....8.J.........A.......3i@......R...R...Q..a...0..>.$......2.~O..>.Ez....G...mW..(TI\b1X5.I...:p.s3..T.~W.m....8.yTY`.F........a..4..zQDf..+....N#..MpRW(9...4;.'J.I...jH..).b....U......,.....IK.f1.o.u._)1Q..!O-...G..64.pu[@.v^...Z.j...3....K.@..e.........\.R.o`.>........+.I&...~......M.Hn.\?.w......A.d.>6....a.z...m7bb..$.=^.`...V...n..o0W@l...>..J....S......\|Q..1..-_.6.(%.....J.sT..e.Bqj..t2.&B.....?.9r.f...x...w....-.rT2p#.....M...g..B...l.....F.aP./o.p..$.3.id......&.'..._......P....p.=.h..[3...8r.)..U^2.....F.:g..d..ud+7......\|.`.D.eEJ...G. F-..D..P..'.y....5.f.......(..O...n....@/f3... ..E......gb.<.. .*..._m...;.YMB.Z

C:\Users\user\Desktop\EFOYFBOLXA.xlsx

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1353
Entropy (8bit):	7.603943439102328
Encrypted:	false
SSDEEP:
MD5:	B6FA98D13F6E6DE5F42D37AC4003E8DD
SHA1:	46984D0E169676CEF73AA5AA4879B5FB81763CCB
SHA-256:	9D4A45BF66FF2E334E542BE58A0D3F0F566AF7A8F18154B4925E91583E4C95C7
SHA-512:	71C89A00EB1D530CE7883A427AEC6B1BE708FF467BF4FDF83D457253D55B860FBDC74479B4F0DC3916F9FAF157C809B6987F9A6904C0DE7E77D5FA6F3780D053
Malicious:	false
Preview:	4C2..!..M..V...X..%..a...x9..{J[.;._...F.7.{#..+x.E...."Z.j..P.>.mlz.~......+.v%.r"....#%...R..?.AJ..V/..}.^+..+.......<5....n....M4(.yQ..Kh....g.Q....i.@.G1e...Y:.).E...vc!....H......,.A.J..../..!i..j...#..D........2...z......w....2.[..PY.3..6M....(f.2....D,......Ig.^.a..,...s..y.Sq.9<.......e..n`.q...(.jG..$...4.....7.._.YH..,.b....%Ry._.:_.^T..}.Ek4.rM>G..........J....\.%aPl...........l.Gu.Q..@.,...U.O..m-C....>;.....o..)..h..C......;..6.P<...`ziM.O....N.....-.'c;.C........8..bP.&gmB..m...[a..MH.+..\|.kJsJ...."..L......U.j. ._V-R}....7.\|>\|A5.e.....h......8.f....i......(g.Wf.J.IF.........G....&..E@...I.A...........?.:?QP]1...8...9x.hCKg...%....L..Ox.`i.t...a....=.h.1<z9.....Y{.'..rH.].3(..1...%2(..R....P.p{....7.2.8`@.4..,...zp...Y.;.K/...B.A&.(.j.Y%.A..o..9._.i....Ct.u'.~c..1..s..6.uZ#..E".O.E^...."...d..;.t_c......`.......o3..m1@....S;..<..a.&.M.l...9D..R*.w...4R...p...>.DNL.P._.......;....R#}...T-.z.{...a.....,..!.....>...t..\..

C:\Users\user\Desktop\Excel.lnk

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	2782
Entropy (8bit):	7.829275126162718
Encrypted:	false
SSDEEP:
MD5:	E4ECA0F4C2CACE8FC6CE75525525C425
SHA1:	2E8A2065C78CD96EF6EE5958B7BABAE974220172
SHA-256:	0060B2676EDFFE5C9A610573E689A31A17C56EEBECC73663C6CAFA42C733DE5B
SHA-512:	E84182AB37C178E2B7611F434D7385E56D5916A0900EF49E27E33E4780A2594D0DCE69FC10D917B2CAE2FC96B0E762A0CD5C845459213B99B0EC418FC568991E
Malicious:	false
Preview:	j$..........`?....zfi6c...o.2.G..0...A7w.N........nbC.T.2.(Qpk.k....d.F.I..s..p..U..H..VX....W...6..OJfe.M+p5....Pb.>....2..o.........P...I.2......E,...L.../......j5.C..B.....XM. .`..q7B[..\.f;.A.&...u.U8Zq.F-d.R!A_........E.I.p......5-.rP.d&.\|...%....n..T...P....-....~n8.].K.U+..`..9%.V.p'..Z.......x..4Fy-.u.U....Y.m%.[...z....Q...............[F.n^].+...Ev.u.......:.U..!.H...Od.w.-.Y>sx...2..<j.....[t......v.z.c.....................G..z....;..j..M...1..(.I.}.S..{!..p.f.t+.y6^....N.!x...<.......x.>6f.~....-..K.i....eR.k@9.....8.}l..Y..&...Z.i.DLh...2..,qd...u}y..Z.t......:..z:.f.....8...K..2.J3r..^.u...r.R...;'.d...U..d..U.:8\.y(#....6..r..*.].c#u.V.Tw...:.q.......nD...`5>.......I[....@..)...f`...e....!....74N..5..V[6N.s:..J..-..................^li.....z..88K".n.g!N;)..@./.Z.\..n...%.....5....[n........Dj..%9...V.@R..SV.j^....[..nq-...}U.Q..:.U....G.....\|[.Qe.Qt7t.<...[...&.s.0}...z.<..%._".m.J..p&0.$~.f.G...sY5X....'\..v....".&.)DD...

C:\Users\user\Desktop\GIGIYTFFYT.png

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1353
Entropy (8bit):	7.608183580632297
Encrypted:	false
SSDEEP:
MD5:	CB6E04388159960A76A98AE86C3EA833
SHA1:	C54F95FFCB6129755E90BBEC9E94DF5378ED2225
SHA-256:	ABA3CEBF462A1063E54DD00D2B20ABCEE7F9630469ED53792BF674BCFB7B24F0
SHA-512:	D791146703DC21E2C9EF8F162AE5F1A434C0C17870DF2F8BCC71441E333C992F708D5094E56C4756CAA9BE1E0C465F9BA665B09740F480B726F30795599A5771
Malicious:	false
Preview:	.:H!B_...n._."...qe:v."]..i.N...O"....NN.Y..m.>/..i.s..I.P.Ds.:..}%........".._u...t..vl..V.)?.(.a........!D.a.K..g.Eirz.,@...... M.>..M..EU<.g3.8...@#.m._M....`.).R...{.....D..^.7F.g.......hZ.....z!.JrU..D(z.>...a.@......b.9.QZ..d8..1..G..M..v....R.x..F.5>.`m.R.....sL...o....c.i.........#.J_..<.....c\|...z.......CG(./R;...g`.<..?..NiU..'C&l...zE....R..!..G....Oe&...zk ..Ny..?;{..%...s..J.....(..C...};...../.4...,...K6....q..F...z......+2..8..R..c..X..K...7O............Y...\|.1.V...\|s.0~....../...=..u........t...L........qB.......H.).....eTZ\...{......_g.r.lhr.sw2..J..H".x+k..l......}.. ..{.....U..Q..}J...@.......n.....F..4..o..d.;.w~Z.;.7.s..........H.T/Jfy.1..$KUy(u...Zv&i....oc..:......fV....h........y.>.@.....?S\J....!U#H..:\..O?.FI.\c.gAg+`.._;....]!p...e.....(.g.zF6..k;...Q..U....7.C.7....Y..Go..,(w.;..,M9.3WE~.E..!...qn..,...L..:.U_....W..H...X..9..(..1...<...K...v......1%og..+.x?.4Gs.".6.IE./.U:..Qp...E......?5T..Q)P.`mY...._..{.I..F6`....

C:\Users\user\Desktop\JDDHMPCDUJ.mp3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1353
Entropy (8bit):	7.590471288273242
Encrypted:	false
SSDEEP:
MD5:	EFC4DDF7384990962D519D599F6DB14E
SHA1:	ABD700A7F29AACD6851896CA7BA107EAD29A5570
SHA-256:	5A9D60C959B0B8B8C535BBA0EB147BBCEF8EBEEECF8D77200BCC72EDD7AABA71
SHA-512:	56693C6816322D5FFCF9F1C829A3CA828AEEBB2F90A373CBD8B177DF78A34F727B6F514C35911861CE013162E59EF7BE01540F722B3A1FBE060CDFC773FACFC6
Malicious:	false
Preview:	....,..ZE.#C.^....#.....T........d(.J0C.{..K..C0.....&."C..o..Z...}{....%..3..p..n=.m...C.ng..0e.!....V0..g.p...%.!._...j/.0..u..pwE.K.....X..=6-.@..v.T......-L......+.....3T.~....\.... f..sfH..e....S].0.ChT\|...s._v....O]....Z..d.....{.v.$......u....S%.X.....P..Y..#.j...7)...T.....>..........WV.Ti.\|.).F.F.B^ItI.i...+~{.N.=.L..Qn./.r.py.?...(....Y8.H.>.......[}vC....N..+.8`L...?..a.d..S....z.g.......P!<He.ND...vI &.w.....a..Ql.=`.~.&.'..(....B.....S.p..B.....+["....u.....$....Z...&.....{\..[......U...J....y.m.6]...Y.]..Y.ec...bSG.....K..T..7.k.?%.7.b...k....Lb..b...e......V..$...c..I..$.p....e.C.-..@.v...%.g..r.&:..e%.....D.h.0.Q.4...D O.o.x......i_P......O..2....C!\zCtj+3.\|..^.\....x..:}.2C.M...2....D..sp i.Vk....}.b.E.!S.2.....Q.E.....fph'z.....="a..@..l..5..4n....?..E...^L'Z........ .-..\|7.....b.(.[.^n..TG.\5gm...^..).. .M'.C......!...E.....@Q.......y3.c...1.e\|#Jz ..bN.?6......n..M...,.{......a........^..$%*$.3v!."n-..f...=.i

C:\Users\user\Desktop\NVWZAPQSQL.png

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1353
Entropy (8bit):	7.61669470318508
Encrypted:	false
SSDEEP:
MD5:	D977C2DCFFA7670C58D85811965DC08C
SHA1:	A31CFE38C21E0E9202699E0CCA5EF7ED4F1A723A
SHA-256:	BAD18C14331B68163121A2C36D7D49F5A746FE869280810E987244C1C1BD21FE
SHA-512:	0CC50A0AC80D7E2F08EE5A3972EDCEDF681FC685AE8B7FE41E2805913360009E39DCE583C9B6E1B5DB481B9BBBF8CABAF914EC4DBED2B5A57A7CAB9BC63D7F71
Malicious:	false
Preview:	.0......,.J..Ma<Y...\|Z......8@V.....\........gH.4h....t2.....d..Y=P......kkm.M,.td........#.....I..`f-.Wm.+......]+..Y....Ig.r.:.6..!..(...?.{.....H.{...f:.^.X....N.5.[.$.RXM..4.?....{L.~(r.+..o...E....u8.{b..`H.\..{..Hu.....T..0;@O...5.G..m...i/..&+l.L.....}.ma...G..lp.....W..wo.....8..B...$:-+.L....6.X~e.'.K..]7...EAXP..9.K...Q,]....\|.o.....A.VW........\y.........PP]<4h.%8'2.BG.....`.....H.`.\|..[U.".=.^..E..2.{l......#..E...V:....J...j.6.../..g[..p..KH.h6)v.v)..._..]`FW...Op....t+..k5...+...5..V.y.Hi...Q...-=".A..X..7.X1Z..'K.R........g"t...I~....K8..+..khh...$.W..x....%..n.m..lYevO...aT.Mq.....@.J..+.....b.....?..R....8..`...h.UQ......Lm.6......e......\|l....R].t....t..I......n.l..$-.........z..9[..u....sk..yS...W..6+.Q~[.....S....3....7.....".j.i.i[...p..S{..^.lR.r..m..\|q.......C..:.P.j.f2..1p....{yh4.....N..G..n.`Y..0...mB..9.].-!.l.zD....\..z..!P.]......R.r&.R.r x.....-.6t...>r..A_0.../.. fm......H.3....T...NoU./6..A

C:\Users\user\Desktop\PALRGUCVEH.pdf

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1353
Entropy (8bit):	7.623901782278435
Encrypted:	false
SSDEEP:
MD5:	B0E4D95553745947E830D03F52E97A4C
SHA1:	5AE003E8CE9AF8981157611A9D982653B478E2FF
SHA-256:	B035B96ACBF1F34382AAD735F536B6F014B6C94A56BD4895B637B0792C2BE3FA
SHA-512:	B88DE118D1918AB7A9BBAE332CF8E19471472250ED1FA7262FB1F1C8B5236351E7D44D5DEC86D3236B3195DB452B58DA03D78DA0E4FC6716E9E8541715D6AB30
Malicious:	false
Preview:	.~....\|.f....t.8.._.. q.h.....WBmYm..x%...K...V..E..`.lr...A'...i...$.Hy....Y..X..2....2...h.4.gg...J.........`X..r..EQ=K......_.3&.1.."NZe&......i...!..Efo.<.PCq.{9....TT.+ZW...{.....(\4...=..h.....^,...o..8.~.[SWOd..n>F.3{..{_.&.l$..s!:s.0v......dsnT#R.(U.G.%Ko...C....Z2.B.q...t.g..yG... w..BH....j....U!.A..{x......M.....(@..r.10.'.q.V..._iS?..f.....hS.."...n.8......P^...Y!..N .....v.l.....).a..\.A ...&.b....&..2.dc.....&..D....._<..7.c.I..'.}.7....H...\|...?..e..bY3.N6.{?{.a..A..BA....M..W.X[=....N...ZE..g.V......(b....z....@_.awAb.T...j.v).....2.G0....".Y..[;.LD..2D._f...,...ez..M.'....xP..%-..Zx...z..3...H.I..H....z..`.Fzr......u.....3...~/?.BW.('....M...D.._.~.8g.B.e....6Z<m@.T..g...5...Wr#zx...W....Q&4....q.+..U..'ceD....~~.......3=.q..r.KZ].Z,..-j/.Ud.i$..~...U....!zo...JS..".r..:.....z.@.....r.1.r.X.g.Q.....).......z:P..N..\|1..3BZ...*.~c-.#.1....V@9..A .H<F>L.....Cz. ..I..w.XS~...._}.@V\.....{.E.[.....`.'.....6B....\|.C......1.

C:\Users\user\Desktop\PIVFAGEAAV.docx

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1353
Entropy (8bit):	7.625313058088296
Encrypted:	false
SSDEEP:
MD5:	955EB60E02F75C83CF4C4E095A68940D
SHA1:	1B5A3C5C139AD4FF74FA98CC42DCA5BFBFD93A40
SHA-256:	19468BA71DFFACAE4EB955A44DFD3A239B5DB107D29AB74B96F909DD75246433
SHA-512:	F76BCB8C202187A7CF0644EFDF1E3D205AC5C1121E208F65B66559FB59EC279D837962C31A7E3812773186B2950BB2B48E112672BBC2E737A64E8D2F32D789A2
Malicious:	false
Preview:	.\X.R6...;.0zbP.I.57.....9....{^..`'.....DLn.3.......I......L.sv<.....M....hS.k...".s.,O.E.....N...1.M...=..&...Un.Z...Odj-.n.6...].%a_....tL..![#.M]...2."=y.........W..8...D.gH+i......<..................-.t..l.Y]......U..A..6.e...V&.xf.H2...9!...2P.tl.>uP.p...e,.....r.p..R..V......m....ei.1\A..w._.y1..IE.......7{...dd....... .o.N.M..w..zK.].V."[I.RL.. ..r..W.p+QZ.`...%.b\.<......%7G..-.......4..=.YR.0Z,...4.M...V.qM....#.i..E..1.?.V.....m.88f..s...j..B.jm.}A......`....~...)"..f..h....M...-N.....(.W.;7..o........\|.I..R.`S.k.#n.L_.+dV....@..x~...V.....\|.......^.......1[S.Q.r7]w..Y/..[em...o....sz...(U.jt.o.0.5.t.d.......7.gM..z)X...?0....Q..bwZ..]....V.{Z....s...8.(........g..ql..Y.kG.b..wJ(...R.~.F.$\..;H..~..K..7@g.....x...\e0e.]...N.b..MF.....-..B...:..KH.dU.ZF.O@..q=5."e.%z..L.N~G....z.#.k....Z2eH..j.R..6...U..d.@.......B+hxp...Yu......{*.....({..r....Z.....oP.x"[t]..BA..'......rm.3.V#...x..8~...\...3B.Y.r..i..

C:\Users\user\Desktop\SQSJKEBWDT.docx

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1353
Entropy (8bit):	7.6332626358829
Encrypted:	false
SSDEEP:
MD5:	126AB42FD4ACE50E3AD90EB0F31961C2
SHA1:	392245B3EFC0DA25BB887989A33863ED9E9E6781
SHA-256:	CF13F69676F5A018294DA0376D71CAAFB3B3327B3EB263D3157FC9B0FB5279BC
SHA-512:	3884ADC581D7E04DB4C6B37F4D5D36548D49CCA8802C30DAF01459D0CA7EB30A3FBC3EF2BBC205467F8ACCA450670D54071B01FC6F7D56FDA982A96EDFF88502
Malicious:	false
Preview:	.....@../..1.P=\|.).G.'..H.#...<.#p..K.)..&.....qX....U.....6{fI\|.....H..h{g.$..3_....FG?......9..$....:...G....FLY.`3.~.......d.Pc.:+..m.M...`..B'.#..eS.......~$kxQ...y.K......"w..p_.....6.......5.,R.........s.M....K.....E..N...y^..9.u......N.6^.(...d1>.@...%.%.Gt.KYq...S.B)...t...\|...3....4.@.....l..`..7...p..)^.f;..R;'.s.......Y..h..#p>..f.8N.....`..sZ.r..../.......V.b.O.y...i$p.....0.E.tH.a:#.>0wL...}-.p/r.}.L.A.g.3..[...)..{P..6f.A.c\|9.$Y(..X.........iw}......R).. .P...L..s...).a.#...1P>...t8VR.@.(..E...Y......_-........6..C5;.O-...~m.?.!..J}.D..z....f.]uI..=Z_2.....j^.....^...q...S..&..........q.V9ACOJ.]A.r.p..o.2,...`.4.yT.\|!..5.v.U1....h..d.....~..y.b@..R..p:\...&...6..?Q.g..`\|C.+lBV...g....\..ir........@...nEAJ...D..b...G@.t.....i.....Y.&..c'&.z.K.I_LV.....;n.h!Yu...f.ANxg..T.\T..K X.>%.......)..W[...*....%.'e.N..2.e...../.....L.%f..H....<..D(2.....0<...~'L...J%[&..7p.......aX.-..9...Fr'..T.g.V.K_.FP../u.>h.s.#.z8..e.].t

C:\Users\user\Desktop\SQSJKEBWDT.pdf

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1353
Entropy (8bit):	7.5967761680356185
Encrypted:	false
SSDEEP:
MD5:	3B7EBC4BDFD90F52AB28ACBA6D3945C1
SHA1:	E4B49854C5042CF9549AA6C0677057FB4190455D
SHA-256:	1D7FF8F7AAC0FD186B81CE24A0CAB2C81E38E64B7D0FE45E70BC96AEC2E6BB17
SHA-512:	5E183B39FB400A5C945839EE1FE94CAF58FC85C75528EFCE43D7F0B05BF4CE5D4A3D86CB13E7C9979D30F1B18B3E9F11ED9AFDBBBA927DD9AF9AE268721D8B59
Malicious:	false
Preview:	X.'P.E.K.y.3.w9.5.h..-..l......X....v...S.&.ku......7...@...yJhn2.}M......G.^....y.]..DDk....+.w$.E.nY......v.y....'};..5R..5.570.....RZ;..M.E.ZJO.s>..\[...Hs..e....?xu..._...@..,.9[..........A.f.... e..5.Y...oEU.$.p...M+....I..z.mv..E.%. F.;...W.k.B)...G...}%.....%.(..t...+8G.9.9..b 7......Z..9{......2.j..8p(+.e2I.:..e........-Z.C.B.G....).b...+hB...+.A.w.[%k.;"..t.Q!.C?...l....*6VYI.c...?It..S.uE.c......g;.+......i..yx.r....=...J0...M.h.6x9}......d.....X..u}:.\.ru}...1.[..u>..9.a.S.x.qE.....s...oC.j./.....l...!...oB..3~p#;..,....\|.^=....g..@.......qVE[5Z..._BKn.5.I.tb....+...=..4..d....C...[x..jj.Z.....m.../k.8.d.H%._..olt(.].ZX.J.W..U...s.6..j.Mi....z>.e..]....g.].A...H....K..W........%.C.'..=[J..@D1....M.C..;.3\|...#.eB..0..95.u.K....Z.]...o.V.Q..#.C.9...O.9;.?..K.0P4 ............H...H.:l.[.t...(c.l(J..U.+..VA.^&lT...t;.<r1.Y..w...z..DE.&;.L.sx..c. ..:Q`?...e-."....33G......&.@9o..N.h.t..j(k%..5.1\|7..Q...4I.1+...{.C..'P.l+4...9i.q

C:\Users\user\Desktop\ZGGKNSUKOP.jpg

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1353
Entropy (8bit):	7.62040656307006
Encrypted:	false
SSDEEP:
MD5:	EA7B9F80C8F05C13ABC0B48A42191568
SHA1:	5726048E11FC4FC4F2CC1A3CF90F0C452C04E220
SHA-256:	107C3524302E820CCEC1707CFED3E8AF86DFDE6163FA5BC3E1702EE90C764696
SHA-512:	CB7CEE8A4643441FDA26126918B16181322A8AC1C633D12866FF85135E2A226B99EA44D90FC376A2B612482267D2AFE575604984DBB13CCAADCE2FA5ADBD61D2
Malicious:	false
Preview:	......9.._..6..A.....x.g2A.1../.0..T?..!.....Cf.&..?.M.e....@....r~.^..3)b2#V4.....C.T`'...e.K.R./.....Mg\...o..I.8./..o..'oPu^....7K.....d...f....g..=.......O&.F.."/..}.1...W.C.....sfcF.e.o..h..E...\|.....z...it$.$..m...>T._.......c.O....cv.I..$5.......$>a..7,BA........t..;..........<q.uZ.F'..!....@...j..J$U_..T...\|....U..8..........Dw..!Yv.._.%.Y.\|..$i"...0.E9.P....2.!...6..w.dXvu.<(..]@.%NX^^.8....#..0s.}.h./?\|..P.....rn5!..._-.`}w..t.....].q.^.v\|....Y\|....PW.G.u...V..9tI.d`.Y....zO....6.4.c.......2.\.M...E..Z.aAX.{&.Z_...u.h..ET..<......i..6...F....U)AWz..q!.6.UK=.4. .D.eu...i......N.p..r.....CQ....)5..g.............M(!.....3.......M...qNA....h4h.....A..5....\|:`....-d.F..[C.pz.........G7..!....Yy......x....m..A....obj.....'.F.w..%...r...a..H.7..i....Z......D..nd5.#..s..r.h..wx.uT.F...S?..S..3F.>..7......U....j..._..^....."...].h.KF..PF..c.$....D_....S..F....%.3.X....{../N0b~&.....,}.r.RX...3fws..Q(.8.]6..\|D6~..*.....g...,.Ex.{.....

C:\Users\user\Desktop\ZGGKNSUKOP.mp3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1353
Entropy (8bit):	7.618867983070381
Encrypted:	false
SSDEEP:
MD5:	9CC47FC7A8A815FE453B4C7EF8409959
SHA1:	453A594FB113FEA1265102F5BF529E6FB9209C8D
SHA-256:	E58AFFDDA1A74E4BB98309DDDA25909CA4333C4DFDFD4DE806390BE22A9792C3
SHA-512:	ECAF62BCC58F571B2176B4F6B17844179B477AAF6303C9D5C92007015331FDBC918E0EA7C743F86E1909BEE2F40F7839FE634DD8DA5CEFE89EEFDF9247DFBCD9
Malicious:	false
Preview:	.. 2;e%..{..6...w{......L..XN.j......_f.cN.i.g.$.D..fx.....2.....CC...\|.v........?.f..\.w..W+{/.mI.f`eT[....qN.<........J2.q.9.i......Cr.G_.\.c['3..t.V08}Q.\|[n[.K.L........P.p.!.R......T...zL....m.....X.....@9...]}.g.m.n...N..!i25^i..Bq.z.......O..g.J.fca..l.......d.g............[.@S....p.8..<a.'..A..k.JW..E.&(V....8.G)0z..+...1..+.>.\..bi.Q.......o......z.....R.D6S......@.......R8......K.eM.H..{.e",,.p}.:.i:w..._..M(.....%$.o4v..a.t...o_..e....o......39....a.4v.1.t>.8....]C.($...3d....y..L.$.WX=.......]..nQ.......m.R+...r..f_.Z}..b}....p...8..e.t.......Y..v.....$..@.....6:.A...631...}.6./.j.j..\|.g....A&]$.K...ZvU..v.A......7l.6.M.x...qob..jF...,..E......aC..t....0.....&.)..pZ"..F1....T..o.i7._......d..G../..b.\|..=...p.WD.Q..?...!XA.F\|.$.O....@..o..8...T...}......o..O.K..}.Sk.N..:.. .{..*.p...M...q..{..K.f...r.....=.)..zX......n.#[...-zKk.V.A..`..`..nvPSq3....5......$..Z^:.P.~.I:......{z.~...:.Q.`X.....Q:.ge.......YT..B'......c.:

C:\Users\user\Desktop\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Users\user\Documents\BJZFPPWAPT.jpg

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1353
Entropy (8bit):	7.612587505293136
Encrypted:	false
SSDEEP:
MD5:	B0DF6663F006F937A361FB00C373AD45
SHA1:	6448A6AD899103C184242323617892F3E9E8A541
SHA-256:	D8FF76A957B091B8C601E941AB209E1009B0B704E66804CC6DC8CC9C04D74129
SHA-512:	B522754B1B08DA465F3396EE026E02AF584DDEC5EDCC3838034DAAEF1D4308CAB6A26EC96BE895B87D9FB3F7BB1C2C393E905F270375C4E394F108F0AC0A6205
Malicious:	false
Preview:	T.Q....+3.:...w.........;..%O....>.%.......:..?.1..H...m.7.....An.I}....j...&..O=.d....d.$.....H.t."..(.;.y3)..]n..hO.....(...-.z..K).Yo.0q"#.....x....#4.....ggt8...r#..J..`..E........ ,..0w...l.b...k?L'.ugF.....N./.#..z.wj.{..i.J.H&.....'.x...&m.x:E....G.7...F.:.....z...'7.O..Z.k&.....\|4%....o<...D.?.^\|...<.....QB..I5.Fe.V..2^..Pg.W.x5.u!.E.C......5....S?..fm..b.r........sv$....q.\|0.....6.."..gp....p.Q..Pm.E#{5c.5...mr...41..X.,.... ......SUG...C).%z..C.._...`=...S.K.....h.Q$^m@.B...,....7."..86.i.w2.s=.W.H.-.B........K.<......#x....9 wD.ZC.'..Y.";5..........o.gK<.%..'.>.W..".H..}M.e....].....HZ....y#...!BG...N...o.P&y.P...zs6.../r....4..h{]d.s.?'Eq..?......H..;.L.%P..0..<..a...r.S.Ye..X~...;...v...>.d...x.........~n#Bn....u...6..dc......:M.z=+\|.....p6...J.~.T[h..UZ.9...oJ.J..Id....1he.....B.....q......B.q;.....]....;..M.E.v.qh{.E<r.........=.._.v.p..#....0.D.q..{..zQ%.<7.s?L.6.`.T_.Q.._H.......:...~...u1....Lx...G..-.70lt.#Z0!.Y.o.

C:\Users\user\Documents\BNAGMGSPLO.docx

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1353
Entropy (8bit):	7.6389438173213176
Encrypted:	false
SSDEEP:
MD5:	534EFFFA8A0AA3C5AF24D579F9A34714
SHA1:	20892CA37C2646A3F69E51A64BC367242B995A8E
SHA-256:	F4C0E175D7408CBBF6A9C8AA13860136B25191E43307105824EC2A28B260B688
SHA-512:	17F5B322213C16F8C05B07E2AA40FAF6A89930C196EE0F1A91E4ADB243E1426CE31B053DE288A731054988C4B332C458A3731B1E8A854AC3CF0CEC35CABBD15E
Malicious:	false
Preview:	...4.=...\|A._.%..G3..NE........i3M..B.......;mS.wG4D.Q.{"4XF].._.~..^.?.>.7k...I\|..>#....XJ.w...!8]...&...6...P.......2......H.4.......t.....i..w..y(%..YD*z]...L.-...V..W...f.......-.,j...k.....#.......7...2..te..j...\|9..lNA.=..Z]M.....tN.N)....o..'.V........:.z......c.4./.Uc.VD..j......T.c.....zU...].F,..UJ..'..-.ez.....L.l...n.0..._(....B..N....e..7.B.1.C...1......Y...E.a..M..'..nQN.0..........>....(.)K.(h.lrZ.h.o@E9R..:..=.4..c.6.2.S....CT......EF..Z,.x.hn).......p.....6....X..!i.@.Gyi0..%h..{.=S.!v.gAW...j.<.......I...%..+S..M..IeG.......P.G......".]B..DW[.+...D..J}6+ R..w.....:.)r..x....VS.@.b...W..../.$..p.wR!..[.z.f.t. ..L..u(.S.\.x..Z~Rg.g..i....m..J..~..}.cv..s/\....a...7l+....{......q.:o..#......h>..p....?..1Y.I....^\|[8.,z$.1......L...g<..#qN..DQ...)..d1P~[C.....&\|..a.2.k,...3..".))..RJ..... (.%.........L&t...C.].F....?Y.7upS\|A:#^e..t.3..c....0 4Rq..+...$......`.....4..h..[,r.F.t.xI.t......}.-6Tx....k....o/iw....K..f.1...0BR.......

C:\Users\user\Documents\BNAGMGSPLO.xlsx

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1353
Entropy (8bit):	7.621529986871201
Encrypted:	false
SSDEEP:
MD5:	0AD5246C6CDAB70B941C256118F41939
SHA1:	19DB9ADFBB1CAF31758F5E8A57E6C2F9EF6E1272
SHA-256:	B0A31C6CAE07A833144400EBE122DB1820033BAA978ABB765B0FC0A4674314BE
SHA-512:	0E3AB11179D835CF68C62CDDA9C6A2EF85470492051203AE9F05F6004C309324106B323DBEFFEB3FE77245E9BCA723D258FF0A261AC5B8FF834326B19345B8FD
Malicious:	false
Preview:	..'.$h?$...dX7.._..uI.oN<....w.#.V.........5^..; cK}.(...]3...kZR)Q.i..}a...W.%..(.S....3..0..T..0.u.p..w.....t=W..WEz.,M..f...(..L.....o..d....d\...\C+r......W..uj..2.N...3.7F$.......oB0.ZH.{.a}Xyq...p..v!.......~...Yb.er....5.7.S.j.....=K.u..c.....S..@S.{ie..Z..M.M.......Ix....f.l0...X...(......Ee..d,.....\|.n..H..w...`.....#.K.<.....U!m.u..w......r.}......hbO..y...Y..a4.S\..d...[).A,..BZ...S....m.H..>K.l.-a.]7.....T$a>.}....a.......'m ...<{,1....y.:.......Cj.m.W...D...n....So...(..}g&`.....'......>..<....[.x..Q...H.\.eX;T.@..9..snb.....\|Z.66#%....Q...Qm.n..\R....w.....].... ,.{7..X.w;........}.T.........Gl..)Oa.b..L.S.p........V...;IV&..4v....Ybl..1...[H.\|. V......oY...,.N..=.s...N.#...ad.C..[c.RNS...}....,)...&[.1.....\o..........h..;.xnL..>)..\|.....w.....wB`]...7......7.V...rS.l0.S......]i[..1...".a.2/,............t'.d.JB..+<.6(......o...bod.;..m..4.o.0...@\.6].O......`......&.crQp."...O.A..\...1v..BY......<.5".o..;....

C:\Users\user\Documents\DUUDTUBZFW.png

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1353
Entropy (8bit):	7.605805363826189
Encrypted:	false
SSDEEP:
MD5:	CBCC55513950EB644601520469248DD8
SHA1:	5BB3F2DDB839CE57401B427D2E5B8F2A3701AF7D
SHA-256:	7127581A107878C19346C315573B4B6A59A9E32A098F50E9C8123C5E25D08185
SHA-512:	6FB9306169C97099132CFD353D83700D5090B726BFD633EBD35C4D37E246EE9B05B972C4FEFACA5B30F8A77E56D9F26340729316DA972F6305FB4D3B38051B4B
Malicious:	false
Preview:	)..4....E..Zj..p..............+,..dUtB...S..$.,`.m.X.,.Jy\.A....a5..RK7.....-...&.}.G..'B.d...`.E.(0.O.}.:..W.2........)L...8....#....V.}.M......G.....0.......>.V.2g....u...............\...}~t8[.H.....s...:s.2.....x...J......Wz...YA..!..7....x'..!?.E....x..wA.J."..$..m..rd.!"'..P.c..$}......>.....t ....L.M..8%....-...R1...5P=.....,k..hv.C.>.{.l!`..'.).W...m.qB.a..aa...T.i.9..#.$\......^.z..D.....X...F....g.;....r.....D.u.zR..,.<}.<+.7..7<Q...!.......Q...p<}..8....r......5.%9F/.jX.s..I..U.O..1h.....2...H...T....G..6..00..t...D...P.....ab..........e.....!]....S.@..i...L.k..C..z.*J[...e.....1E......r.V.......^ ..r.....~. .....Y..gc.p....x....$.......'.!.L.M.......hes........f..)M.....@..!......P...`./.,=#..d...qa...m?.,?)....2k..".j..../.t..j.{s.S...3.A?.K.....Z........p.uv.u..S}^.6.nHO.F....#.SB...,..r...[...NX:..D.A.m@........``.lx......2?C)a..xj....o?".hfl..9'L#.i...>.....v..:r.Lg[..$5.M:L.k..:...../..tD.a).d...&?+.e......YJ..

C:\Users\user\Documents\EEGWXUHVUG.jpg

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1353
Entropy (8bit):	7.61275631783505
Encrypted:	false
SSDEEP:
MD5:	94E19176B66BE9706624E7A4F7B9E349
SHA1:	4A1EBFA8473F83C6989D96683B55EA4C9A87C175
SHA-256:	199535152E0095523CB8DAFA05724FBE25E0395DFE31793144FD50A85E366E8F
SHA-512:	9B1C1BF3009CFF96F2E979BF06A6477D3E40B5D26ED07BDE35C2C29E466FE40907403412BAD428CA84DB0C5B22C0750E8C7252498AF76049B7BBAD9CAE8C92B5
Malicious:	false
Preview:	...lP.+....9.`.b1...1.y.\|G1.8.id.0.....L._&.X.Lx.n.!..a.FMmKx3..M.2g.....?..`.;......Lh..<..Ii.....4...GZJ.J..r.....>.R.lv.@..\|..T......[t%-.....m.=Wt.S....(.B.x]6+..L.P..Kf.K...l.9...h.04IEM.!i...-_lk\|....Fy...8.{(..-y}..^e...~X..3..nq.....8.{....\.}./.t..bv..(.e..W#57...... .....!5..>.....9a.'O]._B.mE..x.h.o,..b....\|@..)D..}.7UX2..}x.#..q..M.7..3B2...d.n.@ ..97.7./6=R...t-........N)~.O}T..1.....qv)v;.A...........i......BL.j...1.t.....S._..............3.i..p...j7..X...g.q...i.e.+..7.....N.N...\| ..DM.g..M...:...b~.g.A_&.Jj..w...SW..z...D...z.....m/V..C.Y..x..f....p.c..{..if.'.j..Y..........o........5....U....e".....~.]c}.i.....R.."}...D.B.HF../.....\f+.!..%.z^(...8.o?.....2....H>....fy'.B#...vD..@.e..).s.s0W.....w...O.J/.E.A%..lC....-4..Ub..f=.WR...2..u.EP#..T[.....<&.M....\|vJ.eDR.P..}.Ygi&9f+..I........0..t3....?.'....G.L.?.6....4..}M..1..._...N0...<....e.vN@.$V..oq]./5l.f3.&..(h...M..d.!.q.....f.f....D..._.]....T=...P.:.v....:.~..

C:\Users\user\Documents\EEGWXUHVUG.xlsx

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1353
Entropy (8bit):	7.612887069750097
Encrypted:	false
SSDEEP:
MD5:	FCBB3B0D8DE8782AFC8A0C7C67215CDB
SHA1:	16833A7FBBE07F1BADCD945305E4DC3358734B7D
SHA-256:	40FB1A4F3F3D8F330EAD5503A594003725B4CC38CD4C24A0DCEA0D880594D76F
SHA-512:	1FF2BA2BCD6E1D55DAB7AC262F173ADC50730D5FFE4B8E7840A16D452C2F62EACBF20CFF74FEF39B20A79F74A0361B9400EC7B514B2CCE228270FEDB968C7CA7
Malicious:	false
Preview:	.j...W";...;.........9@9.......n...VA#....M..5.Y....i...i.}xn.f)c.......7.vt.uJ+X.....@..6...'0.....5.d@...........a...Z.&...fn\|.Pc{N....X.S...V........j..Eb..Q.o..?...;i:...e?J-<Qg(..\/..W.e.....27.[.8.q...Z..7..2#...0].....C......!..R.EN{+[7y4@2~&...A.X.^....$/5."T0@]....u{...,?.Q...G.W.,o...$....%.:.R.fU......l..E...S..{.m..n8B,!..AC.S._"2..m....8.5.y..e...&x............Dxx.!\>u%.o.....5.Kys...2.a..Y.ZRo...57.o6.h..-.(`.O^...5P..,`.+..%a6...P...2.....E.30.I...D4.w]...g...s.....l....?.FXn32.2^.Oa]F...QqPA.0.>fm.x]j..F......T"?........rmo....D.9R......L+......[v....@[.L.x...l`....M....T.9'.<].x.0x.O$.Oo.....J....`.R..g")$.p...l.......z.3.fr..nn......)......^.Z\`......zq.q.....D.....\|.X..t7..n....7.M...S.....l.i....=...uu..a....'.-............&.x....L.B>...v.Z..s.>.PP\|$.{../..Y.....w{~..CX.~...i.8....)3.`.^..QY...W9..>(.T......F...Rj..%.M.%.S....m.s.....A...$.Y..5O9.~66,M.......M..G...g..B...5O...Hvl........P'.8......d.]&6.Dx.5...!%...

C:\Users\user\Documents\EFOYFBOLXA.mp3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1353
Entropy (8bit):	7.631985922962548
Encrypted:	false
SSDEEP:
MD5:	50AE1A7EF3304A15152466919974D0AC
SHA1:	A7A6F0EE41139738E287B2A34CD68C3677924CAE
SHA-256:	EABFE68900E9BB3FE642137836ED0BFADA5BAE88C023F547D97C4E6B2E00C108
SHA-512:	087A563F07644ADEAA4DFA0611B6C9211B95247033344D2FC1157B25E61479EFC0BA0882F72E534898201E1E879453016E0B1B1B76D05280917846EC37A72A4C
Malicious:	false
Preview:	g..G>.-.C../....5.U..........<u.....<.$.T$.(...p.^.?q.t.o...FtMX...p(.a......l...1....v...:...Xu.+...sv."r,...;..{$U.}...yX...n<-.$.R0.....s..Zp.....O.... [3...%u...j.j.3.e......?.@..VIn....j .).yZ;.\|..>O.....E%.0.#..O.2.......rcN.......GmVdt.....\|a...R..h......c..V..i`:I.u..:...,z}.@.J......_HA.....p........;/.....2,L.....w...r...Pf.....F.1..+i..tu..o...K........0..`;;fX.].``L.v......P..fF3..@.{X.?o,...a......Iq.K........ 0......N..f.T...5.2....]T.....~.o..x./Zw.....8.z.w.?jx....2.^..^.\|..K_].f...-....."..6FI..6.EE....0W......T..}..../..?...#..#.&U......S..EE.yr....4........C.\.....gq..'..\|_...h=..f0.].Rc.y..G/`WL..'Yo}.h..T...P..S......ky.4".2.n.....".M.a.w..4...S._.y.{....c..S..C..jv........O:.K.......o.e.B. .3.qZ..}p$q......C6..o%._...X..N../.(.H.[t....q.`..)..V......3$aJ5Fdvw....9q....Z......g.-...&~..#..........h...3..9[.;_...-.Q.C;..0..4.PW....I...~a..u.....!...}..5.i..J.;.N.\|.;...YU....$...9>.-y..{..FF.N...<...)!....v...p..fe.T.2..)

C:\Users\user\Documents\EFOYFBOLXA.pdf

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1353
Entropy (8bit):	7.627437840355294
Encrypted:	false
SSDEEP:
MD5:	D6F52CA4E2739E4159524356122912F9
SHA1:	0CBCD2E218AD6578F6274A9C3666A0C1D9859D14
SHA-256:	B94F44E53F74496CE39776D09708028BCB6C8F4358CE3A6AF8F4E2417553E7AF
SHA-512:	C9333C5C5EA02539457F087E36310F7E5DEC0E381173B969709567339F2DC54DDEF16918F343B122FE418C0A8B7E8EB38D290CCACBE11632D8C0BA17AD4D2EB3
Malicious:	false
Preview:	.\|.N@.0.:&.kY.x.ST.L.J....S........C..y.(..e.[..L.6..X..h....3.+.(k..0a. .y..dC..~...z.\{...I..(?.>m.7....RL..$]%S7...1r...cE3-.m....O^^......K..$...v.S.B...3.g.{..kCo.^O.{^.Bm.a.$,.....,(.\PgT.p.e.39...qOw...:Y...a.a....\@....z......4?.9O./k.bU..b..._..R.....j......k.y....Q.P..1}...z..cU..l.....s.....'..^.\.../.....z.&.Q]Y...E..`..v.vf.s..X...HU.....G...D.u.p..ZZ...P....%=.....L...'r..".u.....>.PR......X..E..`N.l%.h.c.Q...K.../O.lL.]i.Q.Y....1..T$.9.VF....Ec...S:.c0...G...y...K..n...WX..-O.3...o.....j...../Ej.#3F#.sD.....t"}."<....C.9.K.......P:.wR. .Sy..L.f.G....U,/.q.6..;....h...:.~.f.".)..;.gt.Z.t...A@.\.I..eC.v#.m.#?.....M92O..#...!.K....=.V..8.W.G'-5.](PsaCv./sMf..p.T....m...;... 5...+.X.!..o"^R..`~x..[..L.....R.u.;.....y..Bk.(..~i!... .-"C..".......lc.l.x..,g.1.Xp......N ...nm..5}..... N.n..^}...%Q....U$...G.k}q......%...$o.+...zC.z.e$.K.h.r.....6.....Y..pnt.S..E\|.,...`.....D..+-t/..f....2N.zu.B....!.a...................t.>-y.

C:\Users\user\Documents\EFOYFBOLXA.xlsx

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1353
Entropy (8bit):	7.6170108133853605
Encrypted:	false
SSDEEP:
MD5:	DA2EFA4530AC25E49A9628D4388FBCE3
SHA1:	108F2D7201B3C6F1B8389BDAA44BC23383A68F82
SHA-256:	8656F1A3FD84CDB664901BE1CB2D084732442D0CA5EAB1700F8938FC81247DB7
SHA-512:	D675558AABF2BA6B339F232FFF74BDDE1D7148EBFD6383CED99BD0B891BCF12CF08D497263FEC57FF97DFF757C9AB9244B4F0F2DD85E0BB4304EA47D6F4E8F5E
Malicious:	false
Preview:	...I..xE._..=$....S.=%..<'u..t.^....=d..Ks.<.t....0.t.:3..i........7.A.....`........C..p.."....A.{.<%.J@5.'P.8..D......k.@.J..VH.G......Y.=}V.H.I.6..".j....$Jb.1..k./...h,..\|K/..Fq.A..O.nDO.wD..7.....V....b.m0.+.....%.,'.....2.,9.R`..r..yq.u5L.6._?.....R....U..@._Y..j.R...........w.x.^....t....V.b.IqCw..X.e.?.f..b....X......S.W:.j.....@F?..;....P..M...B.1................W...E..99Img.#.R. .\|.....v....K....b..N@.b...EQ......+.b...'0.~B.ad..3#]....@."..8.N.!...dB.M6/A....z..#..K=...........T.`...+....[.c.l....;7.!'.4.p.yp.[....t....z.!Y..[.k.!....S.....fH...+....p..ox..NJx.%./.S@Me.,.A....0...qe...[G.8<.....Z........./)...m.u.V}..z..c....Z.{.Y......vaCmTyB8.....G>..w......-..Q..........B!...,.%...;.H...c.B.g..j..<.6~.QO..AK....9...H.....nE..4..2.@.Dz.......5..L...m.6.S.u..blL..S.l........V.Wa..]-...;0..n.D]..YR%....l4.m.5..B..Q..0]....b1.....5..V...s....r......+A..<\|...[..V.s....l....^.T}.....e...mx...HR.\.i.8.......y..EU.Y.{{.6..w...

C:\Users\user\Documents\GIGIYTFFYT.png

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1353
Entropy (8bit):	7.613871676140211
Encrypted:	false
SSDEEP:
MD5:	ED28EA4C938CDB427A095BD4344443BD
SHA1:	0718DF6FBD72B49A48033BB5E817EB443365C4BA
SHA-256:	C2CD1779FA9C433C5C38F7E4FF534B9B78F4FC5D2036AA3D6A03E988398C2BAA
SHA-512:	793246D874B727E816E9DDB388FF85A2783A066A971CE754C65EB4F4FFEAF75EE8056D25268B4C9D23E9F648AB61DC4C5A69CE616840DC1AB6CFA042825045DB
Malicious:	false
Preview:	....we+.jc6q.A5S...{....{.C..-[...#...M...{.J..}.0.{.......2]^.C..p......U.`N....<O......T4.s..!.....V.xH.T`..=y.bZO..$H^....9./I ..F~-.Jf....,s.....C..w.v..s..;.,_AH..t....Nk~.X..Ow.....R.....\....Wx.i.$U...%...(.h..K..1I...J.W.R.rCm.x.sFK.Rt...d..ky$...My..Xq.....#..e..J.....M..T.K.7.......u...g{<K.h..E..[..G'.G.>.<..N.j..$_......&\L........z_"s.W.~!V.2...Y.ZZ]"&.r?T..G.9Zc.]..,..!N..zl..nA.......z.%..!...>^...T.@$y.Mv.G..........&.X.X@.... ._..!O.....q.o..S.w<..Z..[....0.C....Q...-Q&&...k........pg..9....J.f.W.$J......UC.[.,{.s.&....D.i$a.6U".D.N.%!m<..\|"Gvn..&....=...F....RI.......adZ..:....'.3Vh..4M].s..U..%.!.X.#.H.d.@~jR.=.x....L..Z..`=X....>.jv..6...N...-..&..@oU...2.c...m....Vqz....l....B..'t.%..=..M#.{Bp...'................ .....{i..P.%S.y.N.c...jm^.s..Y.....g...%.....:..%t.E........9.%...U.9..H..l.=C,lk...P.....J.........."X.O....of.....J.....C.R..\..O.........!Kc.=.R)..%....VL.....>q...#C.n..[../.Z=.r...D....Y..\.\

C:\Users\user\Documents\JDDHMPCDUJ.mp3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1353
Entropy (8bit):	7.607771856348175
Encrypted:	false
SSDEEP:
MD5:	D28E8B833F36F2A95FECEC7B64A350FC
SHA1:	583358BD55EEF11F4EECA33D176F7912A457BB21
SHA-256:	DA565414871B803B7500A1CFE02F37397D09D3870E5599A8C829B8FE91E12FA0
SHA-512:	7161F3825CA731A12B9445803BCBD3393721B84BD9A97B1A001D81D69129700099B78C340ED573D50E33FF1160BBDAC0F0C05937D4A0ED54F42E914C5D18D9D5
Malicious:	false
Preview:	.9I.O8..r.Pa........q..L.......{.\.>rZ.....a........cl....\F.D.8K7.p.. 3BFI~..Ei..C.D1.~m.^d...$8z.m.b?+....gW.j.#T..Dm.~."..a..B.... ..!. ...j...'.B..5@Q_..q.G<.x....D.G6.C.....U..2uC.J9....d.....Cb].A.....=......)iS.....x..wJ{#>.H7..+9y>Y>...R9.k...Gc..]...sA..v.$p....f;..Y3....R.c.N....R.%.../#....7.?..G.3.&.V.B..dx.V=n.....j...e.#I-..G...wh@..0.F....!..A.{E1...;l..#[.zd.Q.}no..[...-..w1./.#.N....o...:......6q....Rm..A..7#..6y.\|.#..nB .q.+..+....(..q?2.Z..77c...2p.Z.%.Ax<....\.."m...K .DQ....F@.Wm......d.....6...."...ZI.O.6......=Vwp...b....2.........~P.zX.}..Z.$3v...* j...V..../.Q..w.......j.......>.@=.D..<S...J....d.y.pjtP.0rO...;.P..0}p;WIM..s...H&....~..X..8.d...w..(YXu...4^.F..Y.8..w.`.....^I.y.c.?<n.ggP.j.+7..^...@...U....>.M..D.)..p...R.@..R...Y).bI.z..NL.,V.ia...".[..G.g~.[....sj...W........(.Iq..LfXxv.8......Y../a..$G.~.<.C.}Z&..rL._....a..?1.{..S..Q! ....D...ks)..a..o...s..9...>.?".>....U.....1.S.t...t.dc...y<..6.s..C\|.KAn%x%

C:\Users\user\Documents\NVWZAPQSQL.png

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1353
Entropy (8bit):	7.617560682134198
Encrypted:	false
SSDEEP:
MD5:	D782E1EDBD8A6CC7CA1DB5BBB4272C79
SHA1:	8283690763D080A3F35FEA03ED5E8BFA3098BD50
SHA-256:	B06C3F94845C4C0FF349EBBFCFE618EA74BE9DA7243B52914D3350D6D027B2DE
SHA-512:	C512E2DB73C15480DA6309DE7D62E5DA153E0359ED030D50CF3F8F79B49C4646A5BC43AC238DAB062F66FA203DB099842798345580D7A96C8FD74E9A6F842B76
Malicious:	false
Preview:	.....c..{..qaS._.A...Y.....}9..J..B.].e..Sv.B..........gB;q..oW{.............\;.,.a._.F.............$..DQ........e./..>......>..%....I.3...:.....N".....@O.D.E..r..e...._...TzK....Pr.....4......Q.o.P.S.$..r.[..`..D.).3./...(..)PU.OP..%w..`.1]&...A. ,y.......n.W.v...`.E.A,=.....S.....{$f#...o..LE.y...=$.2....d..w/0.s....CX^.pH...z.{..s.....N.o-..Uf.H9,.&.Sg.[.(.@.Z.....W]..a......G...dh.Y{./e....2....\.7.:.b.w...c!R...)....=X.4..*.o.[...-.i+...77H0. .._...........g....4:.^.'a.....0..@b...;..=..K..l.\.To...t.q.J.k.t...Y.........\,k@......S5t..M.....U..<k...gG..e.1..6m..h..dE.d...~.TkU.....Z......<...b.h.<!...o~...Cf.C\|h.d..st.<7[.....1Sq,..`.q!.?../....!....\|`..Y...Q..v.d...y...@.U.W......~.a..S.?...!.3.Nn-vb!..~...N..U)O........F.O...._..vg.y.t...U..mSz..n.QL.Y.....g~`.L..0=c.....$.u.....o...6.....4I]..[F..X.B_N...f..4...s.X......{e.......6.M...h.y3./q...R8........z~...oI9WD`.c.........[D.. .H...q.W..a.m@..........e_)"<F..'....

C:\Users\user\Documents\PALRGUCVEH.pdf

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1353
Entropy (8bit):	7.627469278243083
Encrypted:	false
SSDEEP:
MD5:	5B9889DED4BCB9EC88041FC6A8FC9673
SHA1:	BC9B9A0C48AEDF9818E9B03822C61F7BE84A0D07
SHA-256:	46FBA2BA68C6B46A657FF6D8D6B558683DB65705ED191AB2606529EF027486DE
SHA-512:	6C1F99F67EBCB2D4D0668AE901990F1F030EEBFFD6AD5CCA71B22F0A0592CA690461FA44C66C7393C60508796FECADF8C425BB6959BA790EA9AB7B4A07503B94
Malicious:	false
Preview:	..w.`...i_...q..hF"..5..=.]...{..`.M.Ap._..(.jM}4.5.^...^..W...Dwv.:....[.}....o....<..".......j2P...aC.H..B8.9...%t.\.m\.....C..k..(.......wL....L......`.....C#.y.Z..N{.Q."...\..f,...HV.a.......h.W.3....ah..C.@g.j...R1.8;.'..^.xt\.vj/?c<...A..E=.]..hH.o.o6...2Q.........k.E..wr5R:..`..Zr..r.,......g.....;3.Nd..^~.()s.U..T...w..n=.HD.R..-s...hJU.....Y/K.F .<B:..t."Y..lS../. .i.AT..E..'g7S'.)..x.X.\|#.q...;.W%[.........-.d"9......R..R....63..t..q.a.fd7%>..f..S..!....n.%?h......n.f.....j.9......#]o&......Vd......t.)...~...B.....j.y.....^6B.q...~..<. mN&....%. .nwZ.%..-G.s.$Z\|p.G....(...."`.....]..D1..Z:..z..^&. /..-..........6E.#.L-.....5..0...V..\|{.T.h...7..8...G.fv...a.._....Z{.C....Z.v}.A....[.!5.W..j...3.i..J.3#....h..(P..3.$....!PS...d..Zq...../VH..#..d..Z.}.t&.\|.)Q.....m.:./>%...."..Qw..x..oS.6.9.A.....(..\.;.k..ZP\|.C....V.U..q.{../l.......Ho....x..kb...{,...k.k.5.S.L...-K.8...?'c;...h..d+..... .#.BV../11.nB...r.)00.\|...\.K9.L.

C:\Users\user\Documents\PIVFAGEAAV.docx

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1353
Entropy (8bit):	7.6322135845734405
Encrypted:	false
SSDEEP:
MD5:	BB4C980B7BBD289BBBCEFF12A3F8CA04
SHA1:	D8A8FFF15554DDFB23B45BED52C19817F318AB69
SHA-256:	E51E9FF014789C8722ADCC9BE5E2949A079A0632D6459B9B23871DD7FD545A71
SHA-512:	EFD404FA3E74B8ADC31935B548642173E2D832E5B7107674990B204F6DC6A13E3ACBAB8F3C843798C02236E2CBFE160C77C1FFF712430A20843DED759AB2C257
Malicious:	false
Preview:	Pf..h.Eu..>@.tF.O.!UwjZ............!..1{@....<.a#:.nC....S.-ePK..7.k2Jm..Pz..7h..h...YV.GM.e-Y1...4+O.x.d._o.....!.-X.G.......kTP.g....M!...\|.T..b\w.:69.....<...b.....zq^..V:".6...p.T.b.4.,....(m..v.$c..3.Emf.T.bn.)..E..nm......K....q...i..MGf..i...(...W..P.[.&q....(.O.....[(sST..=,...e...+....OT..g.p..j.E?7.ePl....@\}K,&..&.@...F.V..(;N...I..$e..(/..h...iU....>..._8...{W..a....#..DN,...UN./Dq.b.@.P..kK..vL ...\..M..9...- .K.9...akE.l....8.%Ls..a85.?..........g.5U-.N..W.Qb.j.b.....}.%....j..4.....'T...r_..H.....7..W....Io...WI.?.r[...psXz}etH..1..e;_.&..T.n....K...{...L...:..rz.0...&...Q.9.yF...EO.....>..B.<...Rh,...;.x...L..Z..{..<x.<P...ex.........-..a..J....%D3.H..5}.4.."..j.r...$r...f/...}NQ...,.z...A..K...........v\wia).R.2I1!..!.?.O..r..l..X...Wo.t\|...d.O...v...H....=...A.i.5.kr .....Q....Yl....'..f%...DnZ...4.\|.C..M.....v'.5eAB.v.9....D......6MZ.=...S.q........+..l.{3.:...}.7Y.4.+..*^JH.?n=. .a.5..".....k.wt..a\..>V.G.....D.....O.

C:\Users\user\Documents\SQSJKEBWDT.docx

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1353
Entropy (8bit):	7.641167522738246
Encrypted:	false
SSDEEP:
MD5:	40F2449344C5F48FFE13EBBCB005C043
SHA1:	837FEE73912548FE938A14C3998A017B98B9AD7A
SHA-256:	FC210738F9FCC70955435E92ACEF4B549D7F753B5F2DFB2D09680A79AE3BF16C
SHA-512:	0D83EC646D5BBC644BF779DE8805A80C61580AD40E1316C94F63B3DA92AE0FAC87218FCBE5DBE0C75043056A2E9D170D1E4E7EA14F4FA21A42B0A540F2C42F01
Malicious:	false
Preview:	.{...C.g6.S.`.+.,?.`f.z].4...@.N..0-........j....J.......$ \|..1...C.[Y"..(..@p.o.R.6.3.b..JQ....3/ ............$..H.$.M....>.7D....H_..#.b....7.la.c`...>.Z#.`...m..x...........4._^Y..w.]e+.....P..,..b.gi&............hQ..=x.kvk....7k...s......+.3d.W#h..r.....~..l.Y...~93/..U.i>..^.}...})...@w.'.A.}.._.G..gjA.O...z.....<.T.Y.a..G.fe.....y.Ss..mR.c-i...s.....U..A.Q..Wbk.[.gI...Jq..CV...........z. .XH&.>s./...q.w$v!C......L0RGG'..k...bLN...C.]s....>56...\).f.q..A/..KF...\._8..>.C...Yc..T)...t7.h.....&..N..s..#-.;Y.\..$l.......4..hfF.<......p.i....}......U.v..&...U.pQl.2.Vku...]..].;F!...F..rA.;[...c\K(wv.H.....LU.^.e.....*U'.n.>n...#.F..+.]].Xc...IX$.&.C1H......2[..O...F....u.......ph..Y....R+..q.V^a.......Y.."o...<oq4.. .F..l...1...KT..L....j9.5...l?>.$..K~qU.L.V....b.....E.....t.zY@ILq..W..TG9.'.}...77......R.[...et.a.d:..b.E.".....3!...@........I.j9f=.......R....p....j.3=KV\|.1:..'~.9"j.X..^i..V.d.E"S#...[+xT..}r..4\..j..X..!_:"....'Pk. ...e.

C:\Users\user\Documents\SQSJKEBWDT.pdf

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1353
Entropy (8bit):	7.618403766606459
Encrypted:	false
SSDEEP:
MD5:	9796F51E8B5003BB2601C3768377C991
SHA1:	7111715BA052336725CEEC87759F43FBC024A5C0
SHA-256:	934ED9109FD768FC21E02E83E42AE4A752E1497E155BECA6EC0D2F1094974A47
SHA-512:	3721D389985A8654A44750E3673A01A218561AA5BDDACFE355E2F51FBDC45D980A0B162C1188E250818513D58E248155F2782EBE2DED448B65946E8CB360FDA2
Malicious:	false
Preview:	.....f..(P\|@../VR.#.Jvm.,..U,..lX.m....r.{e{.Eo#yY...K.O.q..pw..y..y..C.h...SE.....$\B.<..x.On....L.o...b..p...f15<R....#...\|...Q}<%U..\...tx.?.....K......m.....'.1Z...a.!>.t.r..vx?..W....M...L.N....)........{..E.....x....2k..p.m1../..\.9...9.;.4k...q..2e6.g..D7.....V.F.....=.. h.x.....J..l5P..2....OF.3M.Q.h[.....S_.A<............Q7..v.v..m._.w.1...X5.9.'.'.p<....#"g.=..V.8...%......w$.Ut..a..W.G.-.t.y.f.7..N.....&[...l.d...6.!...>..> ..T.=...%i...C;..}...v+qA..2.tV.A<.^...AT..s).....4}..XOf`..bV...`mb.:...4...7z...j.M..........wl.M7z...K.Z.\|4D. A.Z.$_...>`+..V....N_....S@a.B..\|.$b..n.g....[;.E........\.(.T.1...SQ.E.6R)b..'....ko...DE..2a.B.0....x...8k...L.).....l..q...DJl.3\|.8R4.1..+.{...[...9..(..a.rK.ru'.....N}.......Y$\|..U>wR.8.....?.........M...i..=c!...q(...R..=.....Y"..A#\|S....._...........A.$c.$.UF....n).),.B>..?.?~p'..0....e.O.N.Y..%r..B.4.`k`.z.[..t.x..Lb.G.......\..t.....q.......G...iQ5~.JM....ay.NAr.u..\|..w/.

C:\Users\user\Documents\ZGGKNSUKOP.jpg

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1353
Entropy (8bit):	7.606098492890353
Encrypted:	false
SSDEEP:
MD5:	FAA0187504CFD9D9C703E97A83C432A8
SHA1:	5F07284FEFE8C929E7CC4BFB71CACEE51442E83B
SHA-256:	BD7707867D4A73192A91ADEDD1F8497BDEAD441703FE3F6C59D0B33DEC75B177
SHA-512:	670245A1BDEB95A4C693691530AFC7CF7C6AE86AD38B15910AD36FAEF56CAADFD403047424C3E5A80F4ECAB4918F8FCC94FE5DBCC5E3671546717CFFDE1F8C58
Malicious:	false
Preview:	......a>31.d.y;... ...#..y8..r.k1m.)..D...V.........n.d..4....fR....{.........:...z.I..0U[C..K.....3)<0.a.6.@w'-7.iraU.D..-.2..[.?r..k..;n.c.....]9$.'..B...DS..B}:.\|..d..@z@.\|..xu...X.{4..d.(.....>].t..c...w.(^......L$a.....deO.}...'..O:..D.i.h..\s.EFYs..z~N.L...xYP...o...X`~f.(zf.Z.ex.=..}II..7op.B.H..._`.0:..Z.y7..o..>......E=.F...].H.r....F......lN:7...l..G...G...?....T"p..heFw...\|........v2.Y.[.-_...u.D1..+.o....Y...4....]WK...._w.0QJ@mS...o. .-a}....}...U........).z....y...]j.,}....{..X.....M:>5..2.......T.q...%..?..,.ldE..Z.D.O..S.B.;=M=Z..@.....f..........!f...W.y.b(..~..S....q..@[\...M.5.o/x,;.U.U...C.......q..#.g...I......7.n;.rn.Mc$...k.....N..........z#.......:...K....p...\|.J..%,......~.y,....\..d&.6>.t6FS1.......{........U.......8z....Q;.....S..#+...,.AoCw.....k.{...G........h...K.._n..b..Zto../...=x...E*...=UG$..:-.n....4..57.0.3.....w..R....".....u.p.>.....0...f~.;..+5-'.S.B.i.=..u...[X..t`(g..'}...3}.$MH.)..P.N.

C:\Users\user\Documents\ZGGKNSUKOP.mp3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1353
Entropy (8bit):	7.611089310897561
Encrypted:	false
SSDEEP:
MD5:	CC4E535512A598077E77B8CA72348E15
SHA1:	23F3DE7FD435E85EC8522F6EB4240D3E8623AF11
SHA-256:	EE1ECE850D6260718C83281D15DEF39D6642C9C2825DE4361A5359A3F8FCAAF9
SHA-512:	4B1FC0552CBB1483D3451A6B3699882DB621EBFCF540DBBDD0A72CAD2E9AC9C84B3B6693224400F4407A11EC4E3FB5BDEE69ECA00CF4FBB190A57C73EBBA4C4C
Malicious:	false
Preview:	.,Q.a...=...P..V..\...._...!..g.H?....fT.B<....i.[..Hj.i..#.....WE..k[.Sr.......vN8.m}...7......n..v.^....U."A.B.t..GB(7<.r.U.....U."#4...\|......s..H...9...7 G....r..9.4.u...~]....dW....._.-6E....>a..82..[.....l...>.....N....@...o....Q8_.. j\|+.N.+".[.H.o~...........L......{Qt.o5...\....s.jC..-..b..zJ..b. \|.._!+..zM...H..j.^6s..V...>BU..#..ta..C...)L../.fC...6.....a..!HMq.K....." ..D...GI\.K.7I.n...r3....'.....z..D#.......Y...e.6!`H.....j....Fn.T...zX.i.cNPo..#.......?Y.s.....fl.$....3.p.P....)Gg4Ut.3..}..........v.]_...S.I./.a../.G......5...u.&...#..W..3=....DJ.......l.M...`.??...F...q.e(..q.k.....%.)....P....p...W..Z....99.+O....oW..R.).....K..O....1,..{^.W...iy....2......o.z f....Mx..G?%v4.......N.koU>..."..g..:S.{..8.Ov..7.g....3;&..w./.cjj..stKG^i.......V..H.....l..V.4G.x.!....._.rd.+)..S_.s........<..............J1.3.u`..=.....(.^...c@.;@..4w.....j...&...../`..z.k...........G..Nh\|.E....t...I.+.B!.!.4...K....."#../+....

C:\Users\user\Documents\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Users\user\Downloads\BJZFPPWAPT.jpg

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1353
Entropy (8bit):	7.607941443728677
Encrypted:	false
SSDEEP:
MD5:	60839BE8B803E5C3DE2AD83A172EB676
SHA1:	BD7F8027411FB37C8550DD0457F2CBE3F5AA9896
SHA-256:	B14569C495C344057F3909D0E304F6F42FED25033A40DFD67707E468F6239BE6
SHA-512:	DDC17C49A7040EB2D50548439B6FD50A2B3FD4A99498D01E99508502D3B057D7ED07C477FCD5D274FBE66DDB26E58AACEB4FC9C9310F744003F66FA2236031C8
Malicious:	false
Preview:	.].am.'...EaJ.E....hkl.V..,...M\|.1.;.s.e.~x.P.l....R...Qd.A)..H..@..I<.<...e:r.J...{....ovw...i.Q.Z._.a....@E..........lsi...9..2W....G..uM{.][.k.,b.W...H.....9...J...Y.A....6,(w.d....G.....M.Y.~..^S.Y..Mv1 ...}.;wz.....3A6>D..tk...e.e..u.A...l...I.,.(..H.b....[.c.V'..{.......\.....w......+...qY.ok2..R4..v.....P.n[:..j...."$O..J3...t....0ug.v.\|.Aw ..bGd..`nA.6.t..ZWJ. ..MD+Ad..1'..H..Q.$+.......L..%....AE$............U..D..k....S.!..Q.%.u.S..X.c.;.I....Z.% 3w+.....!s..#...P......~.Q......s.S..ta.S.q\..:......*`Ry".;L..."Kq. `.x8...........{...V.{x.../.&1........%.={Lf..^...}....B5 ...jnu.v.....Um.......K.+.,...+.r.....z29g.@D&..p..}&....M...>/p..1Uis.!.^;.!b..fM?.hI.6R.C...e..1......=U6..l....!P..R...+...IM<: $......!.s....G....~.S.\.x../f.X.[..FW..F..C..2KR...Yy./..4.&..X...^..G...o.L...6.....X}.^.....A&.8......q..H.;.....9..A.=%....p.........pd.>.-...d.9...w.c.5...d...z...E.\|.g-...g.n...X.B=G...ZD.V..q...pdj..mZ.-\{.WL.......a.yZ......

C:\Users\user\Downloads\BNAGMGSPLO.docx

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1353
Entropy (8bit):	7.619803970374814
Encrypted:	false
SSDEEP:
MD5:	88653FD50279B23BB8C700660103B8B3
SHA1:	B7D9A74BD2E4036B3F0B1131620F6047FF72F9B0
SHA-256:	10D0D72DD2F313F1FED82CA20DFA1A4B25CF2EAEEAD15D4483301F660F8CBAFC
SHA-512:	0EE85D952BA1738B4C69F90452FC496634DD9668089949AE13AEBAD03C5F59B3BAA6C86744D3FE1C95FD48C978C3CB2B7DA4AB8618F4EB1909FF79D8DEBB1B7C
Malicious:	false
Preview:	....[...gOX..wU..M,..3.}.x..:.W.`o....4X.]Z..........>\|(%'.......7...l^..$~/....0$...H.._qm.C...A...uS.g.5...!.....2_...gh....H~..C.....5.?~..3sG.b.....!..`...m.......c.jI.!.xo.\`.......)....d!.. .tn\.../...;C....w....&.=..8:....&...8....G.9....9.....'T.%.x@X5m..c.&n.5.c.AC..c$u.&..9.. s^gZ..0.k..X..d..=.lJ..O..)..b..7...g...r.....l.iw......5...:...D.X..[y.&]1^.XK...<p.o.f...X:....l..9..e.,<1.<I...-..=....c.Y.A...T.I.....Z.. ....Y........{..6...YQ...v....TJyZ.\.h.+q...........]..;8...0.&..a..y.ZJ...A.s....Z`.....mU.,...;u~.Rw....\|..C$..2?`..`.]I.......{.......]7.f3..\|.....u....5....T%.Q.9.,.."b..z..L..g..Y........({V...,..f\..M.O1..."..l.8...I...o.!0...v..aJ..0{..q.=...+..@.....L........TS...R..2.../".9:..pAv.....:..:.....1~}...K.Tv].F.......,\|n.....~..)....._0....V...!}...~..\.-@v.x^....Gr.S"~'1.r<.Jpi...].-S.yf....vm..D......................Q6.B.....+M..TOE.5j=.W.>E..8...S1.D.Md.....i.#).i!..T......F..u.,..,....I~1.<.Y.m

C:\Users\user\Downloads\BNAGMGSPLO.xlsx

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1353
Entropy (8bit):	7.62434232884753
Encrypted:	false
SSDEEP:
MD5:	C6414BE73EEFAA84739C17F80778A8FB
SHA1:	A3C4EC48BA2D73E5DA4F0A039927722C363C13EB
SHA-256:	A9A626C98E7A9312AFE67865093774886F1CE934B6355477A9CC6BF2FFA79E3B
SHA-512:	9165D9C016FE8F7D7DD66F37DC765C79839C0580EDF014EA48B6D5C6EDFB71F2666DD7A7368D928B60DE00BD021219D7F071612847B6A78BAA4648D7646132DE
Malicious:	false
Preview:	j.....m..a.`L...W\l/.W.E.h..1a.....l..mb..@.C....}.K..x[\'y.b.yk....p.O..K..vh...Y........}.....0....(i..0....O.Rz..`.......Q..N....u=......w. .....d..{,Gt6.D....rG&..c..1......Ly.e'..k.`x.d..'".xP .<.0=.N....].3..b.q.j.~.;....]......h,.u...7....,...@..].zK4.N..".c..k(.9.r..j.p=j.e.k..@p....7...&.^.:......{N.....K.y...f...$....)..I...?z.@=.i.....g..e.@.Y.B..-..3[.m. ..]..&. .lu .1.!......x`;.f..:7'..kB.....~....R7BT.2ei..w........b.aM2...P7......yW...5q..3.0.(r...#J..-B....Z.l9....s.\.O$.@....)...I.>...l.u9..X.{...^.N...-..T.9I....."..;X...8.V..5\|N..C._6.ww.M'...J....<....F'`G.}s...._..6".G..MB=Y.ou.Z.>....z.;....x..of......e........[^@-f./?.)....z.s..t..b/.Dg.....<.;S..Ac]..v....W.o......pc..5.i.m...z.....zl...7........&....B.._...D.!.m.....$...i.$.z.k.s3..L..>...Kx$.....g..lE.*.....FW.Y....H!6......V..0..b.z...De='.`...1H..'K n../.mF\|.!I~...b(cH..0._.tv<.g._$.9.,.w......+.Q.J.....'[5{..;.:.y.?w.....\|...X.....'Z.w..\..Aq q....

C:\Users\user\Downloads\DUUDTUBZFW.png

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1353
Entropy (8bit):	7.600160161889546
Encrypted:	false
SSDEEP:
MD5:	D466D592DE072A9E7432B8204317BF8B
SHA1:	82D516B39A75E3C2A99FB9FD8E117670370D49A0
SHA-256:	58209B4B52D3AD5B12F07BD436FC6CC726801CD10ECAAF0CCD09D86C0E0EA739
SHA-512:	A9FD327D1FEB9DC944D175FD07250D47C63516B442557169580070ADFF931752516FC2BA52C36444647313FFF79C1F4D4E19F6C7573ACBA72BEAA5F107238869
Malicious:	false
Preview:	}..g.....#....~.f!I....c.S......c..[.v.?n...E..D......{.sn;.....'....a...5J.e.F..E......p.&......h../={..#4...E..6.$w..\.F..(k.Q.....OUWU@v.O....[..6.Lz....9.H..2.r.....O....~.#...V#hd....v......vL......3g.y"...^>..L...Hg;..y..I..#7...c.t...p.4+.2..#4/W+b.\|.GV.3.B......du.x........1U.u..s.hWB.G...]P.61...`...8...Tb.s....}.6.CK-28.?..Y.\...l..G..D.......c......[d..."H...Nm....8D<-n.UH.:!..i.15..E7...@.t...'.g.%X"f.......x...1......t.m.H...[Q$M.........k.... ..\|6...V..^....~ij%:....P.#..`.ni.5:.s..}.^"...p.>h..KwO".n....:.....n..."^.U5....@F.......?.....C..I.=..&..u1...&W....8...S......[.4X...<.K. ...K5.;._....8).....l6rF......{c.........M.".^.m..xKHE_...&...1.:.?.*.....U...'l.>#...U9vY..tZ...F...1.h..7 .^...c.....7..`<..1..c.;._S.[\|.]..}..R....H.X$.a....\|A].....K...C...JQGD9......0u...=...sezB....p...r....g.~fy=D.sY.9l$....e;{}..p.=\|..'.<.rE&.8+<T......n.S}.M).USm...#.P.....F...r.^#.\|.....!...d.4.z..R..J.....Qz..M.U.;.H.....0.Zu

C:\Users\user\Downloads\EEGWXUHVUG.jpg

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1353
Entropy (8bit):	7.623798851645878
Encrypted:	false
SSDEEP:
MD5:	308A397FED705530BB3DE20711A32728
SHA1:	7831865560C3DA65271142709CF7B11785745FFE
SHA-256:	0071F0DFFB6F540432CEB16E9CAC2AFCFFCCD2F6D6E08599BAB598EFE7E27205
SHA-512:	B210534EBE120CC0F3AEF55D256E90873D42F94C7EA28377700D32F7DFF226DA7EBA97AABE866A047AECE32AA1B05DE2C3988098C7A63BCE85EDEBFE1823E3C9
Malicious:	false
Preview:	A..'x.Vs...hZ,..G).......D.,.cbPc....bY.;..C......`.-...P?...M.I#.F-.yI....!.VM.c..i."w._k.N.\|r..._.H.O.Q...8..P.I.).l..{#!.T..9@......jB..O.\|.....;Z.B`...A.Px...^b...\...d.....V..1.RJ....O8E.r....q<@G....y.2....huf....f.....X.&>.7...7$m.[.S#...Y...8O../p.s.B#7....R.(,.b<..=.....\qhY .l...b.x...F....J..^7.C.\.......,...-HH0.+...K..7......~.a..DKt]T...kN.}Hz.~..?\|.~...f..w...B.2...4f.e....\|..;<..&..8_...-...Q.d.b;k..F&...q.......M....48.G.....".....y...(....'.,..A..Ln.....r...{_....k...R. ...K..wW%b..7..........x^...JG.H.......%...M.)`Z=.?x..u...D.KCo......vp/..(.t..8[...Pg....<FH....kY...jd..v.o#...pK....-o..J.b.~.:{L..8?.....W.m.'..9...{...3.%..{.Q.7..C.d.2n]...R~.(;.....9......O.G.(.l..E...a.+.?..z3.).7..9....$n....aZ.U\aEc..a.......eK..a..H.G..5h4.....`d..P.8.c...)..EKh..b.8pz.<#;].0.p.".........Z.....2)..\|.{..@o..1..C.{a.v...e+,z'u..4-.3Swa>.....D......E..^....]....[.=.V...+.oO+....Mw:-../.a...;.J...'..&E&....U..F.y....\|

C:\Users\user\Downloads\EEGWXUHVUG.xlsx

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1353
Entropy (8bit):	7.595304240681586
Encrypted:	false
SSDEEP:
MD5:	87CA66A4F6E82C595322400EE813F717
SHA1:	CCEB9060E042A5247820025020C902F8C283F118
SHA-256:	296E622475208A44E45A5F1E5CB38DAA6B21E4561C812B66701018AE96B94347
SHA-512:	7235EC7AAE92BDE171BC583C19425070306969EEEE161E25E013893A2F1F3CE8363E8DA096907A1293A85C6184D260A51CED4C0462AD0C77E3CFA0854FAE50A0
Malicious:	false
Preview:	\n..U...@...\.az#........[.pkX%.....V....C..P..PNZ..7.gd.EUo.w.T3....S....+-..J...W~...n7...a.....72..?....R....S.YE+.....P.....'.B...F=./..7.hR..>J.._.....X..y.~....Q>=.bu..JiJE....L.X....qt.?M..m.^..\|m..{..7e.}.FU..\....}...n......2r,..MjX......q).&..w.f...8x.........Y$.q"....,<>.X.$\/....Wt[.._......U.. >.5...h...B ....l...<.&.p.....7.t.7..>.Jf...i..&.....?+jG...=.... ...G....Y^n...wx-.kC/.....M.\|.p...y...=Y..N..6_4...C@....\ t.0.......Q..2.qB.}o3!.Z..7k..-..U..H6.q.:.)..n...a..T.DP....a..8,KFH.z.E!E....`.G........~....f..\...>.E.!.......O.pKD.a.J.;lr.Q.J....X.1$K.v..................4Je..uei...9.F....g..{.M....<..b....3Z.-..\|....J.....4.J.R.N.\|....v0...Q.+.A...df..-..0{s.%..>.AR....^../\|... ....zGxOM.7B.R1.O.u...~.i6'..M.ZE....BSt....]..@..\....\..&.@.q.X./o"ia'...E.?..dn.;-.K...n...:.C..E...W..G.....K.."...^.....2uE...7g.B..>..,.)..'U.....d.q..eC..T.T.yL]G...x.y..g...9.].a.X..S.f<.$$,...d"GT...A..\..l..G/..o.....+.g

C:\Users\user\Downloads\EFOYFBOLXA.mp3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1353
Entropy (8bit):	7.624473753107627
Encrypted:	false
SSDEEP:
MD5:	A49B50E6F909BAD9618EB2A7FB84F0B6
SHA1:	141BA623002B439F29E57747F6CE5651129EA01F
SHA-256:	4E9EF0D8740F4F5457C26A840A6351C6C60F3857D4E4E40EDC56037483BEF5CB
SHA-512:	05F0337A07978B6A3BD088661AF0CECF9842914013B8A85FD682D52E2D06FDECB117D785D12DBC39D2A6FA7F66777E4E83766F8387EC24B3E74F6C92B7ACD7CF
Malicious:	false
Preview:	&...g..........b.C"h./z+.@.O..F@.s =..R.6.n.Ge.q..l.!/...P.X...[i.}......z.8...Q..h.....s.h...&.aEE...o>(.;l7m.fm.r4.......0.(.o=..(...-...`.;.....#...I..6..u.1z.B9~8.0.4...GR.nU. .H.W.7.D...%..B^...t.jl\|......W.h..n..:...W:c.G.&......@.r_.o{FB'.u./.L[..._ ..v.lm.Z...{v....AVY.R...y.m..wZ.7.a6~..H3J..5.Bz.v.....X...$...?.<5D$.\m.TR.......jP<.7<iK.3..B...h..v...^x.T.RL....~7(S...,hT.%..F.X.....".k...H....Zf\zxE...fy.G...i....lH.V....h\|..0...;\..9S.X.........)a6z},.z.S.E%;...@...\.Sh.^.A...g.jg..7...]....A.o.\|..i.dY....#.....0>..n.&...7/.x.i..#3......Q.G.&L.i_.d.#_...g...x..L...u.h.V:..[..B\..AB;>...8x?B[.Jv.J.....H...M4.j.FI.Wx.g.l..~Ih8f....X..U2._b....\"!.....&..E..K...n...C5..g..E._...$....TQ..r........e,..yj...b.A...^**....8..H.....gt.S`..........(.....K:.%..c4..cb..........~t.x..L.S.#`...[..)a../f..h#N.J.cz..?....%.&...P..W.......O.r.x..Qr.:..K.=B.....n.&.t.~.2.W.`4E-...2`.P.6.Or.z......@@1]v....kR2..@.....VR.R.9...G...9=.:.%.5..8..iqV..

C:\Users\user\Downloads\EFOYFBOLXA.pdf

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1353
Entropy (8bit):	7.603409034973741
Encrypted:	false
SSDEEP:
MD5:	8573DFF2443BBE2CD1AA6B90693E9FD7
SHA1:	8216169EAC6820F350364C1CD79528F00973F21E
SHA-256:	37644243D11CC9A1BBB1526EE86AADBCDD8D21833A37BD658DF1605397C04468
SHA-512:	58E6660AD7D26011C671A894D808AF0649E4E2625424B1D3F875D79D2FDB15372B5B4281CDBA1440693E5352523C392255FD21B91CF3D15DD9064A528F1B212D
Malicious:	false
Preview:	7].X...$.....&....lTl.t.....F.c}y......&.Oep.%..G.XJ.....y.......Y.f..l.?A..\|.\............AYy.}R...9.E..r.......cd...0...,.!A..@7.m.Ld...}4...%.A<k.....3..-.;..6SK.....g...Rey...E.DT..xg.(......(D.&/r.....@........_.<...u....&....}.R_Y...6..2..M...s.4[.....{..Ya.A..w..!.2n..H...u.f....9...c..y.........o....=j.X...J..u.\\..%..A$.y.....Mh......;..xi...1.>..g.uW..Q....]...Z...s.7 .....,.;.].:.......14B<...ce.HG...p...S..b.U.N..D.yI......&R..&.E.}....[z.M...:v.za%..~J.....(n.U@.C-G.r...>.c......).......1a.@.........:.u.u.../X.F...h...6...Y.mr{y.e D...........n_..P..`...'"..[....E.P....P....<U'.^..$/.........:...sf(w..\+OV.TR..30`...M...'6}..GR..:..$.z.n.N..E..8..............f.f.c..G...%..).8...=~..J?..g.&n...42.....t. ....}..\|T..6...9....tM..."..TJ6.%.UA..Pj....b..X.h2"..c..r.Y$S........\|...{.uH.!..j{."........=\v...1......o..,r,G.\.9..'..~..0...+e8.#8.W...#....._....&Cg?.....U.1.......^..$KL<......~.C.R)I{Q.....[q..GE....&).O

C:\Users\user\Downloads\EFOYFBOLXA.xlsx

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1353
Entropy (8bit):	7.609923264208117
Encrypted:	false
SSDEEP:
MD5:	FF47D6358DD8104B9CEAC431C5B049AA
SHA1:	3C9163B89E5C36894548ADEE6685D6AB09FC2B42
SHA-256:	CAFC5A0D8E9FC6CB264F0087C2B7C4EC45624AAAA50A8C01D12B7DA5C00629A1
SHA-512:	26288A7086CB20BF2B4CAA4DC7E745EEFF248FFBBACC0C06E60B857E184056F64D0E4D2DAD02B3339796B46C06514238599F58FA14821FADF8529E93C1FA3C5C
Malicious:	false
Preview:	#..4.\|"........S......&-lo...4}...k.,.9.w......Z.1gma ?...x[JM.R..n.W.#..tTl .._....m..t1.E'..'1"X?...H.{#..WR.....f.."yQ\.C.).\|&......X...,:..H...q....Oy.$...E...D....U.d.....p.d.R..g.M....O...4.Zh....!jd.a.f..G{.......%.r.....`:....zeDH...J.E......s...F-h....f..=.U.=.cx...@..(t...;cB..q.J.T..<...f."}'%.2...5.BoS.".p../.....E..Of.,.v+.(...?.0_.NO...Y..eA......!r.<..pq..`..q....%...._.F.@.p....'....H....._XN..s...4....P....=...m....?.J...17....&..Jr..!"../....~77qq...-..].X.....0...r5....B.`.......V\|.?7.QeQ.....g.f.kC]$..........K'j&..../..bo......_....7..#g.J..3...<..._......].l..}p..;:4[......~]...9.JO.[l....~..3x.dd.z..c...R....p..o...d.f...U...X2!,.O..-S..[.Xk...&.2wd.Y.....V;.9..`...F..7.........H.:.......a....8.M.(..W.x.!..vG.-.....Y...K.0.......-....W.u..eV...u..:.....].N.Oh.l.x....v.5.[..%V.z......2I.l.....T-$!k......m 6..8!......jx!.....\|5.#......H..G/..'\|..J....P..6...26...;.Og7.F...b.-.y..........@.l.#.....Z........)\|..i....

C:\Users\user\Downloads\GIGIYTFFYT.png

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1353
Entropy (8bit):	7.618147740773782
Encrypted:	false
SSDEEP:
MD5:	8204A19DC7ECCA9CC16CD6E08572EA24
SHA1:	20337C98BB5AA5B94487DE2232E50C481BD2F98C
SHA-256:	0841C124068203A11145C4CB7D00CD92CBE1F6D21EBA490401C1CA0EFBA1C5EB
SHA-512:	3FF319A786174858633DC42669E1A53B65A904EBB3B758F9E65FF214E8569D7BD7352F7A08D43A6F068AE00AD18CF34314E8C9E9CA08902CC167CF9A854DA1CC
Malicious:	false
Preview:	..J...o..k.;.q@.7.I.i.............N.L..,.>...5.a..)..v... .9.k+].....wu..X....Gs../...l..e.]~cm....r\H..KKD?."ml.8.N5jtf......7.P.O.I..........r(.j...K...{.O..s..k.l..>.J.[...Z.JO.s.......{.L...5.Vb....{..S..H.a>x...G~..`...<.. ......1s=...~...e.r...e.I96.."..d..X.....+.5s.s...4..3...........CG.....FU.....&.......-..jW.&R>..t4..#.RI..42Y.1m..."....i._....n.C.0"..N.ho.>.......>....j.z.afIl..=..w.S3',.......9..:..t5.3aFsc...."?.%....t{.j.6..&.Z.....X3#..y.. ...6./.E.Z<.xM...a....[Ek..9...........T<.h..o/..!E<m...0E....H.7XeU...M.a.#...PU.3...@..P\.....z]........P.2.x...^.......(...D.....]q...6..c7.l#a.6.Z@.S...e.#.mJ6.K...........&b.4......4.g...\|..#$....@...$.L.....]....{.i..%w..7......>6.N..^..6<.5...:..4......T._..B..%2.\|./b..0..W.3s.r;.6p..SwH..{..N.d.Kyx.c..Y.wb...S.^..a@v.....,JZ..aG..S.z..X2.N.....$?...9v.2J..M.s.$.1.h..x...F:...l6k.....Q.V.....H.....7Z.......'......j.).....y.N..H........:.0-3.k.,..i...*$..[...,.yVI.....

C:\Users\user\Downloads\JDDHMPCDUJ.mp3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1353
Entropy (8bit):	7.582860645198266
Encrypted:	false
SSDEEP:
MD5:	78A2B36F925BEA9BA390CE7FF0754979
SHA1:	5CA0574A086C5F37E0A25908F047DD608C6DB2BC
SHA-256:	D470A331C6D76E6D2C4ED09892E05197AAE90AFB423A98D1F6C0BA724A3C241F
SHA-512:	A2C0CC3BD8A8D82A2D259E5CC51F9ECED4DED8AD0427138147E3568CDC232E089F1AE87E770D9FD8D5825D86F74CF91C9E7164218266F364A3BB7A514AF5BE0F
Malicious:	false
Preview:	......T.8E.Iv....@u.B....o].Jx.b.;k......T..l..U..]R?.....3.i..i.Dw.a0c...Rr?.....$q6.K...K..}3.i..&..]`.x...g7.h.".......Y.=u.'....o.>..8B...i.U.P.l1........^.l...../w.?(&...0.x.yP.N..9..........f.x`j....I..i...........4Jj.........J......E.. ..6GZ...z.CC..i...2....c..v:...{.}.L..9.C....C3m:4.-X@...6"v..E..d..G....(L.g..v..7.w..^...I.{C....{...Z-...4yH.....DY....g....&p>...5&j.t.)~.B/ ...j.7......Pu.+.v.j.R.':k.vHlUj.xy.q..,`.).....xpz.h.....(<.`....n..{F&....Qb...ohs@.S....?._....2^.z..g..'.$......(..{...y..]5..'...+.1OLag...("..#q~.:....hl..Q.....)2.....s.N....hs.!.Z..APPw\|.3..I"..f..cv...o.x.....7+.......tny....t...h..c.U:3/...B.......f..Q6.%q..u.o{.v..T..+.7...V.....#<...Z++.xPH.4....iL.+s...X.....a...a.2..p.._r....L.].p2..N..w.\|Y.I.....g...}Xo.[.a..%.......v!.>...n(.[%.........}(.=.. .W....7...^...l.....v.E.x.....GC)5A.[..,.x{..gj.<DT.}.....ySw..../..!....B...o.c...tUJ..S..z...*5..V.G.vTz..3vs..3!^....o.Z..B$..c.....A.f-..1..o%.)S./l

C:\Users\user\Downloads\NVWZAPQSQL.png

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1353
Entropy (8bit):	7.603792249168963
Encrypted:	false
SSDEEP:
MD5:	2575432C94DE8E270A06A6214C3DEAE7
SHA1:	41DE2D5B7FE0F3C7E718065425BE461CB2943BA3
SHA-256:	D8FBAC7950E21E88A6DA15E0B2BB68910363E05C2633434CA072AE5EA0BD65A3
SHA-512:	3573487C15D12A80BC315D6B23402332F5CCF869A503D060844EBAB219BF08928B943502EC32786D587CC0FF8EC70A6E3BBA9F8D21D68F2DDA440D7369A8E50E
Malicious:	false
Preview:	8.+3.\|.....c.!...,.....~.gl.T..0...C.+.I..R..x..K...Fn?.$...+Z<Z.c.P...U..;..%.o..H.0o~`.:...n..HW.L.Ne]..q.>............X...g.%[..H....[D8..ep.yh...Py.4.Qw.a{.]E.....}..X$CHIlJ.......[...I0NxT-Bb.^VRr.d......R.Fe..>.l,8=B...I.....c...v..H.F--..P..!H.+.<..AW...Y...yU.kl7..Sh....7......!%.pc}..&.RHr.{.`Q{..)_.R.K.u....s....e.."pG.#...0.....`F.j.}9...d..x8[...\|..%._..`T.....ca..'.......Z..U..a....(."...7..5Hx3......9D?P].....`..<..,9.....V.M....._8.T....>.....#..4.5....C......^..:.J.D.8y.8...........@.....@....\|FZd...a.....4..tJ=^....[NY.W..I.O8.&...O..Ov.I....O^...#.+r.eV.?..Y...Z4..\[......j.....j&...ec..jH.3S.S.Bkz6Q.u..Nm).1.j3...3.D.....R..!.....y.i../....PY/m.Z....H...7.:..ac...H..yz...ZA%.....T..(...F=.!.RG... ..!..1...4j......,..)...&.....]...'P_....H..."N.....$L.....T..N.+..dH...[.y{..Z.`..+..5rU.v....^.C.^i.I.Y).......f.......h.~".. .V.{..11%$Ab......\..Nr..Q....j.@.c<.....}...@..W"V.CT..m$e.....XP+C.......j........A...bg6Z.uW\T,..@...i

C:\Users\user\Downloads\PALRGUCVEH.pdf

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1353
Entropy (8bit):	7.61054415083275
Encrypted:	false
SSDEEP:
MD5:	FE1C622711A6B9FDBCF953626ED41532
SHA1:	221EE69862E733D4A9AF0E53DBD6385FDA66C830
SHA-256:	113917506C353F7D539E1C5D077B3068150DAC918BD4849C1D214CC28C10C082
SHA-512:	DAFC76322C03E889B7DA4764BC493878FE3061759B3395157CDE812CC7BEDDBCAC0C62A4ED8AD43AFB9D2EEA5BDCBFAF2C182E0498BEACE4178238EB6BE7A3AE
Malicious:	false
Preview:	...K..Hi0.[...c..m..YMk........Y....t5R..D..(;....S...0.....a....E.W.........v..au./n.1G.=.n.A.3rick...8.C..=....GB..[,.l.s.HJ......Z...9kR&....y......dv\|Af....g....~s......vb....@.-\...h.......s\.....o(S...HA.o-..oT....N..E7..wj\....+....p+]..A..[...X.W..@.........Z...,;..d...iE..04..J........Ty...]...Qq..L..Pn...5..{.)8wdHv..%. MX....v..Z.8:....%.lG..x.mxW@..h#..I..J...i.%.......s............W...........L.D..@uX.d..kp.,a...}"q.W\|..A....P..l...vS.%.(6aRWV..k.J^..pE(..*5...B40;..L....Hd.#MAt..)...@h...9.gG/.9.-....D..9...%..Ef."Q....<.i.)2..w...;!...........)k.r...x.#..;.]..2L..!....=...]....d..!.2G.\~........`.....".n..+.o.@.>...80...!..\|p.<..X./.4.Q..s#.O..X...\..n.......&b........>.~......?F=b..U..X0....K.iA....d...1>EA.1'x.L...Q. $...Q.<....?9......2../.6..&.-...s..'Xy...F.....]0. ...:..(.V..[0...7?.XX...M.......+.F14..M(.A......P..l&.u<2.J..q...n.y.'B.G..J.."s~..)...7P@q..4aY/...@$_...g.<....i".t..M..D.s............p

C:\Users\user\Downloads\PIVFAGEAAV.docx

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1353
Entropy (8bit):	7.621411468713005
Encrypted:	false
SSDEEP:
MD5:	77345711598B8A4F515E743BEDE6FD39
SHA1:	3129E785C2A3406D49F647F5B99CC0265B5BADCF
SHA-256:	D3C96AC3CD5989731F79683F7E9814D7878A1BF3409CD42423489E89A10804E2
SHA-512:	229D41269A157A34B7EA868DF8AA61419F9D4A90799E37FD878BF2774B3FDFA4981E8CC1BB14040E59419ADC668F94114B0409333D9E782494919412C3815159
Malicious:	false
Preview:	D..j.......Y...^..8&..Qoc.. H.6....Tp.....+.,R;.....G;.^.1..k...W..O.3.y..R..].`A.T.x.vi..h8%..b..!LA.R...-ZXr.....Q.elTW..9.f.....2Y...`.?.....HJ....N.&..a="..J.......)3.!.[v..n..8..vYP.H..M/l..$^q.:L%pm.W...9..}.X.X......B+.4Z.z...^..."C.Z.~...18...m.....l..7rJ\|8"@2.l..\...)....7......./-.o1.....)..`.pU.Q.4q....=[D.w....@.].Ez.\......w.y....[.@B..."./M.D.\|.iF...wk.d.MbV...w../....w..9.....w...'l5.%,h...F...V..}('a`.hz..\|...v.\i.@.z.6..I.".6.).\..Y.\.j.U..\|..........T.[...}....E..............M.~Tv..qJ.u...U....E'.9.g.`..M.f4U.A$.............5.X.8.l.\|...eo.R.2Z...\.. J.,...?]0V\N....L...1.J....LF:z.....I...9..n..:..K0f.3..@.0.0"1...V..r 5...uc.g%t..U.k.'D>n...-.@Ht...~..dc.7R.%.. .:..q.2P)..CM...p ..)G.-.(..~%.qk......C..k../......K.'.6...x...g...5.z'.d..T.UC.$n.._/9.....e4..k#.-,...e,.$...@.Y.Z...=..3...I.7......(.N........3[0..!b.M7?B...u...dG.._~.....3..>...}VP.r)..xo..-....+.......W..a..-...s.x8..Bt...4.34.n.Gc.G}u..S.E&.{C.j...)o

C:\Users\user\Downloads\SQSJKEBWDT.docx

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1353
Entropy (8bit):	7.590146736744582
Encrypted:	false
SSDEEP:
MD5:	9C1B7973A4B77C4CF46FFC25C9C7C4B3
SHA1:	514DD85D713F3761A5F8F66A6DAC7F55E229D3F6
SHA-256:	1EEF1313DFA07353687F44977A638C01EAEAE97419DABCAD0C278F0D796AE46B
SHA-512:	DBED51F2BC0A9E08A29183E30817309A36BCC07D930572C965D32A63F286AA37C7D81DA4D341098DBF3344861559C902E3EBEC6578155283C764FA43CA2A3D90
Malicious:	false
Preview:	..C..n..}.+.._U.....b...c..2.{.:k...qnD..m.....x.%.....U.N...4:.e...6...A.E.da........Q..5&..=..oJ\|.N.K5k.......c...i.O....}.lr..#".m.}...(..V...X...5.[.Ox(...%]..~1...,5WVE......,.H......nU..,O8.mP...[.a......B'..ni....`.P.j.r....b..fv..)Y~...R._......#.B.\..k..,....W.y...E0.G?.......3T.k..ZL..%7E....f.B...U.gZ.Ga....S.t>.e.z .)..._...B.g@\_..I............<....b(.....E.R2.1..{./.9(.....5}.7...o./....}..V5....9.....:.`.V.[....M#.....\|..,...+D?/x....OS...!...Xl..Q...4.#...q1...lN...H....l>.....u.0.....s.r.0!.o.0..Cn.u.X.}...0L.M.. ..M..\...:....m.^.b"G..........t.8...B..JV.H0..v?r.xG.N.g.U`.1.n/.. ..yX.@U.&...!g.8T....~...'.e..../.<..9..f.i.x.E.......'#..2.s.>....#.4.....h.....0...Q......."E...y7......N..B-..3...&....8..b..Xs...(=3e....Y..t.. 6..4........q.15...5.......Q.bB...=.O.....\..9.miY......y..7..$...h.......Z...k.C.cn...e,6Tm....%.~O... c.F.t..a....}.>.3t.#\|;.9.r.......K....x..1.SIRE.p....s...FV<.^cI.._Qh%...0._yFP....d...._

C:\Users\user\Downloads\SQSJKEBWDT.pdf

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1353
Entropy (8bit):	7.611043499790191
Encrypted:	false
SSDEEP:
MD5:	86C236A20E5F9F95C1E6424CB5ED4097
SHA1:	757A01A86B2540244627BF599A8DC0EC7FA79B1B
SHA-256:	F6E5BD2E3202AB3C8D2361C9911DDA520052057E57A7E4B024F5B8ED871B5B21
SHA-512:	4CE6B34D2C81672D7C53B4FDA768ED43616853247E7CFF2DB0AE341D91C3A38B20867A26B97B3BB9A208285E4FE25A38525AE18C530D8E1C13C9253CA2DDFB0F
Malicious:	false
Preview:	U.]Iud0.,.v..0l..F.u.H.T..R.....I.0Tl....$3......]...Js.~.\|..+Im...2.x../..k3C@"......b...;.l....8...!.=...C&...?1......b&...a';.j..c..=8fS..V.}.R..\|..f.>$X.!.L.0ld.".r.....2).6..z . ..%.K....}. ..X......2.M.{......[tjr.....@<...&.!.Q....v~......C.cV~N...z33....%.....d...3.#.t..y$.%TQVz......0"...0V<(;..4'. ..\{.....I.]..5q.'3......D....o.r...\|...f..f-..s.<. ;.....Zw$..h..dkN..0.5..C..zP..5g.k.e......j..c..T..CW...h..{........6.K"..=}...,@?.S.z..R.4.&H+.......i.p....Y....zB....0...m.se...;6Q..K...}.RY?.`.Dm.........-...n...Z..L...K+6..]...>[?l...GF,E....%.r.7.T..xJ0...lRYy.[......:T.{.F.5o....M...]....4..o...3..JZ$..^..a@..g.#.QK=..4...z2d....)..P0.E.u(.[N"...K...#..g..<;..$?...ZV.\.U)d....D?..._...C'.....S..'.Y.j...R..xV...A...?.:.3.s.............w..W..+Cv[..B....bZ..oq.v.Zt....j.....y~...^....*jN..skf.)..@..B.e.gV(....(Y.-Ao.....u!Pc..s..xg%.o.Z.".4>..l.>0.Q>P.(...LK..j......V..,......U@.%J.!u.nt....f.L.....[..]..l.K......~..d.3......uw

C:\Users\user\Downloads\ZGGKNSUKOP.jpg

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1353
Entropy (8bit):	7.61380624700647
Encrypted:	false
SSDEEP:
MD5:	E46FFFD2584F077DF5DE98495C069B57
SHA1:	750B90EA93A5F766EA6BE6291A691FA596806B27
SHA-256:	181D792FBD097B7442ADF3021D56BBF575ECF51AA41924DD171A3EA9BA0F45D5
SHA-512:	1D2D81FD10F0F327FBAB9F1D28279A2D39312ADB6CBD0E554C55C3469BCFB2C48538E1A9A4A060CE94D9DDD271EA681908F0B4D828E23AC616E3F11031CF33E9
Malicious:	false
Preview:	U...n.+d..Z..d#0.j. .Y.U. ....5..D./E.N...P......:...A.X.].KO...B..s\.....#...X...?..0.........T[g...3...w..J.g.O..!...B...v..!..d..a......z.....].{Z7..f..YY.P...T~.Z.s....,......Ae$.(.%....{......U.L..K.\|...."...U.`...;...yUi.+d\..(...Jm....\.Ls..X...u..w...X.N....p..?..K..;.T...&..K.PU...TF..$...8..r._...2..:.....A..~.\|.....:\........v.g.s....,.Ei...cz.\u.Tt.!7@[)..3.VB....R..K....%E%..MTt....>..L..\|<.1.}..Rd...I.6.....3;.4...X..u.q{.[^...+......yJ.\.2/...XJ.e.7.W.........U.. .....up-.V'....1...;.;..c.M@.g...rz.f.....>.^%....j?.........Y...Hk........q..o.>..\|V@..(...x...0...3......h.....%'...C...u!q..bc.].O..t.:3...$.>.8,KP6...=.{....e^..R.D"O.(....YB@....8w....T..V):c.U9RN..^. ...t+..../av^.i.........Z..$H71.....C%}?t.A+....aU[v..X...a......o.)t..(.'.s.U=.x.......9.8O....(!.....%.$......_.vxB..~MA...Z5..([.....t....+7V.jj.e;sL.h^.{*..W...r.Ji.....T!b...g.^..Mu..a..h.)...0Fq..N...?.J..A.Q..............5..R..4.....e!...x.._....`..

C:\Users\user\Downloads\ZGGKNSUKOP.mp3

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1353
Entropy (8bit):	7.60059769178106
Encrypted:	false
SSDEEP:
MD5:	F33A459774DC00C3D5B031EC44005FA5
SHA1:	D17278539621660B5D9C9376A729757B23C476B2
SHA-256:	26ECE0D5F783846EABC9157E7CD8505D182E854F0E2F2A2EA20590072E5BE5E4
SHA-512:	A6A466D112AE8355036C9996CE540B105B97BF7A6709022622B27F93C710911A7B455A682CAB5E1BBA55B2182B90F4A2E66CD73FDE49ECC8ADA4D639DB1C235C
Malicious:	false
Preview:	q}.U....up<....D.^.Q..d....@..y..}o.:oevY..E.".AF2.[F.'_.......,H.....8U9...)A.P........\.q).YB.".qs.....I.]2..............J..A..8....... K..O...<R...?...W.\|.1..es.K.J<%M.E\.N.C.\|.>.5.B...6...,.P...M.M.......?.......~q.......e.>3..r...-H<......n..z..(ci$...2.].e2...<6I...._{...U...........dem.,A..YNq.Z8..g.B.....G.]4...... ' 6._.F...'..x=.s.........<.W.....Tx..)...%..\=.#BPX.......Yfo...%B...D..m+.t4..-!.N...`!...x.X..^.G........X6..P.+m.n.T.(EY[.\|...}x$a...h...6m.~...$..ip?...r.....D.j........%.;6B=..\l&.+.....\|2N......K.....M..K.J0..3..>#m..ZL..Iz.+....Pa.43....l..../d.....^..c.3.%-lf.M.b.....T.8..@!.~].;.d^8Y..S......._/..>..v/IL...O....,Z.k..x6...2C.>.a...}.h..@... h"d...}.8..K..Y..8..s.b..dc}j...r.X.$.d]...\|..K>0J..........(....9Yk"j\&.H.[..t......o..ir_....A....&C....U.lw.x7......&Z.A..p.x.7?.I.....{..>).4]..w.p....76. ....$.;......V..Kr..m.{r..PtA..fN/.y....8.U...h..ga..5..[....0e..R.J.K.\|.L..5..\Qr!._v...l...1.Y.W..I-.0m....jX...

C:\Users\user\Downloads\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Users\user\Favorites\Amazon.url

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	438
Entropy (8bit):	6.364158048835602
Encrypted:	false
SSDEEP:
MD5:	CE2717E60650730E21B1F80F2C068737
SHA1:	3C7238AFCAABC975B60872ACBFD3C246295FA82B
SHA-256:	253D2E5188B699BEEDE0A88C4E6B8AB14A07BCDCAABF66658A7CA33667A2A34F
SHA-512:	EE44710EC74C95B2F9BF2031E186D6F3FEF01657212DCA44CA6672F2C34C4F88652844E52FDAD087C3574EBE6BAEDFFD3498CFAB708C139E1C1A766149220620
Malicious:	false
Preview:	........P..v&.n.<....K\A...!\|.....8..3..4.......^j...W%.m(Ce.yhortcut]..IDList=..URL=http://www.amazon.com/......E....k.G.gJ..~..KO..2.T?.;.u9.]&.+.e.{D....B..ym...}e....Du...@S...T...^..(.3.#u<.9.u.....Xw..6.8~....N.&..N.h..wnn.Q_.]..S.mC.*.A.W......D.).^.......?edg.8}).!...... .5'.F.+.Pc.r...@........>.3.K[....................................................................................@...............Y@....czyzk0zzhil.

C:\Users\user\Favorites\Bing.url

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	535
Entropy (8bit):	6.698804869504482
Encrypted:	false
SSDEEP:
MD5:	5E5B13C7C4730C39F6ED2F26B8765A9F
SHA1:	169FE4EED91F78F156E8FE801F6F7501E2DD923E
SHA-256:	06756C4DB9AC1AE02F693494BEEE6E3BFFC45FAF89669827B8521BD84D3CCDB0
SHA-512:	D9A717343D8CBF79DCA916477C7FFC2830631AFBAC255AAD25D12E736B40C2E2193DF4810BF8E09E80AC555E8AC866C6DC93E97215D7CA87DFD3115302C4EA45
Malicious:	false
Preview:	,..i.3j.(.5"@.q....a1....!.....=u.(+..e.....5.........n...(......M.`r.....O.)./...Y..a.y..\..>7lh..e....M#/.P...0].iH5V<.m.q_Z8m..aZg..n..0....H..Rb.... ...K.C.".e~.c.r.c.....L...mages\bing.ico.....C.t6dl...~)c1...`.:...]O. ..eq.0..y .."\|C.c$......^..=........r.1...fY.4.+...N.....9./.z.u..,.@{EA".....W.Xf.v......z?..F...9....x.k..w...j.._.`...k...O/=25..........$..[\|..&.i....F..?I3.6....h....................................................................................................Y@....czyzk0zzhil.

C:\Users\user\Favorites\Facebook.url

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	440
Entropy (8bit):	6.312625719890451
Encrypted:	false
SSDEEP:
MD5:	4E554EE5038DE91C1C1D59B72C39DD05
SHA1:	BD93EBA93AAC313F8D3EE2E5EE60341A48FDD745
SHA-256:	377DEFBF9532529AD528A740DDD7C71525E2B553AD1ECD62A0B52B80FE1DE795
SHA-512:	EA65E5BEC2EDD089CE0D03CD0D4A24980694828824A63FA215D50CFFD9167F397125A1306AAF1E1B7D9AFB5661103818BA60CB092E51D6B075CE87A68075560D
Malicious:	false
Preview:	...3..K..H......U@..T..;..`$j....d.\..V0..k./.>...H.._.C...hortcut]..IDList=..URL=http://www.facebook.com/..........c....=.....>..%.G...1jG...rlh..[.5V.3X...2.7....j.3...x.7.....b.f,.!......H`..t.q._............m....g..uJ.n..V.....%`Qw........5..F}......I....Db.=.eg.'!...vAH.x...m..t..........J.)N.l.<........................................................................................@...............Y@....czyzk0zzhil.

C:\Users\user\Favorites\Google.url

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	438
Entropy (8bit):	6.318060958199918
Encrypted:	false
SSDEEP:
MD5:	DF8C73518B04FB372F30E2439DA828BA
SHA1:	04E23FE1B927B4FEC0EDB31EE2D33BA03AC756AF
SHA-256:	2BA2798F614179717A2BA22C97A454A6CF80712A8DBBC6A75A16CF3959BE8096
SHA-512:	A01334636D1A088382CFBD9F4AAD16DF6FC65EC7227FF88C4D9072370BA6F1ACB432A30E58AB514FB8ADDE880920B7A2F86BBDBCDF306BDAEEB93CC61FE05EC8
Malicious:	false
Preview:	.TB`p...........vy.}....N....V..[.7..f%.:B.. ]8N..._..>......hortcut]..IDList=..URL=http://www.google.com/.....,.Yk&Imd........C{...6...)?.....`.-L...s.R.......]..k.w.5.....e......t...@..V.)Fc_..Y+#C.....#.....V..F..........L..w..).. ......."=.p..a..IO{.WR..85..6.Fv.+j.q.......f.r~F^ccq.....Ql....ZA.._...n.5T....................................................................................@...............Y@....czyzk0zzhil.

C:\Users\user\Favorites\Live.url

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	436
Entropy (8bit):	6.330218243078203
Encrypted:	false
SSDEEP:
MD5:	675CF1E073E15744567F58454E2E81D4
SHA1:	4D4256BAEB88223BD4DE60DC50968280165BE9C0
SHA-256:	80B0440FFAEDC786261665EF2D5D19949D187463689BFE31AB04DF9118F864E7
SHA-512:	373942B4AEDA0DAC663BAC1083654FDB696DA6FD794AED0CE0A377B3834114E68D2CB7629FDC17378AA29E0D398A256D1B94638BA35F33DEFC00D080F1E02E72
Malicious:	false
Preview:	:..U..%.PD0.Sz.(...\|...G.n.a^./..f...z...2....T..9...F\|./.F...hortcut]..IDList=..URL=http://www.live.com/....9.......XrW!o..W~.Sz4c(....y.)........*~s.....n....i...W...ig...\|@Z...y.Jd.A...k..2...{.~.s...$.#......<.....R.........Q..J.%gj~(A...W......P^..d.I.hm..K.7.E2^`.:?O$.B...\w$....7+A..#.mB./G6....................................................................................@...............Y@....czyzk0zzhil.

C:\Users\user\Favorites\NYTimes.url

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	439
Entropy (8bit):	6.2880588865808535
Encrypted:	false
SSDEEP:
MD5:	13C9546786828C7230AF69371D7CBFA2
SHA1:	DACC9590BF3018413CA19825628E9A3544FE7F4B
SHA-256:	9020AB2D6705BD7201C3485C3CF3F9E1E1272F7A2BD46E83DDF7F7FD964CF82F
SHA-512:	979CF8ADD6EF29094A483C0D815B6CA469FEA089D3FD9D504276929138CF0261757F5D173A09437DC6CBE20310ACE6EF04251D598756062F608F0FA4DCD05D03
Malicious:	false
Preview:	.m.....O^.v....Z......@B....GJ...~C.G.t.J..&6...-on...?N\D..bZhortcut]..IDList=..URL=http://www.nytimes.com/....D.A.\|V.rg....+O...6).t.z..^'.......;...Q.~.@..D..=_.F..s......<...v...O..0.8.....x..f=...4p.mm.C..s..DW.A..G.M~.z....D..w.e_.*. ......$.AV.W)..z.m....Uq~.X.V.'..}.......Z.P.V.hqY..A...}C.X..=.S.@.....................................................................................@...............Y@....czyzk0zzhil.

C:\Users\user\Favorites\Reddit.url

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	438
Entropy (8bit):	6.303275022665113
Encrypted:	false
SSDEEP:
MD5:	8E1645748DC60A6560A06541440BCA01
SHA1:	2C66FD1A46B1AEAB30BF8416F01232B2B324E5F9
SHA-256:	404A8C1229064C78F0B82973B73040517266F1E0760E712FBEFDC3968439ECBE
SHA-512:	5E76E64144BE7451B09B252E736C050EDFF0548CC74804B7357D60D5F5AF85DDEC80AB467245DFE29E0C8F4327376BEC718A131FF1B98681D60295C16368E4E2
Malicious:	false
Preview:	t~.Z.....\|Of/.&qA..>X.. .B.&4J..6.e._.9o.G....h..E.b../....hortcut]..IDList=..URL=http://www.reddit.com/.....R....??8x.n....S.7...!...>...A"... ..........1.Y.....Z\|...j....2j....j.;..x..H..`...K.....^.*o...j...Ai.4..Q...........b.3.....k..I3..i.....R..9p6...0.We6...O.}M......ZR.X..!,.bD.Rk..j...i..,)g.-k......................................................................................@...............Y@....czyzk0zzhil.

C:\Users\user\Favorites\Twitter.url

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	439
Entropy (8bit):	6.334081328302338
Encrypted:	false
SSDEEP:
MD5:	A088F9C24272D9607F1B93D455742209
SHA1:	372BBEA11DA9CFF9EE013557D51359BC7B6829FF
SHA-256:	279C41F745E3B882B600F1EDC295505601FD3CA26E997D670CC36C83816F5D48
SHA-512:	D012A796243CB06ED8F236F8D7D0469E21824D5BD0789C7B0C3367C16CC2303C3B0BEFA8E323250CDD5F9C4F5E7893750E3863D82748904846B2082D72CA2E95
Malicious:	false
Preview:	.....]\|5.Jf:C3./{.%..M!Hc.G.#<....1/$J....].>).w.Y.'?..p....`.hortcut]..IDList=..URL=http://www.twitter.com/.........z..BdZ.3.wN...'..o",....s.?.!.`l.....0..^7....I.0.2..<...UD.._..:..',.t......\H.}L.9=.\|.(P..S.v....Xa_...N[.....FyK....7....F.Wq..B.p...DV.....H.q.'.^tC....4aCmW4.C.y...(....O4.....y..`J.......................................................................................@...............Y@....czyzk0zzhil.

C:\Users\user\Favorites\Wikipedia.url

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	441
Entropy (8bit):	6.290959362057724
Encrypted:	false
SSDEEP:
MD5:	9EE3F38FC2C5CFA5DB4DC831F21FF438
SHA1:	DEFC3B3D2E527CEF8C749DA99D5E6948332AB268
SHA-256:	4EEBF622B594447A76BFE2ACA6C722576DECA06D20F6FFFF96C1936320A2532E
SHA-512:	F44B81AE66A87D2C663DC14D00D3075D04750643DDD7DADBECA7B943BA98B86484D9AFD88383267DD711D3DF7375409AE7839EE2F2ABD17F3EDC919CEF2F72D8
Malicious:	false
Preview:	e.;J..T"j...r+.....wv.A0h...7...\.+....0.o........"lyw.v....^.hortcut]..IDList=..URL=http://www.wikipedia.com/......h....WG.u.hu..'..t...1.E...W.(..).....R......a.7.T.z..UK,.YQ...o.-.....U'.=5...w..R...Y:.v......f..b..u.....U.4...\.[.<."D>.....yc.A..K._...A.....1r....f.7...........D.i.u..]..Q)y....c..v.9....M'.....................................................................................@...............Y@....czyzk0zzhil.

C:\Users\user\Favorites\Youtube.url

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	439
Entropy (8bit):	6.310933246444103
Encrypted:	false
SSDEEP:
MD5:	1571E5C6AC56E659A01B612B83EAF2BC
SHA1:	F87CD3175CD6C7A9881FFA5509DB4B2F703754AC
SHA-256:	1046BF8F874E56C52F4C11C71A36C4855998CC1CE3D59CE90C1A75CF7D412091
SHA-512:	E09F0EE36EC84AC10059DFFA93B991870F0D2CD3D2C84246327A2B914F7AB0518DCB9B05A656A67107D77A786F2B04CA1B9C6B4588A79A6A9EF5365882B64F4A
Malicious:	false
Preview:	...d..HU.d.n...........,.H..-....".....d.S.m..i.@....r8t{Rhortcut]..IDList=..URL=http://www.youtube.com/.....(T............(.u.F"..kh.#.CZ.....N5jB-^..E..R.O...L..l....8E.v...9=g..b.t.r..w.3.....'..%.....&....t...g0(...f>\|..5r.J...dT...<.6..F...@.o9/.4/.d..1.._[.....{e..^N.1~.f..p..a..1....G..pS. ..'..2.......................................................................................@...............Y@....czyzk0zzhil.

C:\Users\user\Favorites\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Users\user\Links\Desktop.lnk

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	828
Entropy (8bit):	7.138909967789861
Encrypted:	false
SSDEEP:
MD5:	EA1047DF6510072733C35BE48925C200
SHA1:	C4ECB510645E25BEEA8DDE5C4F6E7320A6ED0A08
SHA-256:	16F8579E94CC54D806861FF1FDA08D811BDB12BA6263A259A343DAB47BCF90DE
SHA-512:	92C10F86AEB16E2742C7513D33906096A7EFD4227E9128DB4B2E55E2B782E4AC03280F56F63FD903BA0144D65E218EEB1AEA5CB31127627EFEA95BE9F73B5C69
Malicious:	false
Preview:	...@>G!.&.37..N....q.m.!.....T...8.......!.[c..e..N.>....=i4...<:.H...J.r....$.5.....\).mP..z,l..RM.....k}.&......j.......9(B..y..1..5..p3.%6m.Jz/.w.T.@...m8$..Z"..^.;h.{<.......7....5U.'0I.X........[#z..AF...}..(.3....t.7sV..u.ym..;....q...#2JA_XK....A..CM./...e...\...9..+.S...B..;.._...j....?F.\|q2b.uE....b."..2.VF..NYck....D..........%7..2vSN........>...}.......UN.J..@....=..>.D.y...z..xP....1df...b#Y.K%.".D...T..~%.C...pH.H@..=x.....h....H.....K...YM...?..................M.Wm.hFU4.~...Anf.Z.k.....6;!O..'O,..@..0=...r,.{.Q[.6....7..[..........1...........zi.m.......{...$.iP.MQ.j~.f..e.1..........~..mE..8...@..X.2...O.^e?Nt...N.UQ...{G......w5_V.....g....Y...i.A..\|..:...m....................................................................................................Y@....czyzk0zzhil.

C:\Users\user\Links\Downloads.lnk

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	zlib compressed data
Category:	dropped
Size (bytes):	1277
Entropy (8bit):	7.500073346189445
Encrypted:	false
SSDEEP:
MD5:	4D51EF08A1B1FE3DF208194EBE9C2CA5
SHA1:	528076490AE54327820E2382AECDEF00C780E64E
SHA-256:	35B58E3B00E325AA56AF8FC1C2EEB112642049FB42F148B6E3681E895B6945A5
SHA-512:	BA42362C62A01434C3235866983DD68071A202A03BB15B5A753D93686F759ADF6CEFDE933D651F7082FD14C2F81B3A70EB9D168281AFD9DEBFED157A3851285E
Malicious:	false
Preview:	h..7......m."b..=(.n.fWz.. >H...c....e.d<^.b.H.D..y)....\.....zU..0..x....h.8W......+.n..;....sQ.T.xEs....$....8..OrJ.N.....WN...uE..CN....L..Of...f..xU..Q..s....;X.Q...W&.3.e.D.`8]pY.XC.s-c.s7.n.N...p..>.B.(..'7..j....!\.E[...QdOn.J0......@....iU.f...X\.l.(.kU.oW%... ...WK..LW.{.H...N..a..E ...9p..LT........a-/....k...m`:........_..E.<.Y!...3.......}\|S....zH.P..m~...3Og.=..2...k.vi..i..Y.nA1El..G.\....K..b.S.....`.hX.:.Y.}..9.QA`..6...TH.R'.7..6.KWQ.e..M.j`u..~.(..F....hT.E..6.y.?...WQ....~..fg..u....<.d......\|.7...dG..k..5G5..(..+.......@t..v.M7H\w...(_..+.el7.......Hx........T.\|....F.%c.^....v._...K...7.3j.t..8...\|.C..H..........Wv.........g..p..[.to....E....h...G....68 .;.'..........Id..g.(\|.r..-....4x.PJIK.`3P.@...^..:h.'..z.....#..[......./>...x....q`Wp1...h.}!".A......e<..a.;>W..]c..h.........d...A....z..e....X....#....lM..=.....I.dD..pH.H@..=x.....h....H.....K...YM...?..................Qo..4r.i..;...]P......[.(.@.<Eh..p[.d.`.w.>w..?.

C:\Users\user\Links\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Users\user\Music\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Users\user\OneDrive\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Users\user\Pictures\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Users\user\Recent\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Users\user\Saved Games\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Users\user\Searches\Everywhere.search-ms

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	575
Entropy (8bit):	6.812939112244448
Encrypted:	false
SSDEEP:
MD5:	A09C5964F678D75B0229D25D799CE408
SHA1:	0A8A00517DFF2606869105BCCE82A9C438AAC739
SHA-256:	8BF255C5C87AE5CC67089BD4EE7B10548FB65E342AEFF5731A1DB1E4C07FBE9B
SHA-512:	ED05B04D9A9DC9CF187B119B70893E28D02DA582AD2977E97190236DD95E27A5B41FB060E28B8D5E4D0BD8517A2227D842A02D3B5523E796E5B7836B6CBDA1C3
Malicious:	false
Preview:	..R..XZf......z...m>...xUj..<...T...Btxv...%.[.u...D...]....]....&C..j...'...O.q..........>G.z.o.T?.BlB&iAV.U.<..P...C.3...N.~..adb.....'Uj..K...^..6@.`~.t..I..pXSU...4.{..F.O{z&.705-d2c5c2264656}" />.. </query>..</persistedQuery>.......W..`pbP.Ct........_.~y`O..}<.-........N.H,.....z.v.1b...x.^w$L4.u..^...;I/..(..;..e(._....o......tz........,...LW....t...m.....mR/......v.]....#....aP...".).L7..=5.h.[G..\I.j&..G....V:..'Q..g.s.......................................................................................................Y@....czyzk0zzhil.

C:\Users\user\Searches\Indexed Locations.search-ms

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	575
Entropy (8bit):	6.786809391556256
Encrypted:	false
SSDEEP:
MD5:	E922A2D6842B2CA0FACD16788B0EC470
SHA1:	5D0E814AD87310E857A3CAE0F6B185965F4BC78C
SHA-256:	C64D3E89ABB4D1FF16B42581BC935767D8BFED49A3F678CB17CE09889B52062F
SHA-512:	9A7D6784FF69710E37D1A0F3AE3250B9F7D306EEB0A76B2BAC8C800E72896116E67AC6DFB51EA87C781BCC56EB3A775AC470D411D38B0C6EE82207813F3A6028
Malicious:	false
Preview:	:.,..e..n.7K......"....[.Gq.4.....4.+)P..>;A.4..37.3a....V...2..T.w. ........#lr~...}V......P...15..b<..b0Wp ...aUJ...<Y.......=iN..g..o....[F\|.#.r...'ex...T......KB..r5.....I&.......M.b2c-40f215767514}" />.. </query>..</persistedQuery>.......B...........v4}QSH.......:\|X...rT...h....Y.L!...7 0....9s6.. .kn...Q.}.8_..{..]. .TZ.).. P...ui..Hc.."......._4I:W.........W.........5.'..s.{..p.R}....i...&E..3_.&7..sg.C{7E.*.......h>.!{..+>....1v.....................................................................................................Y@....czyzk0zzhil.

C:\Users\user\Searches\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Users\user\Searches\winrt--{S-1-5-21-2246122658-3693405117-2476756634-1003}-.searchconnector-ms

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	1186
Entropy (8bit):	7.54014573723419
Encrypted:	false
SSDEEP:
MD5:	B10AE5A2A34F81B1F7595D114FA22EEF
SHA1:	2CEAD9EACCA5AD9E054845FDBA151AB8CA1EF150
SHA-256:	3395F42123476492FA8862FA6F9C20CE258A9A6765547FDBB202CF814FB7573C
SHA-512:	A1E992623FB32A45C475B586FAD0EE31C6669FFBAC3B46794BAAEB42534EB8310466EB6CAC637CD290BE9F3888B7FA40BCF48F0D420FE9494865B3CE92CD0291
Malicious:	false
Preview:	.%..S...Yg'...4.."f...l.....h.. ..#s>CBib...4qC( v.....C..G'b...Zf.0i.U.l...q...s..H...5UiKG.[...-....k..(..q.....(.)&....w.....u.%.........C..75.....-.b.........H......0..."9DC...l.TgRYd.=.RL6..`.5..l-G......o....SB..M2O{.O.C.N_.{...d..O.........s7..y..p....N.}.I..Y.N%..Z]9.....:)I...`y....1...b.#;f./ .....9\v-......L...G.n....q..(B.V........]...+v..............j...*..N.....F....Cvf....s-6.....I..C).a.X...6..4......J.&..u.+].8..o.O.x..I>.#V....c;.!\s.w.b..K.<....gb~...r..ta.QC.../.i.../m..B<.4......;.Q4.-.+.B...;.$>..{{..H.zP..v..w}.;.\|B....j.......A........&..\|$......q..z.........C'..P.....[....k.:!u+.s..H.z^tF.?.iA...r9.g...r./.4..^......!.}.E....&6....XjRff....F..^.NtoJ.l..U.]..E.-...s8.F."..g%.G...z...BM.C!. ;(.$+T.....0..........g./..?0P.".{..lO.h.&].W..m.~Q.searchConnectorDescription>....t.G...p3S......[..W.(z.........V.tXG._...$.0d;{`...G].5....1..fd2O.f{..Z(.....Z.....f..-.ut..P....u..e#&..zpx....Y.~.(..U..pZyY.F.H..

C:\Users\user\Videos\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Users\user\_curlrc

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.747900154632038
Encrypted:	false
SSDEEP:
MD5:	70614DA7AB81BE2425E7CF297FCF1F3D
SHA1:	5EFA4404C171769FE3A26CAF0598AE15106400CF
SHA-256:	FE5D08B75761A7E92D5265DB413667EBA69D926EFF479CD79C632703697E2DBB
SHA-512:	EEF0A0F96F8646BC04DC774C20907B9FD6337E7AC2CA92788ED68C3A44389A2B6A4AEBD1795B7104B7639AEFD1F8AFF419D48A03F01F42880AF378C48C44F00E
Malicious:	false
Preview:	m....&....aO.W.B.....R...1......i%..j@w.t...:`.e..gI..z..c@z.q=\..G._f?.B..B#...KC&P.l..-x.9p.J..--.........(.C..-.Hy..[..r\J..V..M.....=..P........N...#.J.Q:T....<......m'Y<a7gk.j^.R...z...6..c......%&.Y.....................................................................................................Y@....czyzk0zzhil.

C:\Users\user\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Users\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	true
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\instructions_read_me.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.789020748869106
Encrypted:	false
SSDEEP:
MD5:	A1858E97C794B6DD91C84C4117972A63
SHA1:	E0166104EA97FC4DD52349113AC1EB2047B237E5
SHA-256:	BB3B4E779A5F43494E237B1979F0EDDC9BEB0A2A7C1E0B451A32C77795F1A58E
SHA-512:	DA4A96BA2E3078B14784496AF289097A8A0D21BC8486627C932C48BACC9E05D3837C671526F0F1D3F679C14E4A2BC1FD6B3A3196233E5FB194A7E2A8A029C9E1
Malicious:	true
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

Static File Info

General

File type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Entropy (8bit):	6.683099293212036
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	AztyGMg4jw.dll
File size:	819'200 bytes
MD5:	f74cec233a9609461e7518dd4c90207b
SHA1:	92408a8233567f8b10f30f83dfcdd98effe96dca
SHA256:	05ebae760340fe44362ab7c8f70b2d89d6c9ba9b9ee8a9f747b2f19d326c3431
SHA512:	231a0fd347933b31bbfbebebd274c4da40177360f35f295e5fa8384ad30ad11666221c39be28e56866e4b7254f9cbe3956368352ea7f4fe48e89427df7a6bcb4
SSDEEP:	12288:z0LOFSM++OeO+OeNhBBhhBBhlJ2//R18nBIs0I3sHGzVylK7Nb0tq0mxHu84NeiB:zGOFSmKqEI3sHGzVylK7Nb0U1Hu8WK
TLSH:	74059D217656D431D59D00F64928DFABA1BCAD600B748AEBABD83E3B7E381C10735E47
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......).q.m...m...m...&...\|...&.......&...z...x...}...x...u...x...;...&...j...m.......T...K...T...l...T...l...T...l...Richm..........

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x100634ce
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x10000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x65CD1A15 [Wed Feb 14 19:52:53 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	23e2fb791954fbabda43d79392204d36

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
cmp dword ptr [ebp+0Ch], 01h
jne 00007F15886D8407h
call 00007F15886D8C8Bh
push dword ptr [ebp+10h]
push dword ptr [ebp+0Ch]
push dword ptr [ebp+08h]
call 00007F15886D82B3h
add esp, 0Ch
pop ebp
retn 000Ch
push ebp
mov ebp, esp
and dword ptr [100C2D78h], 00000000h
sub esp, 24h
or dword ptr [100BC9F0h], 01h
push 0000000Ah
call dword ptr [10098104h]
test eax, eax
je 00007F15886D85B2h
and dword ptr [ebp-10h], 00000000h
xor eax, eax
push ebx
push esi
push edi
xor ecx, ecx
lea edi, dword ptr [ebp-24h]
push ebx
cpuid
mov esi, ebx
pop ebx
nop
mov dword ptr [edi], eax
mov dword ptr [edi+04h], esi
mov dword ptr [edi+08h], ecx
xor ecx, ecx
mov dword ptr [edi+0Ch], edx
mov eax, dword ptr [ebp-24h]
mov edi, dword ptr [ebp-20h]
mov dword ptr [ebp-0Ch], eax
xor edi, 756E6547h
mov eax, dword ptr [ebp-18h]
xor eax, 49656E69h
mov dword ptr [ebp-04h], eax
mov eax, dword ptr [ebp-1Ch]
xor eax, 6C65746Eh
mov dword ptr [ebp-08h], eax
xor eax, eax
inc eax
push ebx
cpuid
mov esi, ebx
pop ebx
nop
lea ebx, dword ptr [ebp-24h]
mov dword ptr [ebx], eax
mov eax, dword ptr [ebp-04h]
or eax, dword ptr [ebp-08h]
or eax, edi
mov dword ptr [ebx+04h], esi
mov dword ptr [ebx+08h], ecx
mov dword ptr [ebx+0Ch], edx
jne 00007F15886D8445h
mov eax, dword ptr [ebp-24h]
and eax, 0FFF3FF0h
cmp eax, 000106C0h
je 00007F15886D8425h
cmp eax, 00020660h
je 00007F15886D841Eh
cmp eax, 00000070h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0xb73a0	0x48	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0xb73e8	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc4000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xc5000	0x7fa4	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xa9648	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xa9680	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xa9588	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x98000	0x1dc	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x9612c	0x96200	8a481a6952d8c28ebfe960763bee599c	False	0.470735649979184	data	6.721485834955143	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x98000	0x1fee8	0x20000	493e4bc2bfb8c3a0aa06bbc92989cd5e	False	0.40457916259765625	data	5.332336805223001	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xb8000	0xb870	0x9800	e2f1764ee567f500a6ce2c5b2c606be3	False	0.16627261513157895	Device independent bitmap graphic, 0 x 65536 x 16448, 65536 compression, image size 1109917728, resolution 1441792 x 2621440 px/m, 8388608 important colors	4.613287726975152	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xc4000	0x1e0	0x200	d05f2f9f364f8bd689d67b35eca98339	False	0.52734375	data	4.724728911998389	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xc5000	0x7fa4	0x8000	e9bd336cdbefe498b4362523e582833a	False	0.612457275390625	data	6.560834047515487	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0xc4060	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
KERNEL32.dll	GetTickCount, GetModuleFileNameW, lstrcmpW, FindFirstVolumeW, FindNextVolumeW, FindVolumeClose, GetVolumeInformationW, GetVolumePathNamesForVolumeNameW, CreateFileW, WriteFile, CloseHandle, GetFileSizeEx, CreateProcessA, SetFileAttributesW, WaitForSingleObject, CreateThread, VirtualAlloc, VirtualFree, SetLastError, QueryPerformanceCounter, QueryPerformanceFrequency, SetEndOfFile, WriteConsoleW, SetStdHandle, OpenMutexW, CreateMutexW, GetLastError, GetTempPathW, FindNextFileW, FindFirstFileW, ReadFile, FindClose, Sleep, GetCurrentThreadId, GetNativeSystemInfo, ReleaseSRWLockExclusive, AcquireSRWLockExclusive, TryAcquireSRWLockExclusive, WideCharToMultiByte, MultiByteToWideChar, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, WakeAllConditionVariable, SleepConditionVariableSRW, GetSystemTimeAsFileTime, GetModuleHandleW, GetProcAddress, GetLocaleInfoEx, EncodePointer, DecodePointer, LCMapStringEx, GetStringTypeW, CompareStringEx, GetCPInfo, InitializeSListHead, IsProcessorFeaturePresent, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, GetCurrentProcess, TerminateProcess, GetCurrentProcessId, RaiseException, RtlUnwind, InterlockedPushEntrySList, InterlockedFlushSList, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, LoadLibraryExW, ExitProcess, GetModuleHandleExW, GetCommandLineA, GetCommandLineW, HeapAlloc, HeapFree, GetDateFormatW, GetTimeFormatW, CompareStringW, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetStdHandle, GetFileType, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, SetFilePointerEx, ReadConsoleW, HeapReAlloc, HeapSize, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetACP, GetOEMCP, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableW, GetProcessHeap
SHELL32.dll	SHChangeNotify
ADVAPI32.dll	CryptReleaseContext, CryptAcquireContextA, RegSetValueExW, RegOpenKeyExW, RegCreateKeyExW, RegCloseKey, CryptGenRandom

Exports

Name	Ordinal	Address
VisibleEntry	1	0x1000b170

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	02:48:15
Start date:	27/10/2024
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\AztyGMg4jw.dll"
Imagebase:	0x2a0000
File size:	126'464 bytes
MD5 hash:	51E6071F9CBA48E79F10C84515AAE618
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	02:48:15
Start date:	27/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	02:48:16
Start date:	27/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\AztyGMg4jw.dll",#1
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	02:48:16
Start date:	27/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\AztyGMg4jw.dll,VisibleEntry
Imagebase:	0x6a0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	02:48:16
Start date:	27/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\AztyGMg4jw.dll",#1
Imagebase:	0x6a0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	02:48:19
Start date:	27/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\AztyGMg4jw.dll",VisibleEntry
Imagebase:	0x6a0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	32.2%
Total number of Nodes:	298
Total number of Limit Nodes:	30

Executed Functions

Function 6D192EF0 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 123
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000000,FBD4147D,6D221710,00000000,?), ref: 6D192F35
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,6D1F184D,000000FF,?,6D193670), ref: 6D192F3B
CryptAcquireContextA.ADVAPI32(?,Crypto++ RNG,00000000,00000001,00000008), ref: 6D192F4F
CryptAcquireContextA.ADVAPI32(?,Crypto++ RNG,00000000,00000001,00000028), ref: 6D192F60
SetLastError.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,6D1F184D,000000FF), ref: 6D192F85
___std_exception_copy.LIBVCRUNTIME ref: 6D193002

Strings

$-!m, xrefs: 6D192FB0, 6D192FB3
Crypto++ RNG, xrefs: 6D192F47, 6D192F5A
$-!m, xrefs: 6D192FDC
CryptAcquireContext, xrefs: 6D192F8B

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: AcquireContextCrypt$ErrorLast$___std_exception_copy
String ID: $-!m$$-!m$CryptAcquireContext$Crypto++ RNG
API String ID: 616088579-1644095864
Opcode ID: b428fe768f5ed5687e14493e9170688ea86e0e60bb6cd44e5ebe45e2718cdd5b
Instruction ID: 314bd5615ed6121e02b0c0b0c31bbf1a7abcb03e5fcdd62b69323b5fac4efb38
Opcode Fuzzy Hash: b428fe768f5ed5687e14493e9170688ea86e0e60bb6cd44e5ebe45e2718cdd5b
Instruction Fuzzy Hash: 7E41D5B1A04209ABDB20CF95CC45FAAF7FCFF19710F10462AF515E7284DBB4A5058BA0

Function 6D16B1A9 Relevance: 16.3, APIs: 2, Strings: 7, Instructions: 593
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6D164B00: OpenMutexW.KERNEL32(001F0001,00000003,00000002), ref: 6D164B83
Part of subcall function 6D164B00: CreateMutexW.KERNEL32(00000003,00000003,00000002), ref: 6D164BEF

Part of subcall function 6D166D30: RegOpenKeyExW.ADVAPI32(80000002,SYSTEM\CurrentControlSet\Control\Terminal Server,00000000,00020006,?), ref: 6D166D5A
Part of subcall function 6D166D30: RegSetValueExW.ADVAPI32(?,fDenyTSConnections,00000000,00000004,?,00000004), ref: 6D166D76
Part of subcall function 6D166D30: RegCloseKey.ADVAPI32(?), ref: 6D166D7F

GetTickCount.KERNEL32 ref: 6D16B65F

Part of subcall function 6D1725B0: SetFileAttributesW.KERNEL32(?,00000080,FBD4147D), ref: 6D1725FB
Part of subcall function 6D1725B0: CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000003,00000080,00000000), ref: 6D17261F
Part of subcall function 6D1725B0: GetFileSizeEx.KERNEL32(00000000,?), ref: 6D17263E
Part of subcall function 6D1725B0: CloseHandle.KERNEL32(00000000), ref: 6D172649

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 6D16B923

Strings

c:\, xrefs: 6D16B71B
D, xrefs: 6D16B8B5
A%$"3815a%./$K, xrefs: 6D16B5DF
/, xrefs: 6D16B76A
ue, xrefs: 6D16B58D
IHBU, xrefs: 6D16B7B7, 6D16B7E1
", xrefs: 6D16B760

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: CreateFile$CloseMutexOpen$AttributesCountHandleProcessSizeTickValue
String ID: "$/$A%$"3815a%./$K$D$IHBU$c:\$ue
API String ID: 1073009802-3466259702
Opcode ID: 4bb23be4f6a6d97317d3a394e9282744df59fc23d0ddfe2d94d0451dc8f003c0
Instruction ID: 85a2750cd27045c1f2c1aff858ec7478e6b8f24c4e2419b550e641ccf43bb542
Opcode Fuzzy Hash: 4bb23be4f6a6d97317d3a394e9282744df59fc23d0ddfe2d94d0451dc8f003c0
Instruction Fuzzy Hash: 0A327671D042988BDB18CF68CD50BEEB7B1BF59304F14829DE605A7249EBB05AD0CFA1

Function 6D164B00 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 119
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenMutexW.KERNEL32(001F0001,00000003,00000002), ref: 6D164B83
CreateMutexW.KERNEL32(00000003,00000003,00000002), ref: 6D164BEF

Strings

-bomb, xrefs: 6D16509D
-file, xrefs: 6D16561F
-nom, xrefs: 6D165535
utex, xrefs: 6D16553E
ivate, xrefs: 6D16518B
-nordp, xrefs: 6D16510E
-nomutex, xrefs: 6D165690

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: Mutex$CreateOpen
String ID: -bomb$-file$-nom$-nomutex$-nordp$ivate$utex
API String ID: 4030545807-2517714055
Opcode ID: 8c1ac2722625d643c9466d196c35b37228216443d782b4f1b076dc633940221a
Instruction ID: 446b48cf786ebfdd7699bf982efdc4a0ce3a69c666a2632a0ad0c21a6da89039
Opcode Fuzzy Hash: 8c1ac2722625d643c9466d196c35b37228216443d782b4f1b076dc633940221a
Instruction Fuzzy Hash: 5B4172314092D68AD721CF70D454ABBFFF8AF2E605B168ADED0D5CB006E7799245CB90

Function 6D193600 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 105
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptGenRandom.ADVAPI32(00000000,?,00000000,00000001), ref: 6D193680
CryptReleaseContext.ADVAPI32(?,00000000), ref: 6D19369F

Part of subcall function 6D193050: GetLastError.KERNEL32(FBD4147D,75B4FC30,?), ref: 6D193098

Part of subcall function 6D1C40CE: RaiseException.KERNEL32(E06D7363,00000001,00000003,6D1675AC,?,?,?,?,6D1675AC,FBD4147D,6D21043C,FBD4147D), ref: 6D1C412E

Strings

CryptGenRandom, xrefs: 6D1936E8

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: Crypt$ContextErrorExceptionLastRaiseRandomRelease
String ID: CryptGenRandom
API String ID: 2561026028-3616286655
Opcode ID: 336e3014438d489f8c1f2cc05b351086cc0873247a71c8fd2753b32507c89772
Instruction ID: ec5ba177b89d891a144709a4914b1dd364a5269749147dd763f3b60cd41ed2c7
Opcode Fuzzy Hash: 336e3014438d489f8c1f2cc05b351086cc0873247a71c8fd2753b32507c89772
Instruction Fuzzy Hash: 7831B571D05248AFDB10CFD5C848FEEBBB8EF15714F100129E915AB389DBB45A05CB61

Function 6D1934F0 Relevance: 1.6, APIs: 1, Instructions: 84
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 6D19357C

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: ContextCryptRelease
String ID:
API String ID: 829835001-0
Opcode ID: 8e7ab3d4c5a2a7b1b1aca129c88fc49eba9eb0feac85c2a7a7441e379e40beb8
Instruction ID: cf5d82f90fa9275d9ed57c52dc749ed4fc623dc473a5821e2aae12f55288c300
Opcode Fuzzy Hash: 8e7ab3d4c5a2a7b1b1aca129c88fc49eba9eb0feac85c2a7a7441e379e40beb8
Instruction Fuzzy Hash: C4210EB5904204DBFB21CF58D845F7673F4EB19724F014129F919D7348E7B5A801C792

Function 6D1C32E8 Relevance: 10.6, APIs: 7, Instructions: 136
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 6D1C332F
___scrt_uninitialize_crt.LIBCMT ref: 6D1C3349

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: 6119047114f1b8ace8aba336fb69e18be10bbddc67badbeb74bdb305d6f2c327
Instruction ID: 79f60f48230065f61b222bff72ab648024b38497c8065a70c7b3bf7c5c33e6d5
Opcode Fuzzy Hash: 6119047114f1b8ace8aba336fb69e18be10bbddc67badbeb74bdb305d6f2c327
Instruction Fuzzy Hash: 97410572D08615EFDB228F55CC00BAE3AB5EFB1B58F028119F51167258C7F94903CB92

Function 6D1DEBEC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,?,?,FBD4147D,?,6D1DECFB,811C9DC5,?,00000000,?), ref: 6D1DECAD

Strings

ext-ms-, xrefs: 6D1DEC57
api-ms-, xrefs: 6D1DEC43

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 9cfc41d44235fc47325c5b2303df5d76475cb317e382da8f31d250f406568b2f
Instruction ID: 950a50ffbfe976c33f4e3cc18a58234ea5490fd2632b7c8cdc304c6b972373da
Opcode Fuzzy Hash: 9cfc41d44235fc47325c5b2303df5d76475cb317e382da8f31d250f406568b2f
Instruction Fuzzy Hash: 39213D72644121ABDB529725FC84B6BB778EF53366F110210ED95E7284D7F0EB00C6E0

Function 6D1C3398 Relevance: 7.6, APIs: 5, Instructions: 87
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

dllmain_raw.LIBCMT ref: 6D1C33D5
dllmain_crt_dispatch.LIBCMT ref: 6D1C33EC
dllmain_raw.LIBCMT ref: 6D1C3434
dllmain_crt_dispatch.LIBCMT ref: 6D1C3447
dllmain_raw.LIBCMT ref: 6D1C345A

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: bff9652392b888522e16e88fc5c9260262a2778ef4c6426620e00f75a6ed593e
Instruction ID: d7a50a511bc8e7358cce798597dbdd8919f5b0975d2f46863d35e16106d260e4
Opcode Fuzzy Hash: bff9652392b888522e16e88fc5c9260262a2778ef4c6426620e00f75a6ed593e
Instruction Fuzzy Hash: 6D21A171D0461AABDB224F15CC41A7F3A79EBB1B94B028119F8155B218D7B98D03CBE2

Function 6D1D2959 Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,6D1D2953,00000016,6D1CE242,?,?,FBD4147D,6D1CE242,?), ref: 6D1D296A
TerminateProcess.KERNEL32(00000000,?,6D1D2953,00000016,6D1CE242,?,?,FBD4147D,6D1CE242,?), ref: 6D1D2971
ExitProcess.KERNEL32 ref: 6D1D2983

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: f03d95595e81f9d9ab517252350de86618d28ac7af720e805db2186927487dde
Instruction ID: d23d945528d051310b59ecbca0d11e699a8a169bd892f9e9a86cdfa75e083edf
Opcode Fuzzy Hash: f03d95595e81f9d9ab517252350de86618d28ac7af720e805db2186927487dde
Instruction Fuzzy Hash: 86D09EB1008514BFCF552F61EC0DB993F79AF86255B514110B9154A025CBF199539AA0

Function 6D1C31E1 Relevance: 3.1, APIs: 2, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 6D1C322E

Part of subcall function 6D1C3176: InitializeSListHead.KERNEL32(6D222D68,6D1C3238,6D216B00,00000010,6D1C31C9,?,?,?,6D1C33F1,?,00000001,?,?,00000001,?,6D216B48), ref: 6D1C317B

___scrt_is_nonwritable_in_current_image.LIBCMT ref: 6D1C3298

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: Initialize$HeadList___scrt_is_nonwritable_in_current_image
String ID:
API String ID: 3231365870-0
Opcode ID: d649314c8b1a87272a25a695140fdc17b8e7a924e1bef78c7c0fad249a102af5
Instruction ID: 94afd680a69cab9d48a677b9204eceabf9670e0c31d53b0a10c3343dc12be5b4
Opcode Fuzzy Hash: d649314c8b1a87272a25a695140fdc17b8e7a924e1bef78c7c0fad249a102af5
Instruction Fuzzy Hash: EA21F37154C2029FDF15ABB4D4047AD37B06F3336DF114805EA80275CADBFA5146CAA7

Function 6D1DF41F Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6), ref: 6D1DF46B
GetFileType.KERNELBASE(00000000), ref: 6D1DF47D

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: dfc03d99f1b48517eec61d26cf8aab3c5f83ffc6a718e70829bbc9eafea94519
Instruction ID: 19c77b5064f432f51143acee92a0cc42d1759c46a9fce0d7b5b780dfcd1fe551
Opcode Fuzzy Hash: dfc03d99f1b48517eec61d26cf8aab3c5f83ffc6a718e70829bbc9eafea94519
Instruction Fuzzy Hash: 101196711187925AC7604E3E8C887327AA4B7A7234B24571ED5B5C71F7D3F0D685C641

Function 6D1DECB7 Relevance: 1.6, APIs: 1, Instructions: 56
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f6ed6510d0ca990a11b9d1fc4dd014aeb67ada789542a3fe4d9e8b002404624
Instruction ID: 39318a7f6d72b2c6bd4365179ca2b67cf9b989695c3204fdc9a42b115c38718c
Opcode Fuzzy Hash: 2f6ed6510d0ca990a11b9d1fc4dd014aeb67ada789542a3fe4d9e8b002404624
Instruction Fuzzy Hash: E101D2372186165FDF428AA8ED45B6BB3AABBD2B657218125FA60C708CDFB0D500D790

Function 6D16B170 Relevance: 1.5, APIs: 1, Instructions: 18
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 6D16B198

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: CountTick
String ID:
API String ID: 536389180-0
Opcode ID: d1336d1bba055c5d01df49f55268ad0bd08e9f3fc6ba49492b480b872f01e74d
Instruction ID: e85054a500dc1b2c245f9fffc6d6e163fea0b3d164502b791e145cb035e39e16
Opcode Fuzzy Hash: d1336d1bba055c5d01df49f55268ad0bd08e9f3fc6ba49492b480b872f01e74d
Instruction Fuzzy Hash: 41E0CDB4C0530897CB006F799D4666ABBF4BB09710F804234DD5483345EB70A9248A96

Function 6D1ABF2C Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNELBASE(?,?,?,?,?,?,6D16573B,?,-threads,811C9DC5,00000000,00000000), ref: 6D1ABF36

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: ba0af9f39a976bd61f4f98f5e4b0abd31f6e10dd80aabcfcc8e9c88ef97fc7db
Instruction ID: e630653018fe6368d7e61e5d84ad4fafac344a978a53f45f19d3ae2c10cca69b
Opcode Fuzzy Hash: ba0af9f39a976bd61f4f98f5e4b0abd31f6e10dd80aabcfcc8e9c88ef97fc7db
Instruction Fuzzy Hash: 40C09B7490420D9BCF00E7E5E949D8EB7FCEE08104B400551D515E3140E770F9498791

Non-executed Functions

Function 6D1C7E58 Relevance: 46.6, APIs: 25, Strings: 1, Instructions: 1103COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 6D1C7EB6
operator+.LIBVCRUNTIME ref: 6D1C7ED0
DName::operator+.LIBCMT ref: 6D1C8004
DName::operator+.LIBCMT ref: 6D1C8021
DName::operator+.LIBCMT ref: 6D1C8070

Part of subcall function 6D1C90FE: DName::DName.LIBVCRUNTIME ref: 6D1C9141

Part of subcall function 6D1C7C59: shared_ptr.LIBCMT ref: 6D1C7C75

Part of subcall function 6D1C9709: shared_ptr.LIBCMT ref: 6D1C97BA

DName::operator+.LIBCMT ref: 6D1C80E7
DName::operator+.LIBCMT ref: 6D1C80F6
DName::operator+.LIBCMT ref: 6D1C85DB
DName::operator+.LIBCMT ref: 6D1C85F7
DName::operator+.LIBCMT ref: 6D1C8874

Part of subcall function 6D1C7B84: DName::operator+.LIBCMT ref: 6D1C7BA5

DName::operator+.LIBCMT ref: 6D1C8978
DName::operator+.LIBCMT ref: 6D1C8A4D
DName::operator+.LIBCMT ref: 6D1C8AFB
DName::operator+.LIBCMT ref: 6D1C8B38

Strings

/, xrefs: 6D1C873B

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: Name::operator+$NameName::shared_ptr$operator+
String ID: /
API String ID: 1847427470-2043925204
Opcode ID: a5359daa68460022fb5de9e0af9653deb15ab076fb6b236b45fe822a0459d520
Instruction ID: f03780d4830935ed77334d9dccf3ebded86e27e976f62237b827d691228eacc0
Opcode Fuzzy Hash: a5359daa68460022fb5de9e0af9653deb15ab076fb6b236b45fe822a0459d520
Instruction Fuzzy Hash: 39826471E1421A9BDF05CFA4C891BFEB7B5BF68304F11412AE511E7288DBF89A44CB52

Function 6D1C97DE Relevance: 46.2, APIs: 25, Strings: 1, Instructions: 665COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 6D1C98CE

Part of subcall function 6D1CA71B: DName::operator+.LIBCMT ref: 6D1CA7B1

DName::operator+.LIBCMT ref: 6D1C9B18
DName::operator+.LIBCMT ref: 6D1C9B4D
DName::operator+.LIBCMT ref: 6D1C9B9C
DName::DName.LIBVCRUNTIME ref: 6D1C9F37
DName::operator+.LIBCMT ref: 6D1C9F43
DName::operator+.LIBCMT ref: 6D1C9F51
DName::operator+.LIBCMT ref: 6D1C9F5C

Strings

&& , xrefs: 6D1C9DA7

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: Name::operator+$NameName::
String ID: &&
API String ID: 168861036-993083564
Opcode ID: b74b3cc8c2d0316578743000cb210d6b3b8cf8dbb5b0ea9865a1f8cc30a015b6
Instruction ID: 38db6ddd61ae3072bf4cbf900ce92eadbb9816ca648f319cfc661a3b98b8e164
Opcode Fuzzy Hash: b74b3cc8c2d0316578743000cb210d6b3b8cf8dbb5b0ea9865a1f8cc30a015b6
Instruction Fuzzy Hash: 82424371D082099FDF05CF94D4A1BEEBBB4BF29309F11805AE515B7284DBF89A44CB92

Function 6D1AA690 Relevance: 20.3, Strings: 16, Instructions: 285COMMON

Download Yara Rule

Strings

cAMD, xrefs: 6D1AA880
Auth, xrefs: 6D1AA878
Cent, xrefs: 6D1AA983
uine, xrefs: 6D1AA8B2
enti, xrefs: 6D1AA888
Genu, xrefs: 6D1AA7C6
AMDi, xrefs: 6D1AA88F
sbet, xrefs: 6D1AA897
auls, xrefs: 6D1AA98B
VIA2, xrefs: 6D1AA9A3
ineI, xrefs: 6D1AA7DE
ntel, xrefs: 6D1AA7D2
Hygo, xrefs: 6D1AA8A6
nGen, xrefs: 6D1AA8BE
aurH, xrefs: 6D1AA997
ter!, xrefs: 6D1AA89F

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID:
String ID: AMDi$Auth$Cent$Genu$Hygo$VIA2$auls$aurH$cAMD$enti$ineI$nGen$ntel$sbet$ter!$uine
API String ID: 0-2699536740
Opcode ID: 20989d7abce52ba383a5209d4dea8fd08a081edb327d50a1382090dd1730798a
Instruction ID: 4c9f0e3a90404cf5f7b219d421756add8364b5e29094f0d588b59095eae7f5af
Opcode Fuzzy Hash: 20989d7abce52ba383a5209d4dea8fd08a081edb327d50a1382090dd1730798a
Instruction Fuzzy Hash: 7FB103B56283828FCB29CF188041B6FBBF0AF66308F49891EE8D5D3246C765D545DB22

Function 6D165790 Relevance: 15.1, APIs: 7, Strings: 1, Instructions: 1071COMMON

Download Yara Rule

APIs

__alldvrm.LIBCMT ref: 6D166025
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6D166066
__Xtime_get_ticks.LIBCPMT ref: 6D16609F
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6D16610D
__Mtx_unlock.LIBCPMT ref: 6D16660A
std::_Throw_Cpp_error.LIBCPMT ref: 6D1667B2
std::_Throw_Cpp_error.LIBCPMT ref: 6D1667B9

Strings

0, xrefs: 6D165D27

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: Cpp_errorThrow_Unothrow_t@std@@@__ehfuncinfo$??2@std::_$Mtx_unlockXtime_get_ticks__alldvrm
String ID: 0
API String ID: 3452520923-4108050209
Opcode ID: a77742ded670dde5ab14686c494ed69db7f8d621adad56a46cdf9245ae01483d
Instruction ID: 39ceac7f00663cd3148a7c394c0872f9edd2c7f7a7777f9e656449ee98390a0b
Opcode Fuzzy Hash: a77742ded670dde5ab14686c494ed69db7f8d621adad56a46cdf9245ae01483d
Instruction Fuzzy Hash: CAA2DE71D042588BDB29CF68CC94BEDB7B9BF45304F1482D9E509A7285DBB06B90CFA1

Function 6D1E8C68 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 182COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6D1DCFCB: GetLastError.KERNEL32(00000010,00000000,6D1E6D79,6D2172E0,0000000C,6D1E1D49,0000000C,?,6D1D235D,00000000,0000000C,?,00000000,00000000,00000000), ref: 6D1DCFCF
Part of subcall function 6D1DCFCB: SetLastError.KERNEL32(00000000,00000000,?,?,00000000,6D1675C1,?,6D1675C1,6D1675C1,?,6D1D52A5,F4458D6D,F4458D6D), ref: 6D1DD071

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 6D1E8D70
IsValidCodePage.KERNEL32(00000000), ref: 6D1E8DAE
IsValidLocale.KERNEL32(?,00000001), ref: 6D1E8DC1
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 6D1E8E09
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 6D1E8E24

Strings

P_ mE, xrefs: 6D1E8D1D

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID: P_ mE
API String ID: 415426439-2214052151
Opcode ID: 35962890667e06ebdb7e98bc6575e4cebd66d75d0c2115af0e21ffd78bf7b31b
Instruction ID: 434a0e2b556e6c76e407dfe03384eccd08f3d5030ac58996ce080ed0d9bd153c
Opcode Fuzzy Hash: 35962890667e06ebdb7e98bc6575e4cebd66d75d0c2115af0e21ffd78bf7b31b
Instruction Fuzzy Hash: FD518371A00A0AAFEF01DFA9DC44BFE77B8BFA9384F054529A514E7194D7F09940CB61

Function 6D1E95E5 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1473COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 6D1E97FC

Strings

1#IND, xrefs: 6D1E96EA
1#QNAN, xrefs: 6D1E96F8
1#SNAN, xrefs: 6D1E96F1
1#INF, xrefs: 6D1E971B

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: bee2b114d5d3119c7e31986b682e2dcd301afc679a96bfb60084c8f92e8a5dfc
Instruction ID: 40f0e153fe5df9484b48c8f039d03cf71bb8e31d610772976f0ee76ef0239ba5
Opcode Fuzzy Hash: bee2b114d5d3119c7e31986b682e2dcd301afc679a96bfb60084c8f92e8a5dfc
Instruction Fuzzy Hash: 58D24771E086298FDB65CF28CC50BEAB7B5FB95344F1541EAD40DE3244E7B8AA818F41

Function 6D193050 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 278encryptionCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(FBD4147D,75B4FC30,?), ref: 6D193098
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 6D193410

Strings

operation failed with error , xrefs: 6D1931D7
0, xrefs: 6D1930B9
OS_Rng: , xrefs: 6D1931C1

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: ContextCryptErrorLastRelease
String ID: operation failed with error $0$OS_Rng:
API String ID: 3299239745-3942070055
Opcode ID: 8c34e07e3bba6c5bc562d57573601f5086da8ca7ec804bdcee6dc0e10b37090d
Instruction ID: 05bd2a60ab736c3badbf159aa7660f30c2346006214f68cd69cd1fd9bff32b9f
Opcode Fuzzy Hash: 8c34e07e3bba6c5bc562d57573601f5086da8ca7ec804bdcee6dc0e10b37090d
Instruction Fuzzy Hash: 69B10371D002489BEB28CFA4CC84BEDBB75FF55310F248358E108AB695DBB4AAC5CB51

Function 6D1E82F3 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 254COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6D1DCFCB: GetLastError.KERNEL32(00000010,00000000,6D1E6D79,6D2172E0,0000000C,6D1E1D49,0000000C,?,6D1D235D,00000000,0000000C,?,00000000,00000000,00000000), ref: 6D1DCFCF
Part of subcall function 6D1DCFCB: SetLastError.KERNEL32(00000000,00000000,?,?,00000000,6D1675C1,?,6D1675C1,6D1675C1,?,6D1D52A5,F4458D6D,F4458D6D), ref: 6D1DD071

GetACP.KERNEL32(?,?,?,?,?,?,6D1DD9FB,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 6D1E83B2
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,6D1DD9FB,?,?,?,00000055,?,-00000050,?,?), ref: 6D1E83E9
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 6D1E854C

Strings

utf8, xrefs: 6D1E84BB
P_ mE, xrefs: 6D1E8366

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: P_ mE$utf8
API String ID: 607553120-2601179500
Opcode ID: 4ec420126b1d225b60e4faeb8f974b54a2a1ebb1e4d37885c257863ea9bf5277
Instruction ID: d3dbf714b6b6322e61d3486dabee0d31015545126d538cd779d1af3a9d2afca8
Opcode Fuzzy Hash: 4ec420126b1d225b60e4faeb8f974b54a2a1ebb1e4d37885c257863ea9bf5277
Instruction Fuzzy Hash: E5712A71608E07ABE7159B34CC45BBA73A8EF88784F11452AF615DB18AFBF0D940C761

Function 6D1E8A8C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,6D1E8D9E,00000002,00000000,?,?,?,6D1E8D9E,?,00000000), ref: 6D1E8B25
GetLocaleInfoW.KERNEL32(?,20001004,6D1E8D9E,00000002,00000000,?,?,?,6D1E8D9E,?,00000000), ref: 6D1E8B4E
GetACP.KERNEL32(?,?,6D1E8D9E,?,00000000), ref: 6D1E8B63

Strings

ACP, xrefs: 6D1E8AAA
OCP, xrefs: 6D1E8AE0

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 5f9a842ce07a96987f8cf77eeab011672b507e88062b76927540d56dbc763c78
Instruction ID: ff241c602f1720809d76856d873e8809bf74b05fee09341e025cca2b0d36c39b
Opcode Fuzzy Hash: 5f9a842ce07a96987f8cf77eeab011672b507e88062b76927540d56dbc763c78
Instruction Fuzzy Hash: EB21B6A2B48906ABE7158F15C900BA773B6FFE1BE4B468424E905D7148E7F2D941C3E0

Function 6D1A0D90 Relevance: 8.4, APIs: 1, Strings: 3, Instructions: 1430COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 6D1A1FEE

Strings

gfff, xrefs: 6D1A1D4C
gfff, xrefs: 6D1A1AD8
gfff, xrefs: 6D1A1B0F

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID: gfff$gfff$gfff
API String ID: 118556049-4275324669
Opcode ID: 09a7e4622e37384249a63f76410255e82651a2ea99efab405a08d06f584a4770
Instruction ID: 08df5404d3ff72576700fbf41f17eeeb9532952a34d998484dfbdb5288c1f5bf
Opcode Fuzzy Hash: 09a7e4622e37384249a63f76410255e82651a2ea99efab405a08d06f584a4770
Instruction Fuzzy Hash: B7D2D075900258DFDB14CF68C990BEEBBB5BF54304F09809DE90AA7255DBB0AE85CF90

Function 6D1D8A80 Relevance: 6.5, APIs: 4, Instructions: 455COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 915d7398b856c21966162eda4c93e75671037bd6f3c7bdc631b970303f623d7d
Instruction ID: 1c827ae051394df80d03197aece9f8b55eac87b324a911ff7ad8bbf208af622e
Opcode Fuzzy Hash: 915d7398b856c21966162eda4c93e75671037bd6f3c7bdc631b970303f623d7d
Instruction Fuzzy Hash: 49025A71E0121A9FDB54CFA8D8806EEFBB1FF58314F25826AE519E7384D771A901CB90

Function 6D1C39F5 Relevance: 6.1, APIs: 4, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 6D1C3A01
IsDebuggerPresent.KERNEL32 ref: 6D1C3ACD
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6D1C3AED
UnhandledExceptionFilter.KERNEL32(?), ref: 6D1C3AF7

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 9a74ebe89c1ee72a116a803f0e73c2664a5d251d54ef5c941a258e2c46034ea5
Instruction ID: 46eafe6055113de5c9ac2e9f72f87871e9412615e88a91d1978cdfc6c729a82c
Opcode Fuzzy Hash: 9a74ebe89c1ee72a116a803f0e73c2664a5d251d54ef5c941a258e2c46034ea5
Instruction Fuzzy Hash: 56314BB5D0921C9BDF10DFA1D989BCDBBF8AF18304F1041AAE40DA7240EBB49A85CF45

Function 6D1E8710 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 6D1DCFCB: GetLastError.KERNEL32(00000010,00000000,6D1E6D79,6D2172E0,0000000C,6D1E1D49,0000000C,?,6D1D235D,00000000,0000000C,?,00000000,00000000,00000000), ref: 6D1DCFCF
Part of subcall function 6D1DCFCB: SetLastError.KERNEL32(00000000,00000000,?,?,00000000,6D1675C1,?,6D1675C1,6D1675C1,?,6D1D52A5,F4458D6D,F4458D6D), ref: 6D1DD071

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 6D1E8764
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 6D1E87AE
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 6D1E8874

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 8648756135704b41dea89dde618589715f123325fbf3e137ac294498b3af5496
Instruction ID: 32397492580dcc8c308840ec15149869edf3709bd214a5da518ff61830b7a1f7
Opcode Fuzzy Hash: 8648756135704b41dea89dde618589715f123325fbf3e137ac294498b3af5496
Instruction Fuzzy Hash: B1619071A5890B9FEB199F28CC81FBA77A8FF94394F104179EE15C6188E7B4D980CB50

Function 6D172B90 Relevance: 4.6, APIs: 3, Instructions: 133fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?,?,?,00000000), ref: 6D172BEA
WriteFile.KERNEL32(?,?,?,00000000,?,?,00000000), ref: 6D172C8E
WriteFile.KERNEL32(?,?,00000008,?,?,?,00000000), ref: 6D172CDE

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: File$Write$Read
String ID:
API String ID: 685983563-0
Opcode ID: 0ad1750e7b4dc6aa35730f9c4d978748ccde211f6650e2bd700ba911c10cc8e4
Instruction ID: 68a6fa4f0f986fe714f3293f1615703f7a8c27150a8fcb6af1d7a8e7d5a5d8ea
Opcode Fuzzy Hash: 0ad1750e7b4dc6aa35730f9c4d978748ccde211f6650e2bd700ba911c10cc8e4
Instruction Fuzzy Hash: 01517B71A012599FCB10CFA8D884BEEFBF8FF59300F51826AE905AB244D770A805CB90

Function 6D1CE243 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 6D1CE33B
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 6D1CE345
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 6D1CE352

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: bc061929c6b23786f6f62509260cd02940f3a8e788423cd612dd3c446f80ce7f
Instruction ID: ad99c0c28e7982f3de72905464dc03afee95dcd850c448217a7915ef4be552d8
Opcode Fuzzy Hash: bc061929c6b23786f6f62509260cd02940f3a8e788423cd612dd3c446f80ce7f
Instruction Fuzzy Hash: 2F31E6B490521D9BCB21DF65DC89BDCBBB8BF18310F5042EAE41CA7250EB749B818F45

Function 6D193460 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47encryptionCOMMON

Download Yara Rule

APIs

Part of subcall function 6D1934F0: CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 6D19357C

CryptGenRandom.ADVAPI32(00000000,?,?,FBD4147D), ref: 6D19349A

Strings

CryptGenRandom, xrefs: 6D1934C0

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: Crypt$ContextRandomRelease
String ID: CryptGenRandom
API String ID: 3163166064-3616286655
Opcode ID: cfb6ea2781f82c065354ff5ae6ff4e9be256e87a66caa508a25d49e6023e5422
Instruction ID: bb05e04635f722678a530cf1804493049bb958218a05e80f11175d6784587b12
Opcode Fuzzy Hash: cfb6ea2781f82c065354ff5ae6ff4e9be256e87a66caa508a25d49e6023e5422
Instruction Fuzzy Hash: A4016D71908118ABCB15DF90CC45FEEB7B8EB15314F00452AA915AB288DBB46504CB50

Function 6D182B70 Relevance: 3.1, APIs: 2, Instructions: 147COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6D182BDD
__aullrem.LIBCMT ref: 6D182C13

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: __aullrem
String ID:
API String ID: 3758378126-0
Opcode ID: 6c03c0fd5de9c2217616d982115a9fef6d9f357d7d8d83b6779cfd23208b8935
Instruction ID: 5ff5b203cbb6a3967a6b7dfe0f73b0040db5f6b3f81ae472aa2d62ed213ed1e6
Opcode Fuzzy Hash: 6c03c0fd5de9c2217616d982115a9fef6d9f357d7d8d83b6779cfd23208b8935
Instruction Fuzzy Hash: 2241F932B0C3164FC329CF68D840A7AF3E5EBE4314F42453EE9299B659DBB1D9058B81

Function 6D1689A0 Relevance: 3.0, Strings: 2, Instructions: 451COMMON

Download Yara Rule

Strings

ios_base::badbit set, xrefs: 6D1689BE
bad conversion, xrefs: 6D168EFB

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID:
String ID: bad conversion$ios_base::badbit set
API String ID: 0-3204926396
Opcode ID: a403a5d9c9277e2d2eb9b20922d74070e8899df87e81aad68ab82be26a25be23
Instruction ID: 339d2a41033d1e1708408b8aa74d383039db1960304e934e5a94fc73fc3890ce
Opcode Fuzzy Hash: a403a5d9c9277e2d2eb9b20922d74070e8899df87e81aad68ab82be26a25be23
Instruction Fuzzy Hash: AE02E271D04259CFCB14CFA8C890ADDFBB6FF8A314F25421AE515AB398D770A951CBA0

Function 6D199BD0 Relevance: 2.2, APIs: 1, Instructions: 659COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 6D19A2A1

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 300cee119dddc01a54e7982e8540ca0d60c27fb3e51bed6b19390d434808bdf1
Instruction ID: 3024b0158f50058ce4dc641cb104fdb0ea6bc1678af93609dc5f94a0fd0f36a7
Opcode Fuzzy Hash: 300cee119dddc01a54e7982e8540ca0d60c27fb3e51bed6b19390d434808bdf1
Instruction Fuzzy Hash: 7A42FD71A042499FCB14CF68C990BEEBBF5BF98308F05501DE9069B399DBB1E905CB90

Function 6D199470 Relevance: 2.1, APIs: 1, Instructions: 636COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 6D199BB9

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: f63c502ed77bab167abeab0b4570c2126878bffe2258ddc9278d0ff124f1da9f
Instruction ID: 5039b0c9feb2715d263997a6b268f6f7f06f46f2bf352469985aa7d23c4c1388
Opcode Fuzzy Hash: f63c502ed77bab167abeab0b4570c2126878bffe2258ddc9278d0ff124f1da9f
Instruction Fuzzy Hash: 25421F71A04249CFCB19CF68C8A0BEEBBB5BF58304F05505DE9469B399DBB0E945CB90

Function 6D1A42B0 Relevance: 2.0, Strings: 1, Instructions: 702COMMON

Download Yara Rule

Strings

RoundUpToMultipleOf: integer overflow, xrefs: 6D1A4C37

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID:
String ID: RoundUpToMultipleOf: integer overflow
API String ID: 0-1120416164
Opcode ID: 2f57ff94cf9a7375f7e32c698bca2b1bfeb5d604070f1124757a0e5c3651641a
Instruction ID: 06b4164f18078535b7c95a1c55062ff3dd4c4f80a657f3720b9d8a48955c5e10
Opcode Fuzzy Hash: 2f57ff94cf9a7375f7e32c698bca2b1bfeb5d604070f1124757a0e5c3651641a
Instruction Fuzzy Hash: D25247B06101588FC718CF68C490A3A7BF2EF5D300B59C25AE899CF396C774EA65DB60

Function 6D1E4FC3 Relevance: 1.9, APIs: 1, Instructions: 408timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,6D1E5408,00000000,00000000,00000000), ref: 6D1E52C7

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: InformationTimeZone
String ID:
API String ID: 565725191-0
Opcode ID: 00cc96e10dcda051ff78a6f601cdb2994dd46ab9a9c82db3c57d744f808db946
Instruction ID: d27b0bbe4c3b286ceb5d0617e2597c86a25f33e6f94006cfb45ce9f8395e9fb0
Opcode Fuzzy Hash: 00cc96e10dcda051ff78a6f601cdb2994dd46ab9a9c82db3c57d744f808db946
Instruction Fuzzy Hash: 99C129B1904526ABEB10DFB4CC01ABEBBB9FF55794F11405AFA01EB188E7F49A41C790

Function 6D1DC7B2 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,6D1DC7AD,?,?,00000008,?,?,6D1EE5F2,00000000), ref: 6D1DC9DF

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 5602c37ef7a0d2ca397de67e48acd3ed672ad1e1586335cef6b1e0c095ec40b7
Instruction ID: 8a5430249af4f806201854576989aacff96e1f6bd35a914f094f1f6db149477b
Opcode Fuzzy Hash: 5602c37ef7a0d2ca397de67e48acd3ed672ad1e1586335cef6b1e0c095ec40b7
Instruction Fuzzy Hash: A9B17C31610609CFD745CF28C486B647BE1FF49364F25CA58E8A9CF2A9C3B5E982CB40

Function 6D1C34F1 Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 6D1C3507

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 19c83a6e8c038e75c22ef793102d9b57a3ad447a04a13667b93fe90e56ce3643
Instruction ID: 88a11a3986765cec22205483d22f38d4a3cc055b25a05eb31fbfa6a256631f9c
Opcode Fuzzy Hash: 19c83a6e8c038e75c22ef793102d9b57a3ad447a04a13667b93fe90e56ce3643
Instruction Fuzzy Hash: DD51E3B19156168FEB14CF65C8857AEBBF4FB58308F10852AD420EB744D7B99A01CF91

Function 6D1E571F Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53945599736ecf40ed6437c5496189551e369dddcab49a26c40648f388460011
Instruction ID: d92e6db587e99f6cf35681f5d8fc72ef57d414c3062d85572c83758b0e64a560
Opcode Fuzzy Hash: 53945599736ecf40ed6437c5496189551e369dddcab49a26c40648f388460011
Instruction Fuzzy Hash: 3541C1B5C08629AFDB10DF79CC98ABABBB9AF45344F1042D9E45DD3204DB709E848F10

Function 6D1E8963 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 6D1DCFCB: GetLastError.KERNEL32(00000010,00000000,6D1E6D79,6D2172E0,0000000C,6D1E1D49,0000000C,?,6D1D235D,00000000,0000000C,?,00000000,00000000,00000000), ref: 6D1DCFCF
Part of subcall function 6D1DCFCB: SetLastError.KERNEL32(00000000,00000000,?,?,00000000,6D1675C1,?,6D1675C1,6D1675C1,?,6D1D52A5,F4458D6D,F4458D6D), ref: 6D1DD071

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 6D1E89B7

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 9848484a5a902fd6bac5063d67956b294b26d7ad4b5bcee32a1bbfe23b436e30
Instruction ID: 7d80b237d7a52b22d27b1f7c0dcda6c84f9cada89f28d7b4f2d5663f1dc4378f
Opcode Fuzzy Hash: 9848484a5a902fd6bac5063d67956b294b26d7ad4b5bcee32a1bbfe23b436e30
Instruction Fuzzy Hash: BF21C5B2659606ABDB188F25CC41EBA77E8EFD4794B11407EEA01D6148EBB4D900CB60

Function 6D1D1B67 Relevance: 1.6, Strings: 1, Instructions: 333COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 6D1D1CD7

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 5b66a5c675da54ea54a4133a210afbad40e7d07dc823bf938c1bf70699a27d12
Instruction ID: 9d063b8f26f5a80340742d185c05d95489e4048d9ceecab89d6f660d7bfc0415
Opcode Fuzzy Hash: 5b66a5c675da54ea54a4133a210afbad40e7d07dc823bf938c1bf70699a27d12
Instruction Fuzzy Hash: D7C10170A48A078FC7A6CF68C5807BABBB1BF16314F104719D56297699D3F0E9C5CB60

Function 6D1D1825 Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

0, xrefs: 6D1D19A9

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 40e51982981f4dadf598a040a58e03d74ec6b9f880be293232b2181865eb4001
Instruction ID: d951fdeede57b45563cb8c04636fbc8e74f7816156c1dfd64c3c6fa6813dcc94
Opcode Fuzzy Hash: 40e51982981f4dadf598a040a58e03d74ec6b9f880be293232b2181865eb4001
Instruction Fuzzy Hash: CEB14671A0864B8BCB98CF68C590ABEBBB1BF11304F10461DD5A29769CD7F1E6C2CB51

Function 6D1E85EA Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6D1DCFCB: GetLastError.KERNEL32(00000010,00000000,6D1E6D79,6D2172E0,0000000C,6D1E1D49,0000000C,?,6D1D235D,00000000,0000000C,?,00000000,00000000,00000000), ref: 6D1DCFCF
Part of subcall function 6D1DCFCB: SetLastError.KERNEL32(00000000,00000000,?,?,00000000,6D1675C1,?,6D1675C1,6D1675C1,?,6D1D52A5,F4458D6D,F4458D6D), ref: 6D1DD071

EnumSystemLocalesW.KERNEL32(6D1E8710,00000001,00000000,?,-00000050,?,6D1E8D44,00000000,?,?,?,00000055,?), ref: 6D1E865C

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 4e90a43759d2cc0ff892f495f9466f042e15d790e40555cc873735a62d8209db
Instruction ID: 4c4a259afb8bf984deff706861d64b393758c899959c345dd4ed388a9c4a1cad
Opcode Fuzzy Hash: 4e90a43759d2cc0ff892f495f9466f042e15d790e40555cc873735a62d8209db
Instruction Fuzzy Hash: 0311E97B204B015FDB189F39C9916BAB7A2FFC4358B59482DE54647A40D7B17942C740

Function 6D1E8B92 Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 6D1DCFCB: GetLastError.KERNEL32(00000010,00000000,6D1E6D79,6D2172E0,0000000C,6D1E1D49,0000000C,?,6D1D235D,00000000,0000000C,?,00000000,00000000,00000000), ref: 6D1DCFCF
Part of subcall function 6D1DCFCB: SetLastError.KERNEL32(00000000,00000000,?,?,00000000,6D1675C1,?,6D1675C1,6D1675C1,?,6D1D52A5,F4458D6D,F4458D6D), ref: 6D1DD071

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,6D1E892C,00000000,00000000,?), ref: 6D1E8BBE

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 448e8e18ad72b18d34dac2e734cb91bfdb660433613477d982d47f8a87c108e8
Instruction ID: 041acb1586dbe01195d5b6e63bbf7578c52b4537eb88fba3296fe3764fe280a0
Opcode Fuzzy Hash: 448e8e18ad72b18d34dac2e734cb91bfdb660433613477d982d47f8a87c108e8
Instruction Fuzzy Hash: A1014972604913ABDB084A348C45BFB3764FB823D4F054829EC02A3184EBF0FD82C6D0

Function 6D1E84F8 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 6D1DCFCB: GetLastError.KERNEL32(00000010,00000000,6D1E6D79,6D2172E0,0000000C,6D1E1D49,0000000C,?,6D1D235D,00000000,0000000C,?,00000000,00000000,00000000), ref: 6D1DCFCF
Part of subcall function 6D1DCFCB: SetLastError.KERNEL32(00000000,00000000,?,?,00000000,6D1675C1,?,6D1675C1,6D1675C1,?,6D1D52A5,F4458D6D,F4458D6D), ref: 6D1DD071

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 6D1E854C

Strings

utf8, xrefs: 6D1E84BB
P_ mE, xrefs: 6D1E8366

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID: P_ mE$utf8
API String ID: 3736152602-2601179500
Opcode ID: 4d26ebabcece158e812fd8df08d0c828a304d3de09c1cb5abef18a8cbc20dd93
Instruction ID: 11a0657c6136385fb4335412e043b080077299f9f1d4928eb5ec7ad61c6f3f46
Opcode Fuzzy Hash: 4d26ebabcece158e812fd8df08d0c828a304d3de09c1cb5abef18a8cbc20dd93
Instruction Fuzzy Hash: E1F02872714105ABC7149B38DD45EFE73ECDF89354F16007AA602D7244EFB4AD008790

Function 6D1E8685 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6D1DCFCB: GetLastError.KERNEL32(00000010,00000000,6D1E6D79,6D2172E0,0000000C,6D1E1D49,0000000C,?,6D1D235D,00000000,0000000C,?,00000000,00000000,00000000), ref: 6D1DCFCF
Part of subcall function 6D1DCFCB: SetLastError.KERNEL32(00000000,00000000,?,?,00000000,6D1675C1,?,6D1675C1,6D1675C1,?,6D1D52A5,F4458D6D,F4458D6D), ref: 6D1DD071

EnumSystemLocalesW.KERNEL32(6D1E8963,00000001,00000000,?,-00000050,?,6D1E8D0C,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 6D1E86CF

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 574046231e6e1786ddff2cd5d8a62627b914578c2993eeeec65c7ab070034c5d
Instruction ID: 4affbb3c6ecae05ab2b6e2504c94aa6716e7e5e323b0d3ec831efcc1cf98486d
Opcode Fuzzy Hash: 574046231e6e1786ddff2cd5d8a62627b914578c2993eeeec65c7ab070034c5d
Instruction Fuzzy Hash: 8DF04636204B041FD7045F35D884A7A7BA1FFC43ACF0A442CFA014B684D7F19802C640

Function 6D177DD0 Relevance: 1.5, Strings: 1, Instructions: 284COMMON

Download Yara Rule

Strings

Unflushable<T>: this object has buffered input that cannot be flushed, xrefs: 6D177EDE

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID:
String ID: Unflushable<T>: this object has buffered input that cannot be flushed
API String ID: 0-3781273281
Opcode ID: 6c164ac86718d56eb3b5acb2e720dd746c4cf76709ed039b63d60669274ad22c
Instruction ID: 04da4055dee28f0f68707f01e2325f4f9b604dbce597be32bf16327f24880206
Opcode Fuzzy Hash: 6c164ac86718d56eb3b5acb2e720dd746c4cf76709ed039b63d60669274ad22c
Instruction Fuzzy Hash: 63A19E76908209EFCB14CFA4C844FEEBBB8FF18710F10466AF9159B654DB74A944CB91

Function 6D1DEA1F Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6D1D5175: EnterCriticalSection.KERNEL32(?,?,6D1D9164,00000000,6D216F10,0000000C,6D1D912C,FBD4147D,?,6D1DE9AE,FBD4147D,?,6D1DD169,00000001,00000364,?), ref: 6D1D5184

EnumSystemLocalesW.KERNEL32(6D1DEA12,00000001,6D2170C0,0000000C,6D1DEE47,00000000), ref: 6D1DEA57

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 5d4d4ccbd3bba1102ac64fdbaf57532e6e6632ff26fbada5d9b473580f596e95
Instruction ID: 95862fed440cd2db1a188bfbfdc934a5716fab912bed5e4719bb76b143aa6863
Opcode Fuzzy Hash: 5d4d4ccbd3bba1102ac64fdbaf57532e6e6632ff26fbada5d9b473580f596e95
Instruction Fuzzy Hash: 9BF062B6A04205DFDB40DF98D445BAD77F0FB49325F10816AE510D7290DBB59A01DF80

Function 6D1C2229 Relevance: 1.5, APIs: 1, Instructions: 32COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoEx.KERNEL32(?,00000022,00000000,00000002,?,?,6D1B7412,00000000,?,00000004,6D1B38B6,?,00000004,6D1B50A1,00000000,00000000), ref: 6D1C2242

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: c73e80462b1bfd5f4d167819dccf5333579b83dc4101c9b59615ca3712a24906
Instruction ID: 0d94140a8848e94e63303a0f4a771a4d9d17e174e7a2020cc31a406eb1eb0cfb
Opcode Fuzzy Hash: c73e80462b1bfd5f4d167819dccf5333579b83dc4101c9b59615ca3712a24906
Instruction Fuzzy Hash: 75E0D833694201B7D7618BB89A0BF7A36E8E72670AF408241F203D50C9D7F8D700D253

Function 6D1E859F Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6D1DCFCB: GetLastError.KERNEL32(00000010,00000000,6D1E6D79,6D2172E0,0000000C,6D1E1D49,0000000C,?,6D1D235D,00000000,0000000C,?,00000000,00000000,00000000), ref: 6D1DCFCF
Part of subcall function 6D1DCFCB: SetLastError.KERNEL32(00000000,00000000,?,?,00000000,6D1675C1,?,6D1675C1,6D1675C1,?,6D1D52A5,F4458D6D,F4458D6D), ref: 6D1DD071

EnumSystemLocalesW.KERNEL32(6D1E84F8,00000001,00000000,?,?,6D1E8D66,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 6D1E85D6

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: ec3f49dd5d05a1451dc6763d2eff0e2ea86717af870480e79b7d54c4e0753301
Instruction ID: 204fd8bf757f6daf3417c25aa532a12f819566b6bf9dec99d8637cee0df4e02b
Opcode Fuzzy Hash: ec3f49dd5d05a1451dc6763d2eff0e2ea86717af870480e79b7d54c4e0753301
Instruction Fuzzy Hash: 5BF0E53A30420557CB049F39D989B6A7FA4EFC2794B0A4059EA068B645DBB19842C790

Function 6D1DEFA2 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,6D1DE571,?,20001004,00000000,00000002,?,?,6D1DDB63), ref: 6D1DEFD6

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 92c133893c9a7c483706c3db777e8069c6fead1f0e8b5dc10c4762b815a6d7f4
Instruction ID: bec1af1c021dab5ac37bd7a28b2e4f632cee505d1ebe552aec2fde3e1e45d1ee
Opcode Fuzzy Hash: 92c133893c9a7c483706c3db777e8069c6fead1f0e8b5dc10c4762b815a6d7f4
Instruction Fuzzy Hash: D9E04F72508618BFCF122F61EC04F9E7E66EF45761F014510FD55A5254CBB28A219A94

Function 6D193420 Relevance: 1.5, APIs: 1, Instructions: 18encryptionCOMMON

Download Yara Rule

APIs

CryptReleaseContext.ADVAPI32(?,00000000), ref: 6D193433

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: ContextCryptRelease
String ID:
API String ID: 829835001-0
Opcode ID: 574f1663217d98e94f6b11c6628ae5bcc3fa7088dcc9b6dc41f9b66a77bcf268
Instruction ID: 87f3d4ca276e1ef1b7c54bdefef4e528e876f1de2dd91e4a97253c15b06a2578
Opcode Fuzzy Hash: 574f1663217d98e94f6b11c6628ae5bcc3fa7088dcc9b6dc41f9b66a77bcf268
Instruction Fuzzy Hash: 22D05EB174431167EB219B64AC09B967AD85F21B51F11C829B58CEB288C7F8D44283EA

Function 6D1F6F30 Relevance: 1.5, APIs: 1, Instructions: 17encryptionCOMMON

Download Yara Rule

APIs

CryptReleaseContext.ADVAPI32(?,00000000), ref: 6D1F6F44

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: ContextCryptRelease
String ID:
API String ID: 829835001-0
Opcode ID: 9c1fe8e340b945c1805b6cd8ec3a2cf7846c2c46fd33b3553f1e85e385641a14
Instruction ID: 5b53b14ba23e57e61bcaca5d8491167bd8a68f617d977964d54761c355eb9cd6
Opcode Fuzzy Hash: 9c1fe8e340b945c1805b6cd8ec3a2cf7846c2c46fd33b3553f1e85e385641a14
Instruction Fuzzy Hash: 3FD0A7B590222957FF314F55AC08F9632E86F12B18F621004FB14BB28CC7F4D8418BD5

Function 6D1E6985 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 6D1E6985

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 73d6a7b25cdf87c30814967f20d5defe74df128428dcfe26fa21ce9335cf6a5d
Instruction ID: c17ae574a09a0532576d331e1e49c1fa584f0fe46062191ae05bc574c6eadaf2
Opcode Fuzzy Hash: 73d6a7b25cdf87c30814967f20d5defe74df128428dcfe26fa21ce9335cf6a5d
Instruction Fuzzy Hash: 3CA022F0A00202CF8F008F33A20C30E3AF8BA032C0300822CF802CC300EB388800CB02

Function 6D1D4440 Relevance: .7, Instructions: 651COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c8920ca615fd6bda82a16392b34e3466ab7fb483b9742243d6030ad858e0800
Instruction ID: d553c3962268c9134aeed9e8a21c0ea9ccf7c9f4a2ca4a7e6c2567ca21c6e606
Opcode Fuzzy Hash: 1c8920ca615fd6bda82a16392b34e3466ab7fb483b9742243d6030ad858e0800
Instruction Fuzzy Hash: BE325C21D69F014DD7639638D872336629CAFB73C4F55C737E825B5AAAEBA9C0C78100

Function 6D1EB929 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c84ec43f4a6d3ebe23f5378fd46b495cb123992876d851ba8b048bb2d05aaa2
Instruction ID: abecda328d5546140d58e225c5e3446673dae9996d1b924f8ed444b599c4d62f
Opcode Fuzzy Hash: 0c84ec43f4a6d3ebe23f5378fd46b495cb123992876d851ba8b048bb2d05aaa2
Instruction Fuzzy Hash: BC322771D69F414DDB23A534C931336A669AFB73C8F11D72BE829B5A9AEB68C0C34100

Function 6D196960 Relevance: .6, Instructions: 571COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c90bc4cd62b12830253e7f44c331dba89beec8b0fb31ac66a48269d71075e70b
Instruction ID: a9286b764443500607d9dd652eb3245c1a1856b10865b7c72860b6c98a5e0d0a
Opcode Fuzzy Hash: c90bc4cd62b12830253e7f44c331dba89beec8b0fb31ac66a48269d71075e70b
Instruction Fuzzy Hash: FF328872501249DFCB18CF68C990AEABBB5BF98304F05821EED5697354DB70E90ACF90

Function 6D17EBD0 Relevance: .5, Instructions: 529COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 600ffe6a644816df3f5b02fd1a0af55f0563e47301b2f226d4218cd1730eeb6c
Instruction ID: 6bf68527db4d92c953d1dbb3a6e8a6d636313c7f27d7ad77dc6105d470db131a
Opcode Fuzzy Hash: 600ffe6a644816df3f5b02fd1a0af55f0563e47301b2f226d4218cd1730eeb6c
Instruction Fuzzy Hash: 6E12FA717042118FDB48CF1DDCA574AB7E2EFC4318F0E8178A8498BB62D639DC958B86

Function 6D17FCE0 Relevance: .5, Instructions: 520COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ae520417df1613e3208f8844786f31b90755d0abdbf7ffb677c735c7948ea5a
Instruction ID: 85785c9a9ff3f9a2120a481c6569875aab4fd2f422cb61745c5340c05a971eaf
Opcode Fuzzy Hash: 3ae520417df1613e3208f8844786f31b90755d0abdbf7ffb677c735c7948ea5a
Instruction Fuzzy Hash: EC125A727083168BC708CE5DD891759B7E2BBC8314F0E453DA849CB791EBB8ED498B81

Function 6D19BE40 Relevance: .5, Instructions: 472COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 503961e1c978e56ac44b5c71c50d385383f9aac4193d00db5554ca2ba91a3e83
Instruction ID: 3bd65605a1bc8c1d0c7b7c71a30803870404d52664dc567ec9cf76b7602567d6
Opcode Fuzzy Hash: 503961e1c978e56ac44b5c71c50d385383f9aac4193d00db5554ca2ba91a3e83
Instruction Fuzzy Hash: 7502E17091828E9FDB14CF64C984BEE7BF6BF54308F014219F9549B285DBB4DA48CB92

Function 6D197000 Relevance: .5, Instructions: 460COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 991273e7e67fa62a7bb55dbf325ac90677dc5379a4c169510812c4970134d6f6
Instruction ID: bb5827886a24355eb7226a7b9818ad98b7e78eb1d8dd454826e254816804af22
Opcode Fuzzy Hash: 991273e7e67fa62a7bb55dbf325ac90677dc5379a4c169510812c4970134d6f6
Instruction Fuzzy Hash: 1C122A71E04219CFCF14CF98C990AEEBBB5FF98314F15412AE906AB355DB71AA05CB90

Function 6D1A2ED0 Relevance: .4, Instructions: 425COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34ae65dd7ddfea9fac55ed9f4ced00f4ae5907b79141e59f53c3a44289ecb51a
Instruction ID: befa8fa4163386b9593c85fe7eae47480c5f77ea6a6a453e974a795413c8527f
Opcode Fuzzy Hash: 34ae65dd7ddfea9fac55ed9f4ced00f4ae5907b79141e59f53c3a44289ecb51a
Instruction Fuzzy Hash: 0D027422D287C98AD707DA3A9052296F3F5AFFF284F19D71BB99431522FB6071D78600

Function 6D1A3620 Relevance: .4, Instructions: 405COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41557ea10abfb654e86557b4da8bbb7ce90587d04632ce6bb78e584054e18bfb
Instruction ID: 3ce08b0ac1bc5edf3d471853d4c406a6203fdf54f00f6370d0caa71c07af7fd6
Opcode Fuzzy Hash: 41557ea10abfb654e86557b4da8bbb7ce90587d04632ce6bb78e584054e18bfb
Instruction Fuzzy Hash: 69028A785182518FE749CF19D4A0A3BBBF1FB8A315F410A0EF49AD7250C335E6A5CB62

Function 6D1A3C40 Relevance: .4, Instructions: 401COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb8f992c8da7415488fe0b78362247233964d8808318f62afbf4208406f28abe
Instruction ID: 8d37b59e383079a5cc8f138c5cc5787e3464a86f895f762538cfbade44a4721b
Opcode Fuzzy Hash: cb8f992c8da7415488fe0b78362247233964d8808318f62afbf4208406f28abe
Instruction Fuzzy Hash: B902A13280A2B49FDB92EF5ED8405AB73F4FF90355F43892ADD8163241C331EA099794

Function 6D19DBE0 Relevance: .4, Instructions: 395COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bafb157184f775b7df4be62770a00618cfa306078b4bdb98f91234421048c1af
Instruction ID: 0b4cc20da5437c9b9c7e9bd773ee5fe2984c96e88491f1164c09fe38c8c9dc79
Opcode Fuzzy Hash: bafb157184f775b7df4be62770a00618cfa306078b4bdb98f91234421048c1af
Instruction Fuzzy Hash: 22D10271D14119AFCF15CFA8DC40AAEBBB5FF99310F11462AF911AB244E7B4A901CB91

Function 6D17DF00 Relevance: .4, Instructions: 391COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d78e913169089c9f52999c9faeaf9f93fc7245a5619cba868740b491b5568d5
Instruction ID: 8724dfdb57dc209975fc6033415d70297e2264948156887fa8b24269a848dfa0
Opcode Fuzzy Hash: 2d78e913169089c9f52999c9faeaf9f93fc7245a5619cba868740b491b5568d5
Instruction Fuzzy Hash: 8EE1BF71A083078BD724CF28D8806ABB7F5BFD5314F054A2DE955C3268E7B1EA05CB92

Function 6D1757C0 Relevance: .4, Instructions: 379COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 840b36af490aa04d14cff5719c3a1698e4a41689de7cdb5b4198d2328afbf7de
Instruction ID: 78f1cd7f7eaa48a912b6265894c84823ee4e8a080ab5baaf62f333e63d1d0dca
Opcode Fuzzy Hash: 840b36af490aa04d14cff5719c3a1698e4a41689de7cdb5b4198d2328afbf7de
Instruction Fuzzy Hash: C2E16F71E046198FDB0CCF99C8904EDB7B2FF8C310B55826ED91AA7356DBB0A941CB84

Function 6D1AB4B0 Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 316ad3ebbfe3f433f74c397d0d3eeae0e3346bfc67252541f226c47824ed1052
Instruction ID: fe2a113028256503bbe19bc10657cfe85b60a1d399dedc7877db62f77563e02d
Opcode Fuzzy Hash: 316ad3ebbfe3f433f74c397d0d3eeae0e3346bfc67252541f226c47824ed1052
Instruction Fuzzy Hash: 04B1623180C7C98BE702CF2DC9416EAB7E1BFA9308F199719FDD862251E771E6858781

Function 6D1A3E64 Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35bd22f95dab943cb3221f365cd1ea733415a38271d1e5144e58f245e77465ab
Instruction ID: 3bc601496fd65ffba7f94aa47c2ba9148c32d6eec440be75946795307b584f80
Opcode Fuzzy Hash: 35bd22f95dab943cb3221f365cd1ea733415a38271d1e5144e58f245e77465ab
Instruction Fuzzy Hash: 27A1633241A2B49FDB52EF6ED8400AB73B5EF94355F43892FDCC167281C235EA089795

Function 6D1D6A4C Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea83c1ebeb0c3f53134d113c75d11b2d3d0c5f202066064cbe2fbd760ea1d0f5
Instruction ID: 8ebb9641c743572d89f61bf9343896f21f34c414677c3941719874352122bc08
Opcode Fuzzy Hash: ea83c1ebeb0c3f53134d113c75d11b2d3d0c5f202066064cbe2fbd760ea1d0f5
Instruction Fuzzy Hash: 44518072E0411EEFDF04CF98C840AEEBBB1FF98304F498059E954AB205D7B4AA41CB91

Function 6D1AB9A0 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d19fac1d6f4950c12209bb7b3f8faa32d4a8b014987f5ff8bef524f107fe509
Instruction ID: c415ef3acba95977e87f5f1f2ee3c326ff4a8915ce81697a2925a3e568c56b08
Opcode Fuzzy Hash: 8d19fac1d6f4950c12209bb7b3f8faa32d4a8b014987f5ff8bef524f107fe509
Instruction Fuzzy Hash: 9B4124B5A08B018FD369CF28D492A56B7F0FF99300B548A2EE49AD7A01E770F544CB91

Function 6D179450 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1f157c11781d06625af646dea1ff3e287586bb77391cb4c7bf8047c1d4bfc61
Instruction ID: 3406bf818fa8e35fafe5d329827280980184e1a2fe82a3892651231985d2ede7
Opcode Fuzzy Hash: b1f157c11781d06625af646dea1ff3e287586bb77391cb4c7bf8047c1d4bfc61
Instruction Fuzzy Hash: 33315732D283374EC711D9B59494061FB62AFA3280B2AC36AFC153745AF762F9C98780

Function 6D1C4ED0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 04a065fada3a1bf1502e33789aefd88eaf697861f05cd79fff05446830b53bab
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 1E11087724C04343D700C93DD5B06FAB795EBFE225B29426AD1618B65CD2BBF1459502

Function 6D1B7F6A Relevance: 31.9, APIs: 6, Strings: 12, Instructions: 433COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1B7F71
ctype.LIBCPMT ref: 6D1B7FB8

Part of subcall function 6D1B7202: __Getctype.LIBCPMT ref: 6D1B7211

Part of subcall function 6D1B2D34: __EH_prolog3.LIBCMT ref: 6D1B2D3B
Part of subcall function 6D1B2D34: std::_Lockit::_Lockit.LIBCPMT ref: 6D1B2D45
Part of subcall function 6D1B2D34: std::_Lockit::~_Lockit.LIBCPMT ref: 6D1B2DB6

Part of subcall function 6D1B2E5E: __EH_prolog3.LIBCMT ref: 6D1B2E65
Part of subcall function 6D1B2E5E: std::_Lockit::_Lockit.LIBCPMT ref: 6D1B2E6F
Part of subcall function 6D1B2E5E: std::_Lockit::~_Lockit.LIBCPMT ref: 6D1B2EE0

Part of subcall function 6D1B30B2: __EH_prolog3.LIBCMT ref: 6D1B30B9
Part of subcall function 6D1B30B2: std::_Lockit::_Lockit.LIBCPMT ref: 6D1B30C3
Part of subcall function 6D1B30B2: std::_Lockit::~_Lockit.LIBCPMT ref: 6D1B3134

Part of subcall function 6D1B301D: __EH_prolog3.LIBCMT ref: 6D1B3024
Part of subcall function 6D1B301D: std::_Lockit::_Lockit.LIBCPMT ref: 6D1B302E
Part of subcall function 6D1B301D: std::_Lockit::~_Lockit.LIBCPMT ref: 6D1B309F

Part of subcall function 6D1ADED6: __EH_prolog3.LIBCMT ref: 6D1ADEDD
Part of subcall function 6D1ADED6: std::_Lockit::_Lockit.LIBCPMT ref: 6D1ADEE7
Part of subcall function 6D1ADED6: std::_Lockit::~_Lockit.LIBCPMT ref: 6D1ADF8E

collate.LIBCPMT ref: 6D1B80EC
numpunct.LIBCPMT ref: 6D1B8366

Part of subcall function 6D1B38C0: __EH_prolog3.LIBCMT ref: 6D1B38C7

Part of subcall function 6D1B355A: __EH_prolog3.LIBCMT ref: 6D1B3561
Part of subcall function 6D1B355A: std::_Lockit::_Lockit.LIBCPMT ref: 6D1B356B
Part of subcall function 6D1B355A: std::_Lockit::~_Lockit.LIBCPMT ref: 6D1B35DC

Part of subcall function 6D1B3684: __EH_prolog3.LIBCMT ref: 6D1B368B
Part of subcall function 6D1B3684: std::_Lockit::_Lockit.LIBCPMT ref: 6D1B3695
Part of subcall function 6D1B3684: std::_Lockit::~_Lockit.LIBCPMT ref: 6D1B3706

Part of subcall function 6D1ADED6: Concurrency::cancel_current_task.LIBCPMT ref: 6D1ADF99
Part of subcall function 6D1ADED6: __EH_prolog3.LIBCMT ref: 6D1ADFA6

Part of subcall function 6D1B288C: __EH_prolog3.LIBCMT ref: 6D1B2893
Part of subcall function 6D1B288C: std::_Lockit::_Lockit.LIBCPMT ref: 6D1B289D
Part of subcall function 6D1B288C: std::_Lockit::~_Lockit.LIBCPMT ref: 6D1B290E

__Getcoll.LIBCPMT ref: 6D1B812C

Part of subcall function 6D17D2F0: std::_Lockit::_Lockit.LIBCPMT ref: 6D17D2FF
Part of subcall function 6D17D2F0: std::_Lockit::~_Lockit.LIBCPMT ref: 6D17D31A

codecvt.LIBCPMT ref: 6D1B8417

Strings

<,"m, xrefs: 6D1B838A
)"m, xrefs: 6D1B7F88
\,"m, xrefs: 6D1B8249
X,"m, xrefs: 6D1B8206
T,"m, xrefs: 6D1B81C3
P,"m, xrefs: 6D1B8169
L,"m, xrefs: 6D1B8101
@,"m, xrefs: 6D1B7FF2
`,"m, xrefs: 6D1B82B5
d,"m, xrefs: 6D1B833A
D,"m, xrefs: 6D1B8038
H,"m, xrefs: 6D1B807B

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: Lockitstd::_$H_prolog3$Lockit::_Lockit::~_$Concurrency::cancel_current_taskGetcollGetctypecodecvtcollatectypenumpunct
String ID: <,"m$@,"m$D,"m$H,"m$L,"m$P,"m$T,"m$X,"m$\,"m$`,"m$d,"m$)"m
API String ID: 281747047-3743970008
Opcode ID: 5bc951d3e6fa23469385eeba94f7ad44fef8a8327714fe1ecc3dcc0ab55a1fb3
Instruction ID: 0f659dd7ebd1f49d695e9fac6bf8d1089e336ab59b1555a640e58c66328c7a51
Opcode Fuzzy Hash: 5bc951d3e6fa23469385eeba94f7ad44fef8a8327714fe1ecc3dcc0ab55a1fb3
Instruction Fuzzy Hash: 3DE1F6B190861B9FDB115FA88C0167F7AB4FF91764F06442DEA646B398EBF18C01C792

Function 6D1725B0 Relevance: 31.9, APIs: 15, Strings: 3, Instructions: 389fileCOMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNEL32(?,00000080,FBD4147D), ref: 6D1725FB
CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000003,00000080,00000000), ref: 6D17261F
GetFileSizeEx.KERNEL32(00000000,?), ref: 6D17263E
CloseHandle.KERNEL32(00000000), ref: 6D172649
ReadFile.KERNEL32(?,?,00000147,?,?), ref: 6D172741
CloseHandle.KERNEL32(?), ref: 6D17277C

Strings

@, xrefs: 6D1727DA
@KL, xrefs: 6D17282A
czyzk0zzhil, xrefs: 6D172747

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: File$CloseHandle$AttributesCreateReadSize
String ID: @$@KL$czyzk0zzhil
API String ID: 1805668264-1791230362
Opcode ID: 75f7680202bfd1689e3782bd68a4cddb75b61e661e7d0226e15c11bea553f9a3
Instruction ID: eae5b84113ec53d927511a1ca2c407c43baf31d6c99adc098bfd0f747f43b320
Opcode Fuzzy Hash: 75f7680202bfd1689e3782bd68a4cddb75b61e661e7d0226e15c11bea553f9a3
Instruction Fuzzy Hash: E7F1AE71E442699BDB31CF24CC54BEDB7B9FF1A304F0041EAEA09A6294D7B59A81CF41

Function 6D1B7A8E Relevance: 23.2, APIs: 6, Strings: 7, Instructions: 433COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1B7A95
ctype.LIBCPMT ref: 6D1B7ADC

Part of subcall function 6D1B7202: __Getctype.LIBCPMT ref: 6D1B7211

Part of subcall function 6D1B2C9F: __EH_prolog3.LIBCMT ref: 6D1B2CA6
Part of subcall function 6D1B2C9F: std::_Lockit::_Lockit.LIBCPMT ref: 6D1B2CB0
Part of subcall function 6D1B2C9F: std::_Lockit::~_Lockit.LIBCPMT ref: 6D1B2D21

Part of subcall function 6D1B2DC9: __EH_prolog3.LIBCMT ref: 6D1B2DD0
Part of subcall function 6D1B2DC9: std::_Lockit::_Lockit.LIBCPMT ref: 6D1B2DDA
Part of subcall function 6D1B2DC9: std::_Lockit::~_Lockit.LIBCPMT ref: 6D1B2E4B

Part of subcall function 6D1B2F88: __EH_prolog3.LIBCMT ref: 6D1B2F8F
Part of subcall function 6D1B2F88: std::_Lockit::_Lockit.LIBCPMT ref: 6D1B2F99
Part of subcall function 6D1B2F88: std::_Lockit::~_Lockit.LIBCPMT ref: 6D1B300A

Part of subcall function 6D1B2EF3: __EH_prolog3.LIBCMT ref: 6D1B2EFA
Part of subcall function 6D1B2EF3: std::_Lockit::_Lockit.LIBCPMT ref: 6D1B2F04
Part of subcall function 6D1B2EF3: std::_Lockit::~_Lockit.LIBCPMT ref: 6D1B2F75

Part of subcall function 6D1ADED6: __EH_prolog3.LIBCMT ref: 6D1ADEDD
Part of subcall function 6D1ADED6: std::_Lockit::_Lockit.LIBCPMT ref: 6D1ADEE7
Part of subcall function 6D1ADED6: std::_Lockit::~_Lockit.LIBCPMT ref: 6D1ADF8E

collate.LIBCPMT ref: 6D1B7C10
numpunct.LIBCPMT ref: 6D1B7E8A

Part of subcall function 6D1B388D: __EH_prolog3.LIBCMT ref: 6D1B3894

Part of subcall function 6D1B34C5: __EH_prolog3.LIBCMT ref: 6D1B34CC
Part of subcall function 6D1B34C5: std::_Lockit::_Lockit.LIBCPMT ref: 6D1B34D6
Part of subcall function 6D1B34C5: std::_Lockit::~_Lockit.LIBCPMT ref: 6D1B3547

Part of subcall function 6D1B35EF: __EH_prolog3.LIBCMT ref: 6D1B35F6
Part of subcall function 6D1B35EF: std::_Lockit::_Lockit.LIBCPMT ref: 6D1B3600
Part of subcall function 6D1B35EF: std::_Lockit::~_Lockit.LIBCPMT ref: 6D1B3671

Part of subcall function 6D1ADED6: Concurrency::cancel_current_task.LIBCPMT ref: 6D1ADF99
Part of subcall function 6D1ADED6: __EH_prolog3.LIBCMT ref: 6D1ADFA6

Part of subcall function 6D1B27F7: __EH_prolog3.LIBCMT ref: 6D1B27FE
Part of subcall function 6D1B27F7: std::_Lockit::_Lockit.LIBCPMT ref: 6D1B2808
Part of subcall function 6D1B27F7: std::_Lockit::~_Lockit.LIBCPMT ref: 6D1B2879

__Getcoll.LIBCPMT ref: 6D1B7C50

Part of subcall function 6D17D2F0: std::_Lockit::_Lockit.LIBCPMT ref: 6D17D2FF
Part of subcall function 6D17D2F0: std::_Lockit::~_Lockit.LIBCPMT ref: 6D17D31A

codecvt.LIBCPMT ref: 6D1B7F3B

Strings

l,"m, xrefs: 6D1B7B5C
h,"m, xrefs: 6D1B7B16
t,"m, xrefs: 6D1B7C25
)"m, xrefs: 6D1B7F16
|,"m, xrefs: 6D1B7CE7
x,"m, xrefs: 6D1B7C8D
p,"m, xrefs: 6D1B7B9F

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: Lockitstd::_$H_prolog3$Lockit::_Lockit::~_$Concurrency::cancel_current_taskGetcollGetctypecodecvtcollatectypenumpunct
String ID: h,"m$l,"m$p,"m$t,"m$x,"m$|,"m$)"m
API String ID: 281747047-908147334
Opcode ID: 1cd7ea90a5c89faac5deae5f205f72d06ab648a8ba4eb1bb074c0ad8e173a0ae
Instruction ID: f4b9826b9e6ed5919a480f5c0263d1488e8d48e41497c0f93a946637f92ce33d
Opcode Fuzzy Hash: 1cd7ea90a5c89faac5deae5f205f72d06ab648a8ba4eb1bb074c0ad8e173a0ae
Instruction Fuzzy Hash: 81E1E871C4871AABDB125FA48C0167F7AB5FF91364F12441EEA646B398EBF18D00C792

Function 6D1667C0 Relevance: 21.2, APIs: 1, Strings: 11, Instructions: 240COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000000,?,00000104,00000000,FBD4147D,00000000,00000000), ref: 6D166839

Strings

ios_base::badbit set, xrefs: 6D166AC3, 6D166AEC
X, xrefs: 6D166866
W, xrefs: 6D166848
ios_base::failbit set, xrefs: 6D166ACD
], xrefs: 6D16685F
U, xrefs: 6D16686D
ios_base::eofbit set, xrefs: 6D166AD2
], xrefs: 6D166858
S, xrefs: 6D166874
<, xrefs: 6D166841
V, xrefs: 6D166851

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: PathTemp
String ID: <$S$U$V$W$X$]$]$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2920410445-4250386859
Opcode ID: 0c3ff6b370668ba7dcf10ca3fda2561661f191f2c432c97f52acbb16ccca3e57
Instruction ID: 82740ba45209ea7b72557e985a02224ed8385608e707425df0ab423933c7c26c
Opcode Fuzzy Hash: 0c3ff6b370668ba7dcf10ca3fda2561661f191f2c432c97f52acbb16ccca3e57
Instruction Fuzzy Hash: 35A1E370914248CFDB14CFA4C854BEDBBF4FF58304F15829DE905AB295E7B46A94CBA0

Function 6D1CA9EF Relevance: 19.8, APIs: 13, Instructions: 332COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 6D1CAAB8
DName::operator+.LIBCMT ref: 6D1CAAF5
DName::DName.LIBVCRUNTIME ref: 6D1CAB09
DName::operator+.LIBCMT ref: 6D1CAB18
DName::operator+.LIBCMT ref: 6D1CABA6
DName::DName.LIBVCRUNTIME ref: 6D1CABCE
DName::operator+.LIBCMT ref: 6D1CABDC
DName::operator+.LIBCMT ref: 6D1CAC16
DName::operator+.LIBCMT ref: 6D1CAC57
UnDecorator::getReturnType.LIBCMT ref: 6D1CAC87
operator+.LIBVCRUNTIME ref: 6D1CAD89

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: Name::operator+$NameName::$Decorator::getReturnTypeoperator+
String ID:
API String ID: 2932655852-0
Opcode ID: 12b05ca6f729239602607385750916fb22c8534fb1f79dc085542aab9e4e3cc0
Instruction ID: cbd093c59cf93253038b99684479af9ef7f15d649dfba65be76eea609ab38f5c
Opcode Fuzzy Hash: 12b05ca6f729239602607385750916fb22c8534fb1f79dc085542aab9e4e3cc0
Instruction Fuzzy Hash: 40C17571D18209AFCB05CF94D495EFD7BB5BB25304F01405EF612A7284EBF89A44CB62

Function 6D1CBEED Relevance: 19.8, APIs: 13, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 6D1CBF58
DName::operator+.LIBCMT ref: 6D1CC09B

Part of subcall function 6D1C7C59: shared_ptr.LIBCMT ref: 6D1C7C75

DName::operator+.LIBCMT ref: 6D1CC046
DName::operator+.LIBCMT ref: 6D1CC0E7
DName::operator+.LIBCMT ref: 6D1CC0F6
DName::operator+.LIBCMT ref: 6D1CC222
DName::operator=.LIBVCRUNTIME ref: 6D1CC262
DName::DName.LIBVCRUNTIME ref: 6D1CC26C
DName::operator+.LIBCMT ref: 6D1CC289
DName::operator+.LIBCMT ref: 6D1CC295

Part of subcall function 6D1CD738: Replicator::operator[].LIBCMT ref: 6D1CD775

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: Name::operator+$NameName::Name::operator=Replicator::operator[]shared_ptr
String ID:
API String ID: 1043660730-0
Opcode ID: b3d3e77be53c15c28c02718319956538fed1d2864c92b6528f7f9fc69065b979
Instruction ID: 43e1c0830a1c376f1bacaec22b61032dbb709cbbdb210ef8738aede748e3ffc3
Opcode Fuzzy Hash: b3d3e77be53c15c28c02718319956538fed1d2864c92b6528f7f9fc69065b979
Instruction Fuzzy Hash: FBC18FB1E082099FDB11CFA4C854BEEB7F9BF26704F04845EE145A7284DBF99A44CB52

Function 6D170F50 Relevance: 19.7, APIs: 1, Strings: 10, Instructions: 489fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D1711F2

Strings

DL_GroupParameters_EC<EC>, xrefs: 6D196223, 6D196280, 6D1963B1
: missing required parameter ', xrefs: 6D196230, 6D1963BE
hil, xrefs: 6D171151
GroupOID, xrefs: 6D19610B
SubgroupOrder, xrefs: 6D19627B
Curve, xrefs: 6D1961ED, 6D1963D1
InputBuffer, xrefs: 6D1710BC
SubgroupGenerator, xrefs: 6D196213, 6D196243
8, xrefs: 6D171098
Cofactor, xrefs: 6D19629C

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: FileWrite
String ID: 8$: missing required parameter '$Cofactor$Curve$DL_GroupParameters_EC<EC>$GroupOID$InputBuffer$SubgroupGenerator$SubgroupOrder$hil
API String ID: 3934441357-932917116
Opcode ID: bd28c3b8c337e7dcc2b264bf5513d518009e8fe08d42cb91a85dcc087d96ff89
Instruction ID: 9201ac4ccb5364ef887eb025737e80fcc55e14904baaf38e19b21746401ecfa6
Opcode Fuzzy Hash: bd28c3b8c337e7dcc2b264bf5513d518009e8fe08d42cb91a85dcc087d96ff89
Instruction Fuzzy Hash: 7312D070D04248DFDB20DFA8CC54FEEBBB5BF55304F108199E519AB28ADBB45A44CBA1

Function 6D174B70 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 439COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 6D174C15
__alldvrm.LIBCMT ref: 6D174C96
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6D174CCB
__Xtime_get_ticks.LIBCPMT ref: 6D174CF2
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6D174D4A
__Mtx_unlock.LIBCPMT ref: 6D174ED6
__Mtx_unlock.LIBCPMT ref: 6D174FDD
std::_Throw_Cpp_error.LIBCPMT ref: 6D17500E
std::_Throw_Cpp_error.LIBCPMT ref: 6D175015

Strings

CryptoMaterial: this object contains invalid values, xrefs: 6D175085

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: Mtx_unlock$Cpp_errorThrow_Unothrow_t@std@@@__ehfuncinfo$??2@std::_$Xtime_get_ticks__alldvrm
String ID: CryptoMaterial: this object contains invalid values
API String ID: 549452151-887990677
Opcode ID: 2985cd4e36fe3791ec8a21c2451805eb4dd1de95822c50b9f6a09d07a8d9d4a1
Instruction ID: 5bf8133215d53990a0e8ba684299fbfac517f017209b01aba60a0ba83fc93e4d
Opcode Fuzzy Hash: 2985cd4e36fe3791ec8a21c2451805eb4dd1de95822c50b9f6a09d07a8d9d4a1
Instruction Fuzzy Hash: E3F1F4B1D04248DFDB20CFA8C840BADBBB5FF59314F254219E915BB398DBB4A941CB91

Function 6D1ED60A Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6D1ED2C3: CreateFileW.KERNEL32(?,00000000,?,6D1ED6B3,?,?,00000000,?,6D1ED6B3,?,0000000C), ref: 6D1ED2E0

GetLastError.KERNEL32 ref: 6D1ED71E
__dosmaperr.LIBCMT ref: 6D1ED725
GetFileType.KERNEL32(00000000), ref: 6D1ED731
GetLastError.KERNEL32 ref: 6D1ED73B
__dosmaperr.LIBCMT ref: 6D1ED744
CloseHandle.KERNEL32(00000000), ref: 6D1ED764
CloseHandle.KERNEL32(6D1E4AC0), ref: 6D1ED8B1
GetLastError.KERNEL32 ref: 6D1ED8E3
__dosmaperr.LIBCMT ref: 6D1ED8EA

Strings

H, xrefs: 6D1ED86F

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 8358cfe2f9034190c74997286dc3fd898b72ec8788b919cf12e68636cc5eb08a
Instruction ID: abbad8a2a21607e9979be7d02f711d95df9477da5cec1204bb341ffa0d89608a
Opcode Fuzzy Hash: 8358cfe2f9034190c74997286dc3fd898b72ec8788b919cf12e68636cc5eb08a
Instruction Fuzzy Hash: 5FA15572A185558FCF09CF68DC51BAE3BB1BF8B368F19014DE8149B284DBB49812CB51

Function 6D1C91AD Relevance: 16.9, APIs: 11, Instructions: 359COMMONLIBRARYCODE

Download Yara Rule

APIs

shared_ptr.LIBCMT ref: 6D1C9220
shared_ptr.LIBCMT ref: 6D1C9268
shared_ptr.LIBCMT ref: 6D1C9287
operator+.LIBVCRUNTIME ref: 6D1C93B5
DName::operator=.LIBVCRUNTIME ref: 6D1C93C7
shared_ptr.LIBCMT ref: 6D1C960C
DName::operator+.LIBCMT ref: 6D1C964E
operator+.LIBVCRUNTIME ref: 6D1C9694

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: shared_ptr$operator+$Name::operator+Name::operator=
String ID:
API String ID: 1464150960-0
Opcode ID: 9cfea86f723d7e20b778e5ccc336bf7b23922310f2a99751dd9c1a19b1034ac7
Instruction ID: 321c18f928083e157138363f472d853b3ae49dfc5e909a16f4c6fc2777634802
Opcode Fuzzy Hash: 9cfea86f723d7e20b778e5ccc336bf7b23922310f2a99751dd9c1a19b1034ac7
Instruction Fuzzy Hash: FFE15EB1C0420A9BCB05CFA4D5A5BEEBBB4BB25309F02815AD511A7288D7FD9705CF93

Function 6D1CD738 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 185COMMONLIBRARYCODE

Download Yara Rule

APIs

Replicator::operator[].LIBCMT ref: 6D1CD775

Strings

@, xrefs: 6D1CD8E1
template-parameter-, xrefs: 6D1CD7D4
generic-type-, xrefs: 6D1CD7FB

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: Replicator::operator[]
String ID: @$generic-type-$template-parameter-
API String ID: 3676697650-1320211309
Opcode ID: f49f1865d46f1ef5a9942fb304aaa77510d2a4fa411a2225cca2dd56d87a32de
Instruction ID: 30afd77f9df5fb7ef9756425e063c7e363be3b44fca603abb503e75a1090e2b1
Opcode Fuzzy Hash: f49f1865d46f1ef5a9942fb304aaa77510d2a4fa411a2225cca2dd56d87a32de
Instruction Fuzzy Hash: A561A471E442099FDB01CF94D845BFEB7F8BF69314F05801AE611A7294DBF89A05CBA2

Function 6D1C0D35 Relevance: 14.4, APIs: 1, Strings: 7, Instructions: 351COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1C0D3C

Part of subcall function 6D162470: std::_Lockit::_Lockit.LIBCPMT ref: 6D1624A3
Part of subcall function 6D162470: std::_Lockit::_Lockit.LIBCPMT ref: 6D1624C5
Part of subcall function 6D162470: std::_Lockit::~_Lockit.LIBCPMT ref: 6D1624E5
Part of subcall function 6D162470: std::_Lockit::~_Lockit.LIBCPMT ref: 6D1625DD

Strings

%b %d %H : %M : %S %Y, xrefs: 6D1C0FF4
:AM:am:PM:pm, xrefs: 6D1C10D1
%H : %M : %S, xrefs: 6D1C0EF8
%d / %m / %y, xrefs: 6D1C109F
%H : %M, xrefs: 6D1C0E81
%m / %d / %y, xrefs: 6D1C0E38
%I : %M : %S %p, xrefs: 6D1C10C6

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3
String ID: %H : %M$%H : %M : %S$%I : %M : %S %p$%b %d %H : %M : %S %Y$%d / %m / %y$%m / %d / %y$:AM:am:PM:pm
API String ID: 1383202999-2891247106
Opcode ID: 542e97f78fc6ce4c8c7519d38922aff2aab24a9e76151b078649f2eab85ada61
Instruction ID: c8587ff29ef26552c7bf168524057a8c201c540cbfbd2db8dc23b4ced342f8dd
Opcode Fuzzy Hash: 542e97f78fc6ce4c8c7519d38922aff2aab24a9e76151b078649f2eab85ada61
Instruction Fuzzy Hash: E8C1B2B658410AAFCB05DFA8C955EFF3BF8BB25340F014119FA12E3259D6B4DA50CB62

Function 6D1BACB9 Relevance: 14.4, APIs: 1, Strings: 7, Instructions: 351COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1BACC0

Part of subcall function 6D1B2A4B: __EH_prolog3.LIBCMT ref: 6D1B2A52
Part of subcall function 6D1B2A4B: std::_Lockit::_Lockit.LIBCPMT ref: 6D1B2A5C
Part of subcall function 6D1B2A4B: std::_Lockit::~_Lockit.LIBCPMT ref: 6D1B2ACD

Strings

%b %d %H : %M : %S %Y, xrefs: 6D1BAF78
:AM:am:PM:pm, xrefs: 6D1BB055
%H : %M : %S, xrefs: 6D1BAE7C
%d / %m / %y, xrefs: 6D1BB023
%H : %M, xrefs: 6D1BAE05
%m / %d / %y, xrefs: 6D1BADBC
%I : %M : %S %p, xrefs: 6D1BB04A

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: H_prolog3Lockitstd::_$Lockit::_Lockit::~_
String ID: %H : %M$%H : %M : %S$%I : %M : %S %p$%b %d %H : %M : %S %Y$%d / %m / %y$%m / %d / %y$:AM:am:PM:pm
API String ID: 1538362411-2891247106
Opcode ID: 8f70277adbd144afc1b782488cf95891a128c4067d31363035905f9557a8e2ef
Instruction ID: d8c029fe773da555c7fbbf3effd9bfa6e29cd08e236de65ccabcdd8e7a1fc5d3
Opcode Fuzzy Hash: 8f70277adbd144afc1b782488cf95891a128c4067d31363035905f9557a8e2ef
Instruction Fuzzy Hash: 45C18FB654410AAFDB05DFA8CD95EFE3BB8BB19300F014119FA56E6259E6F1DA00CB60

Function 6D1BB0A9 Relevance: 14.4, APIs: 1, Strings: 7, Instructions: 351COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1BB0B0

Part of subcall function 6D1B2AE0: __EH_prolog3.LIBCMT ref: 6D1B2AE7
Part of subcall function 6D1B2AE0: std::_Lockit::_Lockit.LIBCPMT ref: 6D1B2AF1
Part of subcall function 6D1B2AE0: std::_Lockit::~_Lockit.LIBCPMT ref: 6D1B2B62

Strings

%b %d %H : %M : %S %Y, xrefs: 6D1BB368
:AM:am:PM:pm, xrefs: 6D1BB445
%H : %M : %S, xrefs: 6D1BB26C
%d / %m / %y, xrefs: 6D1BB413
%H : %M, xrefs: 6D1BB1F5
%m / %d / %y, xrefs: 6D1BB1AC
%I : %M : %S %p, xrefs: 6D1BB43A

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: H_prolog3Lockitstd::_$Lockit::_Lockit::~_
String ID: %H : %M$%H : %M : %S$%I : %M : %S %p$%b %d %H : %M : %S %Y$%d / %m / %y$%m / %d / %y$:AM:am:PM:pm
API String ID: 1538362411-2891247106
Opcode ID: 6eb7253714474300ed7bc6c63ac1ddade83149f88b79e2abb11d9c16319645b9
Instruction ID: 08c028a151cb85349995dd4eccbf86f82237e57d51e83d8078727ad3dcfb146c
Opcode Fuzzy Hash: 6eb7253714474300ed7bc6c63ac1ddade83149f88b79e2abb11d9c16319645b9
Instruction Fuzzy Hash: 8EC190B650410AAFDB05DFA8CED5EFE3BF8FB15304F014119FA56A2669D6B0DA10CB60

Function 6D1B723B Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D1B7242
_Maklocstr.LIBCPMT ref: 6D1B72AB
_Maklocstr.LIBCPMT ref: 6D1B72BD
_Maklocchr.LIBCPMT ref: 6D1B72D5
_Maklocchr.LIBCPMT ref: 6D1B72E5
_Getvals.LIBCPMT ref: 6D1B7307

Part of subcall function 6D1B0145: _Maklocchr.LIBCPMT ref: 6D1B0174
Part of subcall function 6D1B0145: _Maklocchr.LIBCPMT ref: 6D1B018A

Strings

true, xrefs: 6D1B72B8
false, xrefs: 6D1B72A6

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: Maklocchr$Maklocstr$GetvalsH_prolog3_
String ID: false$true
API String ID: 3549167292-2658103896
Opcode ID: 58990acc8096090578691a8c4ede2577cce6a6c771d7d178975ad78b3ad9b1b5
Instruction ID: dee2fd82aa26099ba1af18268f5e2873c1621e1748cd2d27fc584270acf07d7a
Opcode Fuzzy Hash: 58990acc8096090578691a8c4ede2577cce6a6c771d7d178975ad78b3ad9b1b5
Instruction Fuzzy Hash: 77218EB1D04308AADF15DFE5D885ADE7BA8BF09310F01805BFA14AF259DBF09504CBA1

Function 6D1AF229 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 6D1AF22F
GetProcAddress.KERNEL32(00000000,GetCurrentPackageId), ref: 6D1AF23D
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6D1AF24E
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 6D1AF25F

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6D1AF243
GetCurrentPackageId, xrefs: 6D1AF237
GetTempPath2W, xrefs: 6D1AF254
kernel32.dll, xrefs: 6D1AF22A

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetCurrentPackageId$GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1247241052
Opcode ID: 49689741f3c3d620c921ed73062798f5679de1a28601afbc159656ce256c4d92
Instruction ID: 8fd3a7ad8e584fd1af86febfad4f4a74419edb241e18a1bbce7b89c54406b5a1
Opcode Fuzzy Hash: 49689741f3c3d620c921ed73062798f5679de1a28601afbc159656ce256c4d92
Instruction Fuzzy Hash: 74E0BFF1811110AB8F205FB5780CBB73AF4FF472413405456F502D2A05DBB14402DB94

Function 6D1CC9C2 Relevance: 13.8, APIs: 9, Instructions: 297COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 6D1CCA98
UnDecorator::getSignedDimension.LIBCMT ref: 6D1CCAA3
UnDecorator::getSignedDimension.LIBCMT ref: 6D1CCB8F
UnDecorator::getSignedDimension.LIBCMT ref: 6D1CCBAC
UnDecorator::getSignedDimension.LIBCMT ref: 6D1CCBC9
DName::operator+.LIBCMT ref: 6D1CCBDE
UnDecorator::getSignedDimension.LIBCMT ref: 6D1CCBF8
DName::operator+.LIBCMT ref: 6D1CCCCD

Part of subcall function 6D1C8B88: DName::DName.LIBVCRUNTIME ref: 6D1C8BE6

DName::DName.LIBVCRUNTIME ref: 6D1CCD44

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: Decorator::getDimensionSigned$Name::operator+$NameName::
String ID:
API String ID: 3679549980-0
Opcode ID: 4442aa72cf3e61cd9718c13ea2833907bdc1dd12bb7396850b81282b9f44863e
Instruction ID: 1ec2105b9cec4fca6e1c11a022297c8bf463b582777b09b953b139c5b9452ad4
Opcode Fuzzy Hash: 4442aa72cf3e61cd9718c13ea2833907bdc1dd12bb7396850b81282b9f44863e
Instruction Fuzzy Hash: BE91B371D4810A9ACB05CBF8D959BFE7A79AB35304F01401AE211A618CEBFDDE05C7A3

Function 6D166B10 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 168registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(80000000,?,00000000,00000000,00000000,00000103,00000000,0000000A,?,.mmpt0z3lb,0000000A,FBD4147D), ref: 6D166C2C
RegSetValueExW.ADVAPI32(?,?,00000000,00000001,?), ref: 6D166C5A
SHChangeNotify.SHELL32(08000000,00000000,00000000,00000000), ref: 6D166C6B
SHChangeNotify.SHELL32(08000000,00003000,00000000,00000000), ref: 6D166C7F

Strings

!, xrefs: 6D166B72
e, xrefs: 6D166B69
.mmpt0z3lb, xrefs: 6D166B44

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: ChangeNotify$CreateValue
String ID: !$.mmpt0z3lb$e
API String ID: 846225995-1983884171
Opcode ID: 037dd91299d12a6c733ad1cbcac547e5dcd6f70d8dec01bdc923b158c89f49a2
Instruction ID: 825d93c68b104a11f95e87c696108bd5112236767d9194d84722a6abadfa8578
Opcode Fuzzy Hash: 037dd91299d12a6c733ad1cbcac547e5dcd6f70d8dec01bdc923b158c89f49a2
Instruction Fuzzy Hash: 8351C171A0424CAFDB14CFA4DC95BEEB7B4EF04704F204218FA15AB284DBB4A655CBA5

Function 6D1B7314 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D1B731B
_Maklocstr.LIBCPMT ref: 6D1B7382
_Maklocstr.LIBCPMT ref: 6D1B7394
_Maklocchr.LIBCPMT ref: 6D1B73AC
_Maklocchr.LIBCPMT ref: 6D1B73BC

Strings

true, xrefs: 6D1B738F
false, xrefs: 6D1B737D

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: MaklocchrMaklocstr$H_prolog3_
String ID: false$true
API String ID: 2404127365-2658103896
Opcode ID: 329466772773075e3d16b9ffcd2f29bd00178cea084e5a843ab061fcde045c60
Instruction ID: 7d70b8482af3be3b7cab3fab2153165698d92f96dc9193ce06ee2db93f984438
Opcode Fuzzy Hash: 329466772773075e3d16b9ffcd2f29bd00178cea084e5a843ab061fcde045c60
Instruction Fuzzy Hash: B0217AB5D04348AADF14DFA2C88499EB7B8BF45700F00805AEA059F259EBB4D504CB61

Function 6D1C25A9 Relevance: 12.2, APIs: 8, Instructions: 224COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,?,?), ref: 6D1C2634
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 6D1C26C2
__alloca_probe_16.LIBCMT ref: 6D1C26EC
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 6D1C2734
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 6D1C274E
__alloca_probe_16.LIBCMT ref: 6D1C2774
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 6D1C27B1
CompareStringEx.KERNEL32(?,?,?,?,00000000,?,00000000,00000000,00000000), ref: 6D1C27CE

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: ByteCharMultiWide$__alloca_probe_16$CompareInfoString
String ID:
API String ID: 3603178046-0
Opcode ID: 1b3a56616789d97b9e1433aa78e88e120c1ed3ae72200c0bdae71a3b356e23b6
Instruction ID: b942e33c40a9e3e232b13330b9522a9f0fcdac27099362074ec6f643bbf2c91f
Opcode Fuzzy Hash: 1b3a56616789d97b9e1433aa78e88e120c1ed3ae72200c0bdae71a3b356e23b6
Instruction Fuzzy Hash: 8571E371A0421A9BDF218FA4CC90FEE7BBAEF7A314F155015E914A7158DBF9C801CB62

Function 6D1AF344 Relevance: 12.2, APIs: 8, Instructions: 175COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 6D1AF38D
__alloca_probe_16.LIBCMT ref: 6D1AF3B9
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 6D1AF3F8
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 6D1AF415
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 6D1AF454
__alloca_probe_16.LIBCMT ref: 6D1AF471
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 6D1AF4B3
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 6D1AF4D6

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: 4279482f96100dcd2fb0fb65789cc82ef2202dcb810d2f50ff63439ad0ba5c98
Instruction ID: a26ecf421ad811319c60fbb58751084a877bef48fb2f9d31cc7847f767b25dc5
Opcode Fuzzy Hash: 4279482f96100dcd2fb0fb65789cc82ef2202dcb810d2f50ff63439ad0ba5c98
Instruction Fuzzy Hash: F2519D7A600217ABEF218FA4CC44FBA7BB9EF51744F258025FA24D6199DBB4C911CB50

Function 6D1E1EB1 Relevance: 10.8, APIs: 7, Instructions: 329COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 6D1E1F37

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 3342fbe6aa44414992b95acc1df7e6c4a1b929ff075e8becbb06756ada028003
Instruction ID: 4128f802546396747fc392e7def81d228cb70a08e70e22153f91f25a670732e9
Opcode Fuzzy Hash: 3342fbe6aa44414992b95acc1df7e6c4a1b929ff075e8becbb06756ada028003
Instruction Fuzzy Hash: 06B1CCB2A04B579FDB258F64CC91BEE7BB4EF26390F154155EA00AB289D3F09941C7A0

Function 6D1C6A0D Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

___TypeMatch.LIBVCRUNTIME ref: 6D1C6C3A
_UnwindNestedFrames.LIBCMT ref: 6D1C6D8C
CallUnexpected.LIBVCRUNTIME ref: 6D1C6DA7

Strings

csm, xrefs: 6D1C6AB7
csm, xrefs: 6D1C6A4A
csm, xrefs: 6D1C6B63

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwind
String ID: csm$csm$csm
API String ID: 3456342781-393685449
Opcode ID: 8e25bb19875484f5ec20a6160dbae73908ac0cc71a20ee84e278ef504e9f95ea
Instruction ID: 50a543ad4a62e86c5f9a4159cc06166f663150eafdd72de570a0f341d5a7a0b7
Opcode Fuzzy Hash: 8e25bb19875484f5ec20a6160dbae73908ac0cc71a20ee84e278ef504e9f95ea
Instruction Fuzzy Hash: 86B19D7180420EDFCF05CFA0D8809BEBBB5FF24314B11455AE9156B229D7B9EA61CBD2

Function 6D1C8F61 Relevance: 10.7, APIs: 7, Instructions: 151COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 6D1C8FEF
DName::operator+.LIBCMT ref: 6D1C9042

Part of subcall function 6D1C7C59: shared_ptr.LIBCMT ref: 6D1C7C75

Part of subcall function 6D1C7B84: DName::operator+.LIBCMT ref: 6D1C7BA5

DName::operator+.LIBCMT ref: 6D1C9033
DName::operator+.LIBCMT ref: 6D1C9093
DName::operator+.LIBCMT ref: 6D1C90A0
DName::operator+.LIBCMT ref: 6D1C90E7
DName::operator+.LIBCMT ref: 6D1C90F4

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: Name::operator+$shared_ptr
String ID:
API String ID: 1037112749-0
Opcode ID: 28f9532e402add5c04f7ba2affc6890788638e75ded754f6c6894ca0129db01c
Instruction ID: 2fc15add1cc9ef0493284a0c865d90af0d9295b923f8874de85746b76d49a0ce
Opcode Fuzzy Hash: 28f9532e402add5c04f7ba2affc6890788638e75ded754f6c6894ca0129db01c
Instruction Fuzzy Hash: 35519A75D04209AFDF05CBD4D895FEEBBB8BF28715F01405AE601A7184DBF89A44CBA2

Function 6D1ABFB9 Relevance: 10.6, APIs: 7, Instructions: 150threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6D1ABFE1
GetCurrentThreadId.KERNEL32 ref: 6D1ABFFE
GetCurrentThreadId.KERNEL32 ref: 6D1AC01F
GetCurrentThreadId.KERNEL32 ref: 6D1AC09F
__Xtime_diff_to_millis2.LIBCPMT ref: 6D1AC0B7
GetCurrentThreadId.KERNEL32 ref: 6D1AC0E1
GetCurrentThreadId.KERNEL32 ref: 6D1AC127

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: CurrentThread$Xtime_diff_to_millis2
String ID:
API String ID: 1280559528-0
Opcode ID: 9fa74de4361f24221c3fdf44639cd5a2fd14ffcce41c26f491a3d21aaefb6b85
Instruction ID: f7114213f2a22fe70d749dd41e0130ad9542074df7001a42b8221100ff921003
Opcode Fuzzy Hash: 9fa74de4361f24221c3fdf44639cd5a2fd14ffcce41c26f491a3d21aaefb6b85
Instruction Fuzzy Hash: 6351C1BDA0451ACFCF01DFA4CA81AA9B7F2FF1931071A8459D9169B249C7B0ED41CB91

Function 6D1A4C70 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 131COMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?), ref: 6D1A4CAA
GetLastError.KERNEL32(0000000A), ref: 6D1A4CD5

Strings

Timer: QueryPerformanceCounter failed with error , xrefs: 6D1A4CF0
Timer: QueryPerformanceFrequency failed with error , xrefs: 6D1A4DDB

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: CounterErrorLastPerformanceQuery
String ID: Timer: QueryPerformanceCounter failed with error $Timer: QueryPerformanceFrequency failed with error
API String ID: 1297246462-2136607233
Opcode ID: 8832e2e7932e72e0ae189a21af3bf2ab4fc8c40443aa32ffd55415233ab298cb
Instruction ID: b6bccc7c0952af90202fe1d57bd494eda8d2db91b60e8e4e3b7e950fcd99628f
Opcode Fuzzy Hash: 8832e2e7932e72e0ae189a21af3bf2ab4fc8c40443aa32ffd55415233ab298cb
Instruction Fuzzy Hash: 63416FB5944208EBDB20DFE4D844FAEB7B8FB19704F104229F915A7285DBB5A504CB61

Function 6D1C4D40 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 6D1C4D77
___except_validate_context_record.LIBVCRUNTIME ref: 6D1C4D7F
_ValidateLocalCookies.LIBCMT ref: 6D1C4E08
__IsNonwritableInCurrentImage.LIBCMT ref: 6D1C4E33
_ValidateLocalCookies.LIBCMT ref: 6D1C4E88

Strings

csm, xrefs: 6D1C4E1D

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 48811eb16003f3bc8e80145906ae06f078088440355aad8728f576121a9bf951
Instruction ID: 0afe46a1794ac3f80fa57dc02900495eb49918ebffcab45c3a53d7b3c7647615
Opcode Fuzzy Hash: 48811eb16003f3bc8e80145906ae06f078088440355aad8728f576121a9bf951
Instruction Fuzzy Hash: CA41DB34D082099BCF00DF68D840ABEBBB5BF69318F11C055E9149B399E7B9E911CB92

Function 6D1B2C0A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1B2C11
std::_Lockit::_Lockit.LIBCPMT ref: 6D1B2C1B

Part of subcall function 6D17D2F0: std::_Lockit::_Lockit.LIBCPMT ref: 6D17D2FF
Part of subcall function 6D17D2F0: std::_Lockit::~_Lockit.LIBCPMT ref: 6D17D31A

messages.LIBCPMT ref: 6D1B2C55
std::_Facet_Register.LIBCPMT ref: 6D1B2C6C
std::_Lockit::~_Lockit.LIBCPMT ref: 6D1B2C8C

Strings

P,"m, xrefs: 6D1B2C26

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermessages
String ID: P,"m
API String ID: 2750803064-1336882431
Opcode ID: f44f707b1757d892e6b1d66f08a4ab65a1e935379d0433d074270224cd63ffb7
Instruction ID: 40bba7153939ff7b767b8ff9215576a11e225c841957d70b07c33e1ed1a21766
Opcode Fuzzy Hash: f44f707b1757d892e6b1d66f08a4ab65a1e935379d0433d074270224cd63ffb7
Instruction Fuzzy Hash: DE01267590811A8FCB11CBA4D8047BE7771AF44324F174509D510AB388CFF58A02CBD1

Function 6D1B2921 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1B2928
std::_Lockit::_Lockit.LIBCPMT ref: 6D1B2932

Part of subcall function 6D17D2F0: std::_Lockit::_Lockit.LIBCPMT ref: 6D17D2FF
Part of subcall function 6D17D2F0: std::_Lockit::~_Lockit.LIBCPMT ref: 6D17D31A

collate.LIBCPMT ref: 6D1B296C
std::_Facet_Register.LIBCPMT ref: 6D1B2983
std::_Lockit::~_Lockit.LIBCPMT ref: 6D1B29A3

Strings

t,"m, xrefs: 6D1B293D

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercollate
String ID: t,"m
API String ID: 1007100420-1627327638
Opcode ID: dd98f72865267772b2967af078863abb97d85634813c18ef55d5482ea9db5795
Instruction ID: b891c65ff31b43a868d030c910c63b519d494ccc1bb3680f6aa85f84b732611f
Opcode Fuzzy Hash: dd98f72865267772b2967af078863abb97d85634813c18ef55d5482ea9db5795
Instruction Fuzzy Hash: 9A0122759082298BCF21DBA4C8447BE77B1AF81718F164508E610AB388CFF49A02CBD2

Function 6D1B29B6 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1B29BD
std::_Lockit::_Lockit.LIBCPMT ref: 6D1B29C7

Part of subcall function 6D17D2F0: std::_Lockit::_Lockit.LIBCPMT ref: 6D17D2FF
Part of subcall function 6D17D2F0: std::_Lockit::~_Lockit.LIBCPMT ref: 6D17D31A

collate.LIBCPMT ref: 6D1B2A01
std::_Facet_Register.LIBCPMT ref: 6D1B2A18
std::_Lockit::~_Lockit.LIBCPMT ref: 6D1B2A38

Strings

L,"m, xrefs: 6D1B29D2

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercollate
String ID: L,"m
API String ID: 1007100420-1432411352
Opcode ID: c28412d58e84ca0c020002b1e10ad9f6ce2569ae5f2dac640f4372ad67ce79f0
Instruction ID: 1a01df7b499d77d35b844fcad0594cf2b85c20265a0a62ade1098e66df387657
Opcode Fuzzy Hash: c28412d58e84ca0c020002b1e10ad9f6ce2569ae5f2dac640f4372ad67ce79f0
Instruction Fuzzy Hash: 5901627590811A9FCB24CFA4C8007BE73B1AF88318F174108E910AB388CFF48A02CB91

Function 6D1B2B75 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1B2B7C
std::_Lockit::_Lockit.LIBCPMT ref: 6D1B2B86

Part of subcall function 6D17D2F0: std::_Lockit::_Lockit.LIBCPMT ref: 6D17D2FF
Part of subcall function 6D17D2F0: std::_Lockit::~_Lockit.LIBCPMT ref: 6D17D31A

messages.LIBCPMT ref: 6D1B2BC0
std::_Facet_Register.LIBCPMT ref: 6D1B2BD7
std::_Lockit::~_Lockit.LIBCPMT ref: 6D1B2BF7

Strings

x,"m, xrefs: 6D1B2B91

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermessages
String ID: x,"m
API String ID: 2750803064-707375918
Opcode ID: 150dd87b14d37cbcc57ba39c5946abb04ccd4f89583a4083356803259cd283da
Instruction ID: c0b23238e23e4134b52d9e1bc98a9a384bf142589623c281c980d86b6c270259
Opcode Fuzzy Hash: 150dd87b14d37cbcc57ba39c5946abb04ccd4f89583a4083356803259cd283da
Instruction Fuzzy Hash: 8F01007590815A8FCB24DBA0D944ABE77B1AF85318F164509EA10AB288CFF48A02CB91

Function 6D1B2AE0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1B2AE7
std::_Lockit::_Lockit.LIBCPMT ref: 6D1B2AF1

Part of subcall function 6D17D2F0: std::_Lockit::_Lockit.LIBCPMT ref: 6D17D2FF
Part of subcall function 6D17D2F0: std::_Lockit::~_Lockit.LIBCPMT ref: 6D17D31A

ctype.LIBCPMT ref: 6D1B2B2B
std::_Facet_Register.LIBCPMT ref: 6D1B2B42
std::_Lockit::~_Lockit.LIBCPMT ref: 6D1B2B62

Strings

)"m, xrefs: 6D1B2AFC

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registerctype
String ID: )"m
API String ID: 83828444-2289182684
Opcode ID: 28af725ec71e9dff7fe4d02c6327e93a8010e69238ed14217c3cdb4b2a737752
Instruction ID: 50b5f502fdf706edcb0b234f64bd4aadf11468b9c20c831f5dd8f45a9d4ae848
Opcode Fuzzy Hash: 28af725ec71e9dff7fe4d02c6327e93a8010e69238ed14217c3cdb4b2a737752
Instruction Fuzzy Hash: F20126759081598FCB25DFA4D9007BEB7B1AF41318F164509E910AB28CCFF09A02CB91

Function 6D1B27F7 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1B27FE
std::_Lockit::_Lockit.LIBCPMT ref: 6D1B2808

Part of subcall function 6D17D2F0: std::_Lockit::_Lockit.LIBCPMT ref: 6D17D2FF
Part of subcall function 6D17D2F0: std::_Lockit::~_Lockit.LIBCPMT ref: 6D17D31A

codecvt.LIBCPMT ref: 6D1B2842
std::_Facet_Register.LIBCPMT ref: 6D1B2859
std::_Lockit::~_Lockit.LIBCPMT ref: 6D1B2879

Strings

)"m, xrefs: 6D1B2813

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercodecvt
String ID: )"m
API String ID: 712880209-2289182684
Opcode ID: 61842c0e97ba9eb18d77a8bc61b42a5cfa580576f640038cc9f6410d1e0c0b39
Instruction ID: 79c6ae73548404b8f0e649c0d1afe5f91fef8e0411dd829ffeda51f78b44dacc
Opcode Fuzzy Hash: 61842c0e97ba9eb18d77a8bc61b42a5cfa580576f640038cc9f6410d1e0c0b39
Instruction Fuzzy Hash: E3012675E0851A8FCB15CB64D8407BE77B1BF44314F264509E910AB29CCFF08A02CBD1

Function 6D1B3430 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1B3437
std::_Lockit::_Lockit.LIBCPMT ref: 6D1B3441

Part of subcall function 6D17D2F0: std::_Lockit::_Lockit.LIBCPMT ref: 6D17D2FF
Part of subcall function 6D17D2F0: std::_Lockit::~_Lockit.LIBCPMT ref: 6D17D31A

numpunct.LIBCPMT ref: 6D1B347B
std::_Facet_Register.LIBCPMT ref: 6D1B3492
std::_Lockit::~_Lockit.LIBCPMT ref: 6D1B34B2

Strings

H,"m, xrefs: 6D1B344C

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registernumpunct
String ID: H,"m
API String ID: 743221004-3657583503
Opcode ID: 1c027e40265efb8c5a87c3fd0b7ed294ad181526b6d01b800341d5b36c613257
Instruction ID: 2e013b0487b3edfaabd0a5ebbc260faa27f958b6a8521b93a30aff9053c2502a
Opcode Fuzzy Hash: 1c027e40265efb8c5a87c3fd0b7ed294ad181526b6d01b800341d5b36c613257
Instruction Fuzzy Hash: 1201D2759081598FCB06DFA4D8047BE77B1AF85328F164509E610AB399DFF49A02CBD1

Function 6D1B301D Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1B3024
std::_Lockit::_Lockit.LIBCPMT ref: 6D1B302E

Part of subcall function 6D17D2F0: std::_Lockit::_Lockit.LIBCPMT ref: 6D17D2FF
Part of subcall function 6D17D2F0: std::_Lockit::~_Lockit.LIBCPMT ref: 6D17D31A

moneypunct.LIBCPMT ref: 6D1B3068
std::_Facet_Register.LIBCPMT ref: 6D1B307F
std::_Lockit::~_Lockit.LIBCPMT ref: 6D1B309F

Strings

`,"m, xrefs: 6D1B3039

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID: `,"m
API String ID: 419941038-3213151326
Opcode ID: f775199bd77c3816bbb9d2cc27c692dd21209a7f09c274526fe1af3e30d10e72
Instruction ID: 3da64393922083bcc6bd4f3fc9b9d112998768567afeb7c6f706e1bd8ab15b59
Opcode Fuzzy Hash: f775199bd77c3816bbb9d2cc27c692dd21209a7f09c274526fe1af3e30d10e72
Instruction Fuzzy Hash: 4401D675908119CBCB15DFA4D4447BE77B1AF81714F164609E950AB388CFF59A02CB91

Function 6D1B30B2 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1B30B9
std::_Lockit::_Lockit.LIBCPMT ref: 6D1B30C3

Part of subcall function 6D17D2F0: std::_Lockit::_Lockit.LIBCPMT ref: 6D17D2FF
Part of subcall function 6D17D2F0: std::_Lockit::~_Lockit.LIBCPMT ref: 6D17D31A

moneypunct.LIBCPMT ref: 6D1B30FD
std::_Facet_Register.LIBCPMT ref: 6D1B3114
std::_Lockit::~_Lockit.LIBCPMT ref: 6D1B3134

Strings

\,"m, xrefs: 6D1B30CE

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID: \,"m
API String ID: 419941038-91851591
Opcode ID: 5d64038f47e5caddcac78d50bfab152a3f3858e2fa47db771c9cf94917ddd87b
Instruction ID: 225974c9784563eb796fd5bea9d50836654cc08ae7e1c3bb20a73f1d8d626a09
Opcode Fuzzy Hash: 5d64038f47e5caddcac78d50bfab152a3f3858e2fa47db771c9cf94917ddd87b
Instruction Fuzzy Hash: 24012EB5A0815A9BCB14DFA4C9507BEB7B5AF91318F164508E910AB388CFF48A02CB91

Function 6D1B339B Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1B33A2
std::_Lockit::_Lockit.LIBCPMT ref: 6D1B33AC

Part of subcall function 6D17D2F0: std::_Lockit::_Lockit.LIBCPMT ref: 6D17D2FF
Part of subcall function 6D17D2F0: std::_Lockit::~_Lockit.LIBCPMT ref: 6D17D31A

numpunct.LIBCPMT ref: 6D1B33E6
std::_Facet_Register.LIBCPMT ref: 6D1B33FD
std::_Lockit::~_Lockit.LIBCPMT ref: 6D1B341D

Strings

p,"m, xrefs: 6D1B33B7

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registernumpunct
String ID: p,"m
API String ID: 743221004-4020083649
Opcode ID: fb86517c17516c299755ec2cb52b71f04dda61af153b95e02af4911bec5fff6b
Instruction ID: a716f1dc611829c6e33c220ba46cedc87a412235112f6cac716c6821c3c6a1c6
Opcode Fuzzy Hash: fb86517c17516c299755ec2cb52b71f04dda61af153b95e02af4911bec5fff6b
Instruction Fuzzy Hash: D8012275A081198FCB15DBA4D8047BE77B1AF90318F164508E910AB288CFF08E02CBD1

Function 6D1E1530 Relevance: 9.3, APIs: 6, Instructions: 292COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6ed344bf70efff814ea12db1f74ba15f6047aa7e20437b57023ab51ff9ded54
Instruction ID: ca77c138bc5793eafbcb4dac5250bcfd810c4245d890876065f587b0b324833f
Opcode Fuzzy Hash: a6ed344bf70efff814ea12db1f74ba15f6047aa7e20437b57023ab51ff9ded54
Instruction Fuzzy Hash: 68B1F6B4E08A4A9FDB41CFA8C850FBEBBB1FF5A794F054158E51497289C7F09982CB50

Function 6D163301 Relevance: 9.2, APIs: 6, Instructions: 188COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6D163312
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 6D16335A

Part of subcall function 6D1AC61A: _Yarn.LIBCPMT ref: 6D1AC639
Part of subcall function 6D1AC61A: _Yarn.LIBCPMT ref: 6D1AC65D

std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 6D16338F
std::_Lockit::~_Lockit.LIBCPMT ref: 6D163424
std::_Lockit::_Lockit.LIBCPMT ref: 6D163474
std::_Lockit::~_Lockit.LIBCPMT ref: 6D163495

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Locinfo::_Lockit::_Lockit::~_Yarn$Locinfo_ctorLocinfo_dtor
String ID:
API String ID: 3482073847-0
Opcode ID: 2787e18aacd9628a088e5d6d83c276aefe5e7b6bca71fda250b7083a75fb37c1
Instruction ID: e4063764cc4ad9505e2beec46cb61f8688bd32c17269b6e08bbbe28f43a1f89e
Opcode Fuzzy Hash: 2787e18aacd9628a088e5d6d83c276aefe5e7b6bca71fda250b7083a75fb37c1
Instruction Fuzzy Hash: 3771A0B4D043858FEB20CFA5C844BAEFBB4BF24304F144119D815AB356EBB5E955CBA1

Function 6D162470 Relevance: 9.1, APIs: 6, Instructions: 120COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6D1624A3
std::_Lockit::_Lockit.LIBCPMT ref: 6D1624C5
std::_Lockit::~_Lockit.LIBCPMT ref: 6D1624E5
__Getctype.LIBCPMT ref: 6D16259C
std::_Facet_Register.LIBCPMT ref: 6D1625C5
std::_Lockit::~_Lockit.LIBCPMT ref: 6D1625DD

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetctypeRegister
String ID:
API String ID: 1102183713-0
Opcode ID: 2bafc8c4f410bc027940b1b04b2d5bcccec12f6739b860511e5511d49fed99cd
Instruction ID: 9e371425deb4574d6417ddc592cf6ccff9abfbaaa468b61b3cde25d47d65f611
Opcode Fuzzy Hash: 2bafc8c4f410bc027940b1b04b2d5bcccec12f6739b860511e5511d49fed99cd
Instruction Fuzzy Hash: EA41E0B590829A8BCB31CF54C454BAFB7B4FF05308F15811AE801AB248EBB0E941CBA1

Function 6D1DA493 Relevance: 9.1, APIs: 3, Strings: 2, Instructions: 370COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 6D1DA57D
__freea.LIBCMT ref: 6D1DA60D
__freea.LIBCMT ref: 6D1DA629

Strings

am/pm, xrefs: 6D1DA68B
a/p, xrefs: 6D1DA6EF

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: __freea$__alloca_probe_16
String ID: a/p$am/pm
API String ID: 3509577899-3206640213
Opcode ID: 7262dfd299d0b638c353150c8ccaa2cb12589f159634e3463f73438bfbae1a4f
Instruction ID: b3da57a3e684d6eb37bf80f9fa8de019eae688672bf012edbab68a7dc4609c05
Opcode Fuzzy Hash: 7262dfd299d0b638c353150c8ccaa2cb12589f159634e3463f73438bfbae1a4f
Instruction Fuzzy Hash: 98C11134A54203CBDB85CF68C894FBAB7B0FF36705F218149E911AB298D7F59942CB61

Function 6D1CD5E4 Relevance: 9.1, APIs: 6, Instructions: 119COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 6D1CD628
DName::operator+.LIBCMT ref: 6D1CD634

Part of subcall function 6D1C7C59: shared_ptr.LIBCMT ref: 6D1C7C75

DName::operator+=.LIBCMT ref: 6D1CD6F2

Part of subcall function 6D1CBEED: DName::operator+.LIBCMT ref: 6D1CBF58
Part of subcall function 6D1CBEED: DName::operator+.LIBCMT ref: 6D1CC222

Part of subcall function 6D1C7B84: DName::operator+.LIBCMT ref: 6D1C7BA5

DName::operator+.LIBCMT ref: 6D1CD6AF

Part of subcall function 6D1C7CB1: DName::operator=.LIBVCRUNTIME ref: 6D1C7CD2

DName::DName.LIBVCRUNTIME ref: 6D1CD716
DName::operator+.LIBCMT ref: 6D1CD722

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: Name::operator+$NameName::Name::operator+=Name::operator=shared_ptr
String ID:
API String ID: 2795783184-0
Opcode ID: 7c808c9fdce165d638a546ac91a98d9cdba7c8a86f840457480c0b9b152b28ac
Instruction ID: a37565376a4337acab922bb835aab0119e8c5f1fb6a927fa10e8b769f6bff970
Opcode Fuzzy Hash: 7c808c9fdce165d638a546ac91a98d9cdba7c8a86f840457480c0b9b152b28ac
Instruction Fuzzy Hash: 5641EAB0A44305AFCB01CFA4C454BAE7BF9BB66708F01445EE246D7248DBF99941CB66

Function 6D1CC2AB Relevance: 9.1, APIs: 6, Instructions: 94COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6D1CD738: Replicator::operator[].LIBCMT ref: 6D1CD775

DName::operator=.LIBVCRUNTIME ref: 6D1CC357

Part of subcall function 6D1CBEED: DName::operator+.LIBCMT ref: 6D1CBF58
Part of subcall function 6D1CBEED: DName::operator+.LIBCMT ref: 6D1CC222

DName::operator+.LIBCMT ref: 6D1CC311
DName::operator+.LIBCMT ref: 6D1CC31D
DName::DName.LIBVCRUNTIME ref: 6D1CC361
DName::operator+.LIBCMT ref: 6D1CC37E
DName::operator+.LIBCMT ref: 6D1CC38A

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: Name::operator+$NameName::Name::operator=Replicator::operator[]
String ID:
API String ID: 955152517-0
Opcode ID: 987da655926cf31133cc8de5fad0aef4079d64c88d5ae778f9392ab2863533dc
Instruction ID: a2d0755f0442e9302ce0e2441816db99aa5944b904961aa3b92bfd202cc2a6d5
Opcode Fuzzy Hash: 987da655926cf31133cc8de5fad0aef4079d64c88d5ae778f9392ab2863533dc
Instruction Fuzzy Hash: 1B31C1B1A083049FCB14CF58D454BAEBBF9BF69704F04845DE58AD7384D7B89900CB62

Function 6D1C669F Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,6D1C661D,6D1C2AE8,6D1C31B9,?,6D1C33F1,?,00000001,?,?,00000001,?,6D216B48,0000000C,6D1C34EA), ref: 6D1C66AD
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6D1C66BB
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6D1C66D4
SetLastError.KERNEL32(00000000,6D1C33F1,?,00000001,?,?,00000001,?,6D216B48,0000000C,6D1C34EA,?,00000001,?), ref: 6D1C6726

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 71a584d2aab39e6885d93fbe273df3fd06701a9d67a168604bc061665675475a
Instruction ID: 06d014f05fff91b8c382e7d990d9df21c7ea9fa20c6ceda5fc118dc8acc1a98b
Opcode Fuzzy Hash: 71a584d2aab39e6885d93fbe273df3fd06701a9d67a168604bc061665675475a
Instruction Fuzzy Hash: F801283634C7165EEB110AB46C8AA372BA4EB366BC3210239E224814E8FFE94815D1D2

Function 6D16AB30 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 301COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 6D16AE0F
__fread_nolock.LIBCMT ref: 6D16AE31

Strings

ios_base::badbit set, xrefs: 6D16AC4D, 6D16AC75
ios_base::failbit set, xrefs: 6D16AC56, 6D16ACB8
ios_base::eofbit set, xrefs: 6D16AC5B

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: __fread_nolock
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2638373210-1866435925
Opcode ID: 60d262378057fe16cb5deee54b00bac4f4907aaa2a223f329108ffbcf0705cc0
Instruction ID: 8043f3ad91e62792d64413ab286cffbd6c9dc2161a12ef32ce045079b2dfb0a9
Opcode Fuzzy Hash: 60d262378057fe16cb5deee54b00bac4f4907aaa2a223f329108ffbcf0705cc0
Instruction Fuzzy Hash: 4AB1BD72A041599FCB04CF6CD880EAA77B5FF98314F1181A9ED059B349D7B1ED20CBA0

Function 6D163570 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 218COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6D16359B
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 6D1635EA

Part of subcall function 6D1AC61A: _Yarn.LIBCPMT ref: 6D1AC639
Part of subcall function 6D1AC61A: _Yarn.LIBCPMT ref: 6D1AC65D

Strings

bad locale name, xrefs: 6D163606

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: d508fd52e76e8301dcde2c1e61df152619ad04804bcbe3b924bc25d70f8fcda9
Instruction ID: da2130f0d61c80be0a1ce0c772231f29dc6953e5736c218d40bb879af4a62788
Opcode Fuzzy Hash: d508fd52e76e8301dcde2c1e61df152619ad04804bcbe3b924bc25d70f8fcda9
Instruction Fuzzy Hash: 1481BDB19046489FCB14CFA8C840B9EFBF4EF58314F14861EE919A7744D7B4AA45CBA1

Function 6D167660 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

Strings

string too long, xrefs: 6D167660
invalid string position, xrefs: 6D167680
vector too long, xrefs: 6D167670
invalid vector subscript, xrefs: 6D167690

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: std::invalid_argument::invalid_argument
String ID: invalid string position$invalid vector subscript$string too long$vector too long
API String ID: 2141394445-272296199
Opcode ID: 0268ae5546e8d535f6351ced4ab09f744f0aa10652f0b5fe4a918968c720bdf1
Instruction ID: c1c0561f32d0759b9af15710063a1e7c16cf44b3ea9c3abd3607395bc0f7bca9
Opcode Fuzzy Hash: 0268ae5546e8d535f6351ced4ab09f744f0aa10652f0b5fe4a918968c720bdf1
Instruction Fuzzy Hash: CB313AB2A041491BD304CBB89855ABEB3DC9F64314B150536EA18C7A0AE7F5E560C2B2

Function 6D19D270 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 6D19D3E0
Concurrency::cancel_current_task.LIBCPMT ref: 6D19D3E5
Concurrency::cancel_current_task.LIBCPMT ref: 6D19D3EA

Strings

true, xrefs: 6D19D397
false, xrefs: 6D19D372

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID: false$true
API String ID: 118556049-2658103896
Opcode ID: 8d03173a3bfb77be61bfed4056061e543e9d15b8e81207e0fcf2f4f6364ce455
Instruction ID: 4717a7290d30e6478d74e3676df954ce77f3be2c0520ffb24a2a59107f10b73e
Opcode Fuzzy Hash: 8d03173a3bfb77be61bfed4056061e543e9d15b8e81207e0fcf2f4f6364ce455
Instruction Fuzzy Hash: 0941DEB490570A9BDB10CFA4D9407AABBF4FF15308F11452DD9149B748E7F6EA05CBA0

Function 6D19D3F0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 114COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 6D19D52D
Concurrency::cancel_current_task.LIBCPMT ref: 6D19D532
Concurrency::cancel_current_task.LIBCPMT ref: 6D19D537

Strings

true, xrefs: 6D19D4E3
false, xrefs: 6D19D4B9

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID: false$true
API String ID: 118556049-2658103896
Opcode ID: 7952369d4919556f377523564d0a5f7bd9d6b5bcbd133be5589fd29f923713a5
Instruction ID: 5ba959cde267011485480f0c8e0f36ea9db81c3474f5c07e67ee68a3eedded03
Opcode Fuzzy Hash: 7952369d4919556f377523564d0a5f7bd9d6b5bcbd133be5589fd29f923713a5
Instruction Fuzzy Hash: DF4153B89043499FDB00CF64D940BAABBF4EF16318F04842DE9158BB46D7F6E509CBA1

Function 6D1B7137 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1B713E
_Getvals.LIBCPMT ref: 6D1B7190
_Mpunct.LIBCPMT ref: 6D1B71CB
_Mpunct.LIBCPMT ref: 6D1B71E5

Strings

$+xv, xrefs: 6D1B71F0

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: Mpunct$GetvalsH_prolog3
String ID: $+xv
API String ID: 2204710431-1686923651
Opcode ID: 424c200b39b00d729bd3347ad7168523718566d91b6c24fb0819abab4b39d91a
Instruction ID: eedd6c989fc201a0acba507f4845d6ab203c3038d2d0f0b2dc023eeb91871bc2
Opcode Fuzzy Hash: 424c200b39b00d729bd3347ad7168523718566d91b6c24fb0819abab4b39d91a
Instruction Fuzzy Hash: DB21C4B1908B566FD721CF74889077BBEF8BB0C604F044A1EE199C7A41E7B4E601CBA0

Function 6D1B2D34 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1B2D3B
std::_Lockit::_Lockit.LIBCPMT ref: 6D1B2D45

Part of subcall function 6D17D2F0: std::_Lockit::_Lockit.LIBCPMT ref: 6D17D2FF
Part of subcall function 6D17D2F0: std::_Lockit::~_Lockit.LIBCPMT ref: 6D17D31A

std::_Facet_Register.LIBCPMT ref: 6D1B2D96
std::_Lockit::~_Lockit.LIBCPMT ref: 6D1B2DB6

Strings

T,"m, xrefs: 6D1B2D50

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID: T,"m
API String ID: 2854358121-3234702248
Opcode ID: 94580a1307ba7a3a7e68fa85eab920fcee75d95a6b2a78e50255773b1b24d765
Instruction ID: 930cbb70dfd559a1c820248eaf635c6e52988e8ee9ee1ea5629661f18d3a7a39
Opcode Fuzzy Hash: 94580a1307ba7a3a7e68fa85eab920fcee75d95a6b2a78e50255773b1b24d765
Instruction Fuzzy Hash: 28012275A081198FCB11CFA0D8047BE77B1AF81318F164509E910BB288CFF48E06CBD2

Function 6D1B2C9F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1B2CA6
std::_Lockit::_Lockit.LIBCPMT ref: 6D1B2CB0

Part of subcall function 6D17D2F0: std::_Lockit::_Lockit.LIBCPMT ref: 6D17D2FF
Part of subcall function 6D17D2F0: std::_Lockit::~_Lockit.LIBCPMT ref: 6D17D31A

std::_Facet_Register.LIBCPMT ref: 6D1B2D01
std::_Lockit::~_Lockit.LIBCPMT ref: 6D1B2D21

Strings

|,"m, xrefs: 6D1B2CBB

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID: |,"m
API String ID: 2854358121-2773165177
Opcode ID: d0737cf86fb78a54a916634e358bc257a34c3778aef653d6e2192fe94c7bf8c6
Instruction ID: d8fdd56f24503a2e48385d40dcb04f19665d451b0688fbf8e88d5fc28dc9b461
Opcode Fuzzy Hash: d0737cf86fb78a54a916634e358bc257a34c3778aef653d6e2192fe94c7bf8c6
Instruction Fuzzy Hash: 3901F57990815A9BCB11DBA4D8047BE77B1BF85328F264509E910BB388DFF49E06CBD1

Function 6D1B2E5E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1B2E65
std::_Lockit::_Lockit.LIBCPMT ref: 6D1B2E6F

Part of subcall function 6D17D2F0: std::_Lockit::_Lockit.LIBCPMT ref: 6D17D2FF
Part of subcall function 6D17D2F0: std::_Lockit::~_Lockit.LIBCPMT ref: 6D17D31A

std::_Facet_Register.LIBCPMT ref: 6D1B2EC0
std::_Lockit::~_Lockit.LIBCPMT ref: 6D1B2EE0

Strings

X,"m, xrefs: 6D1B2E7A

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID: X,"m
API String ID: 2854358121-2317032464
Opcode ID: ea6c48e5d65b6e602bff1e862b045482636a3dc2d167af9991a4f379b7c81d9b
Instruction ID: ae6bf5fb89ec1baf9325d9b6bcc780e0609f075953a4b7bf1c83f10f707c3e77
Opcode Fuzzy Hash: ea6c48e5d65b6e602bff1e862b045482636a3dc2d167af9991a4f379b7c81d9b
Instruction Fuzzy Hash: 020122769081598BCB11DFA4D800BBE77B1BF81318F164508E910AB288CFF08A02CB91

Function 6D1B355A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1B3561
std::_Lockit::_Lockit.LIBCPMT ref: 6D1B356B

Part of subcall function 6D17D2F0: std::_Lockit::_Lockit.LIBCPMT ref: 6D17D2FF
Part of subcall function 6D17D2F0: std::_Lockit::~_Lockit.LIBCPMT ref: 6D17D31A

std::_Facet_Register.LIBCPMT ref: 6D1B35BC
std::_Lockit::~_Lockit.LIBCPMT ref: 6D1B35DC

Strings

d,"m, xrefs: 6D1B3576

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID: d,"m
API String ID: 2854358121-820402953
Opcode ID: 79c221a51280f3265c23079301a7877e08c6a308f8272351b6670e638509c25d
Instruction ID: 21c22e454f457164d92eba1da0a3260c1d15814dc251f23732e6f58f1dadbf9d
Opcode Fuzzy Hash: 79c221a51280f3265c23079301a7877e08c6a308f8272351b6670e638509c25d
Instruction Fuzzy Hash: 4801D275A0811A8FCB15DFA4D844BBEB7B1AF91314F164509E911AB388CFF49A03CBD1

Function 6D1B3684 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1B368B
std::_Lockit::_Lockit.LIBCPMT ref: 6D1B3695

Part of subcall function 6D17D2F0: std::_Lockit::_Lockit.LIBCPMT ref: 6D17D2FF
Part of subcall function 6D17D2F0: std::_Lockit::~_Lockit.LIBCPMT ref: 6D17D31A

std::_Facet_Register.LIBCPMT ref: 6D1B36E6
std::_Lockit::~_Lockit.LIBCPMT ref: 6D1B3706

Strings

<,"m, xrefs: 6D1B36A0

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID: <,"m
API String ID: 2854358121-1046445124
Opcode ID: a6c49ac147762429853c6a52784de5a16f544d3f09f958bc28c04851ec186957
Instruction ID: 216ca1e7f3f841798132e88a81b45a38fbee1d4f411c6e7d9d2033f17453d81c
Opcode Fuzzy Hash: a6c49ac147762429853c6a52784de5a16f544d3f09f958bc28c04851ec186957
Instruction Fuzzy Hash: 5C01D2B99082199FCB11DBA4D8047BEB7B1BF85314F164509E511AB398CFF49E02CBD1

Function 6D1B3147 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1B314E
std::_Lockit::_Lockit.LIBCPMT ref: 6D1B3158

Part of subcall function 6D17D2F0: std::_Lockit::_Lockit.LIBCPMT ref: 6D17D2FF
Part of subcall function 6D17D2F0: std::_Lockit::~_Lockit.LIBCPMT ref: 6D17D31A

std::_Facet_Register.LIBCPMT ref: 6D1B31A9
std::_Lockit::~_Lockit.LIBCPMT ref: 6D1B31C9

Strings

h,"m, xrefs: 6D1B3163

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID: h,"m
API String ID: 2854358121-2050024625
Opcode ID: c3362f1bc86d8a3247a6386ec609c868d24b1a9da098561728e323257fea2533
Instruction ID: e89c7defcb6673fb9c31bd16a5a709d8b77c7a0fd515515d607bde6abbd29f97
Opcode Fuzzy Hash: c3362f1bc86d8a3247a6386ec609c868d24b1a9da098561728e323257fea2533
Instruction Fuzzy Hash: 200126B5D0811A9BCB04DB60D8047BE77B5AF91314F164509E910AB398CFF08A02CBD1

Function 6D1B31DC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1B31E3
std::_Lockit::_Lockit.LIBCPMT ref: 6D1B31ED

Part of subcall function 6D17D2F0: std::_Lockit::_Lockit.LIBCPMT ref: 6D17D2FF
Part of subcall function 6D17D2F0: std::_Lockit::~_Lockit.LIBCPMT ref: 6D17D31A

std::_Facet_Register.LIBCPMT ref: 6D1B323E
std::_Lockit::~_Lockit.LIBCPMT ref: 6D1B325E

Strings

@,"m, xrefs: 6D1B31F8

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID: @,"m
API String ID: 2854358121-532046688
Opcode ID: 0f768c9a7a56e14f29232b517a5e50c02683b8431c693d6b8ba8f370d471a8a3
Instruction ID: 28e308f41d6be2ffc3a287bd9eaf9db09383ab3f75e5e00bb0998bb16b33a9af
Opcode Fuzzy Hash: 0f768c9a7a56e14f29232b517a5e50c02683b8431c693d6b8ba8f370d471a8a3
Instruction Fuzzy Hash: 8501C0799081198FCB15DBA4D8447BE77B1AF81328F164549E511AB288CFF49A02CB91

Function 6D1B3306 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1B330D
std::_Lockit::_Lockit.LIBCPMT ref: 6D1B3317

Part of subcall function 6D17D2F0: std::_Lockit::_Lockit.LIBCPMT ref: 6D17D2FF
Part of subcall function 6D17D2F0: std::_Lockit::~_Lockit.LIBCPMT ref: 6D17D31A

std::_Facet_Register.LIBCPMT ref: 6D1B3368
std::_Lockit::~_Lockit.LIBCPMT ref: 6D1B3388

Strings

D,"m, xrefs: 6D1B3322

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID: D,"m
API String ID: 2854358121-2429875255
Opcode ID: 89859c58e52a8a209a115bc8f12201bf662533cbf4279952c523a89cf752fcf7
Instruction ID: 7f69cdbd028780f3939465cdcb88137eadb24c00c08050eeee80f0ee6573f2ae
Opcode Fuzzy Hash: 89859c58e52a8a209a115bc8f12201bf662533cbf4279952c523a89cf752fcf7
Instruction Fuzzy Hash: AC01D275918119CBCB15DBA4D8047BFB7B1AF85318F164509E910AB2A8DFF49E02CB91

Function 6D1B3271 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1B3278
std::_Lockit::_Lockit.LIBCPMT ref: 6D1B3282

Part of subcall function 6D17D2F0: std::_Lockit::_Lockit.LIBCPMT ref: 6D17D2FF
Part of subcall function 6D17D2F0: std::_Lockit::~_Lockit.LIBCPMT ref: 6D17D31A

std::_Facet_Register.LIBCPMT ref: 6D1B32D3
std::_Lockit::~_Lockit.LIBCPMT ref: 6D1B32F3

Strings

l,"m, xrefs: 6D1B328D

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID: l,"m
API String ID: 2854358121-4115821542
Opcode ID: f82f0620591a273f2488acb88a0bee23b706454d1bb6b8b9888406a62cfa4002
Instruction ID: 6f749682b4270c43e48f3b6eea8347a3be45dac4a338a10443cb49d2713f497b
Opcode Fuzzy Hash: f82f0620591a273f2488acb88a0bee23b706454d1bb6b8b9888406a62cfa4002
Instruction Fuzzy Hash: D901D27590811A8BCB05DBA4D8147BE77B1BF85318F164549E510AB398DFF49A02CBD1

Function 6D1D29E5 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,FBD4147D,?,?,00000000,6D1EFB80,000000FF,?,6D1D297F,?,?,6D1D2953,00000016), ref: 6D1D2A1A
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 6D1D2A2C
FreeLibrary.KERNEL32(00000000,?,00000000,6D1EFB80,000000FF,?,6D1D297F,?,?,6D1D2953,00000016), ref: 6D1D2A4E

Strings

CorExitProcess, xrefs: 6D1D2A24
mscoree.dll, xrefs: 6D1D2A13

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: f271ab968b4a8d80f1150d98969330d44c00da080161076b56c6bbb4b04e7a53
Instruction ID: d9540de15f5f0ad2f76c4ed97d49b74e645c9f8a24abb47bef420121c29804a8
Opcode Fuzzy Hash: f271ab968b4a8d80f1150d98969330d44c00da080161076b56c6bbb4b04e7a53
Instruction Fuzzy Hash: 7D01A2B2904656AFDF118F40DC08BBFBBF8FB45750F000625E831A2694DBB49800CA90

Function 6D166D30 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,SYSTEM\CurrentControlSet\Control\Terminal Server,00000000,00020006,?), ref: 6D166D5A
RegSetValueExW.ADVAPI32(?,fDenyTSConnections,00000000,00000004,?,00000004), ref: 6D166D76
RegCloseKey.ADVAPI32(?), ref: 6D166D7F

Strings

SYSTEM\CurrentControlSet\Control\Terminal Server, xrefs: 6D166D50
fDenyTSConnections, xrefs: 6D166D6E

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: CloseOpenValue
String ID: SYSTEM\CurrentControlSet\Control\Terminal Server$fDenyTSConnections
API String ID: 779948276-1389234016
Opcode ID: 4a13fdc994628e00be572450f94f1955f328f3644a5d707c2cc9e8f5e1b7a67a
Instruction ID: d75d975620f2779eebaedbed47ecb39e6351ab540adfea0f94e5028eb1824e6e
Opcode Fuzzy Hash: 4a13fdc994628e00be572450f94f1955f328f3644a5d707c2cc9e8f5e1b7a67a
Instruction Fuzzy Hash: 14F0A9B0A0020CBBEF109EE1EC0EFAD7BB8EF01714F500195FB49A5184E7B05A549BA9

Function 6D16BC30 Relevance: 7.7, APIs: 5, Instructions: 201COMMON

Download Yara Rule

APIs

FindFirstVolumeW.KERNEL32(?,00000200,FBD4147D), ref: 6D16BCA7
GetVolumePathNamesForVolumeNameW.KERNEL32(?,?,00000400,?), ref: 6D16BCDA
GetVolumeInformationW.KERNEL32(?,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 6D16BD02
FindNextVolumeW.KERNEL32(00000000,?,00000200), ref: 6D16BEE7
FindVolumeClose.KERNEL32(00000000), ref: 6D16BEF6

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: Volume$Find$CloseFirstInformationNameNamesNextPath
String ID:
API String ID: 1001540003-0
Opcode ID: 47fc3af4140b0865864c87200beba108fca9cf0b92882dbdd4b23de76561191e
Instruction ID: 60cd3b023f83fb6431c254372fb4a24a8586c8c2c7f5112a34710b45552cf405
Opcode Fuzzy Hash: 47fc3af4140b0865864c87200beba108fca9cf0b92882dbdd4b23de76561191e
Instruction Fuzzy Hash: 4E816D7191021C9BEB20CB28CD44FE9B3B8FF45314F108699E519A7641EFB4AB84CFA1

Function 6D1E2F12 Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 6D1E2F97
__alloca_probe_16.LIBCMT ref: 6D1E3060
__freea.LIBCMT ref: 6D1E30C7

Part of subcall function 6D1E1CA2: HeapAlloc.KERNEL32(00000000,?,02FAC108,?,6D1C2A02,?,?,6D1676DA,?,?,6D16559C,00000020,?,6D6F6E2D,811C9DC5,?), ref: 6D1E1CD4

__freea.LIBCMT ref: 6D1E30DA
__freea.LIBCMT ref: 6D1E30E7

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: dd433f4ff2187fd20134f1979cfc827e1ac7969ba40ff316b2b8c25a5b087a2d
Instruction ID: 953d4a32e1df721e061714e990c4b59c5266785dff84a3e7960f5a691e841855
Opcode Fuzzy Hash: dd433f4ff2187fd20134f1979cfc827e1ac7969ba40ff316b2b8c25a5b087a2d
Instruction Fuzzy Hash: 7451E472604607AFEF118FA1DC44EBB76A9EF54395B124029FE14D7128EBF1CC12C660

Function 6D1CB8D9 Relevance: 7.7, APIs: 5, Instructions: 178COMMONLIBRARYCODE

Download Yara Rule

APIs

shared_ptr.LIBCMT ref: 6D1CB944
operator+.LIBVCRUNTIME ref: 6D1CB994
shared_ptr.LIBCMT ref: 6D1CBA60
DName::DName.LIBVCRUNTIME ref: 6D1CBA90
operator+.LIBVCRUNTIME ref: 6D1CBAF1

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: operator+shared_ptr$NameName::
String ID:
API String ID: 2894330373-0
Opcode ID: be7738d458fb77809d7e4bb8a7f69fcec74242cf97425a00b5d21b66fe8b4fe8
Instruction ID: 64e193bd0db6464dcb8d7baea44936a22beb82b1bcb2e359067c698723b98af3
Opcode Fuzzy Hash: be7738d458fb77809d7e4bb8a7f69fcec74242cf97425a00b5d21b66fe8b4fe8
Instruction Fuzzy Hash: 0D615CB191810AEEDB01CFA8C944AAE7BB9FB25304F00C55AE559DB218D7FAD701CF52

Function 6D162300 Relevance: 7.6, APIs: 5, Instructions: 117COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6D162331
std::_Lockit::_Lockit.LIBCPMT ref: 6D16234F
std::_Lockit::~_Lockit.LIBCPMT ref: 6D16236F
std::_Facet_Register.LIBCPMT ref: 6D162436
std::_Lockit::~_Lockit.LIBCPMT ref: 6D16244E

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 6ad751177c892cefbc7a7cc0e4ac36fb5c3dba3fd3a1d264d98420b70868345d
Instruction ID: 33f99c5bf44f93ed7278ec1ba4f2cb827e9c07cdb1093505aa8a47c06ad9eb83
Opcode Fuzzy Hash: 6ad751177c892cefbc7a7cc0e4ac36fb5c3dba3fd3a1d264d98420b70868345d
Instruction Fuzzy Hash: 6441E071A052558BCB21CF58C480BAFBBB4FF15754F15821AE805AB349DBB0E941CBA1

Function 6D19B780 Relevance: 7.6, APIs: 5, Instructions: 117COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6D19B7B1
std::_Lockit::_Lockit.LIBCPMT ref: 6D19B7CF
std::_Lockit::~_Lockit.LIBCPMT ref: 6D19B7EF
std::_Facet_Register.LIBCPMT ref: 6D19B8B6
std::_Lockit::~_Lockit.LIBCPMT ref: 6D19B8CE

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 81efb3310a51162a7ce7d9b81a4062605723815fa67538dfbe37985aa5dcece4
Instruction ID: 97f348a12b7d664884d43218fcc468fe1aa18c87e49f84176f1825c92f8902b1
Opcode Fuzzy Hash: 81efb3310a51162a7ce7d9b81a4062605723815fa67538dfbe37985aa5dcece4
Instruction Fuzzy Hash: E441EF75E0521ACBDB21CF58C684BBABBB4FF09714F15815AE805AB348D7B0A940CBD1

Function 6D19B8F0 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6D19B91D
std::_Lockit::_Lockit.LIBCPMT ref: 6D19B940
std::_Lockit::~_Lockit.LIBCPMT ref: 6D19B960
std::_Facet_Register.LIBCPMT ref: 6D19B9D5
std::_Lockit::~_Lockit.LIBCPMT ref: 6D19B9ED

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: d38902305e449da9003d7eba5a3da78de6853c524ecc380a4570aa21adf51aff
Instruction ID: 6987fd01aee813ff697a3a0bbcfde637a95a306f33b24d6050349f066b511d39
Opcode Fuzzy Hash: d38902305e449da9003d7eba5a3da78de6853c524ecc380a4570aa21adf51aff
Instruction Fuzzy Hash: C631E1B591421ACFCB11CF54C9C4BAFB7B4FB05328F15421AE915AB348D7B1A940CBD1

Function 6D1ADED6 Relevance: 7.6, APIs: 5, Instructions: 94COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1ADEDD
std::_Lockit::_Lockit.LIBCPMT ref: 6D1ADEE7
std::_Lockit::~_Lockit.LIBCPMT ref: 6D1ADF8E
Concurrency::cancel_current_task.LIBCPMT ref: 6D1ADF99
__EH_prolog3.LIBCMT ref: 6D1ADFA6

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: H_prolog3Lockitstd::_$Concurrency::cancel_current_taskLockit::_Lockit::~_
String ID:
API String ID: 845066630-0
Opcode ID: d6299fc726967893cf202df36d9b2bfad3b0d9522409a750c6338b6fc904f99e
Instruction ID: 41ea0df5458ff80389e068cfbfa08a5ddaadc49ac3cc6d73e3208c5b34d6812d
Opcode Fuzzy Hash: d6299fc726967893cf202df36d9b2bfad3b0d9522409a750c6338b6fc904f99e
Instruction Fuzzy Hash: 2F31E079A04616AFDB04DF54C850BADB3B0FF45310F468419EA11AB398EFB0EE02CB81

Function 6D1B00B3 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

_Maklocstr.LIBCPMT ref: 6D1B00D3
_Maklocstr.LIBCPMT ref: 6D1B00F0
_Maklocstr.LIBCPMT ref: 6D1B010D
_Maklocchr.LIBCPMT ref: 6D1B011F
_Maklocchr.LIBCPMT ref: 6D1B0132

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: Maklocstr$Maklocchr
String ID:
API String ID: 2020259771-0
Opcode ID: e0daf161fc85b869e5f426d338106c5aaf4cb92922c9df93ce7eef2839e8b398
Instruction ID: 1bdba169081a2204bb3f96b3407d95b6c553ab176d3f232a267dcc9525fc406d
Opcode Fuzzy Hash: e0daf161fc85b869e5f426d338106c5aaf4cb92922c9df93ce7eef2839e8b398
Instruction Fuzzy Hash: A6118CB1544745BFE720CBA69880F26B7ECFB0A254F04451AF2848BA44D7B5F85487A9

Function 6D1B2F88 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1B2F8F
std::_Lockit::_Lockit.LIBCPMT ref: 6D1B2F99

Part of subcall function 6D17D2F0: std::_Lockit::_Lockit.LIBCPMT ref: 6D17D2FF
Part of subcall function 6D17D2F0: std::_Lockit::~_Lockit.LIBCPMT ref: 6D17D31A

moneypunct.LIBCPMT ref: 6D1B2FD3
std::_Facet_Register.LIBCPMT ref: 6D1B2FEA
std::_Lockit::~_Lockit.LIBCPMT ref: 6D1B300A

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID:
API String ID: 419941038-0
Opcode ID: 695c02036b7b41352a1cbed259f0ccdd28bfb862c42d239541368513ca9dba15
Instruction ID: 102b7afeb6e24896479dc63859d1099c4222786e947ec9b774ae391554e30d1a
Opcode Fuzzy Hash: 695c02036b7b41352a1cbed259f0ccdd28bfb862c42d239541368513ca9dba15
Instruction Fuzzy Hash: B601457990815A8BCB11DBA4D8007BEBBB1BF84718F164509E510AB388DFF48E02CBD1

Function 6D1B2EF3 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1B2EFA
std::_Lockit::_Lockit.LIBCPMT ref: 6D1B2F04

Part of subcall function 6D17D2F0: std::_Lockit::_Lockit.LIBCPMT ref: 6D17D2FF
Part of subcall function 6D17D2F0: std::_Lockit::~_Lockit.LIBCPMT ref: 6D17D31A

moneypunct.LIBCPMT ref: 6D1B2F3E
std::_Facet_Register.LIBCPMT ref: 6D1B2F55
std::_Lockit::~_Lockit.LIBCPMT ref: 6D1B2F75

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID:
API String ID: 419941038-0
Opcode ID: a173111ec4113fb05789c80f1404adde756139fbdb70807ea58e2844e816eeda
Instruction ID: 1fe9fa6e5e5e6e62d2c7ba9723402bb282e5b9fb6e2bf557cb4f5ae9a6251dd3
Opcode Fuzzy Hash: a173111ec4113fb05789c80f1404adde756139fbdb70807ea58e2844e816eeda
Instruction Fuzzy Hash: 0201D67590815ACBCB11DB64D8047BE7775BF91318F164509E510AB298CFF49E06CBD1

Function 6D1BE96D Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1BE974
std::_Lockit::_Lockit.LIBCPMT ref: 6D1BE97E

Part of subcall function 6D17D2F0: std::_Lockit::_Lockit.LIBCPMT ref: 6D17D2FF
Part of subcall function 6D17D2F0: std::_Lockit::~_Lockit.LIBCPMT ref: 6D17D31A

messages.LIBCPMT ref: 6D1BE9B8
std::_Facet_Register.LIBCPMT ref: 6D1BE9CF
std::_Lockit::~_Lockit.LIBCPMT ref: 6D1BE9EF

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermessages
String ID:
API String ID: 2750803064-0
Opcode ID: 819883ac7c0cefc44acc62aea717f04717cf1167f93fdb97cce4bec107dca3ac
Instruction ID: 22c6b3634b14b8458d77f261c87657a0b8bd1b7f98902a971b7614ee887d79ae
Opcode Fuzzy Hash: 819883ac7c0cefc44acc62aea717f04717cf1167f93fdb97cce4bec107dca3ac
Instruction Fuzzy Hash: DF0122759081598FCB01DBA4D8047BE77B1AF90314F164648E910AB388CFF59E06CBC1

Function 6D1B288C Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1B2893
std::_Lockit::_Lockit.LIBCPMT ref: 6D1B289D

Part of subcall function 6D17D2F0: std::_Lockit::_Lockit.LIBCPMT ref: 6D17D2FF
Part of subcall function 6D17D2F0: std::_Lockit::~_Lockit.LIBCPMT ref: 6D17D31A

codecvt.LIBCPMT ref: 6D1B28D7
std::_Facet_Register.LIBCPMT ref: 6D1B28EE
std::_Lockit::~_Lockit.LIBCPMT ref: 6D1B290E

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercodecvt
String ID:
API String ID: 712880209-0
Opcode ID: 4b2b8d0928fc17c2ca559feae0b3d470a4aab73fde1f3512308135da827e4598
Instruction ID: c1be782f864ae12e4c0bb0f35438758e32114be4d3d33bf0c30adf0b72b9a513
Opcode Fuzzy Hash: 4b2b8d0928fc17c2ca559feae0b3d470a4aab73fde1f3512308135da827e4598
Instruction Fuzzy Hash: 8B010075A081199BCB25DBA0C8106BE77B2AF95318F264509E510AB3C8CFF49A06CBD1

Function 6D1BE8D8 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1BE8DF
collate.LIBCPMT ref: 6D1BE923
std::_Facet_Register.LIBCPMT ref: 6D1BE93A
std::_Lockit::~_Lockit.LIBCPMT ref: 6D1BE95A
std::_Lockit::_Lockit.LIBCPMT ref: 6D1BE8E9

Part of subcall function 6D17D2F0: std::_Lockit::_Lockit.LIBCPMT ref: 6D17D2FF
Part of subcall function 6D17D2F0: std::_Lockit::~_Lockit.LIBCPMT ref: 6D17D31A

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercollate
String ID:
API String ID: 1007100420-0
Opcode ID: bd0c95963a2be13007aa185b03b3b64cc75012cf6f66bcee89648798f99623c6
Instruction ID: 696f113c309a239cd10a7f7dd87d7ef22f5e83e5c982b3ef3e180a73dc99962e
Opcode Fuzzy Hash: bd0c95963a2be13007aa185b03b3b64cc75012cf6f66bcee89648798f99623c6
Instruction Fuzzy Hash: C201047590815A8BCF00CB60D4006BE77B1AF44314F164649E910EB288CFF48F06CB92

Function 6D1BEB2C Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1BEB33
std::_Lockit::_Lockit.LIBCPMT ref: 6D1BEB3D

Part of subcall function 6D17D2F0: std::_Lockit::_Lockit.LIBCPMT ref: 6D17D2FF
Part of subcall function 6D17D2F0: std::_Lockit::~_Lockit.LIBCPMT ref: 6D17D31A

moneypunct.LIBCPMT ref: 6D1BEB77
std::_Facet_Register.LIBCPMT ref: 6D1BEB8E
std::_Lockit::~_Lockit.LIBCPMT ref: 6D1BEBAE

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID:
API String ID: 419941038-0
Opcode ID: f4be90fd1831809f1302c4452438bd427afb86c3e3c7662fcea60de6c53cae0e
Instruction ID: 970dbcada5d261448c59ff8613e4d5197ada535eff1a89f525a0e567da9fce8d
Opcode Fuzzy Hash: f4be90fd1831809f1302c4452438bd427afb86c3e3c7662fcea60de6c53cae0e
Instruction Fuzzy Hash: FB010075908119CFCF11DBA0DA807BE77B1AF80314F260949E911AB298CFF18A028BC1

Function 6D1BEBC1 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1BEBC8
std::_Lockit::_Lockit.LIBCPMT ref: 6D1BEBD2

Part of subcall function 6D17D2F0: std::_Lockit::_Lockit.LIBCPMT ref: 6D17D2FF
Part of subcall function 6D17D2F0: std::_Lockit::~_Lockit.LIBCPMT ref: 6D17D31A

moneypunct.LIBCPMT ref: 6D1BEC0C
std::_Facet_Register.LIBCPMT ref: 6D1BEC23
std::_Lockit::~_Lockit.LIBCPMT ref: 6D1BEC43

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID:
API String ID: 419941038-0
Opcode ID: 1cec6fe9a9070b122a1e02d40a93d8433658cb4e4474d594e42f6e9e18e530d0
Instruction ID: 0e9160c04f923cb9a71ed09ba5c9423ef00a08991f72be9ca599b8c0acd8c859
Opcode Fuzzy Hash: 1cec6fe9a9070b122a1e02d40a93d8433658cb4e4474d594e42f6e9e18e530d0
Instruction Fuzzy Hash: 3C01227590811A8BCB15CBA0D8047BE77B1AF85314F164949E911AB288CFF19E02CBC2

Function 6D1B2A4B Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1B2A52
std::_Lockit::_Lockit.LIBCPMT ref: 6D1B2A5C

Part of subcall function 6D17D2F0: std::_Lockit::_Lockit.LIBCPMT ref: 6D17D2FF
Part of subcall function 6D17D2F0: std::_Lockit::~_Lockit.LIBCPMT ref: 6D17D31A

ctype.LIBCPMT ref: 6D1B2A96
std::_Facet_Register.LIBCPMT ref: 6D1B2AAD
std::_Lockit::~_Lockit.LIBCPMT ref: 6D1B2ACD

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registerctype
String ID:
API String ID: 83828444-0
Opcode ID: 025ca96ad759560308f6a74bbb808ab4d11071031448664945eab47a1f482f04
Instruction ID: 80ff68c3d1d7143f6337e55cb473861f3967289492a0c892fc822a818e0d067c
Opcode Fuzzy Hash: 025ca96ad759560308f6a74bbb808ab4d11071031448664945eab47a1f482f04
Instruction Fuzzy Hash: 97012275A0815A9FCB21DBA4C8007BE77B1BF90318F264509E510AB398CFF09E02CBE1

Function 6D1AC51D Relevance: 7.5, APIs: 5, Instructions: 44COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1AC524
std::_Lockit::_Lockit.LIBCPMT ref: 6D1AC52F
std::_Lockit::~_Lockit.LIBCPMT ref: 6D1AC59D

Part of subcall function 6D1AC6AF: std::locale::_Locimp::_Locimp.LIBCPMT ref: 6D1AC6C7

std::locale::_Setgloballocale.LIBCPMT ref: 6D1AC54A
_Yarn.LIBCPMT ref: 6D1AC560

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: b90899cdc262713cbda5e41b4ceb93d2fbc703ec40a5e52b29e30796aefd32a2
Instruction ID: d1638936f23f9e634db645e19446eca56abe356556f302ab3ceb82870192a315
Opcode Fuzzy Hash: b90899cdc262713cbda5e41b4ceb93d2fbc703ec40a5e52b29e30796aefd32a2
Instruction Fuzzy Hash: 4A01D4BDA091519FCB0AEF20D454B7D77B2FF86244B194109E9015B388CFB46A02DBC2

Function 6D19F150 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 206COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 6D19F366

Strings

gfff, xrefs: 6D19F2F8
gfff, xrefs: 6D19F190
gfff, xrefs: 6D19F1AE

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID: gfff$gfff$gfff
API String ID: 118556049-4275324669
Opcode ID: 1eb42f2db6cca24c0e17608a6a98f068a75c44e8fdf4f22b9b4a2b9a8f171093
Instruction ID: a23ca816df1cff902bb3ca70a71dbfd5fbfc7fc4e3a8c5baf9bee4cebe17766b
Opcode Fuzzy Hash: 1eb42f2db6cca24c0e17608a6a98f068a75c44e8fdf4f22b9b4a2b9a8f171093
Instruction Fuzzy Hash: DC71F8B1D00115AFCB18CF59D980AEEFBB5FF48314F15812DE51AAB744D770AA10CB92

Function 6D16BF30 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 193fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,6D2216E4,FBD4147D,?,?), ref: 6D16C0BC
WriteFile.KERNEL32(00000000,ATTENTION!Your network has been breached and all data was encrypted. Please contact us at:https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0*!* To access .onion websites downlo,00000443,?), ref: 6D16C0E1
CloseHandle.KERNEL32(00000000), ref: 6D16C0E8

Strings

ATTENTION!Your network has been breached and all data was encrypted. Please contact us at:https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0*!* To access .onion websites downlo, xrefs: 6D16C0DB

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID: ATTENTION!Your network has been breached and all data was encrypted. Please contact us at:https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0*!* To access .onion websites downlo
API String ID: 1065093856-1965701463
Opcode ID: a0ebf676ce8ea51825f5864c620ae7cfb63891bf0307aefef41c5f6cf0921fe4
Instruction ID: 7b725cb0da5512b3a8a603b82b805ee4a87f9128843bbe54bfa3aced55de349b
Opcode Fuzzy Hash: a0ebf676ce8ea51825f5864c620ae7cfb63891bf0307aefef41c5f6cf0921fe4
Instruction Fuzzy Hash: 67710271D00249DBDF04CFA8CC94BEEBBB5FF48314F204219E515A7694D7B4AA91CBA1

Function 6D1C0070 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1C0077
_Mpunct.LIBCPMT ref: 6D1C0104
_Mpunct.LIBCPMT ref: 6D1C011E

Strings

$+xv, xrefs: 6D1C0129

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: Mpunct$H_prolog3
String ID: $+xv
API String ID: 4281374311-1686923651
Opcode ID: 0970eec116276283f05dca4295df4358aaa6006ec09aaf093c29e35b6667c1af
Instruction ID: 9189ad07e3d2ae564822f137c1d8f1d2662971bfda26ebe93ddfd7c2c049cd55
Opcode Fuzzy Hash: 0970eec116276283f05dca4295df4358aaa6006ec09aaf093c29e35b6667c1af
Instruction Fuzzy Hash: 5D21E2B1908B566ED721CFB5888073BBFF8AB1C604F054A1AE199C7A41D3B4E601CB91

Function 6D1B706C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1B7073

Part of subcall function 6D1B00B3: _Maklocstr.LIBCPMT ref: 6D1B00D3
Part of subcall function 6D1B00B3: _Maklocstr.LIBCPMT ref: 6D1B00F0
Part of subcall function 6D1B00B3: _Maklocstr.LIBCPMT ref: 6D1B010D
Part of subcall function 6D1B00B3: _Maklocchr.LIBCPMT ref: 6D1B011F
Part of subcall function 6D1B00B3: _Maklocchr.LIBCPMT ref: 6D1B0132

_Mpunct.LIBCPMT ref: 6D1B7100
_Mpunct.LIBCPMT ref: 6D1B711A

Strings

$+xv, xrefs: 6D1B7125

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: Maklocstr$MaklocchrMpunct$H_prolog3
String ID: $+xv
API String ID: 2939335142-1686923651
Opcode ID: 871e035669be2c900bc6c7060aa43b6e4776fc61e7680ba10406e6d821ce4394
Instruction ID: 0759b9b1a35168e2cf7ecf2d2f406d75516e042809fe3a107001bcb35a73df62
Opcode Fuzzy Hash: 871e035669be2c900bc6c7060aa43b6e4776fc61e7680ba10406e6d821ce4394
Instruction Fuzzy Hash: A021C1B1908B566EDB21CFB4889077BBEF8BB0D604F044A1EE599C7A41D7B4E601CB90

Function 6D1CDF2C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,6D1CDEDD,00000000,?,00000001,?,?,?,6D1CDFCC,00000001,FlsFree,6D1FEFDC,FlsFree), ref: 6D1CDF39
GetLastError.KERNEL32(?,6D1CDEDD,00000000,?,00000001,?,?,?,6D1CDFCC,00000001,FlsFree,6D1FEFDC,FlsFree,00000000,?,6D1C67AB), ref: 6D1CDF43
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 6D1CDF6B

Strings

api-ms-, xrefs: 6D1CDF50

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 97468944d04e9e623693c7d241ce58a577f6b0f142d591e0e0664446fc04caba
Instruction ID: 01bab860c3333d30ec4ee269396b6aa16757d36b7816b9dda14b3ce24b0796d0
Opcode Fuzzy Hash: 97468944d04e9e623693c7d241ce58a577f6b0f142d591e0e0664446fc04caba
Instruction Fuzzy Hash: 0EE048B02C8205BBEF001E61FC05B583AA5AF52740F114421FA0CE40D5E7F5A5518545

Function 6D1C30C1 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 23COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6D222D64,00000000,?,6D1935F2,6D221890,6D1F6F30,00000001), ref: 6D1C30CB
ReleaseSRWLockExclusive.KERNEL32(6D222D64,?,6D1935F2,6D221890,6D1F6F30,00000001), ref: 6D1C30FE
WakeAllConditionVariable.KERNEL32(6D222D60,?,6D1935F2,6D221890,6D1F6F30,00000001), ref: 6D1C3109

Strings

d-"m, xrefs: 6D1C30C5

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionReleaseVariableWake
String ID: d-"m
API String ID: 1466638765-824455486
Opcode ID: 2ca56061d88963add94845713ad639784ceb4b1ddf3debd7796925657b043af2
Instruction ID: f6ffbe59f775488a14b37f25a1f069ed2ba8bb113d45ef8b6167d1e416107d68
Opcode Fuzzy Hash: 2ca56061d88963add94845713ad639784ceb4b1ddf3debd7796925657b043af2
Instruction Fuzzy Hash: 3AF039B9516244DFCB14DF99E949BA6B7B8FF0A705B40802AFA05C3700CB726800CF54

Function 6D1C3096 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6D222D64), ref: 6D1C30A0
ReleaseSRWLockExclusive.KERNEL32(6D222D64), ref: 6D1C30AD
WakeAllConditionVariable.KERNEL32(6D222D60), ref: 6D1C30B8

Strings

d-"m, xrefs: 6D1C309A

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionReleaseVariableWake
String ID: d-"m
API String ID: 1466638765-824455486
Opcode ID: e1550b44bc29412173804acc91c1c7d8efc610a27e34aae014d4a4de420d6c05
Instruction ID: 432c7123f70b86096d0bec53afff388c29bea328f3eb9e7f12e12428d090fb78
Opcode Fuzzy Hash: e1550b44bc29412173804acc91c1c7d8efc610a27e34aae014d4a4de420d6c05
Instruction Fuzzy Hash: 59D09E72051118ABCB115AD5F808BD977A8EF0A262F454051F5098250187B2540087A6

Function 6D1DFA0B Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(FBD4147D,00000000,00000000,?), ref: 6D1DFA6E

Part of subcall function 6D1E36D5: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6D1E30BD,?,00000000,-00000008), ref: 6D1E3736

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 6D1DFCC0
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 6D1DFD06
GetLastError.KERNEL32 ref: 6D1DFDA9

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: c9197c265c3cc1e06bdc7df3c33f82155d94e6054d535a4920ff20a26157a98f
Instruction ID: 4a8854a105610e8dab59c3fc15c2495ff7529818eaaceb36e28d0ca4e55a6fe0
Opcode Fuzzy Hash: c9197c265c3cc1e06bdc7df3c33f82155d94e6054d535a4920ff20a26157a98f
Instruction Fuzzy Hash: 9AD1AD75D04688AFCF11CFA8C880AEDBBB5FF49314F14812AE925EB349D770AA41CB50

Function 6D1B42ED Relevance: 6.3, APIs: 4, Instructions: 319COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D1B42F4
_strcspn.LIBCMT ref: 6D1B435F
_strcspn.LIBCMT ref: 6D1B437F
ctype.LIBCPMT ref: 6D1B43EF

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: _strcspn$H_prolog3_ctype
String ID:
API String ID: 838279627-0
Opcode ID: ce68f191e6938901c8a0fc1ca7d11e4207057871ee0d2e7dac03bbb33190bca6
Instruction ID: 17f552c7321514bbd81c210bca6af7a5d1aa095418548d900d485cbf30d2a9f0
Opcode Fuzzy Hash: ce68f191e6938901c8a0fc1ca7d11e4207057871ee0d2e7dac03bbb33190bca6
Instruction Fuzzy Hash: BCC16B71D0421DDFDF05CF98C980AEEBBB9FF48318F158019E505AB219D7B0AA56CBA1

Function 6D1B3F93 Relevance: 6.3, APIs: 4, Instructions: 319COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D1B3F9A
_strcspn.LIBCMT ref: 6D1B4005
_strcspn.LIBCMT ref: 6D1B4025
ctype.LIBCPMT ref: 6D1B4095

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: _strcspn$H_prolog3_ctype
String ID:
API String ID: 838279627-0
Opcode ID: 454d89684a6692691e4b5ff4c365396646966d5c750d4e74454d5af7b2b30976
Instruction ID: 2f61adac7ac5da10422b8e6cabfce66cd604b60f5fb2af072d34f0a714a531a2
Opcode Fuzzy Hash: 454d89684a6692691e4b5ff4c365396646966d5c750d4e74454d5af7b2b30976
Instruction Fuzzy Hash: BAC16DB1D0420E9FDF05CFD4C980AEEBBB9FF18314F158019E505AB218D7B0AA56CBA1

Function 6D1CA095 Relevance: 6.2, APIs: 4, Instructions: 192COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1CA09C
UnDecorator::getSymbolName.LIBCMT ref: 6D1CA12E
DName::operator+.LIBCMT ref: 6D1CA232
DName::DName.LIBVCRUNTIME ref: 6D1CA2D5

Part of subcall function 6D1C7C59: shared_ptr.LIBCMT ref: 6D1C7C75

Part of subcall function 6D1C7E58: DName::DName.LIBVCRUNTIME ref: 6D1C7EB6

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: Name$Name::$Decorator::getH_prolog3Name::operator+Symbolshared_ptr
String ID:
API String ID: 1134295639-0
Opcode ID: 3e74c4b004a04e53d546b69485a2497bf2b6a5c3f947f749de154a5d9e0e1358
Instruction ID: 8a3fc7a6e2f2489f8e205f8e10cf0a0bb4914ef60b58c18fdc6470f38c6d71a6
Opcode Fuzzy Hash: 3e74c4b004a04e53d546b69485a2497bf2b6a5c3f947f749de154a5d9e0e1358
Instruction Fuzzy Hash: 49718271D5421A8FDF02CF94C444FEEBBB9BB29314F05401AE911AB249D7BA9904CFA2

Function 6D1C67B6 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 6D1C687D
___AdjustPointer.LIBCMT ref: 6D1C68A0
___AdjustPointer.LIBCMT ref: 6D1C693C

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 90d67eb96b6a6cc694f796ca1bef79612c3daa6cf4db4047aeb5bd4c6c1b4788
Instruction ID: 0f0efeb93131a2d571411a0bcf35a79087f83f38350a5fae08cc8e9ccc4eeecd
Opcode Fuzzy Hash: 90d67eb96b6a6cc694f796ca1bef79612c3daa6cf4db4047aeb5bd4c6c1b4788
Instruction Fuzzy Hash: 9951C072A0830BAFEB258F10D840B7A77B4FF70314F114529E915866A8E7B9E851C7E3

Function 6D1CA451 Relevance: 6.1, APIs: 4, Instructions: 131COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 6D1CA484

Part of subcall function 6D1C7C37: DName::operator+=.LIBCMT ref: 6D1C7C4D

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: Name::operator+Name::operator+=
String ID:
API String ID: 382699925-0
Opcode ID: 9cfac6d40289d3ee506ae06b10fce2e098705d7e59749ec59f8c36377dc01ecb
Instruction ID: 7160db0155a4eed865ad4f7a5b426bde293d2381456c36120c5bbebdd38aa3be
Opcode Fuzzy Hash: 9cfac6d40289d3ee506ae06b10fce2e098705d7e59749ec59f8c36377dc01ecb
Instruction Fuzzy Hash: CA413F71D0420A9BCB02CF98D549AEEBBB5BB25304F018519E605B7248DBF8D745CB92

Function 6D1E54DC Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 6D1E36D5: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6D1E30BD,?,00000000,-00000008), ref: 6D1E3736

GetLastError.KERNEL32 ref: 6D1E5540
__dosmaperr.LIBCMT ref: 6D1E5547
GetLastError.KERNEL32(?,?,?,?), ref: 6D1E5581
__dosmaperr.LIBCMT ref: 6D1E5588

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 6d945ad309116e019feb2ec26628b1323c1660ebfea3d7605326433d73bad545
Instruction ID: 50a708246be525942f18a7d4f79177da7ce054786532ce7632c59001e2f542f0
Opcode Fuzzy Hash: 6d945ad309116e019feb2ec26628b1323c1660ebfea3d7605326433d73bad545
Instruction Fuzzy Hash: 73210771608A06AFAB109F65C89097BB7BAFF053E87058519F918C3144D7F0EC4087D0

Function 6D1D9313 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68c305ce87f62a14b2080319b492d5bb9358588b4eaa40ada5abba2290b4be1c
Instruction ID: 2233433960625c0e41aeafb381e508bb719e1b224e894d5ac16e41c4b44b4512
Opcode Fuzzy Hash: 68c305ce87f62a14b2080319b492d5bb9358588b4eaa40ada5abba2290b4be1c
Instruction Fuzzy Hash: 1D21C071208606BFDB809FB9D8B095A77B9EF013687028524FA18D7198D7F0EC51C760

Function 6D1E6464 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 6D1E646C

Part of subcall function 6D1E36D5: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6D1E30BD,?,00000000,-00000008), ref: 6D1E3736

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6D1E64A4
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6D1E64C4

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 90971a601f0ea482ae5c319523705dd3a575ecfdd5a95e9dc6040003101a5706
Instruction ID: 9080fc24f45e5c7d0df76afc438089c13815616621488a209da6f907d12fb7ee
Opcode Fuzzy Hash: 90971a601f0ea482ae5c319523705dd3a575ecfdd5a95e9dc6040003101a5706
Instruction Fuzzy Hash: 6011E5F1609E1A7F6A512BB66C8CEAF69BCDE462EC3410624F700D1149EBE1CE0041F0

Function 6D1ADD95 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1ADD9C
std::_Lockit::_Lockit.LIBCPMT ref: 6D1ADDA6

Part of subcall function 6D17D2F0: std::_Lockit::_Lockit.LIBCPMT ref: 6D17D2FF
Part of subcall function 6D17D2F0: std::_Lockit::~_Lockit.LIBCPMT ref: 6D17D31A

std::_Facet_Register.LIBCPMT ref: 6D1ADDF7
std::_Lockit::~_Lockit.LIBCPMT ref: 6D1ADE17

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 013e53d63ed29abf408b2f7ca82310bede42debce5734a4be9aa93c2f6b9d80a
Instruction ID: 176c3389762f684de9feec6b9d9e6c4a29831be2ddb52713b5161636ad2ec96b
Opcode Fuzzy Hash: 013e53d63ed29abf408b2f7ca82310bede42debce5734a4be9aa93c2f6b9d80a
Instruction Fuzzy Hash: 1F117879A486599BCB21CBA4A8007FE77F5AFA4314F264009F900AB3C8DFF49E0187D1

Function 6D1B2DC9 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1B2DD0
std::_Lockit::_Lockit.LIBCPMT ref: 6D1B2DDA

Part of subcall function 6D17D2F0: std::_Lockit::_Lockit.LIBCPMT ref: 6D17D2FF
Part of subcall function 6D17D2F0: std::_Lockit::~_Lockit.LIBCPMT ref: 6D17D31A

std::_Facet_Register.LIBCPMT ref: 6D1B2E2B
std::_Lockit::~_Lockit.LIBCPMT ref: 6D1B2E4B

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: c54908a5aaf923779207a7726ed1a67f41bf705019fd21820fbaf94814f23016
Instruction ID: 39eb34ee8124868d2277b746a9541fa4b74864daab6e3e50fdec3e761f563118
Opcode Fuzzy Hash: c54908a5aaf923779207a7726ed1a67f41bf705019fd21820fbaf94814f23016
Instruction Fuzzy Hash: 0401457694815A8FCB25CBA0C9047BE77B1BF85318F164909E520AB388CFF49E02CBD1

Function 6D1BECEB Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1BECF2
std::_Lockit::_Lockit.LIBCPMT ref: 6D1BECFC

Part of subcall function 6D17D2F0: std::_Lockit::_Lockit.LIBCPMT ref: 6D17D2FF
Part of subcall function 6D17D2F0: std::_Lockit::~_Lockit.LIBCPMT ref: 6D17D31A

std::_Facet_Register.LIBCPMT ref: 6D1BED4D
std::_Lockit::~_Lockit.LIBCPMT ref: 6D1BED6D

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: cb0a41bc3ffa6d46f5bad62e62140b670a74ad0124a503c10bd25e83295a1f17
Instruction ID: 92998299ba86fd0b8db167de896e867cd8b6a121bc83e7292f96bb1387a9c737
Opcode Fuzzy Hash: cb0a41bc3ffa6d46f5bad62e62140b670a74ad0124a503c10bd25e83295a1f17
Instruction Fuzzy Hash: CD0100B99081198BCB11DBA0D8007BE77B1AF91324F264948E910AB288CFF19A02CB81

Function 6D1BEA02 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1BEA09
std::_Lockit::_Lockit.LIBCPMT ref: 6D1BEA13

Part of subcall function 6D17D2F0: std::_Lockit::_Lockit.LIBCPMT ref: 6D17D2FF
Part of subcall function 6D17D2F0: std::_Lockit::~_Lockit.LIBCPMT ref: 6D17D31A

std::_Facet_Register.LIBCPMT ref: 6D1BEA64
std::_Lockit::~_Lockit.LIBCPMT ref: 6D1BEA84

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 685b6afd61e8b2fa4a1b28f65ada2c1697b4af77bb3db4f3ff4f9b8c5e38c059
Instruction ID: 39b9f2a37a661ff2b3b523dbcdf7974107ef5be14ddd27be7f1b25256819f14a
Opcode Fuzzy Hash: 685b6afd61e8b2fa4a1b28f65ada2c1697b4af77bb3db4f3ff4f9b8c5e38c059
Instruction Fuzzy Hash: 170122B990811A8FCB05DBA0C9447BE7BB5BF90318F160548E910AB388CFF19E02CB81

Function 6D1BEA97 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1BEA9E
std::_Lockit::_Lockit.LIBCPMT ref: 6D1BEAA8

Part of subcall function 6D17D2F0: std::_Lockit::_Lockit.LIBCPMT ref: 6D17D2FF
Part of subcall function 6D17D2F0: std::_Lockit::~_Lockit.LIBCPMT ref: 6D17D31A

std::_Facet_Register.LIBCPMT ref: 6D1BEAF9
std::_Lockit::~_Lockit.LIBCPMT ref: 6D1BEB19

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 29dd96b09fdb33727937224b8573d8af105fde80ea744f16e858fd4cfa3886f6
Instruction ID: 2652008776c1ac3e7274f016e1898ab0babcd22254a321f9a69a9a336ac2f2ad
Opcode Fuzzy Hash: 29dd96b09fdb33727937224b8573d8af105fde80ea744f16e858fd4cfa3886f6
Instruction Fuzzy Hash: EA012275A181198BCB11DBA4D9047BE77B1AF80324F164548E511EB288CFF19A02CBD2

Function 6D1B35EF Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1B35F6
std::_Lockit::_Lockit.LIBCPMT ref: 6D1B3600

Part of subcall function 6D17D2F0: std::_Lockit::_Lockit.LIBCPMT ref: 6D17D2FF
Part of subcall function 6D17D2F0: std::_Lockit::~_Lockit.LIBCPMT ref: 6D17D31A

std::_Facet_Register.LIBCPMT ref: 6D1B3651
std::_Lockit::~_Lockit.LIBCPMT ref: 6D1B3671

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 04ff6414d469217842bf813542457d15bdeb1d9c285f237bc1478752bc1f9c60
Instruction ID: 611ce0fca19102b2aa98c5ea8212f799ccfd63c052b497ced844ec9c9e3d0427
Opcode Fuzzy Hash: 04ff6414d469217842bf813542457d15bdeb1d9c285f237bc1478752bc1f9c60
Instruction Fuzzy Hash: 4001D2B590815A8FCB15DBA8D904BBE77B1AF81314F164509E910AB388DFF49E02CBD1

Function 6D1B34C5 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D1B34CC
std::_Lockit::_Lockit.LIBCPMT ref: 6D1B34D6

Part of subcall function 6D17D2F0: std::_Lockit::_Lockit.LIBCPMT ref: 6D17D2FF
Part of subcall function 6D17D2F0: std::_Lockit::~_Lockit.LIBCPMT ref: 6D17D31A

std::_Facet_Register.LIBCPMT ref: 6D1B3527
std::_Lockit::~_Lockit.LIBCPMT ref: 6D1B3547

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 9e200a57baaf025c803a2b781af6c69ebc0644f1d95742cc5952c1175b6e18dd
Instruction ID: 28969e9d241e8f3302a5f5bf39f978a3320ca184eb30dc391b4b77d9c1ccd140
Opcode Fuzzy Hash: 9e200a57baaf025c803a2b781af6c69ebc0644f1d95742cc5952c1175b6e18dd
Instruction Fuzzy Hash: 9A0126B5A4815A8BCB05CBA4D4007BEB771AF50714F164509E910AB38CCFF4AA02CBD1

Function 6D1EE20F Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,6D1E9426,00000000,00000001,00000000,?,?,6D1DFDFD,?,00000000,00000000), ref: 6D1EE226
GetLastError.KERNEL32(?,6D1E9426,00000000,00000001,00000000,?,?,6D1DFDFD,?,00000000,00000000,?,?,?,6D1E03D7,00000000), ref: 6D1EE232

Part of subcall function 6D1EE1F8: CloseHandle.KERNEL32(FFFFFFFE,6D1EE242,?,6D1E9426,00000000,00000001,00000000,?,?,6D1DFDFD,?,00000000,00000000,?,?), ref: 6D1EE208

___initconout.LIBCMT ref: 6D1EE242

Part of subcall function 6D1EE1BA: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,6D1EE1E9,6D1E9413,?,?,6D1DFDFD,?,00000000,00000000,?), ref: 6D1EE1CD

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,6D1E9426,00000000,00000001,00000000,?,?,6D1DFDFD,?,00000000,00000000,?), ref: 6D1EE257

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 5b0768c1df04e7c8695b852712271fa51fd12cbe59ff6c214f59a18f0f1e043d
Instruction ID: de691200a774f8fa9e8e89827eb8b9d74ca21da5248752e18dab04a1be9f3d67
Opcode Fuzzy Hash: 5b0768c1df04e7c8695b852712271fa51fd12cbe59ff6c214f59a18f0f1e043d
Instruction Fuzzy Hash: B3F01C36100525FBDF122FD5EC08F8A3F76FF9A3A5B054110FA29C6120CB7299A0EB95

Function 6D1C1FB2 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 185COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6D1C2116

Strings

0123456789abcdefghijklmnopqrstuvwxyz, xrefs: 6D1C207C, 6D1C20B3, 6D1C20B8
-, xrefs: 6D1C2147

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: __aulldiv
String ID: -$0123456789abcdefghijklmnopqrstuvwxyz
API String ID: 3732870572-1956417402
Opcode ID: 490cfc3cb85cbb47986e4901fc748fd1e3afaca930e059200b8eb2bf5edb1d07
Instruction ID: fddb9f1b00b98a07dbf0d69fa33289bf426372a336dc5392ddfe4462c83050eb
Opcode Fuzzy Hash: 490cfc3cb85cbb47986e4901fc748fd1e3afaca930e059200b8eb2bf5edb1d07
Instruction Fuzzy Hash: B4511BB0A483465BDB358FAD88907BFBBF5AF76700F01506AE59097249C3FC8542CB52

Function 6D177220 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 124COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 6D177342

Strings

Cryptographic algorithms are disabled before the power-up self tests are performed., xrefs: 6D177294
Cryptographic algorithms are disabled after a power-up self test failed., xrefs: 6D1772C2

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: ___std_exception_copy
String ID: Cryptographic algorithms are disabled after a power-up self test failed.$Cryptographic algorithms are disabled before the power-up self tests are performed.
API String ID: 2659868963-3345525433
Opcode ID: 299fbc09f8d2ff416c6a4a3fbac46a5c76b6bb7ace8a01517d19494f08fabf95
Instruction ID: 2b0c1bb8652841727b3a952a9f8a36b861f98f8766b2e8fb49b51d9d1c800baa
Opcode Fuzzy Hash: 299fbc09f8d2ff416c6a4a3fbac46a5c76b6bb7ace8a01517d19494f08fabf95
Instruction Fuzzy Hash: D6418271918249ABCB10DFA4C844FEEF7FCEF15614F11462BE921E3658EBB4A504CAA0

Function 6D1C6DB2 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 6D1C6DD7

Strings

MOC, xrefs: 6D1C6DE9
RCC, xrefs: 6D1C6DF1

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: fae7c40a07584ecf4b0d94b37dfa264f29b74e0223201261e70e120236370ba3
Instruction ID: 043b3647baa7120de14419bac94682e87f8a6c05258b1e16c7b0fa3d3d394199
Opcode Fuzzy Hash: fae7c40a07584ecf4b0d94b37dfa264f29b74e0223201261e70e120236370ba3
Instruction Fuzzy Hash: E7413B7190010EAFCF05CF94C980AFE7BB5BF68304F15405AEA14A6269D3B9A960DB92

Function 6D1BC90C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D1BC913

Part of subcall function 6D1B2AE0: __EH_prolog3.LIBCMT ref: 6D1B2AE7
Part of subcall function 6D1B2AE0: std::_Lockit::_Lockit.LIBCPMT ref: 6D1B2AF1
Part of subcall function 6D1B2AE0: std::_Lockit::~_Lockit.LIBCPMT ref: 6D1B2B62

Strings

0123456789-, xrefs: 6D1BC95E
0123456789-, xrefs: 6D1BC963

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: Lockitstd::_$H_prolog3H_prolog3_Lockit::_Lockit::~_
String ID: 0123456789-$0123456789-
API String ID: 2728201062-2494171821
Opcode ID: 2514b931579419e541ace915c5c60d470f749e8b365c99a3511aed49a8acf897
Instruction ID: f64c7c5876e829b27658ad4805da5866eca4f6fc536535ddf7cf7181e08cec6d
Opcode Fuzzy Hash: 2514b931579419e541ace915c5c60d470f749e8b365c99a3511aed49a8acf897
Instruction Fuzzy Hash: 09419F32904119DFCF15DFE8D8909EEBBB6FF08314F11015AEA11BB258DBB09956CBA1

Function 6D1BC613 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D1BC61A

Part of subcall function 6D1B2A4B: __EH_prolog3.LIBCMT ref: 6D1B2A52
Part of subcall function 6D1B2A4B: std::_Lockit::_Lockit.LIBCPMT ref: 6D1B2A5C
Part of subcall function 6D1B2A4B: std::_Lockit::~_Lockit.LIBCPMT ref: 6D1B2ACD

Strings

0123456789-, xrefs: 6D1BC66A
%.0Lf, xrefs: 6D1BC665

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: Lockitstd::_$H_prolog3H_prolog3_Lockit::_Lockit::~_
String ID: %.0Lf$0123456789-
API String ID: 2728201062-3094241602
Opcode ID: e4965be8447d9e2f02df37d5e0c7c9ccf559ac6dff837400b7cfff8566d08b5b
Instruction ID: 0fa9db804dee9b51271a1543ff8f7ee2284f46dd8c4649c118e52a71e8c6e404
Opcode Fuzzy Hash: e4965be8447d9e2f02df37d5e0c7c9ccf559ac6dff837400b7cfff8566d08b5b
Instruction Fuzzy Hash: DA418B31904119DFCF15DFE8C890DEEBBB6FF09314F11015AEA01AB258DBB09A5ACB91

Function 6D1C1844 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D1C184B

Part of subcall function 6D162470: std::_Lockit::_Lockit.LIBCPMT ref: 6D1624A3
Part of subcall function 6D162470: std::_Lockit::_Lockit.LIBCPMT ref: 6D1624C5
Part of subcall function 6D162470: std::_Lockit::~_Lockit.LIBCPMT ref: 6D1624E5
Part of subcall function 6D162470: std::_Lockit::~_Lockit.LIBCPMT ref: 6D1625DD

Strings

0123456789-, xrefs: 6D1C189B
0123456789-, xrefs: 6D1C1896

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3_
String ID: 0123456789-$0123456789-
API String ID: 2088892359-2494171821
Opcode ID: 41e69b9c4889473f63b2c9f315b678f6cd277c5ba068c19de1b7ca49d55e130a
Instruction ID: 30ca0800c6227f8008636b73cd0e4cd84b6a7dc82c951575280b972681c5dc4c
Opcode Fuzzy Hash: 41e69b9c4889473f63b2c9f315b678f6cd277c5ba068c19de1b7ca49d55e130a
Instruction Fuzzy Hash: 1A41BF31E08209DFCF15CFE4D8909EE7BB6FF18304F104059EA11A7255DBB49956CB52

Function 6D1BDC27 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D1BDC2E
__cftoe.LIBCMT ref: 6D1BDCC1

Strings

!%x, xrefs: 6D1BDC3C

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: H_prolog3___cftoe
String ID: !%x
API String ID: 855520168-1893981228
Opcode ID: 4b5d31fbd60e488d8b2999a1ed4b85bd4de8e0fdbfe55c241ef0afae8beb1271
Instruction ID: c374b3cf39692210a5ae1b9e4461934d0fd8fb8655ee0b703770aff8e3114dd8
Opcode Fuzzy Hash: 4b5d31fbd60e488d8b2999a1ed4b85bd4de8e0fdbfe55c241ef0afae8beb1271
Instruction Fuzzy Hash: 9E316F71A11209EFDF04CFA8D951AEEB7B1FF48304F118029F905AB254D7B59E15CB61

Function 6D1CA92C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 71COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 6D1CA943
DName::DName.LIBVCRUNTIME ref: 6D1CA9C8

Strings

A, xrefs: 6D1CA9A8

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: NameName::
String ID: A
API String ID: 1333004437-3554254475
Opcode ID: 1d79301c1d277674e7cc0c2f7d6c50e4f2379d9057536080ab94f922765fd2e5
Instruction ID: b1c6a10bfa16c5ad726c501bdcf540803af76c02ce9e9ec17f89ecb56fb1c7e4
Opcode Fuzzy Hash: 1d79301c1d277674e7cc0c2f7d6c50e4f2379d9057536080ab94f922765fd2e5
Instruction Fuzzy Hash: 1B21D170A08209EFDF02CF94C816FAD7BB5FB66308F02C05AE5055B249C7F99A46CB52

Function 6D1C3112 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6D222D64,6D221710,00000000,?,6D1935C4,6D221890,FBD4147D,6D221710,00000000,?,00000000,6D1F2AA4,000000FF,?,6D19367C,00000001), ref: 6D1C311D
ReleaseSRWLockExclusive.KERNEL32(6D222D64,?,6D1935C4,6D221890,FBD4147D,6D221710,00000000,?,00000000,6D1F2AA4,000000FF,?,6D19367C,00000001), ref: 6D1C3157

Strings

d-"m, xrefs: 6D1C3117

Memory Dump Source

Source File: 00000004.00000002.2213597833.000000006D161000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D160000, based on PE: true

Associated: 00000004.00000002.2213565698.000000006D160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214017201.000000006D1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214082918.000000006D218000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214192044.000000006D21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214291476.000000006D21E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214360181.000000006D223000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2214521865.000000006D224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d160000_rundll32.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID: d-"m
API String ID: 17069307-824455486
Opcode ID: 92d956a6926beddbcf6f31a2991a113945088feb7c499a717d4b1d9516b768f0
Instruction ID: 705f94b3dc3cae1da1ef7187170de106ee8b188fde4eaf8469d7266ec110d097
Opcode Fuzzy Hash: 92d956a6926beddbcf6f31a2991a113945088feb7c499a717d4b1d9516b768f0
Instruction Fuzzy Hash: ACF0A0B4104641DFCB209F59D844B66B7B8FF67B35F11422EE965832C4C7B91843CA52

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories. Content stored on network drives or in other shared locations may be tainted by adding malicious programs, scripts, or exploit code to otherwise valid files. Once a user opens the shared tainted content, the malicious portion can be executed to run the adversary's code on a remote system. Adversaries may use tainted shared content to move laterally.
Tactics:	Lateral Movement
Data Sources:	File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN , ZXProxy, and ZXPortMap. Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.
Tactics:	Impact
Data Sources:	Cloud Storage: Cloud Storage Modification, Command: Command Execution, File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report AztyGMg4jw.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\$WinREAgent\Scratch\instructions_read_me.txt

C:\$WinREAgent\instructions_read_me.txt

C:\PerfLogs\instructions_read_me.txt

C:\Program Files (x86)\AutoIt3\Au3Check.dat

C:\Program Files (x86)\AutoIt3\Au3Check.exe

C:\Program Files (x86)\AutoIt3\Au3Info.exe

C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe

C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe

C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe

C:\Program Files (x86)\AutoIt3\Aut2Exe\instructions_read_me.txt

C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe

C:\Program Files (x86)\AutoIt3\AutoIt v3 Website.url

C:\Program Files (x86)\AutoIt3\AutoIt.chm

C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe

C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe

C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX.chm

C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX.psd1

Windows Analysis Report
AztyGMg4jw.dll